@passioncode-ai/fabric-agent-adapter 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # Changelog
 
+## 0.16.0 - 2026-10-12
+
+Runner and model profiles in both kits (contract DEC-0046, Fabric ADR-0147; FAA-19). The contract's credential
+detector (DEC-0044) is ported too. The contract pin is unchanged (`0cacd08`).
+
+### Added
+
+- **`scripts/fabric_profiles.py` and `scripts/fabric-profiles.mjs`**:
+  - `resolve_model_profile` / `resolveModelProfile` (FAC-SEM-060). The order is request, agent, binding or project,
+    then estate default. The project's `modelClasses` narrow the result, and when nothing is left the launch is
+    refused as `model-classes-empty`, with the policy named.
+  - `profile_problems` / `profileProblems`, the FAC-SEM-058…060 checks of catalogues, profile sets, runner profiles
+    and recorded resolutions.
+  - `runner_check` / `runnerCheck`, for the doctor (runners.md C2). It runs only the catalogued bare binary on `PATH`
+    with its catalogued version and `auth` argv, never through a shell, for at most 5 s.
+  - `model_usable`.
+  - `configuration`, the well-known `configuration`, and `configuration_summary`, which gives the Runner and Model
+    tiles for the dashboard.
+- **`scripts/fabric_secrets.py` and `scripts/fabric-secrets.mjs`**: the contract's one credential detector
+  (`secret-shape.ts`), with `credential_name`, `secret_value`, `secret_argument` and `secret_url`. It is the base for
+  FAA-23 (LC-21).
+- **`build_well_known(configuration=)` / `buildWellKnown({ configuration })`** validates the configuration and carries
+  it. `configuration_problems` / `configurationProblems` are added.
+- **`make_usage_receipt(route=)` / `makeUsageReceipt({ route })`**: a receipt records `subscription` or `key`, and
+  the report keeps the rows of one model on two routes apart.
+- **Probe rule `configuration.declared`.**
+- **Vectors**: `test/fixtures/contract/profile-vectors.json` holds 17 rule cases, 35 resolutions and 128
+  credential-detector cases. Every expected answer comes from the contract's own `profile-rules.ts` and
+  `secret-shape.ts` (`make_profile_vectors.mjs`). Credential-shaped samples are made up and stored hex-encoded.
+- Tests: 11 planted defects across both kits were each caught.
+- **Docs**: `references/profiles.md`, a pointer in SKILL.md, and an updated `protocol.md`. The scenario eval
+  `runner-and-model-profiles` came first.
+
+## 0.15.0 - 2026-10-12
+
+Fabric's button in the dashboard kit (contract DEC-0040, FB-7). With it, FAA-20 is complete. The contract pin is
+unchanged (`0cacd08`).
+
+### Added
+
+- **`assets/dashboard-kit/fabric-button.js`** (kit `fabric-dashboard-kit` 1.1.0) is one floating menu button that
+  opens Fabric on the service. It is driven by `data-service`, `data-service-name`, `data-project`,
+  `data-project-name` and `data-runner`, and implements FB-1 to FB-6:
+  - **Menu (FB-4):** "Chat with Fabric about …", plus "Open a coding session in …" when the page knows its project.
+    Arrow keys, Home, End and Escape work.
+  - **Placement (FB-2):** bottom-right, or bottom-left right-to-left, 16 px plus the safe area. The page keeps the
+    button's height plus 16 px free at the end of its scroll.
+  - **Look (FB-3):** the mark alone below 480 px. The accessible name is always "Open Fabric". Colours are `--ink`
+    on `--panel` with an `--edge` boundary, the pairs the themes are already measured on.
+  - **Host button (FB-6):** the page hides its own button under the host's `fabric_button` cookie `owner=host`.
+  - **Fabric absent (FB-5):** "Fabric is not installed — get it at passioncode.ai/fabric" shows when the cookie or
+    the server says Fabric is absent, or when the page is still visible and focused 1.5 s after a link was followed.
+
+  Links are built with a port of the contract's `buildFabricLink` and `parseFabricLink`, with the FL-4 credential
+  detector. A value the grammar refuses means no button, never a bad link. A press only opens a view (FB-8). The
+  script is CSP-clean, and the only address it names is passioncode.ai/fabric.
+- `test/fixtures/contract/fabric-links.json` holds 42 parse and 9 build cases. Every expected answer comes from the
+  contract's own functions at the pin, through `make_link_vectors.mjs`.
+- `test/fabric-button.test.mjs` covers:
+  - the grammar against those vectors;
+  - the cookie and the menu items;
+  - the CSP check;
+  - the behaviour in WebKit through Playwright: placement, size, scroll clearance, keyboard, right-to-left, the
+    host cookie, Fabric absent, and the 1.5 s test. These are skipped when Playwright is absent.
+
+  Eight planted defects were each caught.
+- The sample service's dashboard shows the button. The layout probe passes all 17 rules on it in WebKit.
+- `references/dashboard-kit.md` has a "Fabric's button" section. The scenario eval `fabric-button-on-a-dashboard`
+  came first.
+
+### Changed
+
+- The dashboard kit is 1.1.0. `dashboard_kit.py install` also copies `fabric-button.js`, and `build` digests every
+  copied file. `DASHBOARD_KIT` in both service kits names `fabric-dashboard-kit@1.1.0`.
+
 ## 0.14.0 - 2026-10-12
 
 The contract pin moves to Fabric Agent Contract `main` `0cacd08`, which includes PR #46 (DEC-0046, runner and model

package/README.md

@@ -230,8 +230,8 @@ FABRIC_CONTRACT_OLD=/path/to/legacy-contract FABRIC_CONTRACT_NEW=/path/to/curren
 ```
 
 Without both environment variables, those tests explicitly skip as `NOT_RUN`.
-This source checkout is 0.14.0. 0.13.0 is the latest published GitHub/npm release (2026-10-12; 0.7.0 and 0.11.0
-were never released); 0.14.0 is published by its `v0.14.0` tag. Source delivery does not update installed skills or live sessions.
+This source checkout is 0.16.0. 0.15.0 is the latest published GitHub/npm release (2026-10-12; 0.7.0 and 0.11.0
+were never released); 0.16.0 is published by its `v0.16.0` tag. Source delivery does not update installed skills or live sessions.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.14.0"
+  version: "0.16.0"
   contract-version: "0.1.0"
   contract-commit: "0cacd08b0e95b6abf131eae1206b60792138bc3c"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,7 +16,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.14.0"
+  version: "0.16.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "0cacd08b0e95b6abf131eae1206b60792138bc3c"
@@ -83,7 +83,8 @@ are in [`scripts/fabric_interop.py`](scripts/fabric_interop.py) and
 [`scripts/fabric-interop.mjs`](scripts/fabric-interop.mjs). When the callers are agents of the estate, the
 service checks each call's delegation token (DEC-0039): read [the delegation reference](references/delegation.md);
 the verifier is [`scripts/fabric_delegation.py`](scripts/fabric_delegation.py) /
-[`scripts/fabric-delegation.mjs`](scripts/fabric-delegation.mjs).
+[`scripts/fabric-delegation.mjs`](scripts/fabric-delegation.mjs). When Fabric chooses the service's runner and models
+(DEC-0046), read [the profiles reference](references/profiles.md).
 
 ## Step 2 — the non-negotiables
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/assets/dashboard-kit/demo.html

@@ -7,6 +7,7 @@
   <title>Example agent · dashboard kit demo</title>
   <link rel="stylesheet" href="fabric-dashboard.css">
   <script src="fabric-dashboard.js" defer></script>
+  <script src="fabric-button.js" defer data-service="example-agent.default" data-service-name="Example Agent" data-project="project-a" data-project-name="Project A"></script>
 </head>
 <body>
   <a class="fd-skip" href="#overview">Skip to content</a>

package/plugins/fabric-agent-adapter/skills/building-fabric-services/assets/dashboard-kit/fabric-button.js

@@ -0,0 +1,280 @@
+/* fabric-dashboard-kit@1.1.0 · Fabric's button (Fabric Agent Contract DEC-0040, FB-1…FB-8, FL-1…FL-6)
+   Load it same-origin, after fabric-dashboard.css, with the service it opens Fabric on:
+     <script src="fabric-button.js" defer data-service="example-agent.default" data-service-name="Example Agent"
+             data-project="project-a" data-project-name="Project A"></script>
+   One floating menu button: "Chat with Fabric about <service>" and, when the page knows its project, "Open a coding
+   session in <project>". Its links carry ids only and open a view in Fabric, nothing more (FB-8). It hides itself
+   when the host draws its own (the fabric_button cookie, FB-6) and says how to get Fabric when Fabric is absent
+   (FB-5). No inline script, no eval, nothing from a CDN; the only address it names is passioncode.ai/fabric.
+   Do not edit in place; `dashboard_kit.py install` replaces it on an upgrade. */
+(function (root) {
+  'use strict';
+
+  var VERSION = '1.1.0';
+  var COOKIE = 'fabric_button';
+  var GET_FABRIC = 'https://passioncode.ai/fabric';
+  var ABSENT_AFTER_MS = 1500;
+  var MAX_LINK_LENGTH = 2048;
+
+  // ---- fabric:// links: a port of the contract's src/fabric-links.ts and src/secret-shape.ts (FL-1…FL-6) ----
+
+  var AGENT_ID = /^[a-z][a-z0-9-]{1,62}(\.[a-z][a-z0-9-]{0,31})?$/;
+  var PROJECT_REF = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+  var RUNNER_KIND = /^[a-z][a-z0-9-]{1,62}$/;
+  var SHAPE = /^fabric:\/\/(chat|session\/new)\/?(?:\?([^#]*))?(?:#(.*))?$/;
+  var KNOWN = {
+    chat: { service: AGENT_ID, project: PROJECT_REF },
+    'session.new': { project: PROJECT_REF, runner: RUNNER_KIND }
+  };
+  var PROMPT_WORDS = ['prompt', 'message', 'msg', 'text', 'instruction', 'instructions'];
+  var CREDENTIAL_WORDS = ['token', 'secret', 'password', 'passwd', 'pass', 'passphrase', 'credential', 'credentials', 'cookie',
+    'authorization', 'bearer', 'jwt', 'otp', 'apikey', 'signature', 'sig', 'accesstoken', 'idtoken', 'authtoken',
+    'refreshtoken', 'sessionid', 'sessiontoken', 'logincode', 'authcode', 'privatekey', 'clientsecret', 'secretkey', 'accesskey'];
+  var CREDENTIAL_PAIRS = {
+    key: ['private', 'api', 'access', 'secret', 'session', 'auth', 'signing', 'encryption', 'master', 'client', 'login', 'refresh'],
+    auth: ['token', 'code', 'header'],
+    session: ['token', 'id'],
+    code: ['login', 'auth', 'access', 'session']
+  };
+  var JWT_SHAPE = /eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*/;
+  var SECRET_VALUE = /(^bearer\s.+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})/i;
+  var LONG_RUN = /[A-Za-z0-9+/=_-]{40,}/g;
+
+  function nameWords(name) {
+    return name.replace(/([a-z0-9])([A-Z])/g, '$1 $2').replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+      .split(/[\s._-]+/).filter(Boolean).map(function (w) { return w.toLowerCase(); });
+  }
+  function withSingulars(words) {
+    return words.concat(words.filter(function (w) { return w.length > 2 && /s$/.test(w); }).map(function (w) { return w.slice(0, -1); }));
+  }
+  function credentialName(name) {
+    var split = nameWords(name);
+    var words = withSingulars(split);
+    if (words.some(function (w) { return CREDENTIAL_WORDS.indexOf(w) >= 0; })) return true;
+    if (split.length === 1 && words.some(function (w) { return Object.prototype.hasOwnProperty.call(CREDENTIAL_PAIRS, w); })) return true;
+    return Object.keys(CREDENTIAL_PAIRS).some(function (w) {
+      return words.indexOf(w) >= 0 && CREDENTIAL_PAIRS[w].some(function (p) { return words.indexOf(p) >= 0; });
+    });
+  }
+  function longSecret(value) {
+    return (value.match(LONG_RUN) || []).some(function (run) { return /[a-z]/.test(run) && /[A-Z]/.test(run) && /[0-9]/.test(run); });
+  }
+  function secretValue(value) { return JWT_SHAPE.test(value) || SECRET_VALUE.test(value) || longSecret(value); }
+  function decodeKeepingPlus(raw) { try { return decodeURIComponent(raw); } catch (e) { return raw; } }
+  function firstKey(text) { var it = new URLSearchParams(text).keys().next(); return it.done ? '' : it.value; }
+  function rawValues(query) {
+    var values = new Map();
+    query.split('&').forEach(function (piece) {
+      if (piece === '') return;
+      var at = piece.indexOf('=');
+      var name = firstKey(at < 0 ? piece : piece.slice(0, at));
+      values.set(name, (values.get(name) || []).concat(at < 0 ? '' : decodeKeepingPlus(piece.slice(at + 1))));
+    });
+    return values;
+  }
+  function promptName(name) { return nameWords(name).some(function (w) { return PROMPT_WORDS.indexOf(w) >= 0; }); }
+  function flat(lists) { return lists.reduce(function (a, b) { return a.concat(b); }, []); }
+
+  /** The contract's parseFabricLink: {ok: true, link, ignored} or {ok: false, problems}. */
+  function parseFabricLink(url) {
+    if (url.length > MAX_LINK_LENGTH) return { ok: false, problems: ['a link is at most ' + MAX_LINK_LENGTH + ' characters'] };
+    var match = SHAPE.exec(url.replace(/^fabric:/i, 'fabric:'));
+    if (!match) return { ok: false, problems: ['not fabric://chat or fabric://session/new'] };
+    var action = match[1] === 'chat' ? 'chat' : 'session.new';
+    var params = new URLSearchParams(match[2] || '');
+    var problems = [];
+    var fragment = match[3] || '';
+    if (fragment) {
+      var pieces = Array.from(new URLSearchParams(fragment));
+      var raw = flat(Array.from(rawValues(fragment).values()));
+      if (secretValue(fragment) || raw.some(secretValue) || pieces.some(function (p) { return (p[1] !== '' && credentialName(p[0])) || secretValue(p[1]) || secretValue(p[0]); })) {
+        problems.push('the fragment could carry a credential; a link never does');
+      }
+    }
+    var ignored = [];
+    var values = {};
+    var known = KNOWN[action];
+    var rawQuery = rawValues(match[2] || '');
+    Array.from(new Set(Array.from(params.keys()))).forEach(function (name) {
+      var all = params.getAll(name);
+      if (promptName(name)) { problems.push('the parameter ' + name + ' carries words to act on; a link carries ids only'); return; }
+      if (credentialName(name) || secretValue(name) || all.some(secretValue) || (rawQuery.get(name) || []).some(secretValue)) {
+        problems.push('the parameter ' + name + ' could carry a credential; a link never does'); return;
+      }
+      var grammar = Object.prototype.hasOwnProperty.call(known, name) ? known[name] : undefined;
+      if (!grammar) { ignored.push(name); return; }
+      if (all.length > 1) { problems.push(name + ' is given ' + all.length + ' times'); return; }
+      var value = all[0] || '';
+      if (!grammar.test(value)) {
+        problems.push(name + ' is not a valid ' + (name === 'service' ? 'agent id' : name === 'runner' ? 'runner kind' : 'project id or slug')); return;
+      }
+      values[name] = value;
+    });
+    var named = function (re) { return problems.some(function (p) { return re.test(p); }); };
+    if (action === 'chat' && values.service === undefined && values.project === undefined && !named(/^(service|project) /)) problems.push('a chat link names a service, a project or both');
+    if (action === 'session.new' && values.project === undefined && !named(/^project /)) problems.push('a session link names its project');
+    if (problems.length) return { ok: false, problems: problems };
+    var link = action === 'chat' ? { action: action } : { action: action, project: values.project };
+    if (action === 'chat') { if (values.service) link.service = values.service; if (values.project) link.project = values.project; }
+    else if (values.runner) link.runner = values.runner;
+    return { ok: true, link: link, ignored: ignored };
+  }
+
+  /** The contract's buildFabricLink: throws on a value the grammar refuses, so a page cannot emit a bad link. */
+  function buildFabricLink(link) {
+    var query = new URLSearchParams();
+    if (link.action === 'chat') {
+      if (link.service !== undefined) query.set('service', link.service);
+      if (link.project !== undefined) query.set('project', link.project);
+    } else {
+      query.set('project', link.project);
+      if (link.runner !== undefined) query.set('runner', link.runner);
+    }
+    var url = 'fabric://' + (link.action === 'chat' ? 'chat' : 'session/new') + '?' + query.toString();
+    var parsed = parseFabricLink(url);
+    if (!parsed.ok) throw new TypeError(parsed.problems.join('; '));
+    return url;
+  }
+
+  /** FB-6: the host's cookie as {owner, fabric}, or null when absent or of an unknown version. */
+  function parseButtonCookie(cookieHeader) {
+    if (typeof cookieHeader !== 'string' || !cookieHeader) return null;
+    var parts = cookieHeader.split(';');
+    for (var i = 0; i < parts.length; i++) {
+      var part = parts[i].replace(/^\s+/, '');
+      if (part.indexOf(COOKIE + '=') !== 0) continue;
+      var raw = part.slice(COOKIE.length + 1);
+      if (raw.charAt(0) === '"' && raw.charAt(raw.length - 1) === '"') raw = raw.slice(1, -1);
+      var fields = new URLSearchParams(decodeKeepingPlus(raw));
+      if (fields.get('v') !== '1') return null;
+      var out = {};
+      if (fields.get('owner') === 'host' || fields.get('owner') === 'page') out.owner = fields.get('owner');
+      if (fields.get('fabric') === 'present' || fields.get('fabric') === 'absent') out.fabric = fields.get('fabric');
+      return out;
+    }
+    return null;
+  }
+
+  /** The menu items for a page: the chat link always, the session link when the page knows its project. */
+  function menuItems(options) {
+    var items = [];
+    var chat = { action: 'chat', service: options.service };
+    if (options.project) chat.project = options.project;
+    items.push({ label: 'Chat with Fabric about ' + (options.serviceName || options.service), href: buildFabricLink(chat) });
+    if (options.project) {
+      var session = { action: 'session.new', project: options.project };
+      if (options.runner) session.runner = options.runner;
+      items.push({ label: 'Open a coding session in ' + (options.projectName || options.project), href: buildFabricLink(session) });
+    }
+    return items;
+  }
+
+  // ---- the button (FB-1…FB-6) ----
+
+  var SVG = 'http://www.w3.org/2000/svg';
+
+  function mark(doc) {
+    var svg = doc.createElementNS(SVG, 'svg');
+    svg.setAttribute('viewBox', '0 0 24 24');
+    svg.setAttribute('aria-hidden', 'true');
+    svg.setAttribute('focusable', 'false');
+    svg.setAttribute('class', 'fd-fabric-button-mark');
+    var path = doc.createElementNS(SVG, 'path');
+    path.setAttribute('d', 'M5 5h14v3H8v3h9v3H8v5H5z'); // the Fabric mark: an F
+    path.setAttribute('fill', 'currentColor');
+    svg.appendChild(path);
+    return svg;
+  }
+
+  function el(doc, tag, attrs, text) {
+    var node = doc.createElement(tag);
+    Object.keys(attrs || {}).forEach(function (k) { node.setAttribute(k, attrs[k]); });
+    if (text !== undefined) node.textContent = text;
+    return node;
+  }
+
+  /** Mount the button in `doc`. Returns the button, or null when the host draws its own (FB-1, FB-6). */
+  function mount(doc, options) {
+    var cookie = parseButtonCookie(doc.cookie);
+    if (cookie && cookie.owner === 'host') return null;
+    var items = menuItems(options);
+    var absent = options.fabric === 'absent' || (cookie && cookie.fabric === 'absent');
+
+    var wrap = el(doc, 'div', { 'class': 'fd-fabric-button-wrap' });
+    var button = el(doc, 'button', { type: 'button', 'class': 'fd-fabric-button', 'aria-haspopup': 'menu', 'aria-expanded': 'false', 'aria-label': 'Open Fabric' });
+    button.appendChild(mark(doc));
+    button.appendChild(el(doc, 'span', { 'class': 'fd-fabric-button-label', 'aria-hidden': 'true' }, 'Fabric'));
+    var menu = el(doc, 'div', { role: 'menu', 'class': 'fd-fabric-button-menu', 'aria-label': 'Fabric' });
+    menu.hidden = true;
+    var links = items.map(function (item) {
+      var a = el(doc, 'a', { role: 'menuitem', href: item.href, tabindex: '-1', 'class': 'fd-fabric-button-item' }, item.label);
+      menu.appendChild(a);
+      return a;
+    });
+    var note = el(doc, 'p', { 'class': 'fd-fabric-button-note', role: 'note' });
+    note.appendChild(doc.createTextNode('Fabric is not installed — get it at '));
+    note.appendChild(el(doc, 'a', { href: GET_FABRIC, target: '_blank', rel: 'noopener', 'class': 'fd-fabric-button-get' }, 'passioncode.ai/fabric'));
+    note.hidden = !absent;
+    menu.appendChild(note);
+    wrap.appendChild(menu);
+    wrap.appendChild(button);
+    doc.body.appendChild(wrap);
+    doc.documentElement.classList.add('fd-has-fabric-button');
+
+    function open(focusFirst) {
+      menu.hidden = false;
+      button.setAttribute('aria-expanded', 'true');
+      if (focusFirst && links.length) links[0].focus();
+    }
+    function close(refocus) {
+      menu.hidden = true;
+      button.setAttribute('aria-expanded', 'false');
+      if (refocus) button.focus();
+    }
+    function move(by) {
+      var at = links.indexOf(doc.activeElement);
+      links[(at + by + links.length) % links.length].focus();
+    }
+    button.addEventListener('click', function () { if (menu.hidden) open(true); else close(true); });
+    button.addEventListener('keydown', function (e) {
+      if (e.key === 'ArrowDown' || e.key === 'ArrowUp') { e.preventDefault(); open(false); (e.key === 'ArrowDown' ? links[0] : links[links.length - 1]).focus(); }
+    });
+    menu.addEventListener('keydown', function (e) {
+      if (e.key === 'Escape') { e.preventDefault(); close(true); }
+      else if (e.key === 'ArrowDown') { e.preventDefault(); move(1); }
+      else if (e.key === 'ArrowUp') { e.preventDefault(); move(-1); }
+      else if (e.key === 'Home') { e.preventDefault(); links[0].focus(); }
+      else if (e.key === 'End') { e.preventDefault(); links[links.length - 1].focus(); }
+      else if (e.key === 'Tab') { close(false); }
+    });
+    doc.addEventListener('click', function (e) { if (!menu.hidden && !wrap.contains(e.target)) close(false); });
+    // FB-5: a page cannot see which schemes this computer handles. If, after following a link, the page is still
+    // visible and focused 1.5 s later, Fabric did not take it: say how to get Fabric, once, and never retry.
+    links.forEach(function (a) {
+      a.addEventListener('click', function () {
+        root.setTimeout(function () {
+          if (doc.visibilityState === 'visible' && doc.hasFocus()) { note.hidden = false; open(false); }
+        }, ABSENT_AFTER_MS);
+      });
+    });
+    return button;
+  }
+
+  function optionsFrom(script) {
+    var d = script.dataset;
+    return { service: d.service, serviceName: d.serviceName, project: d.project, projectName: d.projectName, runner: d.runner, fabric: d.fabric };
+  }
+
+  var api = { version: VERSION, parseFabricLink: parseFabricLink, buildFabricLink: buildFabricLink, parseButtonCookie: parseButtonCookie,
+    menuItems: menuItems, credentialName: credentialName, secretValue: secretValue, nameWords: nameWords, mount: mount };
+  root.FabricButton = api;
+
+  var doc = root.document;
+  var script = doc && doc.currentScript;
+  if (script && script.dataset && script.dataset.service) {
+    var start = function () {
+      try { mount(doc, optionsFrom(script)); } catch (err) { if (root.console) root.console.warn('fabric-button: not shown — ' + err.message); }
+    };
+    if (doc.readyState === 'loading') doc.addEventListener('DOMContentLoaded', start); else start();
+  }
+})(typeof window !== 'undefined' ? window : globalThis);

package/plugins/fabric-agent-adapter/skills/building-fabric-services/assets/dashboard-kit/fabric-dashboard.css

@@ -1,4 +1,4 @@
-/* fabric-dashboard-kit@1.0.0 · fabric-dashboard/0.1 (Fabric Agent Contract DEC-0036)
+/* fabric-dashboard-kit@1.1.0 · fabric-dashboard/0.1 (Fabric Agent Contract DEC-0036)
    A Fabric service dashboard shown inside a host pane: usable from 360 CSS px up, navigation always
    reachable, wide content in its own scroll box, one vertical scroller, appearance from the host.
    Copy this file next to fabric-dashboard.js; do not edit it in place. Put the page's own rules in
@@ -196,3 +196,32 @@ pre.fd-scroll, .fd-scroll pre { margin: 0; padding: var(--space-3); font: var(--
 
 /* ---- appearance owned by the host (ED-6) ---- */
 html[data-fd-host-appearance] [data-fd-appearance-control] { display: none !important; }
+
+/* ---- Fabric's button (DEC-0040, FB-1…FB-6; fabric-button.js) ---- */
+/* FB-2: fixed to the bottom-right (bottom-left right-to-left), 16 px plus the safe area; above the content and the
+   sticky chrome (z 10), below the page's dialogs. The page keeps the button's height plus 16 px free at the end. */
+:root { --fd-fb-size: 44px; }
+html.fd-has-fabric-button body { padding-bottom: calc(var(--fd-fb-size) + 2 * var(--space-4) + env(safe-area-inset-bottom, 0px)); }
+.fd-fabric-button-wrap { position: fixed; z-index: 15; bottom: calc(var(--space-4) + env(safe-area-inset-bottom, 0px));
+  right: calc(var(--space-4) + env(safe-area-inset-right, 0px)); display: flex; flex-direction: column; align-items: flex-end; gap: var(--space-2); }
+[dir="rtl"] .fd-fabric-button-wrap { right: auto; left: calc(var(--space-4) + env(safe-area-inset-left, 0px)); align-items: flex-start; }
+/* FB-3: the mark and the word, 44 × 44 at least; colours from the theme: --ink on --panel (AA), an --edge boundary (3:1). */
+.fd-fabric-button { display: inline-flex; align-items: center; justify-content: center; gap: var(--space-2); min-width: var(--fd-fb-size);
+  min-height: var(--fd-fb-size); padding: 0 var(--space-3); font: 600 var(--t-body) var(--font-ui); color: var(--ink); background: var(--panel);
+  border: 2px solid var(--edge); border-radius: var(--r-pill); cursor: pointer;
+  transition: background-color var(--dur-hover) var(--motion-ease); }
+.fd-fabric-button:hover { background: var(--panel-2); }
+.fd-fabric-button:focus-visible, .fd-fabric-button-item:focus-visible { outline: 3px solid var(--accent); outline-offset: 2px; }
+.fd-fabric-button-mark { width: 20px; height: 20px; flex: none; }
+@media (max-width: 479.98px) { .fd-fabric-button-label { display: none; } .fd-fabric-button { padding: 0; } }
+/* FB-4: the menu; FB-5: the note when Fabric is absent. */
+.fd-fabric-button-menu { min-width: 240px; max-width: min(360px, calc(100vw - 2 * var(--space-4))); padding: var(--space-1); background: var(--panel);
+  color: var(--ink); border: 1px solid var(--edge); border-radius: var(--r-card); }
+.fd-fabric-button-menu[hidden] { display: none; }
+.fd-fabric-button-item { display: block; padding: var(--space-2) var(--space-3); min-height: var(--fd-fb-size); box-sizing: border-box;
+  color: var(--ink); text-decoration: none; border-radius: var(--r-control); font: var(--t-body)/1.5 var(--font-ui); overflow-wrap: anywhere; }
+.fd-fabric-button-item:hover, .fd-fabric-button-item:focus { background: var(--panel-2); }
+.fd-fabric-button-note { margin: var(--space-1) 0 0; padding: var(--space-2) var(--space-3); border-top: 1px solid var(--border-strong);
+  font: var(--t-body)/1.5 var(--font-ui); color: var(--ink); }
+.fd-fabric-button-note[hidden] { display: none; }
+.fd-fabric-button-get { color: var(--ink); text-decoration: underline; }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/assets/dashboard-kit/fabric-dashboard.js

@@ -1,4 +1,4 @@
-/* fabric-dashboard-kit@1.0.0 · fabric-dashboard/0.1 (Fabric Agent Contract DEC-0036)
+/* fabric-dashboard-kit@1.1.0 · fabric-dashboard/0.1 (Fabric Agent Contract DEC-0036)
    Load it same-origin with <script src="fabric-dashboard.js" defer></script>: no inline script, no
    eval, nothing from a CDN. It applies the host's appearance (ED-6, ED-8), folds navigation that
    does not fit into a More menu (ED-3), makes wide boxes keyboard-reachable (ED-4) and keeps
@@ -8,7 +8,7 @@
   'use strict';
 
   var KIT = 'fabric-dashboard-kit';
-  var VERSION = '1.0.0';
+  var VERSION = '1.1.0';
   /* fabric-dashboard-kit:theme-ids:begin */
   var THEMES = ['graphite', 'fabric', 'paper', 'forest', 'ocean', 'ember', 'contrast'];
 /* fabric-dashboard-kit:theme-ids:end */

package/plugins/fabric-agent-adapter/skills/building-fabric-services/assets/dashboard-kit/kit.json

@@ -1,6 +1,6 @@
 {
   "name": "fabric-dashboard-kit",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "profile": "fabric-dashboard/0.1",
   "decision": "DEC-0036",
   "declarationKey": "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1",
@@ -15,14 +15,20 @@
     "contrast"
   ],
   "files": {
-    "fabric-dashboard.css": "3993e6ab5e58d5229bc4dc245aa634fcf88a4f59502e1de90d3d3cfef70528a2",
-    "fabric-dashboard.js": "bac615a40c85d8c668588528f9e21dac800aa01fefb56b8ee573c30520ce74a7",
+    "fabric-dashboard.css": "498571903fac6dfd2d6645283da2f703fa945f410f2fafa269a8c9c322735c3b",
+    "fabric-dashboard.js": "100f55d940d4ed60aa8511cee4c65219c93114eb7d7a66639b0e4e4d7aa05f22",
+    "fabric-button.js": "4f1e100936ae65af5539594681e66092ae1834a4952da547a67d0558c9fadbbe",
     "themes.json": "511839f1a1a83eb37fadfd132791474497d5c28c5091700b9aa31ad076e359b5"
   },
   "history": {
     "1.0.0": {
       "fabric-dashboard.css": "3993e6ab5e58d5229bc4dc245aa634fcf88a4f59502e1de90d3d3cfef70528a2",
       "fabric-dashboard.js": "bac615a40c85d8c668588528f9e21dac800aa01fefb56b8ee573c30520ce74a7"
+    },
+    "1.1.0": {
+      "fabric-dashboard.css": "498571903fac6dfd2d6645283da2f703fa945f410f2fafa269a8c9c322735c3b",
+      "fabric-dashboard.js": "100f55d940d4ed60aa8511cee4c65219c93114eb7d7a66639b0e4e4d7aa05f22",
+      "fabric-button.js": "4f1e100936ae65af5539594681e66092ae1834a4952da547a67d0558c9fadbbe"
     }
   }
 }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-kit.md

@@ -11,6 +11,7 @@ promises so a service does not re-derive them.
 - The rules the page keeps
 - Using the kit
 - Themes and the host's appearance
+- Fabric's button
 - Declaring it
 - Proving it
 - Upgrading an existing dashboard
@@ -79,6 +80,34 @@ controls while it is present; an unknown `theme` is `graphite`. `data-fd-appeara
 what the page applies (declare the same in `appearance`). The page re-reads the cookie when it
 changes (`cookieStore`) and when it becomes visible again.
 
+## Fabric's button
+
+The kit ships Fabric's button (contract DEC-0040, FB-7): one floating menu button that opens Fabric on this
+service. Load it after the stylesheet, with ids only:
+
+```html
+<script src="fabric-button.js" defer data-service="example-agent.default" data-service-name="Example Agent"
+        data-project="project-a" data-project-name="Project A"></script>
+```
+
+- **The menu (FB-4):** "Chat with Fabric about *Example Agent*" always; "Open a coding session in *Project A*" when
+  the page knows its project (`data-runner` picks the runner kind). Arrows move, Escape closes and returns focus.
+- **Placement and look (FB-2, FB-3):** bottom-right (bottom-left right-to-left), 16 px off and clear of the safe
+  area, above the sticky chrome and below dialogs; the page keeps its height plus 16 px free at the end of the
+  scroll. The mark and the word *Fabric*, the mark alone below 480 px; the accessible name is always *Open Fabric*;
+  `--ink` on `--panel` with an `--edge` boundary, the pairs the themes are measured on.
+- **Links (FL-1…FL-6):** built with the kit's port of the contract's `buildFabricLink`; a value outside the grammar
+  — or one shaped like a credential — means no button, never a bad link. A press opens a view in Fabric and starts
+  nothing (FB-8).
+- **The host (FB-6):** when the host's `fabric_button` cookie says `owner=host`, the page hides its own button.
+- **Fabric absent (FB-5):** when the cookie says `fabric=absent`, or `data-fabric="absent"` (a local service whose
+  server checked for Fabric's hub document), or when the page is still visible and focused 1.5 s after a link was
+  followed, the menu says "Fabric is not installed — get it at passioncode.ai/fabric". Nothing downloads, nothing
+  retries.
+
+`window.FabricButton` exposes `buildFabricLink`, `parseFabricLink` and `parseButtonCookie` for a page that needs
+them. The button is optional: a page without the script has no button.
+
 ## Declaring it
 
 When the page meets ED-1…ED-6, say so in the well-known document (ED-9):
@@ -125,9 +154,9 @@ operator and update only with their go-ahead** — the page is theirs and may be
 
 ## When something is missing
 
-- **No Python for the CLI:** copy the two files from `assets/dashboard-kit/` by hand and compare the
+- **No Python for the CLI:** copy the files from `assets/dashboard-kit/` by hand and compare the
   first line's version with `kit.json`.
-- **The page is built by a framework:** import the two files as static assets; keep them unbundled
+- **The page is built by a framework:** import the files as static assets; keep them unbundled
   or keep the version marker comment, so `status` can still read the version.
 - **The page needs a fixed width:** not decided by the profile; declare the `minWidth` it needs
   (up to 1280) and say why in the README.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/profiles.md

@@ -0,0 +1,64 @@
+# Runner and model profiles (DEC-0046)
+
+Which coding agent runs a job (the **runner**) and which models it may use (the **model profile**) are chosen in
+Fabric, not in the service. The service resolves them in the contract's order, keeps to the project's model classes,
+says what applies in its well-known document, and checks in its doctor that the runner and the model are usable.
+Contract: `docs/specification/runners.md` §"Runner and model profiles" and `src/profile-rules.ts` at the pin.
+Python: [`scripts/fabric_profiles.py`](../scripts/fabric_profiles.py); Node:
+[`scripts/fabric-profiles.mjs`](../scripts/fabric-profiles.mjs). Both answer the contract's own vectors.
+
+## Contents
+
+- Resolving the model profile
+- Checking the documents
+- Declaring and showing what applies
+- The doctor
+- Usage by route
+
+## Resolving the model profile
+
+```python
+import fabric_profiles as fp
+resolution = fp.resolve_model_profile(catalogue=catalogue, profiles=estate_and_agent_profiles,
+                                      choices={"request": asked, "agent": own_default, "binding": bound, "estate": estate_default},
+                                      policy=project_spend_policy)
+```
+
+The first level that names a profile wins: **request, agent, binding or project, estate default**. The project's
+`modelClasses` narrow the profile's models — a model stays only if every class the catalogue gives it is allowed — and
+never choose one. An empty result is `{"refused": "model-classes-empty", "policy": {id, revision}}`: refuse the launch
+and name the policy; never fall back to a model outside it. No level at all is `no-profile`; an id nobody offers is
+`unknown-profile`.
+
+## Checking the documents
+
+`profile_problems(kind, doc)` / `profileProblems(kind, doc)` returns the contract's findings for a `model-catalogue`
+(a model catalogued once; a provider never both ordered and ignored, a base slug covering its variants), a
+`model-profiles` set (an id once), a `runner-profile` (a subscription only in its vendor's runner — Claude in Claude
+Code, Kimi in Kimi Code, ChatGPT in Codex; a key route's allow-list is its own model profile; a key named by reference,
+never by value) and a recorded `profile-resolution` (it equals the order's answer).
+
+## Declaring and showing what applies
+
+```python
+conf = fp.configuration(["runner", "model"], resolution, runner_profile)
+well_known = fs.build_well_known(..., configuration=conf, summary=fp.configuration_summary(conf) + other_tiles)
+```
+
+`configuration` is read-only: a change is made in Fabric and reaches the service through its binding, never through
+the well-known document. `configuration_summary` gives the **Runner** and **Model** tiles ("claude-code ·
+subscription", "default · deepseek/deepseek-v4-pro") that the dashboard shows beside the others. The probe checks the
+declaration (`configuration.declared`).
+
+## The doctor
+
+`runner_check(entry)` / `runnerCheck(entry)` takes one entry of Fabric's runner catalogue (`registry/runners.json`)
+and answers whether the runner is installed, which version answers and whether it is signed in. It runs only a bare
+catalogued binary found on `PATH`, only with the catalogued version argv (and `auth` argv), without a shell, within
+the entry's timeout (at most 5 s); an entry outside these rules is refused and nothing runs. `model_usable(model,
+catalogue, policy)` names why a model cannot be used here: not catalogued, or a class the project does not allow.
+
+## Usage by route
+
+`make_usage_receipt(..., route="subscription"|"key")` records how the call was paid — the operator's own login in its
+vendor's runner, or an issued key. The usage report keeps the rows of one model on two routes apart.