@passioncode-ai/fabric-agent-adapter 0.11.1 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.12.0 - 2026-10-12
+
+The contract pin moves to Fabric Agent Contract `main` `2eb91c0` (the merge of contract PR #45: DEC-0041…DEC-0045).
+Bundles issued under the DEC-0039, DEC-0036, DEC-0035, DEC-0033, DEC-0031, DEC-0024, DEC-0021, DEC-0020 and DEC-0019
+revisions stay valid (FAA-24).
+
+### Changed
+
+- **Default contract pin `8e49fbd` → `2eb91c00e852d9c31d804310d38fad91589fcbac`.** `8e49fbd` (DEC-0039) joins
+  `SUPPORTED_CONTRACT_COMMITS`. The schemas between add only:
+  - `session-handoff/1` (DEC-0042);
+  - `degraded[].setup` on the well-known document and `run.mcp.stdio.scope` on the manifest and the provider entry
+    (DEC-0044);
+  - a tighter delegation token (DEC-0045).
+
+  The provider manifest and the MCP, A2A and local-runner profiles stay valid as written. The compiled-schema arms at
+  `2ce3922` and `2eb91c0` agree.
+- **The delegation verifiers follow DEC-0045** in both kits:
+  - The trusted `issuer` is required. Without it the answer is `issuer-unavailable` / `no-trusted-issuer`.
+  - Every published-key problem except an unknown `kid` is the issuer's, including `key-not-for-signing`. A
+    small-order key is refused as `issuer-unavailable` / `small-order-key` before any verification; 0.11.1 answered
+    `bad-signature`.
+  - DL-2's types are checked strictly: URIs, `AGENT_ID` actors, session and task ids, the `scope` and `jti`
+    grammar, exactly one grant, effects named once, the `spend` shape, and `nbf` checked with the types.
+    `approval.method: device` is removed.
+  - A signed token with no `act` is refused as `malformed-chain`. The contract's own verifier throws on it, and the
+    contract was told.
+- **Breaking for a caller of the gate:** `delegation_gate` / `delegationGate` require `issuer`, and
+  `verify_delegation` / `verify_approval` take it as a required argument.
+
+### Added
+
+- **Trust tiers (DL-25, DL-26):** `gate(tool, headers, tier="T2")` and `McpToolServer.handle(..., tier=)`. A T0 or T1
+  caller is never required to present a token; a present one is verified at every tier.
+- **`refusal_from_denial` / `refusalFromDenial`:** the callee's answer after the meter denies a grant check (DL-21
+  step 6).
+- **The contract's canonical vectors** (DEC-0043) run against both `jcs` ports from `test/fixtures/contract/canonical.json`.
+- **`fabric_provider.py` accepts `run.mcp.stdio.scope`** (`project` or `on-demand`) and refuses `session`
+  (FAC-SEM-056, LC-19). The writer does not set it until Fabric reads it.
+- `degraded[].setup` (DEC-0044) is documented in `references/protocol.md`. The kits pass entries through unchanged.
+- Scenario evals came first: `local-caller-needs-no-token` and `stdio-provider-scope`.
+
 ## 0.11.1 - 2026-10-12
 
 0.11.0 plus one fix. The `v0.11.0` tag was refused by the release's own validation and never published: on Node 22,

package/README.md

@@ -202,7 +202,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`
+- commit: `2eb91c00e852d9c31d804310d38fad91589fcbac`
 
 Every other mention of the default contract revision — this section, the skills' metadata, the
 skill card, `adapt_project.py` — must equal it; `python3 test/validate.py` fails a tree
@@ -229,8 +229,8 @@ FABRIC_CONTRACT_OLD=/path/to/legacy-contract FABRIC_CONTRACT_NEW=/path/to/curren
 ```
 
 Without both environment variables, those tests explicitly skip as `NOT_RUN`.
-This source checkout is 0.11.1. 0.10.0 is the latest published GitHub/npm release (2026-10-11; 0.7.0 and 0.11.0
-were never released); 0.11.1 is published by its `v0.11.1` tag. Source delivery does not update installed skills or live sessions.
+This source checkout is 0.12.0. 0.11.1 is the latest published GitHub/npm release (2026-10-12; 0.7.0 and 0.11.0
+were never released); 0.12.0 is published by its `v0.12.0` tag. Source delivery does not update installed skills or live sessions.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.11.1"
+  version: "0.12.0"
   contract-version: "0.1.0"
-  contract-commit: "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
+  contract-commit: "2eb91c00e852d9c31d804310d38fad91589fcbac"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`.
+- commit `2eb91c00e852d9c31d804310d38fad91589fcbac`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/provider-entry.md

@@ -32,7 +32,10 @@ python3 scripts/fabric_provider.py validate ~/Library/Application\ Support/ai.pa
 python3 scripts/fabric_provider.py remove example-agent      # the uninstaller
 ```
 
-`--stdio` takes the rest of the line as the argument array; there is no shell string.
+`--stdio` takes the rest of the line as the argument array; there is no shell string. An entry may carry
+`run.mcp.stdio.scope` (DEC-0044): `project` (started for the sessions of a project that binds it) or `on-demand`;
+`session` — a server in every coding session — is refused (FAC-SEM-056, LC-19). The validator accepts the field; the
+writer does not set it until Fabric reads it.
 
 It refuses, with one sentence that never quotes a value:
 

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -16,10 +16,10 @@ from urllib.parse import urlparse
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
+CONTRACT_COMMIT = "2eb91c00e852d9c31d804310d38fad91589fcbac"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_provider.py

@@ -116,8 +116,11 @@ def _run_problems(run: Any) -> List[str]:
         return [] if match and 1 <= int(match.group(1)) <= 65535 else ["run.mcp.url is http://127.0.0.1:<port>/mcp"]
     stdio = mcp["stdio"]
     problems: List[str] = []
-    if not isinstance(stdio, dict) or not set(stdio) <= {"command", "env"} or "command" not in stdio:
-        return ["run.mcp.stdio is {command, env?}"]
+    if not isinstance(stdio, dict) or not set(stdio) <= {"command", "env", "scope"} or "command" not in stdio:
+        return ["run.mcp.stdio is {command, env?, scope?}"]
+    # DEC-0044, LC-19: where a host starts the server. A server started in every session is refused (FAC-SEM-056).
+    if "scope" in stdio and stdio["scope"] not in ("project", "on-demand"):
+        problems.append("run.mcp.stdio.scope is project or on-demand; a stdio server started in every session is refused (FAC-SEM-056, LC-19)")
     command = stdio["command"]
     if not isinstance(command, list) or not 1 <= len(command) <= 32 or not all(isinstance(a, str) and a for a in command):
         problems.append("run.mcp.stdio.command is an argument array, never a shell string")

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.11.1"
+  version: "0.12.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
+  extension-commit: "2eb91c00e852d9c31d804310d38fad91589fcbac"
 ---
 
 # Building Fabric services

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -12,6 +12,7 @@ contract's own verifier does.
 
 - Declaring it
 - Wiring the gate
+- Who must present a token
 - Approvals
 - What a refusal looks like
 - Keys and the cache
@@ -29,7 +30,7 @@ the declaration (`auth.delegation-declared`) and that `/mcp` refuses the descrip
 ```python
 import fabric_delegation as fd, fabric_interop as fi
 keys = fd.JwksCache(well_known["auth"]["delegation"]["jwks"])          # https, loopback http, or a file
-gate = fd.delegation_gate(audience="example-agent", jwks=keys, issuer=well_known["auth"]["delegation"]["issuer"],
+gate = fd.delegation_gate(audience="example-agent", jwks=keys, issuer=well_known["auth"]["delegation"]["issuer"],  # required
                           effects={"example.write": "draft", "example.publish": "publish"})   # each tool's manifest effect
 server = fi.McpToolServer("example-agent", VERSION, authorize=gate)    # pass the request headers to handle()
 # in a handler: ctx.delegation["principal"], ["caller"], ["chain"] — record the chain with the work
@@ -43,6 +44,16 @@ const verdict = await gate(params.name, req.headers);
 if (!verdict.ok) return refusalToolResult(verdict);
 ```
 
+## Who must present a token
+
+DL-25 places each caller in a tier by its origin: **T0** a loopback caller under the owner's account that the
+service's own local floor (the descriptor token, the Host guard) has authenticated; **T1** an enrolled machine of
+the same owner; **T2** everyone else, and any call relayed onto loopback from off the machine (a tunnel, a proxy, the
+hub forwarding a T2 caller). DL-26: a T0 or T1 caller is never required to present a token — pass the tier,
+`gate(tool, headers, tier="T0")` or `server.handle(message, headers, tier="T0")`, and the call passes with no
+delegation. A token such a caller presents is still verified and refused when invalid. A T2 caller takes the whole
+profile. Money limits and human gates bind at every tier.
+
 The token is read from `Fabric-Delegation` first (a forwarded call; present but empty is refused, never skipped),
 then from `Authorization: Bearer` when the bearer is a delegation JWT (DL-9, DL-10). A tool with no declared
 effect is refused (`unknown-state`), never guessed. The checks run in the DL-13 order; nothing about a token is
@@ -57,7 +68,8 @@ An action with an external effect may need the operator's approval (DL-17, DL-18
 then the grant check where there is one, then `verify_approval` / `verifyApproval`, which consumes the approval's
 `jti` last, then the action. Without an approval, answer `approval-required` with
 `action_digest(action)` / `actionDigest(action)` — the SHA-256 of the action's RFC 8785 form (`jcs`) — so the caller
-can ask the hub. Keep consumed ids in `FileJtiStore` (0600, survives a restart); `MemoryJtiStore` is for tests
+can ask the hub. When the meter denies a grant check, answer `refusal_from_denial(denial)` /
+`refusalFromDenial(denial)`: the meter's code unchanged, its window and level in `error.data` (DL-21 step 6). Keep consumed ids in `FileJtiStore` (0600, survives a restart); `MemoryJtiStore` is for tests
 and `UNSAFE_NO_JTI_STORE` exists only by name. No store at all, or a store file that cannot be read, is
 `unknown-state` — never a pass.
 
@@ -67,7 +79,9 @@ DL-19: an MCP tool answers `refusal_tool_result(r)` / `refusalToolResult(r)` —
 `structuredContent: {error: {code, message, data: {detail}}}`; an HTTP route answers `refusal_http(r)` /
 `refusalHttp(r)` with the code's status (401 for `unauthenticated`, `token-expired`, `principal-unproven`, with
 `WWW-Authenticate: Bearer error="invalid_token"`; 503 for `issuer-unavailable` and `unknown-state`; 403 for the
-rest). `detail` is a short machine word; the token, the approval and the keys never appear in a result or a log.
+rest). A published key the service cannot use — of small order, for another use, or published twice — is the
+issuer's fault, `issuer-unavailable` (DEC-0045); a gate without a trusted issuer refuses everything as
+`no-trusted-issuer`. `detail` is a short machine word; the token, the approval and the keys never appear in a result or a log.
 
 ## Keys and the cache
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,9 +1,11 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`
+Pinned to `fabric-agent-contract` commit `2eb91c00e852d9c31d804310d38fad91589fcbac`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
-delegation and the operator session's lifetime DEC-0039). The contract's schemas are normative;
+delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
+canonical forms DEC-0043; `degraded[].setup` and `run.mcp.stdio.scope` DEC-0044; delegation sealed and trust tiers
+DEC-0045). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
@@ -56,6 +58,9 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
 ```
 
 - `status`: `starting | ready | degraded | stopping`. No answer means `down`.
+- A `degraded[]` entry may carry `setup: true` (DEC-0044): the source waits for a person to finish setting it up
+  (a key not entered, a model not chosen). It is not an outage, and a watcher does not alert on it. The kits pass
+  entries through unchanged.
 - `build` needs `commit` or `digest` (`sha256:<64 hex>`).
 - `summary`: at most six tiles; `attention: true` counts toward the host's badge.
 - `surfaces.events` is required; `dashboard` and `mcp` when the service has them; `usage`

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-delegation.mjs

@@ -57,6 +57,15 @@ export const REFUSAL_MESSAGES = Object.freeze({
 
 const refuse = (code, detail, data) => (data ? { ok: false, code, detail, data } : { ok: false, code, detail });
 const B64URL = /^[A-Za-z0-9_-]+$/;
+/** DL-2's grammar, as the contract's verifier types the claims (DEC-0045). */
+export const AGENT_ID = /^[a-z][a-z0-9-]{1,62}(\.[a-z][a-z0-9-]{0,31})?$/;
+export const OPAQUE_ID = /^[A-Za-z0-9._:-]{1,128}$/;
+const URI = /^[A-Za-z][A-Za-z0-9+.-]*:\S+$/;
+const JTI = /^[A-Za-z0-9._~-]{16,128}$/;
+const SCOPE = /^[a-z][a-z0-9._-]{1,127}( [a-z][a-z0-9._-]{1,127})*$/;
+const SPEND_WINDOWS = ['total', 'task', 'project', 'day', 'week', 'month'];
+const isUri = (value) => typeof value === 'string' && URI.test(value);
+const isAmount = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0;
 const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 const isString = (value) => typeof value === 'string' && value.length > 0;
 const isTime = (value) => typeof value === 'number' && Number.isInteger(value) && value >= 0;
@@ -125,8 +134,11 @@ function keyFor(jwks, kid) {
   // A key published for another use or algorithm is never a candidate (RFC 7517 §4.2, §4.4).
   if ((jwk.use !== undefined && jwk.use !== 'sig') || (jwk.alg !== undefined && jwk.alg !== 'EdDSA')) return { problem: 'key-not-for-signing' };
   if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519' || !isString(jwk.x) || jwk.d !== undefined) return { problem: 'unusable-key' };
+  const raw = Buffer.from(jwk.x, 'base64url');
+  if (raw.length !== 32) return { problem: 'unusable-key' };
+  if (isSmallOrderKey(raw)) return { problem: 'small-order-key' }; // before any verification (DEC-0045, CT-29)
   try {
-    return { key: crypto.createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: jwk.x }, format: 'jwk' }), raw: Buffer.from(jwk.x, 'base64url') };
+    return { key: crypto.createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: jwk.x }, format: 'jwk' }), raw };
   } catch {
     return { problem: 'unusable-key' };
   }
@@ -159,7 +171,8 @@ function authentic(token, jwks, typ) {
   if (header) return { problem: header };
   const kid = compact.header.kid;
   const found = keyFor(jwks, kid);
-  if ('problem' in found) return found.problem === 'unusable-key' || found.problem === 'duplicate-kid' ? { problem: found.problem, issuer: true } : { problem: found.problem };
+  // Only an unknown kid is the token's fault; a published key that cannot be used is the issuer's (DL-13 row 3).
+  if ('problem' in found) return found.problem === 'unknown-key' ? { problem: found.problem } : { problem: found.problem, issuer: true };
   if (compact.signature.length !== 64 || isSmallOrderKey(found.raw) || !crypto.verify(null, compact.signingInput, found.key, compact.signature)) return { problem: 'bad-signature' };
   return { compact, kid };
 }
@@ -193,19 +206,45 @@ export function effectClosure(ceiling) {
 
 export const effectWithin = (effect, ceiling) => effectClosure(ceiling).has(effect);
 
+/** The chain's depth when every actor is DL-2's (agent id `sub`, optional session id), else undefined. No `act`, no chain. */
+function actorChainDepth(act) {
+  if (act === undefined) return undefined;
+  let depth = 0;
+  for (let node = act; node !== undefined; node = node.act) {
+    if (!isObject(node) || typeof node.sub !== 'string' || !AGENT_ID.test(node.sub)) return undefined;
+    if (node.session !== undefined && !(typeof node.session === 'string' && OPAQUE_ID.test(node.session))) return undefined;
+    depth += 1;
+  }
+  return depth;
+}
+
+function spendShaped(spend) {
+  if (!isObject(spend)) return false;
+  if (spend.mode === 'unlimited') return true;
+  if (spend.mode !== 'limited' || !Array.isArray(spend.remaining) || spend.remaining.length === 0 || spend.remaining.length > 6) return false;
+  if (!spend.remaining.every((entry) => isObject(entry) && SPEND_WINDOWS.includes(entry.window) && isAmount(entry.remainingUsd))) return false;
+  return spend.perCallMaxUsd === undefined || isAmount(spend.perCallMaxUsd);
+}
+
+/** DL-13 row 5 as DEC-0045 types it: {claims, depth} or {problem}. A claim the profile does not know is ignored. */
 function delegationShape(payload) {
-  const { iss, sub, act, aud, scope, effect, grant, iat, exp, jti } = payload;
-  if (!isString(iss) || !isString(sub) || !isString(aud) || !isString(scope) || !isString(jti) || !isTime(iat) || !isTime(exp)) return undefined;
-  if (!Array.isArray(effect) || effect.length === 0 || !effect.every((e) => EFFECT_CLASSES.includes(e))) return undefined;
-  if (!Array.isArray(grant) || grant.length === 0 || !grant.every(isString)) return undefined;
-  if (!isObject(act)) return undefined;
-  return payload;
+  const { iss, sub, act, aud, scope, effect, grant, spend, project, task, iat, exp, nbf, jti } = payload;
+  const depth = actorChainDepth(act);
+  if (depth === undefined) return { problem: 'malformed-chain' };
+  const typed = isUri(iss) && isUri(sub) && typeof aud === 'string' && AGENT_ID.test(aud)
+    && typeof scope === 'string' && scope.length <= 4096 && SCOPE.test(scope)
+    && Array.isArray(effect) && effect.length > 0 && new Set(effect).size === effect.length && effect.every((e) => EFFECT_CLASSES.includes(e))
+    && Array.isArray(grant) && grant.length === 1 && typeof grant[0] === 'string' && grant[0].length >= 1 && grant[0].length <= 256
+    && (spend === undefined || spendShaped(spend)) && (project === undefined || isUri(project))
+    && (task === undefined || (typeof task === 'string' && OPAQUE_ID.test(task)))
+    && isTime(iat) && isTime(exp) && (nbf === undefined || isTime(nbf)) && typeof jti === 'string' && JTI.test(jti);
+  return typed ? { claims: payload, depth } : { problem: 'malformed-claims' };
 }
 
 function approvalShape(payload) {
   const { iss, actionDigest: digest, aud, approver, method, iat, exp, jti } = payload;
   if (!isString(iss) || !isString(digest) || !isString(aud) || !isString(approver) || !isString(jti) || !isTime(iat) || !isTime(exp)) return undefined;
-  if (method !== 'prompt' && method !== 'operator-channel' && method !== 'device') return undefined;
+  if (method !== 'prompt' && method !== 'operator-channel') return undefined; // DEC-0045: `device` is removed
   return payload;
 }
 
@@ -214,20 +253,20 @@ function approvalShape(payload) {
  * the epoch. Answers {ok: true, claims, principal, caller, chain, kid} or {ok: false, code, detail}.
  */
 export function verifyDelegation(token, { audience, jwks, now, capability, effect, issuer, readOnly } = {}) {
+  if (!isString(issuer)) return refuse('issuer-unavailable', 'no-trusted-issuer');
   if (!hasKeys(jwks)) return refuse('issuer-unavailable', 'no-published-keys');
   const checked = authentic(token, jwks, DELEGATION_TYP);
   if ('problem' in checked) return refuse(checked.issuer ? 'issuer-unavailable' : 'unauthenticated', checked.problem);
-  const claims = delegationShape(checked.compact.payload);
-  if (!claims) return refuse('unauthenticated', 'malformed-claims');
-  if (issuer !== undefined && claims.iss !== issuer) return refuse('unauthenticated', 'wrong-issuer');
+  const shaped = delegationShape(checked.compact.payload);
+  if ('problem' in shaped) return refuse('unauthenticated', shaped.problem);
+  const { claims, depth } = shaped;
+  if (claims.iss !== issuer) return refuse('unauthenticated', 'wrong-issuer');
   if (claims.exp <= claims.iat || claims.exp - claims.iat > MAX_DELEGATION_LIFETIME_SECONDS) return refuse('unauthenticated', 'lifetime-above-profile');
   if (claims.iat > now + LEEWAY_SECONDS) return refuse('unauthenticated', 'issued-in-future');
   const { nbf } = checked.compact.payload;
-  if (nbf !== undefined && (!isTime(nbf) || nbf > now + LEEWAY_SECONDS)) return refuse('unauthenticated', 'not-yet-valid');
+  if (nbf !== undefined && nbf > now + LEEWAY_SECONDS) return refuse('unauthenticated', 'not-yet-valid');
   if (now > claims.exp + LEEWAY_SECONDS) return refuse('token-expired', 'expired');
   if (claims.aud !== audience) return refuse('wrong-audience', 'audience-mismatch');
-  const depth = chainDepth(claims.act);
-  if (!Number.isFinite(depth)) return refuse('unauthenticated', 'malformed-chain');
   if (depth > MAX_CHAIN_DEPTH) return refuse('chain-too-deep', `depth-${depth}`);
   if (!claims.scope.split(' ').includes(capability)) return refuse('scope-not-granted', 'capability-not-in-scope');
   if (readOnly && effect !== 'none') return refuse('effect-above-ceiling', 'read-only-door');
@@ -239,12 +278,13 @@ export function verifyDelegation(token, { audience, jwks, now, capability, effec
 export function verifyApproval(approval, { audience, jwks, now, actionDigest: expected, issuer, jtiStore } = {}) {
   if (approval === undefined || approval === null || approval === '') return refuse('approval-required', 'no-approval', { actionDigest: expected });
   if (!isObject(jtiStore) || typeof jtiStore.consume !== 'function') return refuse('unknown-state', 'no-jti-store');
+  if (!isString(issuer)) return refuse('issuer-unavailable', 'no-trusted-issuer');
   if (!hasKeys(jwks)) return refuse('issuer-unavailable', 'no-published-keys');
   const checked = authentic(approval, jwks, APPROVAL_TYP);
   if ('problem' in checked) return refuse(checked.issuer ? 'issuer-unavailable' : 'approval-invalid', checked.problem);
   const claims = approvalShape(checked.compact.payload);
   if (!claims) return refuse('approval-invalid', 'malformed-claims');
-  if (issuer !== undefined && claims.iss !== issuer) return refuse('approval-invalid', 'wrong-issuer');
+  if (claims.iss !== issuer) return refuse('approval-invalid', 'wrong-issuer');
   if (claims.exp <= claims.iat || claims.exp - claims.iat > MAX_APPROVAL_LIFETIME_SECONDS) return refuse('approval-invalid', 'lifetime-above-profile');
   if (claims.iat > now + LEEWAY_SECONDS) return refuse('approval-invalid', 'issued-in-future');
   if (now > claims.exp + LEEWAY_SECONDS) return refuse('approval-invalid', 'expired');
@@ -399,15 +439,40 @@ const kidOf = (token) => { const parsed = parseCompact(token); return 'problem'
  * A check for one tools/call: `await gate(tool, headers)` answers the accepted delegation or a DL-19 refusal.
  * `effects` maps each tool to its declared effect class; a tool with none is refused rather than guessed.
  */
+export const TIERS = Object.freeze(['T0', 'T1', 'T2']);
+
+/**
+ * `await gate(tool, headers, tier = 'T2')`. DL-25, DL-26: T0 is a loopback caller under the owner's account that the
+ * service's own local floor authenticated, T1 an enrolled machine of the same owner, T2 everything else (and any call
+ * relayed from off the machine). A T0 or T1 caller is never required to present a token: with none, the call passes
+ * with no delegation. A present token is verified at every tier. `issuer` (auth.delegation.issuer) is required.
+ */
 export function delegationGate({ audience, jwks, effects, issuer, readOnly = false, clock = () => Date.now() / 1000 }) {
-  return async (tool, headers) => {
+  if (!isString(issuer)) throw new Error('the gate needs the issuer it trusts (auth.delegation.issuer)');
+  return async (tool, headers, tier = 'T2') => {
     const effect = effects?.[tool];
     if (!EFFECT_CLASSES.includes(effect)) return refuse('unknown-state', 'no-declared-effect');
     const carried = readDelegationToken(headers);
-    if (!carried) return refuse('unauthenticated', 'no-token');
+    if (!carried) {
+      if (tier === 'T0' || tier === 'T1') return { ok: true, tier, principal: null, caller: null, chain: [], claims: null, kid: null };
+      return refuse('unauthenticated', 'no-token');
+    }
     const keys = jwks instanceof JwksCache ? await jwks.get(kidOf(carried.token)) : jwks;
-    return verifyDelegation(carried.token, { audience, jwks: keys, now: clock(), capability: tool, effect, readOnly, ...(issuer === undefined ? {} : { issuer }) });
+    const verdict = verifyDelegation(carried.token, { audience, jwks: keys, now: clock(), capability: tool, effect, readOnly, issuer });
+    if (verdict.ok) verdict.tier = TIERS.includes(tier) ? tier : 'T2';
+    return verdict;
+  };
+}
+
+/** DL-21 step 6 (DEC-0045): the refusal a callee answers after the meter denied a grant check, the meter's code unchanged. */
+export function refusalFromDenial(denial) {
+  const data = {
+    ...(denial.window === undefined ? {} : { window: denial.window }),
+    ...(denial.level === null || denial.level === undefined ? {} : { level: denial.level }),
+    ...(denial.approvalRequest === undefined ? {} : { approvalRequest: denial.approvalRequest }),
   };
+  const message = `the meter denied the spend: ${denial.reason ?? ''}`.slice(0, 500);
+  return { error: { code: denial.code, message, ...(Object.keys(data).length > 0 ? { data } : {}) } };
 }
 
 /** The DL-19 body: {error: {code, message, data: {detail, ...}}}; never a token or a key. */

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -77,9 +77,36 @@ REFUSAL_MESSAGES = {
 }
 
 _B64URL = re.compile(r"^[A-Za-z0-9_-]+$")
+# DL-2's grammar, as the contract's verifier types the claims (DEC-0045): an agent id, an opaque session or task id,
+# a URI, a jti and a scope.
+AGENT_ID = re.compile(r"^[a-z][a-z0-9-]{1,62}(\.[a-z][a-z0-9-]{0,31})?$")
+OPAQUE_ID = re.compile(r"^[A-Za-z0-9._:-]{1,128}$")
+_URI = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:\S+$")
+_JTI = re.compile(r"^[A-Za-z0-9._~-]{16,128}$")
+_SCOPE = re.compile(r"^[a-z][a-z0-9._-]{1,127}( [a-z][a-z0-9._-]{1,127})*$")
+_SPEND_WINDOWS = ("total", "task", "project", "day", "week", "month")
+# The small-order points of edwards25519 and their non-canonical encodings, sign bit cleared (the contract's
+# src/ed25519.ts; libsodium's has_small_order list).
+SMALL_ORDER_ENCODINGS = (
+    "0000000000000000000000000000000000000000000000000000000000000000", "0100000000000000000000000000000000000000000000000000000000000000",
+    "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05", "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+    "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f", "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
+    "eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
+)
 _MISSING = object()
 
 
+def is_small_order_key(raw: bytes) -> bool:
+    """Whether a 32-byte Ed25519 public key is a point of small order, in any encoding (CT-29)."""
+    if len(raw) != 32:
+        return True
+    return (raw[:31] + bytes([raw[31] & 0x7F])).hex() in SMALL_ORDER_ENCODINGS
+
+
+def _full(pattern: "re.Pattern[str]", value: Any) -> bool:
+    return isinstance(value, str) and pattern.fullmatch(value) is not None
+
+
 def _refuse(code: str, detail: str, data: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     out: Dict[str, Any] = {"ok": False, "code": code, "detail": detail}
     if data:
@@ -280,6 +307,8 @@ def _key_for(jwks: Dict[str, Any], kid: str) -> Dict[str, Any]:
         return {"problem": "unusable-key"}
     if len(raw) != 32:
         return {"problem": "unusable-key"}
+    if is_small_order_key(raw):
+        return {"problem": "small-order-key"}  # refused before any verification (DEC-0045, CT-29)
     return {"key": raw}
 
 
@@ -298,7 +327,8 @@ def _authentic(token: Any, jwks: Dict[str, Any], typ: str) -> Dict[str, Any]:
     kid = compact["header"]["kid"]
     found = _key_for(jwks, kid)
     if "problem" in found:
-        return {"problem": found["problem"], "issuer": found["problem"] in ("unusable-key", "duplicate-kid")}
+        # Only an unknown kid is the token's fault; a published key that cannot be used is the issuer's (DL-13 row 3).
+        return {"problem": found["problem"], "issuer": found["problem"] != "unknown-key"}
     if len(compact["signature"]) != 64 or not ed25519_verify(found["key"], compact["signing_input"], compact["signature"]):
         return {"problem": "bad-signature"}
     return {"compact": compact, "kid": kid}
@@ -341,17 +371,57 @@ def effect_within(effect: str, ceiling: List[str]) -> bool:
     return effect in effect_closure(ceiling)
 
 
-def _delegation_shape(payload: Dict[str, Any]) -> bool:
-    if not all(_is_string(payload.get(k)) for k in ("iss", "sub", "aud", "scope", "jti")):
-        return False
-    if not _is_time(payload.get("iat")) or not _is_time(payload.get("exp")):
+def _actor_chain_depth(act: Any) -> Optional[int]:
+    """The chain's depth when every actor is DL-2's (an agent id `sub`, an optional session id), else None. A token
+    with no `act` has no caller, so it is no chain either."""
+    if act is _MISSING:
+        return None
+    depth = 0
+    node = act
+    while node is not _MISSING:
+        if not isinstance(node, dict) or not _full(AGENT_ID, node.get("sub")):
+            return None
+        if "session" in node and not _full(OPAQUE_ID, node["session"]):
+            return None
+        depth += 1
+        node = node.get("act", _MISSING)
+    return depth
+
+
+def _is_amount(value: Any) -> bool:
+    return isinstance(value, (int, float)) and not isinstance(value, bool) and math.isfinite(value) and value >= 0
+
+
+def _spend_shaped(spend: Any) -> bool:
+    if not isinstance(spend, dict):
         return False
-    effect, grant = payload.get("effect"), payload.get("grant")
-    if not isinstance(effect, list) or not effect or not all(isinstance(e, str) and e in EFFECT_CLASSES for e in effect):
+    if spend.get("mode") == "unlimited":
+        return True
+    remaining = spend.get("remaining")
+    if spend.get("mode") != "limited" or not isinstance(remaining, list) or not 1 <= len(remaining) <= 6:
         return False
-    if not isinstance(grant, list) or not grant or not all(_is_string(g) for g in grant):
+    if not all(isinstance(e, dict) and e.get("window") in _SPEND_WINDOWS and _is_amount(e.get("remainingUsd")) for e in remaining):
         return False
-    return isinstance(payload.get("act"), dict)
+    return "perCallMaxUsd" not in spend or _is_amount(spend["perCallMaxUsd"])
+
+
+def _delegation_shape(payload: Dict[str, Any]) -> Tuple[Optional[str], Optional[int]]:
+    """DL-13 row 5 as DEC-0045 types it: (problem, depth). A claim the profile does not know is ignored."""
+    depth = _actor_chain_depth(payload.get("act", _MISSING))
+    if depth is None:
+        return "malformed-chain", None
+    effect, grant = payload.get("effect"), payload.get("grant")
+    typed = (_full(_URI, payload.get("iss")) and _full(_URI, payload.get("sub")) and _full(AGENT_ID, payload.get("aud"))
+             and isinstance(payload.get("scope"), str) and len(payload["scope"]) <= 4096 and _full(_SCOPE, payload["scope"])
+             and isinstance(effect, list) and len(effect) > 0 and all(isinstance(e, str) and e in EFFECT_CLASSES for e in effect)
+             and len(set(effect)) == len(effect)
+             and isinstance(grant, list) and len(grant) == 1 and isinstance(grant[0], str) and 1 <= _utf16_length(grant[0]) <= 256
+             and ("spend" not in payload or _spend_shaped(payload["spend"]))
+             and ("project" not in payload or _full(_URI, payload["project"]))
+             and ("task" not in payload or _full(OPAQUE_ID, payload["task"]))
+             and _is_time(payload.get("iat")) and _is_time(payload.get("exp"))
+             and ("nbf" not in payload or _is_time(payload["nbf"])) and _full(_JTI, payload.get("jti")))
+    return (None, depth) if typed else ("malformed-claims", None)
 
 
 def _approval_shape(payload: Dict[str, Any]) -> bool:
@@ -359,37 +429,37 @@ def _approval_shape(payload: Dict[str, Any]) -> bool:
         return False
     if not _is_time(payload.get("iat")) or not _is_time(payload.get("exp")):
         return False
-    return payload.get("method") in ("prompt", "operator-channel", "device")
+    return payload.get("method") in ("prompt", "operator-channel")  # DEC-0045: `device` is removed
 
 
 def verify_delegation(token: Any, *, audience: str, jwks: Any, now: float, capability: str, effect: str,
-                      issuer: Optional[str] = None, read_only: bool = False) -> Dict[str, Any]:
+                      issuer: Optional[str], read_only: bool = False) -> Dict[str, Any]:
     """DL-13, in its fixed order: nothing about a token is believed before its signature is.
     `now` is seconds since the epoch. Returns {ok: True, claims, principal, caller, chain, kid} or a refusal
-    {ok: False, code, detail[, data]} whose detail is a short machine word, never the token."""
+    {ok: False, code, detail[, data]} whose detail is a short machine word, never the token. `issuer` is required."""
+    if not _is_string(issuer):
+        return _refuse("issuer-unavailable", "no-trusted-issuer")
     if not _has_keys(jwks):
         return _refuse("issuer-unavailable", "no-published-keys")
     checked = _authentic(token, jwks, DELEGATION_TYP)
     if "problem" in checked:
         return _refuse("issuer-unavailable" if checked.get("issuer") else "unauthenticated", checked["problem"])
     claims = checked["compact"]["payload"]
-    if not _delegation_shape(claims):
-        return _refuse("unauthenticated", "malformed-claims")
-    if issuer is not None and claims["iss"] != issuer:
+    problem, depth = _delegation_shape(claims)
+    if problem:
+        return _refuse("unauthenticated", problem)
+    if claims["iss"] != issuer:
         return _refuse("unauthenticated", "wrong-issuer")
     if claims["exp"] <= claims["iat"] or claims["exp"] - claims["iat"] > MAX_DELEGATION_LIFETIME_SECONDS:
         return _refuse("unauthenticated", "lifetime-above-profile")
     if claims["iat"] > now + LEEWAY_SECONDS:
         return _refuse("unauthenticated", "issued-in-future")
-    if "nbf" in claims and (not _is_time(claims["nbf"]) or claims["nbf"] > now + LEEWAY_SECONDS):
+    if "nbf" in claims and claims["nbf"] > now + LEEWAY_SECONDS:
         return _refuse("unauthenticated", "not-yet-valid")
     if now > claims["exp"] + LEEWAY_SECONDS:
         return _refuse("token-expired", "expired")
     if claims["aud"] != audience:
         return _refuse("wrong-audience", "audience-mismatch")
-    depth = chain_depth(claims["act"])
-    if not math.isfinite(depth):
-        return _refuse("unauthenticated", "malformed-chain")
     if depth > MAX_CHAIN_DEPTH:
         return _refuse("chain-too-deep", "depth-%d" % depth)
     if capability not in claims["scope"].split(" "):
@@ -473,13 +543,15 @@ UNSAFE_NO_JTI_STORE = _NoReplayProtection()
 
 
 def verify_approval(approval: Optional[str], *, audience: str, jwks: Any, now: float, action_digest: str,
-                    jti_store: Any, issuer: Optional[str] = None) -> Dict[str, Any]:
+                    jti_store: Any, issuer: Optional[str]) -> Dict[str, Any]:
     """DL-18: a missing approval is approval-required carrying the action digest; any fault of the document is
     approval-invalid; a second use is approval-reused. The jti is consumed last."""
     if approval is None or approval == "":
         return _refuse("approval-required", "no-approval", {"actionDigest": action_digest})
     if jti_store is None or not callable(getattr(jti_store, "consume", None)):
         return _refuse("unknown-state", "no-jti-store")
+    if not _is_string(issuer):
+        return _refuse("issuer-unavailable", "no-trusted-issuer")
     if not _has_keys(jwks):
         return _refuse("issuer-unavailable", "no-published-keys")
     checked = _authentic(approval, jwks, APPROVAL_TYP)
@@ -488,7 +560,7 @@ def verify_approval(approval: Optional[str], *, audience: str, jwks: Any, now: f
     claims = checked["compact"]["payload"]
     if not _approval_shape(claims):
         return _refuse("approval-invalid", "malformed-claims")
-    if issuer is not None and claims["iss"] != issuer:
+    if claims["iss"] != issuer:
         return _refuse("approval-invalid", "wrong-issuer")
     if claims["exp"] <= claims["iat"] or claims["exp"] - claims["iat"] > MAX_APPROVAL_LIFETIME_SECONDS:
         return _refuse("approval-invalid", "lifetime-above-profile")
@@ -654,8 +726,12 @@ _OPENER = urllib.request.build_opener(_NoRedirect)
 def _fetch(source: str) -> Any:
     if source.startswith(("https://", "http://")):
         request = urllib.request.Request(source, headers={"Accept": "application/json"})
-        with _OPENER.open(request, timeout=5) as response:  # https or loopback http only, no redirect
-            return json.loads(response.read(65537)[:65536])
+        try:
+            with _OPENER.open(request, timeout=5) as response:  # https or loopback http only, no redirect
+                return json.loads(response.read(65537)[:65536])
+        except urllib.error.HTTPError as exc:
+            exc.close()
+            raise
     return json.loads(Path(source).expanduser().read_text())
 
 
@@ -715,26 +791,54 @@ def _kid_of(token: str) -> Optional[str]:
 
 # --- the gate in front of a service's tools ------------------------------------------------------------------
 
-def delegation_gate(*, audience: str, jwks: Any, effects: Mapping[str, str], issuer: Optional[str] = None,
-                    read_only: bool = False, clock: Callable[[], float] = time.time) -> Callable[[str, Any], Dict[str, Any]]:
-    """A check for one tools/call: `gate(tool, headers)` answers the accepted delegation or a DL-19 refusal.
-    `effects` maps each tool to its declared effect class (its manifest entry); a tool with none is refused
-    rather than guessed. `jwks` is a JwksCache or a key set."""
+TIERS = ("T0", "T1", "T2")
+
+
+def delegation_gate(*, audience: str, jwks: Any, effects: Mapping[str, str], issuer: str,
+                    read_only: bool = False, clock: Callable[[], float] = time.time) -> Callable[..., Dict[str, Any]]:
+    """A check for one tools/call: `gate(tool, headers, tier="T2")` answers the accepted delegation or a DL-19
+    refusal. `effects` maps each tool to its declared effect class (its manifest entry); a tool with none is
+    refused rather than guessed. `jwks` is a JwksCache or a key set; `issuer` (auth.delegation.issuer) is required.
 
-    def gate(tool: str, headers: Any) -> Dict[str, Any]:
+    DL-25, DL-26: `tier` is the caller's origin. T0 is a loopback caller under the owner's account that the service's
+    own local floor has authenticated; T1 an enrolled machine of the same owner; T2 everything else, and any call
+    relayed from off the machine. A T0 or T1 caller is never required to present a token: with none, the call
+    passes with no delegation ({ok: True, tier, principal: None, ...}). A present token is verified at every tier
+    and refused when invalid. Unknown tiers count as T2."""
+    if not _is_string(issuer):
+        raise ValueError("the gate needs the issuer it trusts (auth.delegation.issuer)")
+
+    def gate(tool: str, headers: Any, tier: str = "T2") -> Dict[str, Any]:
         effect = effects.get(tool)
         if effect not in EFFECT_CLASSES:
             return _refuse("unknown-state", "no-declared-effect")
         carried = read_delegation_token(headers)
         if carried is None:
+            if tier in ("T0", "T1"):
+                return {"ok": True, "tier": tier, "principal": None, "caller": None, "chain": [], "claims": None, "kid": None}
             return _refuse("unauthenticated", "no-token")
         keys = jwks.get(_kid_of(carried["token"])) if isinstance(jwks, JwksCache) else jwks
-        return verify_delegation(carried["token"], audience=audience, jwks=keys, now=clock(), capability=tool,
-                                 effect=effect, issuer=issuer, read_only=read_only)
+        verdict = verify_delegation(carried["token"], audience=audience, jwks=keys, now=clock(), capability=tool,
+                                    effect=effect, issuer=issuer, read_only=read_only)
+        if verdict["ok"]:
+            verdict["tier"] = tier if tier in TIERS else "T2"
+        return verdict
 
     return gate
 
 
+def refusal_from_denial(denial: Dict[str, Any]) -> Dict[str, Any]:
+    """DL-21 step 6 (DEC-0045): the refusal a callee answers after the meter denied a grant check. The meter's code
+    goes unchanged into error.code; its window, level (when set) and approvalRequest into error.data."""
+    data = {k: denial[k] for k in ("window", "approvalRequest") if denial.get(k) is not None}
+    if denial.get("level") is not None:
+        data["level"] = denial["level"]
+    error: Dict[str, Any] = {"code": denial["code"], "message": ("the meter denied the spend: %s" % denial.get("reason", ""))[:500]}
+    if data:
+        error["data"] = data
+    return {"error": error}
+
+
 def refusal_error(refusal: Dict[str, Any]) -> Dict[str, Any]:
     """The DL-19 body: {error: {code, message, data: {detail, ...}}}; never a token or a key."""
     data = {"detail": refusal["detail"]}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_interop.py

@@ -479,7 +479,7 @@ class McpToolServer:
                  on_job_started: Optional[Callable[[str, CallContext], None]] = None,
                  on_input: Optional[OnInput] = None,
                  authorize: Optional[Callable[[str, Any], Dict[str, Any]]] = None):
-        # authorize(tool, headers) runs before every handler (fabric_delegation.delegation_gate, DEC-0039):
+        # authorize(tool, headers, tier=) runs before every handler (fabric_delegation.delegation_gate, DEC-0039):
         # a refusal is answered in the DL-19 shape and the handler never runs. The built-in job tools are
         # gated by the job's own capability, and answered only for the principal and caller that started it.
         self._authorize = authorize
@@ -517,10 +517,12 @@ class McpToolServer:
     def _error(rid: Any, code: int, message: str) -> Dict[str, Any]:
         return {"jsonrpc": "2.0", "id": rid, "error": {"code": code, "message": message}}
 
-    def handle(self, message: Any, headers: Any = None) -> Optional[Dict[str, Any]]:
+    def handle(self, message: Any, headers: Any = None, tier: str = "T2") -> Optional[Dict[str, Any]]:
         """One JSON-RPC message. Pass the HTTP request headers so the 2026-07-28 standard headers
         are checked (`mcp_header_problem`); a mismatch answers HEADER_MISMATCH even for a
-        notification, so the transport can return HTTP 400."""
+        notification, so the transport can return HTTP 400. `tier` is the caller's origin for the
+        authorize gate (DL-25: T0 local and authenticated by the service's floor, T1 an enrolled
+        machine of the owner, T2 anything else); a gate never requires a token from T0 or T1."""
         if not isinstance(message, dict) or message.get("jsonrpc") != "2.0" or not isinstance(message.get("method"), str):
             return self._error(message.get("id") if isinstance(message, dict) else None, -32600, "Invalid request.")
         problem = mcp_header_problem(message, headers)
@@ -558,7 +560,7 @@ class McpToolServer:
                     private = self.jobs.private(job_id)
                 except UnknownJob:
                     return {"jsonrpc": "2.0", "id": rid, "result": unknown_job_result(job_id, traceparent=span)}
-                verdict = self._authorize(private["capability"], headers)
+                verdict = self._authorize(private["capability"], headers, tier=tier)
                 owner = private.get("delegation")
                 if verdict.get("ok") and owner and (owner.get("principal"), owner.get("caller")) != (verdict.get("principal"), verdict.get("caller")):
                     verdict = {"ok": False, "code": "scope-not-granted", "detail": "job-of-another-caller"}
@@ -571,7 +573,7 @@ class McpToolServer:
             return self._error(rid, -32602, "Unknown tool: %s." % name)
         delegation = None
         if self._authorize is not None:
-            verdict = self._authorize(name, headers)
+            verdict = self._authorize(name, headers, tier=tier)
             if not verdict.get("ok"):
                 import fabric_delegation as _fd  # noqa: E402 - only a gated server needs it
                 return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(verdict, traceparent=span)}

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.11.1"
+  version: "0.12.0"
   contract-version: "0.1.0"
-  contract-commit: "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
+  contract-commit: "2eb91c00e852d9c31d804310d38fad91589fcbac"
 ---
 
 # Creating Fabric-compatible agents
@@ -119,7 +119,7 @@ python3 <plugin-dir>/skills/adapting-projects-to-fabric/scripts/adapt_project.py
   --schema-base <immutable-base-uri>
 ```
 
-Pin exactly contract `0.1.0` at commit `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5` and
+Pin exactly contract `0.1.0` at commit `2eb91c00e852d9c31d804310d38fad91589fcbac` and
 read the pinned guide before implementing protocol details. If this skill is installed
 without its sibling, the scaffolder is absent: create the bundle by hand from the pinned
 contract's `docs/guides/connecting-compatible-agents.md` and mark the structural check