Bench may publish its events (the missing events.event.publish grant) (#516)

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 3ad51768..3bc7af7d 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -669,6 +669,10 @@ const DEFAULT_GRANTS = [
      // other services' above. It publishes bench.* events and answers no other service today, so no Search grant.
      ['bench', 'ai.run.create', 'openvibe.ai', ['ai.generate']],
      ['bench', 'events.subscription.manage', 'openvibe.events', []],
++    // Bench's outbox publishes bench.round.finished, bench.judgement.recorded and bench.rating.changed (contracts
++    // events/payloads). The publish grant was missing, so every event failed at the token endpoint ("not granted:
++    // events.event.publish") and was retried for good: about 430 refused token requests an hour (found 2026-11-02).
++    ['bench', 'events.event.publish', 'openvibe.events', []],
      // Bench's model watch (Bench B10): when a followed score moves beyond its interval, or a model overtakes the one
      // someone follows, Bench pushes that person one notification through Network as app 'bench' (Bench's
      // server/watch/watch.js resolves the watch's user id, then pushes with openvibe-sdk/notifications). Its own name
ddiff --git a/test/bench-notify-grants.test.js b/test/bench-notify-grants.test.js
iindex 5ab06397..5676e17d 100644
---- a/test/bench-notify-grants.test.js
++++ b/test/bench-notify-grants.test.js
@@@ -22,4 +22,7 @@ for (const g of rows) {
      assert.ok(cap && cap.status === 'active', `${g[1]} is an active capability`);
  }
  
++// Bench's outbox publishes its bench.* events (2026-11-02): without this grant every event failed at the token endpoint
++// ("not granted: events.event.publish") and was retried for good.
++assert.ok(principals.DEFAULT_GRANTS.some((g) => g[0] === 'bench' && g[1] === 'events.event.publish' && g[2] === 'openvibe.events'), 'bench may publish its events');
  console.log(`bench notify grants: ${rows.length}`);
ddiff --git a/test/principals.test.js b/test/principals.test.js
iindex 872ef400..2b7576b2 100644
---- a/test/principals.test.js
++++ b/test/principals.test.js
@@@ -199,7 +199,7 @@ const server = http.createServer(app);
      t = await token({ client_id: 'bench', client_secret: 'bench-secret', audience: 'openvibe.network' });
      assert.deepStrictEqual(t.body.scope.split(' '), ['network.account.deletion.confirm', 'network.account.export.contribute', 'network.notifications.push'], 'Bench answers account export and deletion, and pushes its watch notices');
      t = await token({ client_id: 'bench', client_secret: 'bench-secret', audience: 'openvibe.events' });
--    assert.strictEqual(t.body.scope, 'events.subscription.manage', 'Bench subscribes to the account events at boot');
++    assert.deepStrictEqual(t.body.scope.split(' ').sort(), ['events.event.publish', 'events.subscription.manage'], 'Bench subscribes to the account events at boot, and publishes its own bench.* events (2026-11-02)');
      t = await token({ client_id: 'bench', client_secret: 'bench-secret', audience: 'openvibe.ai' });
      assert.strictEqual(t.status, 200, JSON.stringify(t.body));
      const benchAiClaims = serviceAuth.verifyServiceToken(t.body.access_token, { publicKey: keys.publicKey, issuer: ISSUER, audience: 'openvibe.ai' });