openvibers/openvibe.contracts Commits

Add Media-pinned inputs and egress net values to platform.job@1

OP OpenVibers committed 4 Oct 2026 · c1eb592848 · 36 files, +310 −66

Asked: T14 step 1 (C1) — OpenVibe.Contracts: platform.job@1 carries `inputs` and a real `net`. ONE pull request from current origin/main (git fetch first; main carries v0.91.0, tagged at 2700694). Contracts only; additive. This unblocks Node S5 (Media-backed inputs) and Run R3.
Harness job contracts-t14-step-1-c1-115324 (plan T14).

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 31cf7d6d..7e2341bd 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,11 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th
  from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
  the notes were in the tag and commit messages (`git tag -n1`).
  
++## 0.92.0 — 2026-10-04
++
++`platform.job@1` gains `inputs` (Media objects pinned by sha256) and the `net` values `none`, `public`, `openvibe-only`;
++`code` now requires an artifact. Additive; a v1 worker still refuses an unknown `net` with `nack`.
++
  ## 0.91.0 — 2026-10-04
  
  **Chat's service-token ingress** (plan T3 J2, OpenVibe.Chat PR #16). These are the capabilities and request contracts of
ddiff --git a/contracts/platform/job.v1.json b/contracts/platform/job.v1.json
iindex d6c89bc0..1cbc8ab6 100644
---- a/contracts/platform/job.v1.json
++++ b/contracts/platform/job.v1.json
@@@ -25,7 +25,7 @@
      "artifact": {
        "type": "object",
        "additionalProperties": false,
--      "description": "The pre-registered artifact to run; required for class `function`.",
++      "description": "The pre-registered artifact to run; required for classes `function` and `code`.",
        "required": [
          "name",
          "version"
@@@ -81,10 +81,45 @@
      "net": {
        "type": "string",
        "enum": [
--        "deny"
++        "deny",
++        "none",
++        "public",
++        "openvibe-only"
        ],
        "default": "deny",
--      "description": "Network policy; absent means `deny` (no network at all). Further policies are added to v1 additively, and a worker refuses (`nack`) a policy it does not know."
++      "description": "Network policy; absent means `deny`. `none` is `deny` spelled as OpenVibe.Node's worker.egress names it; `public` and `openvibe-only` ask for egress the host must already allow (ADR-046): a worker whose host policy is stricter runs the stricter one, and a worker that cannot enforce what is asked refuses the job (`nack`) rather than running it weaker."
++    },
++    "inputs": {
++      "type": "array",
++      "maxItems": 32,
++      "description": "Files placed in the job's working directory before the process starts. Each is an OpenVibe.Media object pinned by digest: a size or digest mismatch ends the job failed before the process ever runs (run.job.input_digest_mismatch). Never a caller-chosen URL and never a credential; the worker holds its own token. Names are unique and carry no path separator.",
++      "items": {
++        "type": "object",
++        "additionalProperties": false,
++        "required": [
++          "name",
++          "media_id",
++          "sha256"
++        ],
++        "properties": {
++          "name": {
++            "type": "string",
++            "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
++          },
++          "media_id": {
++            "type": "string",
++            "pattern": "^med_[0-9A-HJKMNP-TV-Z]{26}$"
++          },
++          "sha256": {
++            "type": "string",
++            "pattern": "^[0-9a-f]{64}$"
++          },
++          "size_bytes": {
++            "type": "integer",
++            "minimum": 0
++          }
++        }
++      }
      }
    },
    "allOf": [
@@@ -95,7 +130,10 @@
          ],
          "properties": {
            "class": {
--            "const": "function"
++            "enum": [
++              "function",
++              "code"
++            ]
            }
          }
        },
@@@ -124,6 +162,32 @@
          "mem_bytes": 268435456
        },
        "net": "deny"
++    },
++    {
++      "id": "job_01JAB2C3D4E5F6G7H8J9K0MNPR",
++      "class": "code",
++      "artifact": {
++        "name": "transcode",
++        "version": "0.4.1"
++      },
++      "args": {
++        "format": "webm"
++      },
++      "ttl_ms": 120000,
++      "limits": {
++        "wall_ms": 90000,
++        "cpu_ms": 90000,
++        "mem_bytes": 536870912
++      },
++      "net": "public",
++      "inputs": [
++        {
++          "name": "clip.mp4",
++          "media_id": "med_01JAB2C3D4E5F6G7H8J9K0MNPQ",
++          "sha256": "9f86d081884c7d659a2feb15b0b4f8f1c0e6ad1d7e6fd2e1b0b6fd1c4f1d2a3b",
++          "size_bytes": 1048576
++        }
++      ]
      }
    ]
  }
ddiff --git a/fixtures/platform.job/invalid/code-without-artifact.json b/fixtures/platform.job/invalid/code-without-artifact.json
nnew file mode 100644
iindex 00000000..cd8d810f
---- /dev/null
++++ b/fixtures/platform.job/invalid/code-without-artifact.json
@@@ -0,0 +1,22 @@
++{
++  "id": "job_01JAB2C3D4E5F6G7H8J9K0MNPR",
++  "class": "code",
++  "args": {
++    "format": "webm"
++  },
++  "ttl_ms": 120000,
++  "limits": {
++    "wall_ms": 90000,
++    "cpu_ms": 90000,
++    "mem_bytes": 536870912
++  },
++  "net": "public",
++  "inputs": [
++    {
++      "name": "clip.mp4",
++      "media_id": "med_01JAB2C3D4E5F6G7H8J9K0MNPQ",
++      "sha256": "9f86d081884c7d659a2feb15b0b4f8f1c0e6ad1d7e6fd2e1b0b6fd1c4f1d2a3b",
++      "size_bytes": 1048576
++    }
++  ]
++}
ddiff --git a/fixtures/platform.job/invalid/input-bad-digest.json b/fixtures/platform.job/invalid/input-bad-digest.json
nnew file mode 100644
iindex 00000000..d1842cc5
---- /dev/null
++++ b/fixtures/platform.job/invalid/input-bad-digest.json
@@@ -0,0 +1,26 @@
++{
++  "id": "job_01JAB2C3D4E5F6G7H8J9K0MNPR",
++  "class": "code",
++  "artifact": {
++    "name": "transcode",
++    "version": "0.4.1"
++  },
++  "args": {
++    "format": "webm"
++  },
++  "ttl_ms": 120000,
++  "limits": {
++    "wall_ms": 90000,
++    "cpu_ms": 90000,
++    "mem_bytes": 536870912
++  },
++  "net": "public",
++  "inputs": [
++    {
++      "name": "clip.mp4",
++      "media_id": "med_01JAB2C3D4E5F6G7H8J9K0MNPQ",
++      "sha256": "f86d081884c7d659a2feb15b0b4f8f1c0e6ad1d7e6fd2e1b0b6fd1c4f1d2a3b",
++      "size_bytes": 1048576
++    }
++  ]
++}
ddiff --git a/fixtures/platform.job/invalid/unknown-net.json b/fixtures/platform.job/invalid/unknown-net.json
nnew file mode 100644
iindex 00000000..52bbf5e3
---- /dev/null
++++ b/fixtures/platform.job/invalid/unknown-net.json
@@@ -0,0 +1,26 @@
++{
++  "id": "job_01JAB2C3D4E5F6G7H8J9K0MNPR",
++  "class": "code",
++  "artifact": {
++    "name": "transcode",
++    "version": "0.4.1"
++  },
++  "args": {
++    "format": "webm"
++  },
++  "ttl_ms": 120000,
++  "limits": {
++    "wall_ms": 90000,
++    "cpu_ms": 90000,
++    "mem_bytes": 536870912
++  },
++  "net": "restricted",
++  "inputs": [
++    {
++      "name": "clip.mp4",
++      "media_id": "med_01JAB2C3D4E5F6G7H8J9K0MNPQ",
++      "sha256": "9f86d081884c7d659a2feb15b0b4f8f1c0e6ad1d7e6fd2e1b0b6fd1c4f1d2a3b",
++      "size_bytes": 1048576
++    }
++  ]
++}
ddiff --git a/fixtures/platform.job/valid/code-with-inputs.json b/fixtures/platform.job/valid/code-with-inputs.json
nnew file mode 100644
iindex 00000000..78d7c550
---- /dev/null
++++ b/fixtures/platform.job/valid/code-with-inputs.json
@@@ -0,0 +1,26 @@
++{
++  "id": "job_01JAB2C3D4E5F6G7H8J9K0MNPR",
++  "class": "code",
++  "artifact": {
++    "name": "transcode",
++    "version": "0.4.1"
++  },
++  "args": {
++    "format": "webm"
++  },
++  "ttl_ms": 120000,
++  "limits": {
++    "wall_ms": 90000,
++    "cpu_ms": 90000,
++    "mem_bytes": 536870912
++  },
++  "net": "public",
++  "inputs": [
++    {
++      "name": "clip.mp4",
++      "media_id": "med_01JAB2C3D4E5F6G7H8J9K0MNPQ",
++      "sha256": "9f86d081884c7d659a2feb15b0b4f8f1c0e6ad1d7e6fd2e1b0b6fd1c4f1d2a3b",
++      "size_bytes": 1048576
++    }
++  ]
++}
ddiff --git a/generated/json-schema/bundle.json b/generated/json-schema/bundle.json
iindex 21ecf7c7..f980a1b7 100644
---- a/generated/json-schema/bundle.json
++++ b/generated/json-schema/bundle.json
@@@ -63088,7 +63088,7 @@
            "artifact": {
              "type": "object",
              "additionalProperties": false,
--            "description": "The pre-registered artifact to run; required for class `function`.",
++            "description": "The pre-registered artifact to run; required for classes `function` and `code`.",
              "required": [
                "name",
                "version"
@@@ -63144,10 +63144,45 @@
            "net": {
              "type": "string",
              "enum": [
--              "deny"
++              "deny",
++              "none",
++              "public",
++              "openvibe-only"
              ],
              "default": "deny",
--            "description": "Network policy; absent means `deny` (no network at all). Further policies are added to v1 additively, and a worker refuses (`nack`) a policy it does not know."
++            "description": "Network policy; absent means `deny`. `none` is `deny` spelled as OpenVibe.Node's worker.egress names it; `public` and `openvibe-only` ask for egress the host must already allow (ADR-046): a worker whose host policy is stricter runs the stricter one, and a worker that cannot enforce what is asked refuses the job (`nack`) rather than running it weaker."
++          },
++          "inputs": {
++            "type": "array",
++            "maxItems": 32,
++            "description": "Files placed in the job's working directory before the process starts. Each is an OpenVibe.Media object pinned by digest: a size or digest mismatch ends the job failed before the process ever runs (run.job.input_digest_mismatch). Never a caller-chosen URL and never a credential; the worker holds its own token. Names are unique and carry no path separator.",
++            "items": {
++              "type": "object",
++              "additionalProperties": false,
++              "required": [
++                "name",
++                "media_id",
++                "sha256"
++              ],
++              "properties": {
++                "name": {
++                  "type": "string",
++                  "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
++                },
++                "media_id": {
++                  "type": "string",
++                  "pattern": "^med_[0-9A-HJKMNP-TV-Z]{26}$"
++                },
++                "sha256": {
++                  "type": "string",
++                  "pattern": "^[0-9a-f]{64}$"
++                },
++                "size_bytes": {
++                  "type": "integer",
++                  "minimum": 0
++                }
++              }
++            }
            }
          },
          "allOf": [
@@@ -63158,7 +63193,10 @@
                ],
                "properties": {
                  "class": {
--                  "const": "function"
++                  "enum": [
++                    "function",
++                    "code"
++                  ]
                  }
                }
              },
@@@ -63187,6 +63225,32 @@
                "mem_bytes": 268435456
              },
              "net": "deny"
++          },
++          {
++            "id": "job_01JAB2C3D4E5F6G7H8J9K0MNPR",
++            "class": "code",
++            "artifact": {
++              "name": "transcode",
++              "version": "0.4.1"
++            },
++            "args": {
++              "format": "webm"
++            },
++            "ttl_ms": 120000,
++            "limits": {
++              "wall_ms": 90000,
++              "cpu_ms": 90000,
++              "mem_bytes": 536870912
++            },
++            "net": "public",
++            "inputs": [
++              {
++                "name": "clip.mp4",
++                "media_id": "med_01JAB2C3D4E5F6G7H8J9K0MNPQ",
++                "sha256": "9f86d081884c7d659a2feb15b0b4f8f1c0e6ad1d7e6fd2e1b0b6fd1c4f1d2a3b",
++                "size_bytes": 1048576
++              }
++            ]
            }
          ]
        }
ddiff --git a/generated/openapi/ai.json b/generated/openapi/ai.json
iindex f254b188..cde5f36b 100644
---- a/generated/openapi/ai.json
++++ b/generated/openapi/ai.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.AI API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/billing.json b/generated/openapi/billing.json
iindex 71af3a2e..ddd74857 100644
---- a/generated/openapi/billing.json
++++ b/generated/openapi/billing.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Billing API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/blog.json b/generated/openapi/blog.json
iindex 4ecdeea6..00a7af90 100644
---- a/generated/openapi/blog.json
++++ b/generated/openapi/blog.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Blog API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/bot.json b/generated/openapi/bot.json
iindex 0299978b..60465e53 100644
---- a/generated/openapi/bot.json
++++ b/generated/openapi/bot.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Bot API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/chat.json b/generated/openapi/chat.json
iindex dc313f41..52f5e65c 100644
---- a/generated/openapi/chat.json
++++ b/generated/openapi/chat.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Chat API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/codes.json b/generated/openapi/codes.json
iindex e08d2434..0f147018 100644
---- a/generated/openapi/codes.json
++++ b/generated/openapi/codes.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Codes API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/community.json b/generated/openapi/community.json
iindex a040a35f..faa6916d 100644
---- a/generated/openapi/community.json
++++ b/generated/openapi/community.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Community API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/coupons.json b/generated/openapi/coupons.json
iindex c9de9f9a..f4f1a1e9 100644
---- a/generated/openapi/coupons.json
++++ b/generated/openapi/coupons.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Coupons API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/deals.json b/generated/openapi/deals.json
iindex 5a6a2fb1..a9880258 100644
---- a/generated/openapi/deals.json
++++ b/generated/openapi/deals.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Deals API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/events.json b/generated/openapi/events.json
iindex 1980215c..98d65d94 100644
---- a/generated/openapi/events.json
++++ b/generated/openapi/events.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Events API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/games.json b/generated/openapi/games.json
iindex 3777d58f..a4ab76da 100644
---- a/generated/openapi/games.json
++++ b/generated/openapi/games.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Games API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/host.json b/generated/openapi/host.json
iindex 460cb8fb..49d09f7e 100644
---- a/generated/openapi/host.json
++++ b/generated/openapi/host.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Host API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/live.json b/generated/openapi/live.json
iindex 4a7e9bc5..58223de1 100644
---- a/generated/openapi/live.json
++++ b/generated/openapi/live.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Live API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media.json b/generated/openapi/media.json
iindex fbd2ecef..88cc2525 100644
---- a/generated/openapi/media.json
++++ b/generated/openapi/media.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Media API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/network.json b/generated/openapi/network.json
iindex 87f8d8a1..8197c1ce 100644
---- a/generated/openapi/network.json
++++ b/generated/openapi/network.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Network API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/news.json b/generated/openapi/news.json
iindex 0818000d..86315a07 100644
---- a/generated/openapi/news.json
++++ b/generated/openapi/news.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.News API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/openre.json b/generated/openapi/openre.json
iindex 07642a99..bb9ede62 100644
---- a/generated/openapi/openre.json
++++ b/generated/openapi/openre.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenRe.Stream API",
--  "version": "0.91.0",
--  "description": "Routes of OpenRe.Stream as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenRe.Stream as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/reviews.json b/generated/openapi/reviews.json
iindex 47645466..545e3458 100644
---- a/generated/openapi/reviews.json
++++ b/generated/openapi/reviews.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Reviews API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/search.json b/generated/openapi/search.json
iindex 7a88f65a..b9975886 100644
---- a/generated/openapi/search.json
++++ b/generated/openapi/search.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Search API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/sources.json b/generated/openapi/sources.json
iindex 5265f895..d8251db6 100644
---- a/generated/openapi/sources.json
++++ b/generated/openapi/sources.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Sources API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/space.json b/generated/openapi/space.json
iindex 2fc289d4..6f160968 100644
---- a/generated/openapi/space.json
++++ b/generated/openapi/space.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Space API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tips.json b/generated/openapi/tips.json
iindex 065cc958..f7237c01 100644
---- a/generated/openapi/tips.json
++++ b/generated/openapi/tips.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tips API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tools.json b/generated/openapi/tools.json
iindex b7f7d8e2..43c9982a 100644
---- a/generated/openapi/tools.json
++++ b/generated/openapi/tools.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tools API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/trade.json b/generated/openapi/trade.json
iindex aa80a040..6d6841fc 100644
---- a/generated/openapi/trade.json
++++ b/generated/openapi/trade.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Trade API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vip.json b/generated/openapi/vip.json
iindex 8a8138a4..32259056 100644
---- a/generated/openapi/vip.json
++++ b/generated/openapi/vip.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.VIP API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/wiki.json b/generated/openapi/wiki.json
iindex 94c125ba..8d07fa67 100644
---- a/generated/openapi/wiki.json
++++ b/generated/openapi/wiki.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Wiki API",
--  "version": "0.91.0",
--  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.91.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.92.0",
++  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.92.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/typescript/index.d.ts b/generated/typescript/index.d.ts
iindex 84b4a8a6..dbe0c7eb 100644
---- a/generated/typescript/index.d.ts
++++ b/generated/typescript/index.d.ts
@@@ -52054,7 +52054,7 @@ export type Job = {
    id: string;
    class: RuntimeClass;
    /**
--   * The pre-registered artifact to run; required for class `function`.
++   * The pre-registered artifact to run; required for classes `function` and `code`.
     */
    artifact?: {
      name: string;
@@@ -52089,9 +52089,20 @@ export type Job = {
      mem_bytes: number;
    };
    /**
--   * Network policy; absent means `deny` (no network at all). Further policies are added to v1 additively, and a worker refuses (`nack`) a policy it does not know.
++   * Network policy; absent means `deny`. `none` is `deny` spelled as OpenVibe.Node's worker.egress names it; `public` and `openvibe-only` ask for egress the host must already allow (ADR-046): a worker whose host policy is stricter runs the stricter one, and a worker that cannot enforce what is asked refuses the job (`nack`) rather than running it weaker.
     */
--  net?: "deny";
++  net?: "deny" | "none" | "public" | "openvibe-only";
++  /**
++   * Files placed in the job's working directory before the process starts. Each is an OpenVibe.Media object pinned by digest: a size or digest mismatch ends the job failed before the process ever runs (run.job.input_digest_mismatch). Never a caller-chosen URL and never a credential; the worker holds its own token. Names are unique and carry no path separator.
++   *
++   * @maxItems 32
++   */
++  inputs?: {
++    name: string;
++    media_id: string;
++    sha256: string;
++    size_bytes?: number;
++  }[];
  };
  
  /** [email protected] (owner: network) */
ddiff --git a/package-lock.json b/package-lock.json
iindex df917864..35ffb883 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.91.0",
++  "version": "0.92.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-contracts",
--      "version": "0.91.0",
++      "version": "0.92.0",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex 8e792868..1445f5ca 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.91.0",
++  "version": "0.92.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",