openvibers/openvibe.reviews Commits

Pin openvibe-contracts v0.96.0 and drop the proposed-capability fallback (#10)

OP OpenVibers committed 5 Oct 2026 · 440a865e52 · 8 files, +57 −507

* Pin openvibe-contracts v0.96.0 and drop the proposed-capability fallback

## Files changed

- **server/auth/capabilities.js** — All eight `reviews.*` ids are now defined by openvibe-contracts v0.96.0, so the local "proposed id" fallback (`PROPOSED` + the `capabilities.grants` branch) was unreachable dead code. `checkCapability` now delegates straight to `capabilities.check`; `CAPS` is kept as the one shared id list.
- **test/capabilities.test.js** (new) — Pins the new behaviour: every guarded id is defined by the installed contracts and by the `reviews` service manifest, and `checkCapability` agrees with `capabilities.check` for an exact grant, a `reviews.*` prefix grant, a sibling/no grant (`capability.denied`), and an undefined id (`capability.unknown`, proving it delegates rather than deciding locally).
- **STATUS.json** — `contracts` v0.76.0 → v0.96.0, and `updated` 2026-09-28 → 2026-10-04.
- **README.md** — contracts v0.76.0 → v0.96.0 (packages line, acceptance item 5); rewrote the "released in openvibe-contracts v0.20.0 … `capabilities.js` decides them" sentence to name the pinned release and the library grant rule; corrected the stale openvibe-publishing v1.2.0 → v1.3.0 on the same packages line and in the structured-data gate sentence (package.json already pins 1.3.0).
- **CHANGELOG.md** — Unreleased entry for the contracts v0.76.0 → v0.96.0 move and the guard simplification.

`package.json` and `package-lock.json` were left exactly as the harness set them (v0.96.0); I did not touch either.

## Tests run

- `ov test --all` → **21 passed in 107 s** (first run, under load 20/8 CPUs, had `indexnow` time out at 60 s and `corrections`/`delegation` flake; all three passed alone and in the two clean full runs — load flakiness, not a contracts break).
- `node node_modules/openvibe-contracts/bin/check-service.js --service reviews --src server` → **ok**: contracts 0.96.0, 8 capabilities enforced, 0 contract ids validated.
- `node test/capabilities.test.js` → 2 ok.
- `grep -n contracts package.json STATUS.json` → both show **v0.96.0**.

## Not done, and why

- **No code schemas/validators needed changing** — the 0.76→0.96 changelog is additive for Reviews, the service check is green, and nothing validated a contract id that changed. The only fallout was the now-obsolete proposal shim and stale version text.
- **docs/threat-review.md still names openvibe-contracts v0.20.0** (plus other old package versions). That line records the versions the security review was written against — point-in-time provenance — so I left it rather than misstate the audit's basis.
- **docs/service-manifest-proposal.json lacks `reviews.moderation.action`**, which the released contracts `reviews` manifest lists in `eventsProduced`. This repo emits no moderation events, so adding it would declare something the code never produces; it is a contracts-side declaration I did not act on.

* Stop tracking the node_modules link and ignore it as a link too

Changes

ddiff --git a/.gitignore b/.gitignore
iindex bc8c8bd..3ffb3ba 100644
---- a/.gitignore
++++ b/.gitignore
@@@ -6,3 +6,4 @@ data/
  *.log
  *.pem
  *.key
++node_modules
ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 6434faa..f520e27 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -2,4 +2,5 @@
  
  ## Unreleased
  
++- openvibe-contracts moves from v0.76.0 to v0.96.0 (pin, lockfile and `node_modules`); nothing in the range breaks Reviews, and the contracts' own service check is green. All eight `reviews.*` ids are now defined by the release, so `server/auth/capabilities.js` drops its local fallback for proposed ids and sends every check through the library's grant rule; `test/capabilities.test.js` pins that every guarded id is defined and that exact, prefix, denied and unknown ids answer as `capabilities.check()` does. README and STATUS.json name v0.96.0.
  - Every page is rendered through `openvibe-publishing/layout` (v1.2.0, on `openvibe-shared/shell` v2.6.0): the head, the Frame, the noscript navigation, the footer and its init come from the shared document; robots is still exactly what each route passes (the entity page now passes the indexability gate's decision instead of a prebuilt head block). The shell adds `web-runtime.js`, so the home page's JS budget is raised to 257 KB, 61.5 KB brotli (measured 239.1 / 56.3, was 212.2 / 49.9).
ddiff --git a/README.md b/README.md
iindex dda2874..cb6631c 100644
---- a/README.md
++++ b/README.md
@@@ -115,7 +115,7 @@ Old slugs 301, merged entities 301, deleted ones 410.
  `AggregateRating`, and a `Review` for a summary, are emitted **only when the aggregate exists** (i.e.
  real signals back it); without signals the page carries breadcrumbs only (tested). A recommendation
  share is expressed as `ratingValue` 0–100 with `bestRating: 100` and the real count; a summary's
--`Review` never has a `reviewRating`. The openvibe-publishing v1.2.0 gate decides robots per entity
++`Review` never has a `reviewRating`. The openvibe-publishing v1.3.0 gate decides robots per entity
  (no live signal → `unsourced`, summary under the word minimum → `thin`, unsupported points →
  `unsupported_claims`, unreviewed AI → hidden); sitemaps list indexable entities only, Atom/JSON feeds
  list published summaries, `robots.txt` and `llms.txt` are served, and Search receives
@@@ -156,8 +156,8 @@ A write carried by the `ov_token` cookie that another site started is 403 `reque
  | `reviews.summary.publish` | `POST /entities/:ref/summary/revisions` (`correction_note`, `correction_id`: a correction, published at once), `…/revisions/:n/review`, `…/summary/publish`, `…/summary/unpublish` |
  | `reviews.correction.submit` | `POST /entities/:ref/corrections` |
  
--The ids and the service manifest are released in openvibe-contracts v0.20.0 (from the proposals in
--[docs/capabilities-proposal/](docs/capabilities-proposal/) and
++The ids and the service manifest are released in openvibe-contracts (pinned at v0.96.0; the source
++proposals stay in [docs/capabilities-proposal/](docs/capabilities-proposal/) and
  [docs/service-manifest-proposal.json](docs/service-manifest-proposal.json)); `server/auth/capabilities.js`
  decides them with the contracts grant rule. `reviews.entity.manage` and
  `reviews.summary.propose` are additions to the §15.13 minimum list.
@@@ -228,7 +228,7 @@ by editors; signals arrive only from Sources.
  - OpenVibe.AI — optional, proposes summaries through `reviews.summary.propose`
  - OpenVibe.Search — consumes the index events
  - PostgreSQL 18 and Valkey 9 (OpenVibe.Host `roles/data/`, ADR-035): every read and write is async through `openvibe-sdk/db`; Valkey holds the per-actor limit counters (optional)
--- packages: openvibe-publishing v1.2.0, openvibe-contracts v0.76.0, openvibe-shared v2.6.0, openvibe-sdk v0.26.0
++- packages: openvibe-publishing v1.3.0, openvibe-contracts v0.96.0, openvibe-shared v2.6.0, openvibe-sdk v0.26.0
  
  ## Capabilities
  
@@@ -306,7 +306,7 @@ following hold (plan §12.12):
  2. canonical identity/auth integration (Network subjects, a scoped service principal) — **built** and provisioned in production;
  3. server-rendered public routes useful without JavaScript — **built**;
  4. real persistence and end-to-end workflows — **built** and deployed on the host (loopback only, empty database); no Sources review source is enabled yet;
--5. capability and event registration against OpenVibe.Contracts — **done** (openvibe-contracts v0.20.0);
++5. capability and event registration against OpenVibe.Contracts — **done** (openvibe-contracts v0.96.0);
  6. a migration/seed strategy (schema migrations in [migrations/](migrations/); nothing seeded), a security/threat review, sitemap/robots/feed behaviour — discovery **built**; threat review **written**: [docs/threat-review.md](docs/threat-review.md) (the service authors' own, from the code: controls with file:line references, the gaps fixed in that pass and the ones that remain; an independent review is still to come);
  7. acceptance tests proving the advertised functionality — **built** (`npm test`).
  
ddiff --git a/STATUS.json b/STATUS.json
iindex 73e08d4..3aea36b 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -7,7 +7,7 @@
    "runtime": "node 22, express, postgresql",
    "port": 4830,
    "domain": "openvibe.reviews",
--  "contracts": "openvibe-contracts v0.76.0",
++  "contracts": "openvibe-contracts v0.96.0",
    "packages": [
      "openvibe-publishing v1.3.0",
      "openvibe-shared v2.6.0",
@@@ -29,7 +29,7 @@
    "onOpenVibeSites": true,
    "seed": "none: no entities, signals, summaries or ratings are seeded",
    "dataSource": "OpenVibe.Sources category reviews; no review source is enabled there yet (all 6 Sources seeds are disabled)",
--  "updated": "2026-09-28",
++  "updated": "2026-10-04",
    "features": [
      "signals from OpenVibe.Sources by cursor pull and signed webhook, with provenance",
      "deterministic entity resolution; a name alone never resolves",
ddiff --git a/package-lock.json b/package-lock.json
iindex d4acc0d..5b22d44 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -14,7 +14,7 @@
          "express": "^4.21.2",
          "express-rate-limit": "^7.5.0",
          "iovalkey": "^0.4.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.96.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.3.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.6.0",
@@@ -92,65 +92,6 @@
        "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
        "license": "MIT"
      },
--    "node_modules/base64-js": {
--      "version": "1.5.1",
--      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
--      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
--    "node_modules/better-sqlite3": {
--      "version": "11.10.0",
--      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-11.10.0.tgz",
--      "integrity": "sha512-EwhOpyXiOEL/lKzHz9AW1msWFNzGc/z+LzeB3/jnFJpxu+th2yqvzsSWas1v9jgs9+xiXJcD5A8CJxAG2TaghQ==",
--      "hasInstallScript": true,
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "bindings": "^1.5.0",
--        "prebuild-install": "^7.1.1"
--      }
--    },
--    "node_modules/bindings": {
--      "version": "1.5.0",
--      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
--      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "file-uri-to-path": "1.0.0"
--      }
--    },
--    "node_modules/bl": {
--      "version": "4.1.0",
--      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
--      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "buffer": "^5.5.0",
--        "inherits": "^2.0.4",
--        "readable-stream": "^3.4.0"
--      }
--    },
      "node_modules/body-parser": {
        "version": "1.20.8",
        "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.8.tgz",
@@@ -175,32 +116,6 @@
          "npm": "1.2.8000 || >= 1.4.16"
        }
      },
--    "node_modules/buffer": {
--      "version": "5.7.1",
--      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
--      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "base64-js": "^1.3.1",
--        "ieee754": "^1.1.13"
--      }
--    },
      "node_modules/buffer-equal-constant-time": {
        "version": "1.0.1",
        "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
@@@ -245,14 +160,6 @@
          "url": "https://github.com/sponsors/ljharb"
        }
      },
--    "node_modules/chownr": {
--      "version": "1.1.4",
--      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
--      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
--      "license": "ISC",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/cluster-key-slot": {
        "version": "1.1.2",
        "resolved": "https://registry.npmjs.org/cluster-key-slot/-/cluster-key-slot-1.1.2.tgz",
@@@ -320,34 +227,6 @@
          "ms": "2.0.0"
        }
      },
--    "node_modules/decompress-response": {
--      "version": "6.0.0",
--      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
--      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "mimic-response": "^3.1.0"
--      },
--      "engines": {
--        "node": ">=10"
--      },
--      "funding": {
--        "url": "https://github.com/sponsors/sindresorhus"
--      }
--    },
--    "node_modules/deep-extend": {
--      "version": "0.6.0",
--      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
--      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=4.0.0"
--      }
--    },
      "node_modules/denque": {
        "version": "2.1.0",
        "resolved": "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz",
@@@ -376,17 +255,6 @@
          "npm": "1.2.8000 || >= 1.4.16"
        }
      },
--    "node_modules/detect-libc": {
--      "version": "2.1.2",
--      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
--      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
--      "license": "Apache-2.0",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=8"
--      }
--    },
      "node_modules/dotenv": {
        "version": "16.6.1",
        "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
@@@ -437,17 +305,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/end-of-stream": {
--      "version": "1.4.5",
--      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
--      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "once": "^1.4.0"
--      }
--    },
      "node_modules/es-define-property": {
        "version": "1.0.1",
        "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
@@@ -493,17 +350,6 @@
          "node": ">= 0.6"
        }
      },
--    "node_modules/expand-template": {
--      "version": "2.0.3",
--      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
--      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
--      "license": "(MIT OR WTFPL)",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=6"
--      }
--    },
      "node_modules/express": {
        "version": "4.22.3",
        "resolved": "https://registry.npmjs.org/express/-/express-4.22.3.tgz",
@@@ -587,14 +433,6 @@
        ],
        "license": "BSD-3-Clause"
      },
--    "node_modules/file-uri-to-path": {
--      "version": "1.0.0",
--      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
--      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/finalhandler": {
        "version": "1.3.2",
        "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
@@@ -631,14 +469,6 @@
          "node": ">= 0.6"
        }
      },
--    "node_modules/fs-constants": {
--      "version": "1.0.0",
--      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
--      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/function-bind": {
        "version": "1.1.2",
        "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
@@@ -685,14 +515,6 @@
          "node": ">= 0.4"
        }
      },
--    "node_modules/github-from-package": {
--      "version": "0.0.0",
--      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
--      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/gopd": {
        "version": "1.2.0",
        "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@@ -761,42 +583,12 @@
          "node": ">=0.10.0"
        }
      },
--    "node_modules/ieee754": {
--      "version": "1.2.1",
--      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
--      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "BSD-3-Clause",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/inherits": {
        "version": "2.0.4",
        "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
        "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
        "license": "ISC"
      },
--    "node_modules/ini": {
--      "version": "1.3.8",
--      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
--      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
--      "license": "ISC",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/iovalkey": {
        "version": "0.4.0",
        "resolved": "https://registry.npmjs.org/iovalkey/-/iovalkey-0.4.0.tgz",
@@@ -1027,53 +819,12 @@
          "node": ">= 0.6"
        }
      },
--    "node_modules/mimic-response": {
--      "version": "3.1.0",
--      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
--      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=10"
--      },
--      "funding": {
--        "url": "https://github.com/sponsors/sindresorhus"
--      }
--    },
--    "node_modules/minimist": {
--      "version": "1.2.8",
--      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
--      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "funding": {
--        "url": "https://github.com/sponsors/ljharb"
--      }
--    },
--    "node_modules/mkdirp-classic": {
--      "version": "0.5.3",
--      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
--      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/ms": {
        "version": "2.0.0",
        "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
        "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
        "license": "MIT"
      },
--    "node_modules/napi-build-utils": {
--      "version": "2.0.0",
--      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
--      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/negotiator": {
        "version": "0.6.3",
        "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
@@@ -1083,20 +834,6 @@
          "node": ">= 0.6"
        }
      },
--    "node_modules/node-abi": {
--      "version": "3.96.0",
--      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.96.0.tgz",
--      "integrity": "sha512-rebQ/lz7i0EkoLzUVSrKRzA69zMkwLp95kKMWoMDkkM00Suxz0D7zEQPwRml5fQum24mj7bPvmlgLAmu2JCiYg==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "semver": "^7.3.5"
--      },
--      "engines": {
--        "node": ">=10"
--      }
--    },
      "node_modules/object-inspect": {
        "version": "1.13.4",
        "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
@@@ -1121,21 +858,10 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/once": {
--      "version": "1.4.0",
--      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
--      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
--      "license": "ISC",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "wrappy": "1"
--      }
--    },
      "node_modules/openvibe-contracts": {
--      "version": "0.76.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
--      "integrity": "sha512-zTdx776KWrcJKm1JTnf+0+BnsvswdvXy1ldPyse1hSqhnW/SSr98sX696eRetFUhTl8qVM1xSRCykqIUbqItPw==",
++      "version": "0.96.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.96.0",
++      "integrity": "sha512-QEXfNYNkK6n49sXokgbP2FTKaIEawRJOS7Xij9g20fBFSqiVv14voZ60LqECPl1VMZedoSGuYLa8doVlnSxH0w==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
@@@ -1350,35 +1076,6 @@
          "node": ">=0.10.0"
        }
      },
--    "node_modules/prebuild-install": {
--      "version": "7.1.3",
--      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
--      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
--      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "detect-libc": "^2.0.0",
--        "expand-template": "^2.0.3",
--        "github-from-package": "0.0.0",
--        "minimist": "^1.2.3",
--        "mkdirp-classic": "^0.5.3",
--        "napi-build-utils": "^2.0.0",
--        "node-abi": "^3.3.0",
--        "pump": "^3.0.0",
--        "rc": "^1.2.7",
--        "simple-get": "^4.0.0",
--        "tar-fs": "^2.0.0",
--        "tunnel-agent": "^0.6.0"
--      },
--      "bin": {
--        "prebuild-install": "bin.js"
--      },
--      "engines": {
--        "node": ">=10"
--      }
--    },
      "node_modules/proxy-addr": {
        "version": "2.0.8",
        "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
@@@ -1396,18 +1093,6 @@
          "url": "https://opencollective.com/express"
        }
      },
--    "node_modules/pump": {
--      "version": "3.0.4",
--      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
--      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "end-of-stream": "^1.1.0",
--        "once": "^1.3.1"
--      }
--    },
      "node_modules/qs": {
        "version": "6.16.0",
        "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
@@@ -1448,39 +1133,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/rc": {
--      "version": "1.2.8",
--      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
--      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
--      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "deep-extend": "^0.6.0",
--        "ini": "~1.3.0",
--        "minimist": "^1.2.0",
--        "strip-json-comments": "~2.0.1"
--      },
--      "bin": {
--        "rc": "cli.js"
--      }
--    },
--    "node_modules/readable-stream": {
--      "version": "3.6.2",
--      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
--      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "inherits": "^2.0.3",
--        "string_decoder": "^1.1.1",
--        "util-deprecate": "^1.0.1"
--      },
--      "engines": {
--        "node": ">= 6"
--      }
--    },
      "node_modules/redis-errors": {
        "version": "1.2.0",
        "resolved": "https://registry.npmjs.org/redis-errors/-/redis-errors-1.2.0.tgz",
@@@ -1672,55 +1324,6 @@
          "url": "https://github.com/sponsors/ljharb"
        }
      },
--    "node_modules/simple-concat": {
--      "version": "1.0.1",
--      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
--      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
--    "node_modules/simple-get": {
--      "version": "4.0.1",
--      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
--      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
--      "funding": [
--        {
--          "type": "github",
--          "url": "https://github.com/sponsors/feross"
--        },
--        {
--          "type": "patreon",
--          "url": "https://www.patreon.com/feross"
--        },
--        {
--          "type": "consulting",
--          "url": "https://feross.org/support"
--        }
--      ],
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "decompress-response": "^6.0.0",
--        "once": "^1.3.1",
--        "simple-concat": "^1.0.0"
--      }
--    },
      "node_modules/split2": {
        "version": "4.2.0",
        "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
@@@ -1745,60 +1348,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/string_decoder": {
--      "version": "1.3.0",
--      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
--      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "safe-buffer": "~5.2.0"
--      }
--    },
--    "node_modules/strip-json-comments": {
--      "version": "2.0.1",
--      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
--      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "engines": {
--        "node": ">=0.10.0"
--      }
--    },
--    "node_modules/tar-fs": {
--      "version": "2.1.5",
--      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.5.tgz",
--      "integrity": "sha512-OboTd8mmMhZDNPV+UjQcK9yKAatXu2aJ+r1w4im1Otd4M4fl2hwvdoXUxIYHFTHWK/3y3FarBP70v3vwmGlOxw==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "chownr": "^1.1.1",
--        "mkdirp-classic": "^0.5.2",
--        "pump": "^3.0.0",
--        "tar-stream": "^2.1.4"
--      }
--    },
--    "node_modules/tar-stream": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
--      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "bl": "^4.0.3",
--        "end-of-stream": "^1.4.1",
--        "fs-constants": "^1.0.0",
--        "inherits": "^2.0.3",
--        "readable-stream": "^3.1.1"
--      },
--      "engines": {
--        "node": ">=6"
--      }
--    },
      "node_modules/toidentifier": {
        "version": "1.0.1",
        "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
@@@ -1808,20 +1357,6 @@
          "node": ">=0.6"
        }
      },
--    "node_modules/tunnel-agent": {
--      "version": "0.6.0",
--      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
--      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
--      "license": "Apache-2.0",
--      "optional": true,
--      "peer": true,
--      "dependencies": {
--        "safe-buffer": "^5.0.1"
--      },
--      "engines": {
--        "node": "*"
--      }
--    },
      "node_modules/type-is": {
        "version": "1.6.18",
        "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
@@@ -1844,14 +1379,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/util-deprecate": {
--      "version": "1.0.2",
--      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
--      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
--      "license": "MIT",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/utils-merge": {
        "version": "1.0.1",
        "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
@@@ -1870,14 +1397,6 @@
          "node": ">= 0.8"
        }
      },
--    "node_modules/wrappy": {
--      "version": "1.0.2",
--      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
--      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
--      "license": "ISC",
--      "optional": true,
--      "peer": true
--    },
      "node_modules/xtend": {
        "version": "4.0.2",
        "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
ddiff --git a/package.json b/package.json
iindex 9f41a27..7e1ae89 100644
---- a/package.json
++++ b/package.json
@@@ -24,7 +24,7 @@
      "express": "^4.21.2",
      "express-rate-limit": "^7.5.0",
      "iovalkey": "^0.4.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.96.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.3.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.6.0",
ddiff --git a/server/auth/capabilities.js b/server/auth/capabilities.js
iindex 97d0361..7a15804 100644
---- a/server/auth/capabilities.js
++++ b/server/auth/capabilities.js
@@@ -1,12 +1,9 @@
  'use strict';
  /**
-- * Capability checks for service tokens, including the reviews.* ids this service introduces before
-- * the contracts library knows them (proposed in docs/capabilities-proposal/).
-- *
-- * openvibe-contracts' capabilities.check() answers capability.unknown for an id that is not in its
-- * manifests yet. Until a release defines them, a grant of a proposed id is decided locally with the
-- * library's own matching rule (the exact id, or a `prefix.*` grant covering it). An id the library
-- * knows always goes through the library, so the day the release lands nothing changes here.
++ * Capability checks for service tokens. The reviews.* ids this service introduces are defined by the
++ * installed openvibe-contracts, so a grant is decided by the library's own matching rule (the exact
++ * id, or a `prefix.*` grant covering it). CAPS keeps the ids in one place for the guards, the
++ * proposal documents and the tests.
   */
  const { capabilities } = require('openvibe-contracts');
  
@@@ -20,16 +17,10 @@ const CAPS = Object.freeze({
      SUMMARY_PUBLISH: 'reviews.summary.publish',
      CORRECTION_SUBMIT: 'reviews.correction.submit',
  });
--const PROPOSED = new Set(Object.values(CAPS));
  
  /** → { allowed, code, reason } like capabilities.check(). */
  function checkCapability(claims, capabilityId) {
--    if (!capabilities.get(capabilityId) && PROPOSED.has(capabilityId)) {
--        return capabilities.grants(claims && claims.cap, capabilityId)
--            ? { allowed: true, code: null, reason: null }
--            : { allowed: false, code: 'capability.denied', reason: `${capabilityId} not granted` };
--    }
      return capabilities.check(claims, capabilityId);
  }
  
--module.exports = { checkCapability, CAPS, PROPOSED };
++module.exports = { checkCapability, CAPS };
ddiff --git a/test/capabilities.test.js b/test/capabilities.test.js
nnew file mode 100644
iindex 0000000..b4915bd
---- /dev/null
++++ b/test/capabilities.test.js
@@@ -0,0 +1,38 @@
++'use strict';
++/**
++ * The reviews.* capabilities are released by openvibe-contracts, so the service guards delegate to
++ * the library's grant rule rather than deciding a proposed id locally (the fallback that existed
++ * while the ids were only proposals). These pin that: every guarded id is defined by the installed
++ * contracts and by the reviews service manifest, and checkCapability agrees with capabilities.check
++ * for an exact grant, a prefix grant, no grant, and an id the contracts do not define.
++ */
++const assert = require('assert');
++const { capabilities, services } = require('openvibe-contracts');
++const { checkCapability, CAPS } = require('../server/auth/capabilities');
++const { suite } = require('./helpers');
++
++const t = suite('capabilities');
++const GRANTED = { cap: ['reviews.signal.import'], sub: 'svc:sources' };
++
++t('every guarded capability is defined by the installed contracts and the reviews manifest', () => {
++    const manifest = services.get('reviews');
++    assert.ok(manifest, 'openvibe-contracts defines the reviews service manifest');
++    assert.deepStrictEqual([...manifest.capabilities].sort(), Object.values(CAPS).sort());
++    for (const id of Object.values(CAPS)) {
++        const cap = capabilities.get(id);
++        assert.ok(cap, `${id} is defined by openvibe-contracts`);
++        assert.strictEqual(cap.owner, 'reviews', `${id} is owned by reviews`);
++    }
++});
++
++t('checkCapability follows the contracts grant rule (exact, prefix, denied, unknown)', () => {
++    // An exact grant and a `prefix.*` grant the library's matching rule accepts.
++    assert.deepStrictEqual(checkCapability(GRANTED, 'reviews.signal.import'), { allowed: true, code: null, reason: null });
++    assert.deepStrictEqual(checkCapability({ cap: ['reviews.*'] }, 'reviews.signal.import'), { allowed: true, code: null, reason: null });
++    // A grant of a sibling capability, or no cap at all, is denied with the library's code.
++    assert.strictEqual(checkCapability({ cap: ['reviews.entity.resolve'] }, 'reviews.signal.import').code, 'capability.denied');
++    assert.strictEqual(checkCapability(null, 'reviews.signal.import').code, 'capability.denied');
++    // An id the contracts do not define still answers capability.unknown — the guard delegates,
++    // it never decides an unknown id on its own.
++    assert.strictEqual(checkCapability({ cap: ['reviews.*'] }, 'reviews.not.a.capability').code, 'capability.unknown');
++});