openvibers/openvibe.contracts Commits

0.294.0: unsafe-image review capabilities (#304)

OP OpenVibers committed 7 days ago · a9e045f397 · 52 files, +552 −92

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 788ac8ff..c77f42bb 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,9 @@
  # Changelog
  
++## 0.294.0 — 2026-11-06
++
++- Add the unsafe-image review capabilities: `vision.image.review` (Media, Community and Live sort an image or AI text into fine, sex acts or sexual content involving a minor), `vision.review.read` and `vision.review.decide` (the staff queue and an operator's decision), `media.object.review.view` (Vision's 60-second logged evidence view of a hidden or quarantined object) and `media.object.review.decide` (Vision applies an operator's overruling category and releases Media's evidence hold). The Vision and Media service manifests name them.
++
  ## 0.292.0 — 2026-11-06
  
  - Add `locker.envelope@1`: the header of a sealed item — the suite (AES-256-GCM), the chunk size (1 MiB), the padded size, the counter nonce base, the lock kind and one key slot per way in. The content key is never in the header; it is wrapped in a people slot (ECDH P-256 + HKDF-SHA-256, bound to the recipient's key by its RFC 7638 thumbprint), a password slot (PBKDF2-SHA-256, 600000 iterations, the parameters in the header so they can be raised, and bounded above at 10000000 so a hostile header cannot freeze a reader) or a link slot (empty: the key travels in the link's fragment).
ddiff --git a/generated/openapi/actor.json b/generated/openapi/actor.json
iindex a5c7abb9..f14c7dbb 100644
---- a/generated/openapi/actor.json
++++ b/generated/openapi/actor.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Actor API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/ai.json b/generated/openapi/ai.json
iindex c31bafdb..4df40a4e 100644
---- a/generated/openapi/ai.json
++++ b/generated/openapi/ai.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.AI API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/bench.json b/generated/openapi/bench.json
iindex 7d8d65d3..4fda43b9 100644
---- a/generated/openapi/bench.json
++++ b/generated/openapi/bench.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Bench API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Bench as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Bench as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/billing.json b/generated/openapi/billing.json
iindex 52d1615e..d7b4942c 100644
---- a/generated/openapi/billing.json
++++ b/generated/openapi/billing.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Billing API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/blog.json b/generated/openapi/blog.json
iindex b7b7653a..c83dd59e 100644
---- a/generated/openapi/blog.json
++++ b/generated/openapi/blog.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Blog API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/bot.json b/generated/openapi/bot.json
iindex ec396d65..32de1550 100644
---- a/generated/openapi/bot.json
++++ b/generated/openapi/bot.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Bot API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/chat.json b/generated/openapi/chat.json
iindex 5f3d90a8..54fb754d 100644
---- a/generated/openapi/chat.json
++++ b/generated/openapi/chat.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Chat API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/codes.json b/generated/openapi/codes.json
iindex 8564bc1b..2dd6371c 100644
---- a/generated/openapi/codes.json
++++ b/generated/openapi/codes.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Codes API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/community.json b/generated/openapi/community.json
iindex 3a3b707c..265f76f8 100644
---- a/generated/openapi/community.json
++++ b/generated/openapi/community.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Community API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/coupons.json b/generated/openapi/coupons.json
iindex 4daf36aa..aedcd5da 100644
---- a/generated/openapi/coupons.json
++++ b/generated/openapi/coupons.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Coupons API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/deals.json b/generated/openapi/deals.json
iindex 557666da..6c0b9cbe 100644
---- a/generated/openapi/deals.json
++++ b/generated/openapi/deals.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Deals API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/domains.json b/generated/openapi/domains.json
iindex 5134377b..fcdde9c1 100644
---- a/generated/openapi/domains.json
++++ b/generated/openapi/domains.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Domains API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Domains as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Domains as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/events.json b/generated/openapi/events.json
iindex a85a9efb..b26dba95 100644
---- a/generated/openapi/events.json
++++ b/generated/openapi/events.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Events API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/food.json b/generated/openapi/food.json
iindex ac13c530..7b1b8a34 100644
---- a/generated/openapi/food.json
++++ b/generated/openapi/food.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Food API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/games.json b/generated/openapi/games.json
iindex 0ef615c4..1b57482c 100644
---- a/generated/openapi/games.json
++++ b/generated/openapi/games.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Games API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/host.json b/generated/openapi/host.json
iindex 293bbc89..a64294f0 100644
---- a/generated/openapi/host.json
++++ b/generated/openapi/host.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Host API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/index.json b/generated/openapi/index.json
iindex 40ad2510..1519a598 100644
---- a/generated/openapi/index.json
++++ b/generated/openapi/index.json
@@@ -131,8 +131,8 @@
        "service": "media",
        "name": "OpenVibe.Media",
        "origin": "https://openvibe.media",
--      "operations": 15,
--      "capabilities": 10
++      "operations": 17,
++      "capabilities": 12
      },
      {
        "service": "media-hub",
@@@ -264,8 +264,8 @@
        "service": "vision",
        "name": "OpenVibe.Vision",
        "origin": "https://openvibe.vision",
--      "operations": 32,
--      "capabilities": 20
++      "operations": 38,
++      "capabilities": 23
      },
      {
        "service": "watch",
ddiff --git a/generated/openapi/inventory.json b/generated/openapi/inventory.json
iindex 6a1c6759..d1d5887e 100644
---- a/generated/openapi/inventory.json
++++ b/generated/openapi/inventory.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Inventory API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/live.json b/generated/openapi/live.json
iindex d9f08487..7a8ed9bc 100644
---- a/generated/openapi/live.json
++++ b/generated/openapi/live.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Live API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media-hub.json b/generated/openapi/media-hub.json
iindex a6856ffd..eccd8fe8 100644
---- a/generated/openapi/media-hub.json
++++ b/generated/openapi/media-hub.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.MediaHub API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media.json b/generated/openapi/media.json
iindex 7e2b8487..48dc81d2 100644
---- a/generated/openapi/media.json
++++ b/generated/openapi/media.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Media API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
@@@ -728,6 +728,63 @@
      }
     }
    },
++  "/api/v2/{app}/objects/{id}/operator-view": {
++   "post": {
++    "operationId": "post_api_v2_app_objects_id_operator_view",
++    "summary": "Open one 60-second operator evidence view of a hidden or quarantined Media object.",
++    "description": "**media.object.review.view** (first-party): Open one 60-second operator evidence view of a hidden or quarantined Media object. POST /api/v2/:app/objects/:id/operator-view answers a signed URL whose purpose is separate from every normal download signature; the view is logged (who, when, expiry) and a fine object is refused. OpenVibe.Vision alone holds it, for the review page.",
++    "tags": [
++     "media.object"
++    ],
++    "x-openvibe-capabilities": [
++     "media.object.review.view"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "media-review-view",
++    "security": [
++     {
++      "openvibeToken": [
++       "media.object.review.view"
++      ]
++     }
++    ],
++    "parameters": [
++     {
++      "name": "app",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     },
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success"
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
    "/api/v2/{app}/objects/{id}/restore": {
     "post": {
      "operationId": "post_api_v2_app_objects_id_restore",
@@@ -792,6 +849,63 @@
      }
     }
    },
++  "/api/v2/{app}/objects/{id}/review-decision": {
++   "post": {
++    "operationId": "post_api_v2_app_objects_id_review_decision",
++    "summary": "Apply an operator's overruling unsafe-image category to a Media object.",
++    "description": "**media.object.review.decide** (first-party): Apply an operator's overruling unsafe-image category to a Media object. POST /api/v2/:app/objects/:id/review-decision places the evidence hold for minor_sexual or releases it for fine/sex_acts, recording who and when; it is a service-principal capability and never an app key or the object's owner. OpenVibe.Vision calls it after the operator decides.",
++    "tags": [
++     "media.object"
++    ],
++    "x-openvibe-capabilities": [
++     "media.object.review.decide"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "media-review-decide",
++    "security": [
++     {
++      "openvibeToken": [
++       "media.object.review.decide"
++      ]
++     }
++    ],
++    "parameters": [
++     {
++      "name": "app",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     },
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success"
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
    "/f/{key}": {
     "get": {
      "operationId": "get_f_key",
ddiff --git a/generated/openapi/network.json b/generated/openapi/network.json
iindex 9081e922..8f9a781f 100644
---- a/generated/openapi/network.json
++++ b/generated/openapi/network.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Network API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/news.json b/generated/openapi/news.json
iindex 6a84b5ac..b36525ae 100644
---- a/generated/openapi/news.json
++++ b/generated/openapi/news.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.News API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/openre.json b/generated/openapi/openre.json
iindex b83315a9..5607b7d0 100644
---- a/generated/openapi/openre.json
++++ b/generated/openapi/openre.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenRestream API",
--  "version": "0.292.0",
--  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/play.json b/generated/openapi/play.json
iindex 31d25dce..a9e2e7fc 100644
---- a/generated/openapi/play.json
++++ b/generated/openapi/play.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Play API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/quest.json b/generated/openapi/quest.json
iindex 5367db25..8105e275 100644
---- a/generated/openapi/quest.json
++++ b/generated/openapi/quest.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Quest API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/report.json b/generated/openapi/report.json
iindex 1a98c244..5c9b33a8 100644
---- a/generated/openapi/report.json
++++ b/generated/openapi/report.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Report API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Report as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Report as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/reviews.json b/generated/openapi/reviews.json
iindex e6221c11..aaac9726 100644
---- a/generated/openapi/reviews.json
++++ b/generated/openapi/reviews.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Reviews API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/run.json b/generated/openapi/run.json
iindex 22dbace7..dc550837 100644
---- a/generated/openapi/run.json
++++ b/generated/openapi/run.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Run API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/search.json b/generated/openapi/search.json
iindex 35fad45d..c3026210 100644
---- a/generated/openapi/search.json
++++ b/generated/openapi/search.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Search API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/services.json b/generated/openapi/services.json
iindex f66dfadc..1b571432 100644
---- a/generated/openapi/services.json
++++ b/generated/openapi/services.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Services API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/sources.json b/generated/openapi/sources.json
iindex e5fa7d8f..3a046dc7 100644
---- a/generated/openapi/sources.json
++++ b/generated/openapi/sources.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Sources API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/space.json b/generated/openapi/space.json
iindex 1dbe7604..7aeac1a8 100644
---- a/generated/openapi/space.json
++++ b/generated/openapi/space.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Space API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tips.json b/generated/openapi/tips.json
iindex 0d1c7ce0..4a9d6cb2 100644
---- a/generated/openapi/tips.json
++++ b/generated/openapi/tips.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tips API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/today.json b/generated/openapi/today.json
iindex 0a11e1e0..c656a7c7 100644
---- a/generated/openapi/today.json
++++ b/generated/openapi/today.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Today API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Today as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Today as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tools.json b/generated/openapi/tools.json
iindex e14c1bf6..8da444e0 100644
---- a/generated/openapi/tools.json
++++ b/generated/openapi/tools.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tools API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/trade.json b/generated/openapi/trade.json
iindex de13ae43..cb7a9a80 100644
---- a/generated/openapi/trade.json
++++ b/generated/openapi/trade.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Trade API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vip.json b/generated/openapi/vip.json
iindex 7420a3df..7295e1ce 100644
---- a/generated/openapi/vip.json
++++ b/generated/openapi/vip.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.VIP API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vision.json b/generated/openapi/vision.json
iindex bb9dfd9e..74ca6518 100644
---- a/generated/openapi/vision.json
++++ b/generated/openapi/vision.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Vision API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Vision as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Vision as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
@@@ -1846,6 +1846,268 @@
      }
     }
    },
++  "/api/v1/review": {
++   "get": {
++    "operationId": "get_api_v1_review",
++    "summary": "Read OpenVibe.Vision's unsafe-image review queue and one review, including its operator report and the logged operator views.",
++    "description": "**vision.review.read** (first-party): Read OpenVibe.Vision's unsafe-image review queue and one review, including its operator report and the logged operator views. Staff use it through the review pages; a service token holding this capability can read the queue. POST /api/v1/review/:id/reveal opens one 60-second Media evidence view and logs it.",
++    "tags": [
++     "vision.review"
++    ],
++    "x-openvibe-capabilities": [
++     "vision.review.read"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "vision-review-read",
++    "security": [
++     {
++      "openvibeToken": [
++       "vision.review.read"
++      ]
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success"
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   },
++   "post": {
++    "operationId": "post_api_v1_review",
++    "summary": "Sort one image (or one AI text) into OpenVibe.Vision's unsafe-image review: exactly fine (nudity allowed), sex_acts (never public; kept for its owner) or minor_sexual (always blocked, quarantined and ",
++    "description": "**vision.image.review** (first-party): Sort one image (or one AI text) into OpenVibe.Vision's unsafe-image review: exactly fine (nudity allowed), sex_acts (never public; kept for its owner) or minor_sexual (always blocked, quarantined and reported to the operator). POST /api/v1/review accepts a multipart image, a data URL, a public https image URL or text, plus the caller's object reference; the answer carries the category, plain words, the action and the operator report for category 3. Media, Community and Live call it with their own service token. No image bytes are stored.",
++    "tags": [
++     "vision.image"
++    ],
++    "x-openvibe-capabilities": [
++     "vision.image.review"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "vision-review",
++    "security": [
++     {
++      "openvibeToken": [
++       "vision.image.review"
++      ]
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success"
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
++  "/api/v1/review/{id}": {
++   "get": {
++    "operationId": "get_api_v1_review_id",
++    "summary": "Read OpenVibe.Vision's unsafe-image review queue and one review, including its operator report and the logged operator views.",
++    "description": "**vision.review.read** (first-party): Read OpenVibe.Vision's unsafe-image review queue and one review, including its operator report and the logged operator views. Staff use it through the review pages; a service token holding this capability can read the queue. POST /api/v1/review/:id/reveal opens one 60-second Media evidence view and logs it.",
++    "tags": [
++     "vision.review"
++    ],
++    "x-openvibe-capabilities": [
++     "vision.review.read"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "vision-review-read",
++    "security": [
++     {
++      "openvibeToken": [
++       "vision.review.read"
++      ]
++     }
++    ],
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success"
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
++  "/api/v1/review/{id}/decide": {
++   "post": {
++    "operationId": "post_api_v1_review_id_decide",
++    "summary": "Set one OpenVibe.Vision unsafe-image review to exactly fine, sex_acts or minor_sexual.",
++    "description": "**vision.review.decide** (first-party): Set one OpenVibe.Vision unsafe-image review to exactly fine, sex_acts or minor_sexual. POST /api/v1/review/:id/decide records who decided and when, and an overruling category releases Media's evidence hold. Staff use it through the review page; a service token holding this capability can make the same decision.",
++    "tags": [
++     "vision.review"
++    ],
++    "x-openvibe-capabilities": [
++     "vision.review.decide"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "vision-review-decide",
++    "security": [
++     {
++      "openvibeToken": [
++       "vision.review.decide"
++      ]
++     }
++    ],
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success"
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
++  "/api/v1/review/{id}/reveal": {
++   "post": {
++    "operationId": "post_api_v1_review_id_reveal",
++    "summary": "Read OpenVibe.Vision's unsafe-image review queue and one review, including its operator report and the logged operator views.",
++    "description": "**vision.review.read** (first-party): Read OpenVibe.Vision's unsafe-image review queue and one review, including its operator report and the logged operator views. Staff use it through the review pages; a service token holding this capability can read the queue. POST /api/v1/review/:id/reveal opens one 60-second Media evidence view and logs it.",
++    "tags": [
++     "vision.review"
++    ],
++    "x-openvibe-capabilities": [
++     "vision.review.read"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "vision-review-read",
++    "security": [
++     {
++      "openvibeToken": [
++       "vision.review.read"
++      ]
++     }
++    ],
++    "parameters": [
++     {
++      "name": "id",
++      "in": "path",
++      "required": true,
++      "schema": {
++       "type": "string"
++      }
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success"
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
++  "/api/v1/review/reports": {
++   "get": {
++    "operationId": "get_api_v1_review_reports",
++    "summary": "Read OpenVibe.Vision's unsafe-image review queue and one review, including its operator report and the logged operator views.",
++    "description": "**vision.review.read** (first-party): Read OpenVibe.Vision's unsafe-image review queue and one review, including its operator report and the logged operator views. Staff use it through the review pages; a service token holding this capability can read the queue. POST /api/v1/review/:id/reveal opens one 60-second Media evidence view and logs it.",
++    "tags": [
++     "vision.review"
++    ],
++    "x-openvibe-capabilities": [
++     "vision.review.read"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "vision-review-read",
++    "security": [
++     {
++      "openvibeToken": [
++       "vision.review.read"
++      ]
++     }
++    ],
++    "responses": {
++     "2XX": {
++      "description": "Success"
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
    "/api/v1/ui-check": {
     "post": {
      "operationId": "post_api_v1_ui_check",
ddiff --git a/generated/openapi/watch.json b/generated/openapi/watch.json
iindex ab92d64b..18124766 100644
---- a/generated/openapi/watch.json
++++ b/generated/openapi/watch.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Watch API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/wiki.json b/generated/openapi/wiki.json
iindex 0218e5f1..6b7858d8 100644
---- a/generated/openapi/wiki.json
++++ b/generated/openapi/wiki.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Wiki API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/work.json b/generated/openapi/work.json
iindex fbde4d56..a29c60e1 100644
---- a/generated/openapi/work.json
++++ b/generated/openapi/work.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Work API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/zone.json b/generated/openapi/zone.json
iindex 16adf093..25633f52 100644
---- a/generated/openapi/zone.json
++++ b/generated/openapi/zone.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Zone API",
--  "version": "0.292.0",
--  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.294.0",
++  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.294.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/manifests/capabilities/media.object.review.decide.json b/manifests/capabilities/media.object.review.decide.json
nnew file mode 100644
iindex 00000000..2116a504
---- /dev/null
++++ b/manifests/capabilities/media.object.review.decide.json
@@@ -0,0 +1,15 @@
++{
++  "id": "media.object.review.decide",
++  "version": "1.0",
++  "owner": "media",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Apply an operator's overruling unsafe-image category to a Media object. POST /api/v2/:app/objects/:id/review-decision places the evidence hold for minor_sexual or releases it for fine/sex_acts, recording who and when; it is a service-principal capability and never an app key or the object's owner. OpenVibe.Vision calls it after the operator decides.",
++  "permissions": ["media:review-decide"],
++  "resourceConstraints": ["namespace"],
++  "quotaClass": "media-review-decide",
++  "events": ["media.moderation.action"],
++  "implementedBy": ["POST /api/v2/:app/objects/:id/review-decision"],
++  "inputSchema": "common.no-body@1",
++  "outputSchema": "common.no-body@1"
++}
ddiff --git a/manifests/capabilities/media.object.review.view.json b/manifests/capabilities/media.object.review.view.json
nnew file mode 100644
iindex 00000000..b9ba3d72
---- /dev/null
++++ b/manifests/capabilities/media.object.review.view.json
@@@ -0,0 +1,15 @@
++{
++  "id": "media.object.review.view",
++  "version": "1.0",
++  "owner": "media",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Open one 60-second operator evidence view of a hidden or quarantined Media object. POST /api/v2/:app/objects/:id/operator-view answers a signed URL whose purpose is separate from every normal download signature; the view is logged (who, when, expiry) and a fine object is refused. OpenVibe.Vision alone holds it, for the review page.",
++  "permissions": ["media:review-view"],
++  "resourceConstraints": ["namespace"],
++  "quotaClass": "media-review-view",
++  "events": ["media.moderation.action"],
++  "implementedBy": ["POST /api/v2/:app/objects/:id/operator-view"],
++  "inputSchema": "common.no-body@1",
++  "outputSchema": "common.no-body@1"
++}
ddiff --git a/manifests/capabilities/vision.image.review.json b/manifests/capabilities/vision.image.review.json
nnew file mode 100644
iindex 00000000..e85a4091
---- /dev/null
++++ b/manifests/capabilities/vision.image.review.json
@@@ -0,0 +1,15 @@
++{
++  "id": "vision.image.review",
++  "version": "1.0",
++  "owner": "vision",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Sort one image (or one AI text) into OpenVibe.Vision's unsafe-image review: exactly fine (nudity allowed), sex_acts (never public; kept for its owner) or minor_sexual (always blocked, quarantined and reported to the operator). POST /api/v1/review accepts a multipart image, a data URL, a public https image URL or text, plus the caller's object reference; the answer carries the category, plain words, the action and the operator report for category 3. Media, Community and Live call it with their own service token. No image bytes are stored.",
++  "permissions": ["vision:review"],
++  "resourceConstraints": ["none"],
++  "quotaClass": "vision-review",
++  "events": [],
++  "implementedBy": ["POST /api/v1/review"],
++  "inputSchema": "common.no-body@1",
++  "outputSchema": "common.no-body@1"
++}
ddiff --git a/manifests/capabilities/vision.review.decide.json b/manifests/capabilities/vision.review.decide.json
nnew file mode 100644
iindex 00000000..0ed3f072
---- /dev/null
++++ b/manifests/capabilities/vision.review.decide.json
@@@ -0,0 +1,15 @@
++{
++  "id": "vision.review.decide",
++  "version": "1.0",
++  "owner": "vision",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Set one OpenVibe.Vision unsafe-image review to exactly fine, sex_acts or minor_sexual. POST /api/v1/review/:id/decide records who decided and when, and an overruling category releases Media's evidence hold. Staff use it through the review page; a service token holding this capability can make the same decision.",
++  "permissions": ["vision:review-decide"],
++  "resourceConstraints": ["none"],
++  "quotaClass": "vision-review-decide",
++  "events": [],
++  "implementedBy": ["POST /api/v1/review/:id/decide"],
++  "inputSchema": "common.no-body@1",
++  "outputSchema": "common.no-body@1"
++}
ddiff --git a/manifests/capabilities/vision.review.read.json b/manifests/capabilities/vision.review.read.json
nnew file mode 100644
iindex 00000000..31e51e0b
---- /dev/null
++++ b/manifests/capabilities/vision.review.read.json
@@@ -0,0 +1,15 @@
++{
++  "id": "vision.review.read",
++  "version": "1.0",
++  "owner": "vision",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Read OpenVibe.Vision's unsafe-image review queue and one review, including its operator report and the logged operator views. Staff use it through the review pages; a service token holding this capability can read the queue. POST /api/v1/review/:id/reveal opens one 60-second Media evidence view and logs it.",
++  "permissions": ["vision:review-read"],
++  "resourceConstraints": ["none"],
++  "quotaClass": "vision-review-read",
++  "events": [],
++  "implementedBy": ["GET /api/v1/review", "GET /api/v1/review/reports", "GET /api/v1/review/:id", "POST /api/v1/review/:id/reveal"],
++  "inputSchema": "common.no-body@1",
++  "outputSchema": "common.no-body@1"
++}
ddiff --git a/manifests/services/media.json b/manifests/services/media.json
iindex eab3c398..f3943a8e 100644
---- a/manifests/services/media.json
++++ b/manifests/services/media.json
@@@ -53,7 +53,9 @@
      "media.resource.control",
      "media.resource.read",
      "media.upload.create",
--    "media.zone.provision"
++    "media.zone.provision",
++    "media.object.review.view",
++    "media.object.review.decide"
    ],
    "eventsProduced": [
      "media.clip.failed",
ddiff --git a/manifests/services/vision.json b/manifests/services/vision.json
iindex 61c9a6e1..fb192d5b 100644
---- a/manifests/services/vision.json
++++ b/manifests/services/vision.json
@@@ -35,7 +35,10 @@
      "vision.face.cast.match",
      "vision.face.cast.read",
      "vision.models.read",
--    "vision.benchmarks.read"
++    "vision.benchmarks.read",
++    "vision.image.review",
++    "vision.review.read",
++    "vision.review.decide"
    ],
    "eventsProduced": [
      "vision.result.ready",
@@@ -98,7 +101,7 @@
        "none": "no claims: one process serves the site and the API"
      }
    },
--  "notes": "Port 5130, unit openvibe-vision.service, database ov_vision. The Vision room (plan 2026-10-28 §5.8b): ask a picture, read text with the local Tesseract 5 engine first, compare the local reader with up to three AI hints, check HTML, a public URL or a screenshot for UI faults, write alt text, search only your own images by CLIP, read receipts, match products to offers, watch camera stills and find VOD moments. Faces are local (YuNet/SFace): detect and blur are identity-free, and verify, find, cast and library grouping each need a separate signed consent record (vision.consent@1) with a scope, expiry and a revocation that erases the derived data. Refusal is the same whether or not the person exists. OpenVibe.AI is the only model gateway (ai.run.create); no provider key is held, no image bytes are stored for general answers and no face template enters Search, a prompt or Bench. Public AI text passes noLooks. OAuth client `vision`; MCP at POST /mcp (RFC 9728 protected-resource metadata) exposes the image tools and never enrolment, verification or face-group mutation. Answers account export and deletion (ADR-033), subscribes to the two account Events topics and publishes vision.result.ready and vision.alert through its outbox. v1 has no public records, so it has no Search outbox.",
++  "notes": "Port 5130, unit openvibe-vision.service, database ov_vision. The Vision room (plan 2026-10-28 \u00a75.8b): ask a picture, read text with the local Tesseract 5 engine first, compare the local reader with up to three AI hints, check HTML, a public URL or a screenshot for UI faults, write alt text, search only your own images by CLIP, read receipts, match products to offers, watch camera stills and find VOD moments. Faces are local (YuNet/SFace): detect and blur are identity-free, and verify, find, cast and library grouping each need a separate signed consent record (vision.consent@1) with a scope, expiry and a revocation that erases the derived data. Refusal is the same whether or not the person exists. OpenVibe.AI is the only model gateway (ai.run.create); no provider key is held, no image bytes are stored for general answers and no face template enters Search, a prompt or Bench. Public AI text passes noLooks. OAuth client `vision`; MCP at POST /mcp (RFC 9728 protected-resource metadata) exposes the image tools and never enrolment, verification or face-group mutation. Answers account export and deletion (ADR-033), subscribes to the two account Events topics and publishes vision.result.ready and vision.alert through its outbox. v1 has no public records, so it has no Search outbox.",
    "health": "/api/health",
    "ready": "/api/ready",
    "internalOrigin": "http://127.0.0.1:5130",
ddiff --git a/package.json b/package.json
iindex 84578c3e..8cf64d0d 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.292.0",
++  "version": "0.294.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",