openvibers/openvibe.contracts Commits

Contracts 0.178.0: Actor webhooks can name a project secret (secret_ref, ADR-056) (#138)

OP OpenVibers committed 29 days ago · eb0a5b5dc1 · 44 files, +296 −119

**Actor webhooks can name a project secret (Contracts 0.178.0; ADR-044 §7, ADR-056).**

- **`actor.task-create-request@1`:** each webhook may carry `secret_ref`, the lower-case name of a project secret. The task must be made in a project by an app or agent token carrying `project_id` and `env`, and the project must have granted the secret to `actor` for `sign`. OpenVibe.Network then signs each delivery (`network.secret.use`) in the same headers, so Actor never holds the value. No per-task `webhook_secret` is minted when every webhook names one. A task outside a project is refused 422 `actor.webhook.secret_unavailable`. The description loses "not accepted yet".
- **`platform.task@1`:** `secret_ref` accepts the ADR-056 lower-case names as well as the earlier upper-case environment-variable form. This relaxes a pattern and narrows nothing.
- **Fixtures:** a valid webhook with `secret_ref`, and an invalid one with spaces in the name.
- **Checks:** 20,108 pass; `compat` against v0.177.0 finds no breaking change; generated artifacts are regenerated.

Next: Actor implements it.

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex e1d8b02a..c6e30b2a 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,16 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th
  from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
  the notes were in the tag and commit messages (`git tag -n1`).
  
++## 0.178.0 — 2026-10-15
++
++- **Actor webhooks name a project secret** (ADR-044 §7, ADR-056). `actor.task-create-request@1` webhooks take
++  `secret_ref`, the lower-case name of a project secret granted to `actor` for `sign`. OpenVibe.Network signs each
++  delivery in the same headers, so Actor never holds the value, and no `webhook_secret` is minted when every webhook
++  names one. A task outside a project is refused 422 `actor.webhook.secret_unavailable`.
++- **`platform.task@1`** `secret_ref` accepts the ADR-056 lower-case names as well as the earlier upper-case
++  environment-variable references.
++- Fixtures: a valid task webhook with `secret_ref`, and an invalid one with spaces in the name.
++
  ## 0.177.0 — 2026-10-15
  
  - **Project secrets (ADR-056).** OpenVibe.Network keeps secrets per project and environment, written once and used by
ddiff --git a/contracts/actor/task-create-request.v1.json b/contracts/actor/task-create-request.v1.json
iindex 1303478c..52a19a59 100644
---- a/contracts/actor/task-create-request.v1.json
++++ b/contracts/actor/task-create-request.v1.json
@@@ -2,7 +2,7 @@
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "$id": "https://openvibe.network/contracts/actor/task-create-request.v1.json",
    "title": "ActorTaskCreateRequest",
--  "description": "actor.task-create-request@1: the body of POST /api/v1/tasks on OpenVibe.Actor (capability actor.task.create), the creation subset of platform.task@1. TASK is the instruction in plain words. MODE is the planner objective (default balanced). BUDGET caps what this task may cost (per_task_usd) and what the caller's tasks may cost in one UTC day (per_day_usd); either may be left out for the person's free-allowance defaults, and a value above the person's tier is refused 422 actor.budget.over_tier, never silently lowered. AGENT pins one agent system by its id from GET /api/v1/agents (routing still checks that it can take the task). IDEMPOTENCY_KEY: a repeat from the same requester within 24 h with an identical body answers the first task (200), with a different body 409 actor.idempotency.conflict. WEBHOOKS (at most 8): each an https URL and the state changes to deliver there (the names of platform.task@1 `state`). Actor signs every delivery with a secret it mints for the task, returned once as `webhook_secret` in the answer that created it (and in an idempotent repeat), and POSTs actor.task-webhook@1 through its egress guard: public addresses only, ports 443 or 8443, no credentials in the URL, never a redirect. A URL that cannot be delivered to is refused 422 actor.webhook.refused. A project secret named by reference (platform.task@1 `secret_ref`) is not accepted yet.",
++  "description": "actor.task-create-request@1: the body of POST /api/v1/tasks on OpenVibe.Actor (capability actor.task.create), the creation subset of platform.task@1. TASK is the instruction in plain words. MODE is the planner objective (default balanced). BUDGET caps what this task may cost (per_task_usd) and what the caller's tasks may cost in one UTC day (per_day_usd); either may be left out for the person's free-allowance defaults, and a value above the person's tier is refused 422 actor.budget.over_tier, never silently lowered. AGENT pins one agent system by its id from GET /api/v1/agents (routing still checks that it can take the task). IDEMPOTENCY_KEY: a repeat from the same requester within 24 h with an identical body answers the first task (200), with a different body 409 actor.idempotency.conflict. WEBHOOKS (at most 8): each an https URL and the state changes to deliver there (the names of platform.task@1 `state`). Actor signs every delivery with a secret it mints for the task, returned once as `webhook_secret` in the answer that created it (and in an idempotent repeat), and POSTs actor.task-webhook@1 through its egress guard: public addresses only, ports 443 or 8443, no credentials in the URL, never a redirect. A URL that cannot be delivered to is refused 422 actor.webhook.refused. A webhook may instead name a project secret (`secret_ref`, ADR-056): its deliveries are then signed by OpenVibe.Network with that secret, in the same headers, and no webhook_secret is minted when every webhook names one. A secret_ref on a task outside a project is refused 422 actor.webhook.secret_unavailable.",
    "type": "object",
    "additionalProperties": false,
    "required": [
@@@ -90,6 +90,11 @@
                ]
              },
              "description": "The state changes delivered; the names of platform.task@1 `state`."
++          },
++          "secret_ref": {
++            "type": "string",
++            "pattern": "^[a-z][a-z0-9_-]{0,63}$",
++            "description": "The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature."
            }
          }
        },
ddiff --git a/contracts/platform/task.v1.json b/contracts/platform/task.v1.json
iindex 0430c444..3e439a25 100644
---- a/contracts/platform/task.v1.json
++++ b/contracts/platform/task.v1.json
@@@ -240,8 +240,8 @@
            },
            "secret_ref": {
              "type": "string",
--            "pattern": "^[A-Z0-9_]+$",
--            "description": "The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference."
++            "pattern": "^([A-Z0-9_]+|[a-z][a-z0-9_-]{0,63})$",
++            "description": "The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference."
            }
          }
        },
ddiff --git a/fixtures/actor.task-create-request/invalid/webhook-secret-ref-spaces.json b/fixtures/actor.task-create-request/invalid/webhook-secret-ref-spaces.json
nnew file mode 100644
iindex 00000000..405cd036
---- /dev/null
++++ b/fixtures/actor.task-create-request/invalid/webhook-secret-ref-spaces.json
@@@ -0,0 +1,4 @@
++{
++  "task": "Summarise this week's Node.js release notes",
++  "webhooks": [{ "url": "https://hooks.example.com/actor", "events": ["succeeded"], "secret_ref": "Webhook Signing" }]
++}
ddiff --git a/fixtures/actor.task-create-request/valid/webhook-secret-ref.json b/fixtures/actor.task-create-request/valid/webhook-secret-ref.json
nnew file mode 100644
iindex 00000000..0638849d
---- /dev/null
++++ b/fixtures/actor.task-create-request/valid/webhook-secret-ref.json
@@@ -0,0 +1,4 @@
++{
++  "task": "Summarise this week's Node.js release notes",
++  "webhooks": [{ "url": "https://hooks.example.com/actor", "events": ["succeeded", "failed"], "secret_ref": "webhook-signing" }]
++}
ddiff --git a/generated/json-schema/bundle.json b/generated/json-schema/bundle.json
iindex d01031af..bbc9fb4b 100644
---- a/generated/json-schema/bundle.json
++++ b/generated/json-schema/bundle.json
@@@ -67974,8 +67974,8 @@
                  },
                  "secret_ref": {
                    "type": "string",
--                  "pattern": "^[A-Z0-9_]+$",
--                  "description": "The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference."
++                  "pattern": "^([A-Z0-9_]+|[a-z][a-z0-9_-]{0,63})$",
++                  "description": "The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference."
                  }
                }
              },
@@@ -75521,7 +75521,7 @@
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "$id": "https://openvibe.network/contracts/actor/task-create-request.v1.json",
          "title": "ActorTaskCreateRequest",
--        "description": "actor.task-create-request@1: the body of POST /api/v1/tasks on OpenVibe.Actor (capability actor.task.create), the creation subset of platform.task@1. TASK is the instruction in plain words. MODE is the planner objective (default balanced). BUDGET caps what this task may cost (per_task_usd) and what the caller's tasks may cost in one UTC day (per_day_usd); either may be left out for the person's free-allowance defaults, and a value above the person's tier is refused 422 actor.budget.over_tier, never silently lowered. AGENT pins one agent system by its id from GET /api/v1/agents (routing still checks that it can take the task). IDEMPOTENCY_KEY: a repeat from the same requester within 24 h with an identical body answers the first task (200), with a different body 409 actor.idempotency.conflict. WEBHOOKS (at most 8): each an https URL and the state changes to deliver there (the names of platform.task@1 `state`). Actor signs every delivery with a secret it mints for the task, returned once as `webhook_secret` in the answer that created it (and in an idempotent repeat), and POSTs actor.task-webhook@1 through its egress guard: public addresses only, ports 443 or 8443, no credentials in the URL, never a redirect. A URL that cannot be delivered to is refused 422 actor.webhook.refused. A project secret named by reference (platform.task@1 `secret_ref`) is not accepted yet.",
++        "description": "actor.task-create-request@1: the body of POST /api/v1/tasks on OpenVibe.Actor (capability actor.task.create), the creation subset of platform.task@1. TASK is the instruction in plain words. MODE is the planner objective (default balanced). BUDGET caps what this task may cost (per_task_usd) and what the caller's tasks may cost in one UTC day (per_day_usd); either may be left out for the person's free-allowance defaults, and a value above the person's tier is refused 422 actor.budget.over_tier, never silently lowered. AGENT pins one agent system by its id from GET /api/v1/agents (routing still checks that it can take the task). IDEMPOTENCY_KEY: a repeat from the same requester within 24 h with an identical body answers the first task (200), with a different body 409 actor.idempotency.conflict. WEBHOOKS (at most 8): each an https URL and the state changes to deliver there (the names of platform.task@1 `state`). Actor signs every delivery with a secret it mints for the task, returned once as `webhook_secret` in the answer that created it (and in an idempotent repeat), and POSTs actor.task-webhook@1 through its egress guard: public addresses only, ports 443 or 8443, no credentials in the URL, never a redirect. A URL that cannot be delivered to is refused 422 actor.webhook.refused. A webhook may instead name a project secret (`secret_ref`, ADR-056): its deliveries are then signed by OpenVibe.Network with that secret, in the same headers, and no webhook_secret is minted when every webhook names one. A secret_ref on a task outside a project is refused 422 actor.webhook.secret_unavailable.",
          "type": "object",
          "additionalProperties": false,
          "required": [
@@@ -75609,6 +75609,11 @@
                      ]
                    },
                    "description": "The state changes delivered; the names of platform.task@1 `state`."
++                },
++                "secret_ref": {
++                  "type": "string",
++                  "pattern": "^[a-z][a-z0-9_-]{0,63}$",
++                  "description": "The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature."
                  }
                }
              },
ddiff --git a/generated/openapi/actor.json b/generated/openapi/actor.json
iindex 2384ffbc..1981eb80 100644
---- a/generated/openapi/actor.json
++++ b/generated/openapi/actor.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Actor API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
@@@ -1806,7 +1806,7 @@
     },
     "actor.task-create-request.v1": {
      "title": "ActorTaskCreateRequest",
--    "description": "actor.task-create-request@1: the body of POST /api/v1/tasks on OpenVibe.Actor (capability actor.task.create), the creation subset of platform.task@1. TASK is the instruction in plain words. MODE is the planner objective (default balanced). BUDGET caps what this task may cost (per_task_usd) and what the caller's tasks may cost in one UTC day (per_day_usd); either may be left out for the person's free-allowance defaults, and a value above the person's tier is refused 422 actor.budget.over_tier, never silently lowered. AGENT pins one agent system by its id from GET /api/v1/agents (routing still checks that it can take the task). IDEMPOTENCY_KEY: a repeat from the same requester within 24 h with an identical body answers the first task (200), with a different body 409 actor.idempotency.conflict. WEBHOOKS (at most 8): each an https URL and the state changes to deliver there (the names of platform.task@1 `state`). Actor signs every delivery with a secret it mints for the task, returned once as `webhook_secret` in the answer that created it (and in an idempotent repeat), and POSTs actor.task-webhook@1 through its egress guard: public addresses only, ports 443 or 8443, no credentials in the URL, never a redirect. A URL that cannot be delivered to is refused 422 actor.webhook.refused. A project secret named by reference (platform.task@1 `secret_ref`) is not accepted yet.",
++    "description": "actor.task-create-request@1: the body of POST /api/v1/tasks on OpenVibe.Actor (capability actor.task.create), the creation subset of platform.task@1. TASK is the instruction in plain words. MODE is the planner objective (default balanced). BUDGET caps what this task may cost (per_task_usd) and what the caller's tasks may cost in one UTC day (per_day_usd); either may be left out for the person's free-allowance defaults, and a value above the person's tier is refused 422 actor.budget.over_tier, never silently lowered. AGENT pins one agent system by its id from GET /api/v1/agents (routing still checks that it can take the task). IDEMPOTENCY_KEY: a repeat from the same requester within 24 h with an identical body answers the first task (200), with a different body 409 actor.idempotency.conflict. WEBHOOKS (at most 8): each an https URL and the state changes to deliver there (the names of platform.task@1 `state`). Actor signs every delivery with a secret it mints for the task, returned once as `webhook_secret` in the answer that created it (and in an idempotent repeat), and POSTs actor.task-webhook@1 through its egress guard: public addresses only, ports 443 or 8443, no credentials in the URL, never a redirect. A URL that cannot be delivered to is refused 422 actor.webhook.refused. A webhook may instead name a project secret (`secret_ref`, ADR-056): its deliveries are then signed by OpenVibe.Network with that secret, in the same headers, and no webhook_secret is minted when every webhook names one. A secret_ref on a task outside a project is refused 422 actor.webhook.secret_unavailable.",
      "type": "object",
      "additionalProperties": false,
      "required": [
@@@ -1894,6 +1894,11 @@
            ]
           },
           "description": "The state changes delivered; the names of platform.task@1 `state`."
++        },
++        "secret_ref": {
++         "type": "string",
++         "pattern": "^[a-z][a-z0-9_-]{0,63}$",
++         "description": "The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature."
          }
         }
        },
@@@ -2736,8 +2741,8 @@
          },
          "secret_ref": {
           "type": "string",
--         "pattern": "^[A-Z0-9_]+$",
--         "description": "The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference."
++         "pattern": "^([A-Z0-9_]+|[a-z][a-z0-9_-]{0,63})$",
++         "description": "The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference."
          }
         }
        },
ddiff --git a/generated/openapi/ai.json b/generated/openapi/ai.json
iindex e967b8a8..21c82439 100644
---- a/generated/openapi/ai.json
++++ b/generated/openapi/ai.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.AI API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/billing.json b/generated/openapi/billing.json
iindex 1b935da3..aeefae64 100644
---- a/generated/openapi/billing.json
++++ b/generated/openapi/billing.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Billing API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/blog.json b/generated/openapi/blog.json
iindex e85f737e..73c2a3cf 100644
---- a/generated/openapi/blog.json
++++ b/generated/openapi/blog.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Blog API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/bot.json b/generated/openapi/bot.json
iindex 8fe51461..a4733d89 100644
---- a/generated/openapi/bot.json
++++ b/generated/openapi/bot.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Bot API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/chat.json b/generated/openapi/chat.json
iindex 3e512a28..95d4cd43 100644
---- a/generated/openapi/chat.json
++++ b/generated/openapi/chat.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Chat API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/codes.json b/generated/openapi/codes.json
iindex 8a2080bd..0a9051eb 100644
---- a/generated/openapi/codes.json
++++ b/generated/openapi/codes.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Codes API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/community.json b/generated/openapi/community.json
iindex 911d5af2..7e892aae 100644
---- a/generated/openapi/community.json
++++ b/generated/openapi/community.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Community API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/coupons.json b/generated/openapi/coupons.json
iindex c7a51c11..aa9a3d47 100644
---- a/generated/openapi/coupons.json
++++ b/generated/openapi/coupons.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Coupons API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/deals.json b/generated/openapi/deals.json
iindex 35208db1..dd918c45 100644
---- a/generated/openapi/deals.json
++++ b/generated/openapi/deals.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Deals API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/events.json b/generated/openapi/events.json
iindex 42486092..f6e23d30 100644
---- a/generated/openapi/events.json
++++ b/generated/openapi/events.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Events API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/food.json b/generated/openapi/food.json
iindex f4cfbe46..ef4f8ef9 100644
---- a/generated/openapi/food.json
++++ b/generated/openapi/food.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Food API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/games.json b/generated/openapi/games.json
iindex 757ab797..7eabd605 100644
---- a/generated/openapi/games.json
++++ b/generated/openapi/games.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Games API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/host.json b/generated/openapi/host.json
iindex e4a705af..63a3ad89 100644
---- a/generated/openapi/host.json
++++ b/generated/openapi/host.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Host API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/inventory.json b/generated/openapi/inventory.json
iindex 1be602bd..492aeaba 100644
---- a/generated/openapi/inventory.json
++++ b/generated/openapi/inventory.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Inventory API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/live.json b/generated/openapi/live.json
iindex 3276d589..ca1947ce 100644
---- a/generated/openapi/live.json
++++ b/generated/openapi/live.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Live API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media-hub.json b/generated/openapi/media-hub.json
iindex cacabcfc..da898b01 100644
---- a/generated/openapi/media-hub.json
++++ b/generated/openapi/media-hub.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.MediaHub API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media.json b/generated/openapi/media.json
iindex e2cc4c54..956d6443 100644
---- a/generated/openapi/media.json
++++ b/generated/openapi/media.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Media API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/network.json b/generated/openapi/network.json
iindex f0d7f064..e7af95a9 100644
---- a/generated/openapi/network.json
++++ b/generated/openapi/network.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Network API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/news.json b/generated/openapi/news.json
iindex 2db65733..f3eda66a 100644
---- a/generated/openapi/news.json
++++ b/generated/openapi/news.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.News API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/openre.json b/generated/openapi/openre.json
iindex b8350085..2349045e 100644
---- a/generated/openapi/openre.json
++++ b/generated/openapi/openre.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenRestream API",
--  "version": "0.177.0",
--  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/play.json b/generated/openapi/play.json
iindex 29a6a809..14e1627b 100644
---- a/generated/openapi/play.json
++++ b/generated/openapi/play.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Play API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/reviews.json b/generated/openapi/reviews.json
iindex cd26d9f2..da8e79e1 100644
---- a/generated/openapi/reviews.json
++++ b/generated/openapi/reviews.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Reviews API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/run.json b/generated/openapi/run.json
iindex 4e4896c4..dbc4c675 100644
---- a/generated/openapi/run.json
++++ b/generated/openapi/run.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Run API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/search.json b/generated/openapi/search.json
iindex a7baccfd..1458224f 100644
---- a/generated/openapi/search.json
++++ b/generated/openapi/search.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Search API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/services.json b/generated/openapi/services.json
iindex 628ec652..2a62af4a 100644
---- a/generated/openapi/services.json
++++ b/generated/openapi/services.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Services API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/sources.json b/generated/openapi/sources.json
iindex 9d0230a2..6906bdad 100644
---- a/generated/openapi/sources.json
++++ b/generated/openapi/sources.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Sources API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/space.json b/generated/openapi/space.json
iindex 641d7302..b2a22e80 100644
---- a/generated/openapi/space.json
++++ b/generated/openapi/space.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Space API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tips.json b/generated/openapi/tips.json
iindex 7e878c14..c7d570a8 100644
---- a/generated/openapi/tips.json
++++ b/generated/openapi/tips.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tips API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tools.json b/generated/openapi/tools.json
iindex 5c48cd28..f836f4e8 100644
---- a/generated/openapi/tools.json
++++ b/generated/openapi/tools.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tools API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/trade.json b/generated/openapi/trade.json
iindex 648ad507..74d7ba4a 100644
---- a/generated/openapi/trade.json
++++ b/generated/openapi/trade.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Trade API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vip.json b/generated/openapi/vip.json
iindex abc81db0..3eee683e 100644
---- a/generated/openapi/vip.json
++++ b/generated/openapi/vip.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.VIP API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/watch.json b/generated/openapi/watch.json
iindex d222b5ef..1b44f89a 100644
---- a/generated/openapi/watch.json
++++ b/generated/openapi/watch.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Watch API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/wiki.json b/generated/openapi/wiki.json
iindex 5fef2414..f2ce31f0 100644
---- a/generated/openapi/wiki.json
++++ b/generated/openapi/wiki.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Wiki API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/work.json b/generated/openapi/work.json
iindex da13899d..094e1a7d 100644
---- a/generated/openapi/work.json
++++ b/generated/openapi/work.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Work API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/zone.json b/generated/openapi/zone.json
iindex e113a575..a733bb97 100644
---- a/generated/openapi/zone.json
++++ b/generated/openapi/zone.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Zone API",
--  "version": "0.177.0",
--  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.178.0",
++  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/typescript/index.d.ts b/generated/typescript/index.d.ts
iindex a1d4ac73..5b017526 100644
---- a/generated/typescript/index.d.ts
++++ b/generated/typescript/index.d.ts
@@@ -182247,7 +182247,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          }
@@@ -182268,7 +182268,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182287,7 +182287,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          }
@@@ -182308,7 +182308,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182327,7 +182327,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182346,7 +182346,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          }
@@@ -182367,7 +182367,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182386,7 +182386,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182405,7 +182405,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182424,7 +182424,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          }
@@@ -182445,7 +182445,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182464,7 +182464,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182483,7 +182483,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182502,7 +182502,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182521,7 +182521,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          }
@@@ -182542,7 +182542,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182561,7 +182561,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182580,7 +182580,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182599,7 +182599,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182618,7 +182618,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182637,7 +182637,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          }
@@@ -182658,7 +182658,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182677,7 +182677,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182696,7 +182696,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182715,7 +182715,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182734,7 +182734,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182753,7 +182753,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182772,7 +182772,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          }
@@@ -182793,7 +182793,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182812,7 +182812,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182831,7 +182831,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182850,7 +182850,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182869,7 +182869,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182888,7 +182888,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182907,7 +182907,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          },
@@@ -182926,7 +182926,7 @@ export type Task = {
              ...("queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled")[]
            ];
            /**
--           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference.
++           * The NAME of the project secret used to sign the delivery (an HMAC header), never the secret itself, as community.moderation-request@1 names a webhook_url_ref and ADR-043 keeps device credentials by reference. Project secrets (ADR-056) are named in lower case; the upper-case form is the earlier environment-variable reference.
             */
            secret_ref?: string;
          }
@@@ -185401,7 +185401,7 @@ export interface SpaceModerationActionPayload {
  
  /** [email protected] (owner: actor) */
  /**
-- * actor.task-create-request@1: the body of POST /api/v1/tasks on OpenVibe.Actor (capability actor.task.create), the creation subset of platform.task@1. TASK is the instruction in plain words. MODE is the planner objective (default balanced). BUDGET caps what this task may cost (per_task_usd) and what the caller's tasks may cost in one UTC day (per_day_usd); either may be left out for the person's free-allowance defaults, and a value above the person's tier is refused 422 actor.budget.over_tier, never silently lowered. AGENT pins one agent system by its id from GET /api/v1/agents (routing still checks that it can take the task). IDEMPOTENCY_KEY: a repeat from the same requester within 24 h with an identical body answers the first task (200), with a different body 409 actor.idempotency.conflict. WEBHOOKS (at most 8): each an https URL and the state changes to deliver there (the names of platform.task@1 `state`). Actor signs every delivery with a secret it mints for the task, returned once as `webhook_secret` in the answer that created it (and in an idempotent repeat), and POSTs actor.task-webhook@1 through its egress guard: public addresses only, ports 443 or 8443, no credentials in the URL, never a redirect. A URL that cannot be delivered to is refused 422 actor.webhook.refused. A project secret named by reference (platform.task@1 `secret_ref`) is not accepted yet.
++ * actor.task-create-request@1: the body of POST /api/v1/tasks on OpenVibe.Actor (capability actor.task.create), the creation subset of platform.task@1. TASK is the instruction in plain words. MODE is the planner objective (default balanced). BUDGET caps what this task may cost (per_task_usd) and what the caller's tasks may cost in one UTC day (per_day_usd); either may be left out for the person's free-allowance defaults, and a value above the person's tier is refused 422 actor.budget.over_tier, never silently lowered. AGENT pins one agent system by its id from GET /api/v1/agents (routing still checks that it can take the task). IDEMPOTENCY_KEY: a repeat from the same requester within 24 h with an identical body answers the first task (200), with a different body 409 actor.idempotency.conflict. WEBHOOKS (at most 8): each an https URL and the state changes to deliver there (the names of platform.task@1 `state`). Actor signs every delivery with a secret it mints for the task, returned once as `webhook_secret` in the answer that created it (and in an idempotent repeat), and POSTs actor.task-webhook@1 through its egress guard: public addresses only, ports 443 or 8443, no credentials in the URL, never a redirect. A URL that cannot be delivered to is refused 422 actor.webhook.refused. A webhook may instead name a project secret (`secret_ref`, ADR-056): its deliveries are then signed by OpenVibe.Network with that secret, in the same headers, and no webhook_secret is minted when every webhook names one. A secret_ref on a task outside a project is refused 422 actor.webhook.secret_unavailable.
   */
  export interface ActorTaskCreateRequest {
    /**
@@@ -185469,6 +185469,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          }
        ]
      | [
@@@ -185515,6 +185519,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -185559,6 +185567,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          }
        ]
      | [
@@@ -185605,6 +185617,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -185649,6 +185665,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -185693,6 +185713,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          }
        ]
      | [
@@@ -185739,6 +185763,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -185783,6 +185811,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -185827,6 +185859,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -185871,6 +185907,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          }
        ]
      | [
@@@ -185917,6 +185957,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -185961,6 +186005,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186005,6 +186053,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186049,6 +186101,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186093,6 +186149,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          }
        ]
      | [
@@@ -186139,6 +186199,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186183,6 +186247,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186227,6 +186295,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186271,6 +186343,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186315,6 +186391,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186359,6 +186439,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          }
        ]
      | [
@@@ -186405,6 +186489,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186449,6 +186537,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186493,6 +186585,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186537,6 +186633,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186581,6 +186681,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186625,6 +186729,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186669,6 +186777,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          }
        ]
      | [
@@@ -186715,6 +186827,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186759,6 +186875,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186803,6 +186923,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186847,6 +186971,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186891,6 +187019,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186935,6 +187067,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -186979,6 +187115,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          },
          {
            /**
@@@ -187023,6 +187163,10 @@ export interface ActorTaskCreateRequest {
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled",
                  "queued" | "running" | "verifying" | "succeeded" | "failed" | "cancelled"
                ];
++          /**
++           * The name of a project secret (ADR-056) that signs this webhook's deliveries instead of the task's own secret. The task must be made in a project (by an app or agent token carrying project_id and env); the secret is looked up in that project and environment, and the project must have granted it to actor for sign. Actor never sees the value: OpenVibe.Network computes each signature.
++           */
++          secret_ref?: string;
          }
        ];
  }
ddiff --git a/package.json b/package.json
iindex 6324a9dd..fbed115c 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.177.0",
++  "version": "0.178.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",