@passioncode-ai/fabric-agent-adapter 0.14.0 → 0.16.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_profiles.py

@@ -0,0 +1,277 @@
+#!/usr/bin/env python3
+"""Runner and model profiles in the kit (Fabric Agent Contract DEC-0046, Fabric ADR-0147). A port of the contract's
+`src/profile-rules.ts` at the pin — `resolve_model_profile` and the FAC-SEM-058…060 checks — held to the contract's own
+answers by test/fixtures/contract/profile-vectors.json; plus what a service does with them: the doctor's runner and
+model checks (runners.md C2) and the well-known `configuration` with its summary tiles ("Runner & model").
+
+    import fabric_profiles as fp
+    resolution = fp.resolve_model_profile(catalogue=catalogue, profiles=profiles, choices={"binding": "default"}, policy=policy)
+    configuration = fp.configuration(["runner", "model"], resolution, runner_profile)   # well-known `configuration`
+    summary += fp.configuration_summary(configuration)                                    # the dashboard's tiles
+"""
+
+from __future__ import annotations
+
+import json
+import math
+import re
+import shutil
+import subprocess
+from typing import Any, Callable, Dict, List, Optional, Sequence
+
+import fabric_secrets as _secrets
+import fabric_service as _fs
+
+RESOLUTION_ORDER = ("request", "agent", "binding", "estate")
+# The vendor login each subscription is, and the one runner kind it runs in (DEC-0046, ADR-0147 decision 2).
+SUBSCRIPTION_RUNNER = {"claude": "claude-code", "kimi": "kimi-code", "chatgpt": "codex"}
+MAX_PROBE_MS = 5000
+_BARE_BINARY = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*$")
+
+
+class ProfileError(ValueError):
+    pass
+
+
+def _list(value: Any) -> List[Dict[str, Any]]:
+    return [item for item in value if isinstance(item, dict)] if isinstance(value, list) else []
+
+
+def _strings(value: Any) -> List[str]:
+    return [item for item in value if isinstance(item, str)] if isinstance(value, list) else []
+
+
+def _js_string(value: Any) -> str:
+    """JavaScript's String(value), which the contract's messages and policy ids use."""
+    if value is None:
+        return "undefined"
+    if value is True:
+        return "true"
+    if value is False:
+        return "false"
+    if isinstance(value, float) and value.is_integer():
+        return str(int(value))
+    if isinstance(value, (dict, list)):
+        return "[object Object]" if isinstance(value, dict) else ",".join(_js_string(v) for v in value)
+    return str(value)
+
+
+def _js_number(value: Any) -> Optional[float]:
+    """JavaScript's Number(value); NaN is None (JSON writes it as null)."""
+    if isinstance(value, bool):
+        return 1 if value else 0
+    if isinstance(value, (int, float)):
+        return value if not (isinstance(value, float) and math.isnan(value)) else None
+    if isinstance(value, str):
+        text = value.strip()
+        if text == "":
+            return 0
+        try:
+            number = float(text)
+        except ValueError:
+            return None
+        return int(number) if number.is_integer() else number
+    return None
+
+
+def resolve_model_profile(*, catalogue: Any, profiles: Any, choices: Any, policy: Any = None) -> Dict[str, Any]:
+    """FAC-SEM-060: the request's profile, else the agent's, else the binding's or project's, else the estate default.
+    When the project's policy names `modelClasses`, a model stays only if every class the catalogue gives it is
+    allowed; an empty result refuses the launch, naming the policy."""
+    choices = choices if isinstance(choices, dict) else {}
+    level = next((name for name in RESOLUTION_ORDER if isinstance(choices.get(name), str)), None)
+    if level is None:
+        return {"refused": "no-profile"}
+    profile_id = choices[level]
+    profile = next((item for item in _list(profiles) if item.get("id") == profile_id), None)
+    if profile is None:
+        return {"refused": "unknown-profile", "profile": profile_id}
+    models = _strings(profile.get("models"))
+    if not isinstance(policy, dict) or not isinstance(policy.get("modelClasses"), list):
+        return {"from": level, "profile": profile_id, "models": models}
+    allowed = set(_strings(policy["modelClasses"]))
+    rows = {}
+    for row in _list(catalogue.get("models") if isinstance(catalogue, dict) else None):
+        rows[json.dumps(row.get("id"))] = row
+    within = [m for m in models if json.dumps(m) in rows and all(c in allowed for c in _strings(rows[json.dumps(m)].get("classes")))]
+    if within:
+        return {"from": level, "profile": profile_id, "models": within}
+    meta = policy.get("meta") if isinstance(policy.get("meta"), dict) else {}
+    return {"refused": "model-classes-empty", "profile": profile_id, "policy": {"id": _js_string(meta.get("id")), "revision": _js_number(meta.get("revision"))}}
+
+
+def _finding(code: str, path: str, message: str) -> Dict[str, str]:
+    return {"code": code, "instancePath": path, "message": message}
+
+
+def _model_catalogue(value: Dict[str, Any]) -> List[Dict[str, str]]:
+    findings, seen = [], []
+    for index, row in enumerate(_list(value.get("models"))):
+        if row.get("id") in seen:
+            findings.append(_finding("FAC-SEM-058", "/models/%d/id" % index, "model %s is catalogued more than once" % _js_string(row.get("id"))))
+        seen.append(row.get("id"))
+        routing = row.get("provider") if isinstance(row.get("provider"), dict) else {}
+        ignored = set(_strings(routing.get("ignore")))
+        for slug in _strings(routing.get("order")):
+            if slug in ignored or slug.split("/")[0] in ignored:
+                findings.append(_finding("FAC-SEM-058", "/models/%d/provider" % index, "model %s both orders and ignores provider %s" % (_js_string(row.get("id")), slug)))
+    return findings
+
+
+def _model_profiles(value: Dict[str, Any]) -> List[Dict[str, str]]:
+    findings, seen = [], []
+    for index, profile in enumerate(_list(value.get("profiles"))):
+        if profile.get("id") in seen:
+            findings.append(_finding("FAC-SEM-058", "/profiles/%d/id" % index, "model profile %s is declared more than once" % _js_string(profile.get("id"))))
+        seen.append(profile.get("id"))
+    return findings
+
+
+def _runner_profile(value: Dict[str, Any]) -> List[Dict[str, str]]:
+    findings = []
+    if value.get("route") == "subscription" and isinstance(value.get("subscription"), dict):
+        login = _js_string(value["subscription"].get("login"))
+        runner = SUBSCRIPTION_RUNNER.get(login)
+        if runner != value.get("runnerKind"):
+            findings.append(_finding("FAC-SEM-059", "/runnerKind", "a %s subscription runs only in %s, not in %s; another runner takes the key route"
+                                     % (login, runner if runner is not None else "its vendor's runner", _js_string(value.get("runnerKind")))))
+    if value.get("route") == "key" and isinstance(value.get("key"), dict):
+        key = value["key"]
+        if key.get("modelAllowList") != value.get("modelProfile") or ("modelAllowList" in key) != ("modelProfile" in value):
+            findings.append(_finding("FAC-SEM-059", "/key/modelAllowList", "the key admits the models of %s, but the profile runs %s"
+                                     % (_js_string(key.get("modelAllowList")), _js_string(value.get("modelProfile")))))
+        if isinstance(key.get("ref"), str) and _secrets.secret_value(key["ref"]):
+            findings.append(_finding("FAC-SEM-059", "/key/ref", "the key is named by its secret reference, never by its value"))
+    return findings
+
+
+def _compact(value: Any) -> str:
+    return json.dumps(value, separators=(",", ":"), ensure_ascii=False)
+
+
+def _profile_resolution(value: Dict[str, Any]) -> List[Dict[str, str]]:
+    findings = []
+    catalogue = value.get("catalogue")
+    catalogued = [row.get("id") for row in _list(catalogue.get("models") if isinstance(catalogue, dict) else None)]
+    ids: List[Any] = []
+    for i, profile in enumerate(_list(value.get("profiles"))):
+        if profile.get("id") in ids:
+            findings.append(_finding("FAC-SEM-060", "/profiles/%d/id" % i, "profile id %s is offered more than once to one resolution" % _js_string(profile.get("id"))))
+        ids.append(profile.get("id"))
+        for j, model in enumerate(_strings(profile.get("models"))):
+            if model not in catalogued:
+                findings.append(_finding("FAC-SEM-060", "/profiles/%d/models/%d" % (i, j), "profile %s names %s, which the catalogue does not hold" % (_js_string(profile.get("id")), model)))
+    choices = value.get("choices") if isinstance(value.get("choices"), dict) else {}
+    expected = resolve_model_profile(catalogue=catalogue, profiles=value.get("profiles"), choices=choices, policy=value.get("policy"))
+    if "resolved" not in value or value["resolved"] != expected:
+        findings.append(_finding("FAC-SEM-060", "/resolved", "the resolution is %s" % _compact(expected)))
+    return findings
+
+
+def profile_problems(kind: str, value: Dict[str, Any]) -> Optional[List[Dict[str, str]]]:
+    """The contract's profileRules: findings for a `model-catalogue`, `model-profiles`, `runner-profile` or
+    `profile-resolution` document; None for another kind."""
+    return {"model-catalogue": _model_catalogue, "model-profiles": _model_profiles, "runner-profile": _runner_profile,
+            "profile-resolution": _profile_resolution}.get(kind, lambda v: None)(value)
+
+
+# --- the doctor's checks ----------------------------------------------------------------------------------------
+
+def _argv(value: Any, label: str) -> List[str]:
+    if not isinstance(value, list) or not all(isinstance(a, str) for a in value):
+        raise ProfileError("%s is an argument array, never a shell string" % label)
+    return list(value)
+
+
+def runner_check(entry: Dict[str, Any], *, path: Optional[str] = None,
+                 run: Callable[..., Any] = subprocess.run) -> Dict[str, Any]:
+    """runners.md C2: is the catalogued runner installed, which version answers, and is it signed in. Only a bare
+    catalogued binary found on PATH is run, only with the catalogued version argv (and `auth` argv), without a shell,
+    within its timeout (at most 5 s). A catalogue entry outside these rules is refused and nothing runs."""
+    kind = entry.get("kind")
+    binaries = entry.get("binaries")
+    if not isinstance(binaries, list) or not binaries or not all(isinstance(b, str) and _BARE_BINARY.match(b) and ".." not in b for b in binaries):
+        raise ProfileError("binaries are bare executable names, never paths")
+    version = entry.get("version") if isinstance(entry.get("version"), dict) else {}
+    version_argv = _argv(version.get("argv"), "version.argv")
+    pattern = version.get("pattern")
+    if not isinstance(pattern, str):
+        raise ProfileError("version.pattern is a regular expression")
+    timeout_ms = version.get("timeoutMs", MAX_PROBE_MS)
+    if not isinstance(timeout_ms, int) or isinstance(timeout_ms, bool) or not 0 < timeout_ms <= MAX_PROBE_MS:
+        raise ProfileError("version.timeoutMs is at most %d" % MAX_PROBE_MS)
+    auth_argv = _argv(entry["auth"], "auth") if "auth" in entry else None
+    out: Dict[str, Any] = {"kind": kind, "installed": False, "binary": None, "version": None, "signedIn": None, "problems": []}
+    binary = next((found for found in (shutil.which(name, path=path) for name in binaries) if found), None)
+    if binary is None:
+        out["problems"].append("%s is not installed: none of %s is on PATH" % (kind, ", ".join(binaries)))
+        return out
+    out.update(installed=True, binary=binary)
+
+    def probe(argv: List[str]) -> Optional[Any]:
+        try:
+            return run([binary] + argv, capture_output=True, text=True, timeout=timeout_ms / 1000.0, shell=False)
+        except subprocess.TimeoutExpired:
+            out["problems"].append("%s %s did not answer within %d ms" % (kind, " ".join(argv), timeout_ms))
+        except OSError as exc:
+            out["problems"].append("%s could not be run: %s" % (kind, exc.__class__.__name__))
+        return None
+
+    answered = probe(version_argv)
+    if answered is not None:
+        match = re.search(pattern, answered.stdout or "") or re.search(pattern, answered.stderr or "")
+        if match and match.groups():
+            out["version"] = match.group(1)
+        else:
+            out["problems"].append("%s answered, but its version did not match the catalogue's pattern" % kind)
+    if auth_argv is not None:
+        signed = probe(auth_argv)
+        if signed is not None:
+            out["signedIn"] = signed.returncode == 0
+            if not out["signedIn"]:
+                out["problems"].append("%s is installed but not signed in" % kind)
+    return out
+
+
+def model_usable(model: str, catalogue: Any, policy: Any = None) -> List[str]:
+    """Problems with running `model` here: not in the catalogue, or a class the project's policy does not allow."""
+    rows = {row.get("id"): row for row in _list(catalogue.get("models") if isinstance(catalogue, dict) else None)}
+    if model not in rows:
+        return ["model %s is not in the model catalogue" % model]
+    if isinstance(policy, dict) and isinstance(policy.get("modelClasses"), list):
+        allowed = set(_strings(policy["modelClasses"]))
+        outside = [c for c in _strings(rows[model].get("classes")) if c not in allowed]
+        if outside:
+            meta = policy.get("meta") if isinstance(policy.get("meta"), dict) else {}
+            return ["model %s has class %s, which policy %s does not allow" % (model, ", ".join(outside), _js_string(meta.get("id")))]
+    return []
+
+
+# --- the well-known `configuration` and its tiles --------------------------------------------------------------
+
+def configuration(slots: Sequence[str], resolution: Dict[str, Any], runner_profile: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+    """The well-known `configuration` (DEC-0046): the configurable slots, and the profiles that apply now. Read-only:
+    a change is made in Fabric and reaches the agent through its binding."""
+    if "refused" in resolution:
+        raise ProfileError("the resolution was refused (%s); a refused resolution is not a configuration" % resolution["refused"])
+    resolved: Dict[str, Any] = {"from": resolution.get("from")}
+    if runner_profile:
+        resolved.update(runnerProfile=runner_profile.get("id"), runnerKind=runner_profile.get("runnerKind"), route=runner_profile.get("route"))
+    resolved.update(modelProfile=resolution.get("profile"), models=list(resolution.get("models") or []))
+    doc = {"slots": list(slots), "resolved": {k: v for k, v in resolved.items() if v is not None}}
+    problems = _fs.configuration_problems(doc)
+    if problems:
+        raise ProfileError("; ".join(problems))
+    return doc
+
+
+def configuration_summary(doc: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """Summary tiles for the well-known document and the dashboard — "Runner & model"."""
+    resolved = doc.get("resolved") or {}
+    tiles = []
+    if resolved.get("runnerKind"):
+        tiles.append({"label": "Runner", "value": " · ".join(x for x in (resolved.get("runnerKind"), resolved.get("route")) if x)})
+    if resolved.get("modelProfile"):
+        first = (resolved.get("models") or [None])[0]
+        tiles.append({"label": "Model", "value": " · ".join(x for x in (resolved["modelProfile"], first) if x)})
+    return tiles

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_secrets.py

@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+"""The contract's one credential detector (Fabric Agent Contract DEC-0044, `src/secret-shape.ts` at the pin): a name
+that can only carry a credential, a value shaped like one, a launch argument that carries one, and a URL that does
+(LC-21). A port held to the contract's own answers by test/fixtures/contract/profile-vectors.json. Standard library
+only. The dashboard kit's fabric-button.js carries its own copy of the name and value checks (FL-4)."""
+
+from __future__ import annotations
+
+import re
+from typing import Dict, List
+import urllib.parse
+
+CREDENTIAL_WORDS = (
+    "token", "secret", "password", "passwd", "pass", "passphrase", "credential", "credentials", "cookie", "authorization",
+    "bearer", "jwt", "otp", "apikey", "signature", "sig",
+    "accesstoken", "idtoken", "authtoken", "refreshtoken", "sessionid", "sessiontoken", "logincode", "authcode", "privatekey",
+    "clientsecret", "secretkey", "accesskey",
+)
+CREDENTIAL_PAIRS: Dict[str, tuple] = {
+    "key": ("private", "api", "access", "secret", "session", "auth", "signing", "encryption", "master", "client", "login", "refresh"),
+    "auth": ("token", "code", "header"),
+    "session": ("token", "id"),
+    "code": ("login", "auth", "access", "session"),
+}
+JWT_SHAPE = re.compile(r"eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*")
+SECRET_VALUE = re.compile(r"(^bearer\s.+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})",
+                          re.IGNORECASE | re.DOTALL)
+_LONG_RUN = re.compile(r"[A-Za-z0-9+/=_-]{40,}")
+_BEARER_INSIDE = re.compile(r"\bbearer\s+(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{12,}=*", re.IGNORECASE)
+_PATH_LIKE = re.compile(r"^(?:[/~.]|[A-Za-z]:[\\/]|[a-z][a-z0-9+.-]*://)", re.IGNORECASE)
+_SCHEME = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:")
+
+
+def name_words(name: str) -> List[str]:
+    """A name's words: split at `.`, `_`, `-` and camelCase humps, lowercased (`APIKey` is `api key`)."""
+    spaced = re.sub(r"([a-z0-9])([A-Z])", r"\1 \2", name)
+    spaced = re.sub(r"([A-Z]+)([A-Z][a-z])", r"\1 \2", spaced)
+    return [w.lower() for w in re.split(r"[\s._-]+", spaced) if w]
+
+
+def _with_singulars(words: List[str]) -> List[str]:
+    return words + [w[:-1] for w in words if len(w) > 2 and w.endswith("s")]
+
+
+def credential_name(name: str) -> bool:
+    """Whether a name — a parameter, a header, an environment variable, a config key — can only carry a credential."""
+    split = name_words(name)
+    words = _with_singulars(split)
+    if any(w in CREDENTIAL_WORDS for w in words):
+        return True
+    if len(split) == 1 and any(w in CREDENTIAL_PAIRS for w in words):
+        return True
+    return any(word in words and any(p in words for p in partners) for word, partners in CREDENTIAL_PAIRS.items())
+
+
+def _long_secret(value: str) -> bool:
+    return any(re.search(r"[a-z]", run) and re.search(r"[A-Z]", run) and re.search(r"[0-9]", run) for run in _LONG_RUN.findall(value))
+
+
+def secret_value(value: str) -> bool:
+    """A JWT anywhere, a provider key or `Bearer …`, or a long base64 run mixing upper case, lower case and digits."""
+    return bool(JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or _long_secret(value))
+
+
+def _path_like(piece: str) -> bool:
+    return bool(_PATH_LIKE.match(piece)) or (
+        bool(re.search(r"[\\/]", piece))
+        and (bool(re.search(r"\.[A-Za-z0-9]{1,8}$", piece)) or any(re.fullmatch(r"[a-z][a-z0-9_-]{2,}", s) for s in re.split(r"[\\/]", piece))))
+
+
+def secret_argument(value: str) -> bool:
+    """The same for a launch argument or a server's command and URL: a long run is looked for between path separators,
+    so a folder path holding a session id is not taken for a key."""
+    if JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or _BEARER_INSIDE.search(value):
+        return True
+    for piece in re.split(r"[\s=]", value):
+        if _path_like(piece):
+            if any(_long_secret(part) for part in re.split(r"[\\/]", piece)):
+                return True
+        elif _long_secret(piece):
+            return True
+    return False
+
+
+def _decode_keeping_plus(raw: str) -> str:
+    """decodeURIComponent: a malformed escape or bytes that are not UTF-8 leave the raw text."""
+    if re.search(r"%(?![0-9A-Fa-f]{2})", raw):
+        return raw
+    try:
+        return urllib.parse.unquote_to_bytes(raw).decode("utf-8")
+    except UnicodeDecodeError:
+        return raw
+
+
+def _form_name(text: str) -> str:
+    pairs = urllib.parse.parse_qsl(text, keep_blank_values=True)
+    return pairs[0][0] if pairs else ""
+
+
+def raw_values(query: str) -> Dict[str, List[str]]:
+    """Each query or fragment piece's raw value by its decoded name, with `+` kept."""
+    values: Dict[str, List[str]] = {}
+    for piece in query.split("&"):
+        if piece == "":
+            continue
+        at = piece.find("=")
+        name = _form_name(piece if at < 0 else piece[:at])
+        values.setdefault(name, []).append("" if at < 0 else _decode_keeping_plus(piece[at + 1:]))
+    return values
+
+
+def secret_url(value: str) -> bool:
+    """Whether a URL an MCP entry or a launch names carries a credential (LC-21): anything secret_argument finds, a
+    password in its user information, or a query or fragment parameter whose name can only carry a credential and has
+    a value, or whose value is shaped like one. A string that is not an absolute URL is checked as an argument only."""
+    if secret_argument(value):
+        return True
+    if not _SCHEME.match(value.strip()):
+        return False  # not an absolute URL (WHATWG URL parsing refuses it)
+    try:
+        parts = urllib.parse.urlsplit(value.strip())
+    except ValueError:
+        return False
+    if not parts.scheme:
+        return False
+    if parts.password:
+        return True
+    for part in (parts.query, parts.fragment):
+        for name, raws in raw_values(part).items():
+            if any((raw != "" and credential_name(name)) or secret_value(raw) for raw in raws):
+                return True
+    return False

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -43,7 +43,7 @@ EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/service
 # The embedded dashboard declaration (fabric-dashboard/0.1, DEC-0036 ED-9), under the well-known
 # document's `extensions`. The kit is assets/dashboard-kit; its version is the one in kit.json.
 DASHBOARD_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1"
-DASHBOARD_KIT = "fabric-dashboard-kit@1.0.0"
+DASHBOARD_KIT = "fabric-dashboard-kit@1.1.0"
 REFERENCE_THEMES = ("graphite", "fabric", "paper", "forest", "ocean", "ember", "contrast")
 EXIT_ALREADY_RUNNING = 75
 # Lifecycle contract (fabric-workspace knowledge/lifecycle.md). A launchd-supervised copy that finds
@@ -758,12 +758,45 @@ def dashboard_extension(min_width: int = 360, appearance: Sequence[str] = ("sche
     return {DASHBOARD_EXTENSION_KEY: value}
 
 
+_PROFILE_ID = re.compile(r"^[a-z][a-z0-9-]{0,62}$")
+_RUNNER_KIND = re.compile(r"^[a-z][a-z0-9-]{1,62}$")
+_MODEL_ID = re.compile(r"^[a-z0-9][a-z0-9._-]{0,63}/[a-z0-9][a-z0-9._:-]{0,127}$")
+ROUTES = ("subscription", "key")
+
+
+def configuration_problems(doc: Any) -> List[str]:
+    """DEC-0046: the well-known `configuration` — {slots, resolved} as service-well-known.schema.json types it."""
+    if not isinstance(doc, dict):
+        return ["configuration is an object"]
+    problems = ["configuration has no member %s" % k for k in doc if k not in ("slots", "resolved")]
+    slots = doc.get("slots")
+    if not isinstance(slots, list) or len(slots) > 2 or len(set(map(str, slots))) != len(slots) or not all(s in ("runner", "model") for s in slots):
+        problems.append("slots is a list of runner and model, each once")
+    resolved = doc.get("resolved")
+    if not isinstance(resolved, dict):
+        return problems + ["resolved is an object"]
+    for k, v in resolved.items():
+        ok = {"from": lambda x: x in ("request", "agent", "binding", "estate"),
+              "runnerProfile": lambda x: isinstance(x, str) and bool(_PROFILE_ID.match(x)),
+              "modelProfile": lambda x: isinstance(x, str) and bool(_PROFILE_ID.match(x)),
+              "runnerKind": lambda x: isinstance(x, str) and bool(_RUNNER_KIND.match(x)),
+              "route": lambda x: x in ROUTES,
+              "models": lambda x: isinstance(x, list) and len(x) <= 16 and all(isinstance(m, str) and _MODEL_ID.match(m) for m in x)}.get(k)
+        if ok is None:
+            problems.append("resolved has no member %s" % k)
+        elif not ok(v):
+            problems.append("resolved.%s is not valid" % k)
+    return problems
+
+
 def build_well_known(*, service_id: str, instance: str, name: str, version: str, build: Dict[str, Any],
                      started_at: str, status: str, degraded: Sequence[Dict[str, str]],
                      surfaces: Dict[str, Any], summary: Optional[Sequence[Dict[str, Any]]] = None,
                      update_available: Optional[str] = None, pid: Optional[int] = None,
-                     extensions: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+                     extensions: Optional[Dict[str, Any]] = None,
+                     configuration: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     """The unauthenticated identity answer. `degraded` is always present; ready means empty.
+    `configuration` (DEC-0046) says what the operator can configure and what applies now; fabric_profiles builds it.
     `extensions` is kept as given (a reader ignores keys it does not know); a dashboard declaration
     in it must be valid (dashboard_extension builds one)."""
     if status not in STATUSES:
@@ -790,6 +823,11 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
             if problems:
                 raise ServiceError("Dashboard declaration: %s." % "; ".join(problems))
         doc["extensions"] = dict(extensions)
+    if configuration is not None:
+        problems = configuration_problems(configuration)
+        if problems:
+            raise ServiceError("configuration: %s." % "; ".join(problems))
+        doc["configuration"] = configuration
     return doc
 
 
@@ -896,7 +934,7 @@ _PROVIDER = re.compile(r"^[a-z][a-z0-9._-]{0,63}$")
 def make_usage_receipt(provider: str, model: str, *, input_tokens: int, output_tokens: int,
                        cache_read_tokens: int = 0, cache_write_tokens: int = 0,
                        cost_usd: Optional[float] = None, cost_basis: Optional[str] = None,
-                       at: Optional[str] = None) -> Dict[str, Any]:
+                       at: Optional[str] = None, route: Optional[str] = None) -> Dict[str, Any]:
     """One model call, from the provider's own usage numbers. No prompt, output or caller.
 
     `cost_usd` is None when the call cannot be priced: the report counts it as unpriced and
@@ -917,8 +955,13 @@ def make_usage_receipt(provider: str, model: str, *, input_tokens: int, output_t
     basis = cost_basis or ("unknown" if cost_usd is None else "provider")
     if basis not in COST_BASES or (cost_usd is None) != (basis == "unknown"):
         raise ServiceError("cost_basis is provider or price-list with a cost, unknown without one.")
-    return {"at": at or now_iso(), "provider": provider, "model": model, **counts,
-            "costUsd": None if cost_usd is None else float(cost_usd), "costBasis": basis}
+    if route is not None and route not in ROUTES:
+        raise ServiceError("route is subscription or key (DEC-0046).")
+    receipt = {"at": at or now_iso(), "provider": provider, "model": model, **counts,
+               "costUsd": None if cost_usd is None else float(cost_usd), "costBasis": basis}
+    if route is not None:
+        receipt["route"] = route  # the operator's own login in its vendor's runner, or an issued key
+    return receipt
 
 
 def _add_totals(row: Dict[str, Any], receipt: Dict[str, Any]) -> None:
@@ -952,20 +995,22 @@ def usage_report(receipts: Iterable[Dict[str, Any]], *, service_id: str, instanc
         date = str(r.get("at", ""))[:10]
         if not (first <= date <= last):
             continue
-        key = (r["provider"], r["model"])
-        row = days.setdefault(date, {}).setdefault("%s\u0000%s" % key, {
+        key = (r["provider"], r["model"], r.get("route") or "")
+        row = days.setdefault(date, {}).setdefault("%s\u0000%s\u0000%s" % key, {
             "provider": r["provider"], "model": r["model"], "calls": 0, "unpricedCalls": 0,
             "inputTokens": 0, "outputTokens": 0, "cacheReadTokens": 0, "cacheWriteTokens": 0, "_cost": 0.0})
+        if r.get("route"):
+            row["route"] = r["route"]  # DEC-0046: rows of one model on two routes stay apart
         _add_totals(row, r)
         bases.setdefault((date,) + key, set()).add(r.get("costBasis") or "unknown")
     out_days = []
     for date in sorted(days):
         models = []
         for row in days[date].values():
-            seen = bases[(date, row["provider"], row["model"])]
+            seen = bases[(date, row["provider"], row["model"], row.get("route") or "")]
             row["costBasis"] = next(iter(seen)) if len(seen) == 1 else "mixed"
             models.append(_close_totals(row))
-        models.sort(key=lambda m: (m["provider"], m["model"]))
+        models.sort(key=lambda m: (m["provider"], m["model"], m.get("route") or ""))
         day = {"date": date, "calls": 0, "unpricedCalls": 0, "inputTokens": 0, "outputTokens": 0,
                "cacheReadTokens": 0, "cacheWriteTokens": 0, "_cost": 0.0}
         for m in models:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/sample_service.py

@@ -33,10 +33,12 @@ VERSION = "0.1.0"
 # in the well-known document only when the kit is there to serve.
 KIT_DIR = Path(__file__).resolve().parent.parent / "assets" / "dashboard-kit"
 KIT_FILES = {"/kit/fabric-dashboard.css": ("fabric-dashboard.css", "text/css; charset=utf-8"),
-             "/kit/fabric-dashboard.js": ("fabric-dashboard.js", "text/javascript; charset=utf-8")}
+             "/kit/fabric-dashboard.js": ("fabric-dashboard.js", "text/javascript; charset=utf-8"),
+             "/kit/fabric-button.js": ("fabric-button.js", "text/javascript; charset=utf-8")}  # DEC-0040, FB-7
 PAGE = """<!doctype html><html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1"><title>{name}</title>
 <link rel="stylesheet" href="/kit/fabric-dashboard.css"><script src="/kit/fabric-dashboard.js" defer></script>
+<script src="/kit/fabric-button.js" defer data-service="{agent}" data-service-name="{name}"></script>
 </head><body><div class="fd-chrome"><header class="fd-header"><p class="fd-title">{name}</p>
 <span class="fd-chip fd-s-ok"><span class="fd-dot"></span>Status: {status}</span></header>
 <nav class="fd-nav" aria-label="Sections"><ul class="fd-nav-list"><li><a href="#events" aria-current="page">Events</a></li>
@@ -227,7 +229,7 @@ def make_handler(svc: Service):
                     return self._send(401, "Open this dashboard from Fabric Dashboards.", content_type="text/plain")
                 rows = "".join("<li>%s — %s</li>" % (html.escape(e["at"]), html.escape(e["text"]))
                                for e in reversed(svc.log.fetch(None, 20)))
-                return self._send(200, PAGE.format(name=html.escape(svc.name), status="ready", rows=rows),
+                return self._send(200, PAGE.format(name=html.escape(svc.name), agent=html.escape("%s.%s" % (svc.id, svc.instance)), status="ready", rows=rows),
                                   content_type="text/html; charset=utf-8")
             self._send(404, {"error": "Not found."})
 

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.14.0"
+  version: "0.16.0"
   contract-version: "0.1.0"
   contract-commit: "0cacd08b0e95b6abf131eae1206b60792138bc3c"
 ---