Run sessions' grants (contracts 0.223.0, Desks D6): run holds bot.desk.session on Bot; actor holds run.session.create/read/control on Run; contracts v0.223.0 (#366)

ddiff --git a/README.md b/README.md
iindex a09f0086..e5a36fc5 100644
---- a/README.md
++++ b/README.md
@@@ -757,7 +757,7 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md). The rules the code keeps:
  MIT (`license` in [package.json](package.json)).
  
  <!-- versions:start -->
--- openvibe-contracts: v0.222.0
++- openvibe-contracts: v0.223.0
  - openvibe-sdk: v0.67.0
  - openvibe-shared: v4.19.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 7c330a8d..9e9db71f 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -6,7 +6,7 @@
    "runtime": "node 22, express, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
    "port": 4000,
    "domain": "openvibe.network (with auth., api., admin., my. and themes.openvibe.network in its manifest)",
--  "contracts": "openvibe-contracts v0.222.0",
++  "contracts": "openvibe-contracts v0.223.0",
    "sdk": "openvibe-sdk v0.67.0",
    "shared": "openvibe-shared v4.19.0",
    "capabilities": [
ddiff --git a/package-lock.json b/package-lock.json
iindex edd5dc78..211e42c1 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -20,7 +20,7 @@
          "iovalkey": "^0.4.0",
          "jsonwebtoken": "^9.0.0",
          "multer": "^1.4.5-lts.1",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.222.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.223.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.67.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.19.0",
          "pg": "^8.23.0",
@@@ -1320,9 +1320,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.222.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.222.0",
--      "integrity": "sha512-wdUQCilq9glRMwfxEswbIj3l0QQqKDXZAi2+CR5Mlh34rZjI1Q+7GlAoR0UtNwZAgtLwXhPxFyJ/aPk8lcDG1Q==",
++      "version": "0.223.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.223.0",
++      "integrity": "sha512-FWcPL1951IeYcelp3dUiDRJEiFkTbsLMLth9RVUFfuLTuHGQKoQXA5HIu6H2e2BupPTyBH+AZD00LqmA6jDmdg==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex c2f45cd0..a74da53b 100644
---- a/package.json
++++ b/package.json
@@@ -24,7 +24,7 @@
      "iovalkey": "^0.4.0",
      "jsonwebtoken": "^9.0.0",
      "multer": "^1.4.5-lts.1",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.222.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.223.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.67.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.19.0",
      "pg": "^8.23.0",
ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 032076bf..cf7ec224 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -413,6 +413,10 @@ const DEFAULT_GRANTS = [
      // AI on your own machines (contracts 0.219.0): a person's own model, on their own machine through its OpenVibe Node,
      // for that person's runs only (Bot checks the owner and their switch, "Let my AI use this computer's models").
      ['ai', 'bot.machine.ai', 'openvibe.bot', []],          // ai.run.* (AI server/events.js, 2026-09-24)
++    // Run sessions (contracts 0.223.0, the Desks plan's D6): Run leases one desk per session on OpenVibe.Bot, acting for
++    // the session's person; OpenVibe.Actor opens, uses and ends a browser session on Run for the person it works for.
++    ['run', 'bot.desk.session', 'openvibe.bot', []],
++    ...['run.session.create', 'run.session.read', 'run.session.control'].map((c) => ['actor', c, 'openvibe.run', []]),
      // Wave 13: Live's AI features run as OpenVibe.AI workflows (AI_SERVICE=remote in live.env).
      // Live runs its own live.* workflows, network.site_copy as the footer-copy fallback, and media.analyze
      // (local-first VOD/clip analysis, roadmap WS-O task 5) (OpenVibe.AI fails closed on a token with no ns).
ddiff --git a/test/run-session-grants.test.js b/test/run-session-grants.test.js
nnew file mode 100644
iindex 00000000..7178f70c
---- /dev/null
++++ b/test/run-session-grants.test.js
@@@ -0,0 +1,19 @@
++/**
++ * Run sessions' grants (contracts 0.223.0, the Desks plan's D6): OpenVibe.Run holds bot.desk.session on OpenVibe.Bot (a
++ * desk leased per session, for its person) and nothing else of Bot's computer control; OpenVibe.Actor holds the three
++ * session capabilities on Run, to work in a browser session for the person it acts for.
++ *
++ *   node test/run-session-grants.test.js
++ */
++'use strict';
++const assert = require('assert');
++const contracts = require('openvibe-contracts');
++const principals = require('../server/identity/principals');
++
++const of = (svc, aud) => principals.DEFAULT_GRANTS.filter((g) => g[0] === svc && g[2] === aud).map((g) => g[1]).sort();
++assert.deepStrictEqual(of('run', 'openvibe.bot'), ['bot.desk.session', 'bot.job.dispatch'], 'run dispatches jobs and leases desks on Bot, and holds no computer control there');
++assert.deepStrictEqual(of('actor', 'openvibe.run'), ['run.session.control', 'run.session.create', 'run.session.read'], 'actor uses Run sessions');
++const ids = ['bot.desk.session', 'run.session.create', 'run.session.read', 'run.session.control'];
++const missing = ids.filter((id) => { const cap = contracts.capabilities.get(id); return !(cap && cap.status === 'active'); });
++assert.deepStrictEqual(missing, [], 'every one is an active capability in the pinned contracts');
++console.log('run session grants: ok');