@passioncode-ai/fabric-agent-adapter 0.15.0 → 0.17.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-profiles.mjs

@@ -0,0 +1,196 @@
+// Runner and model profiles in the kit (Fabric Agent Contract DEC-0046, Fabric ADR-0147). A port of the contract's
+// `src/profile-rules.ts` at the pin — resolveModelProfile and the FAC-SEM-058…060 checks — held to the contract's own
+// answers by test/fixtures/contract/profile-vectors.json; plus the doctor's runner and model checks (runners.md C2) and
+// the well-known `configuration` with its summary tiles ("Runner & model"). No dependencies.
+
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { secretValue } from './fabric-secrets.mjs';
+import { configurationProblems } from './fabric-service.mjs';
+
+export const RESOLUTION_ORDER = Object.freeze(['request', 'agent', 'binding', 'estate']);
+/** The vendor login each subscription is, and the one runner kind it runs in (DEC-0046, ADR-0147 decision 2). */
+export const SUBSCRIPTION_RUNNER = Object.freeze({ claude: 'claude-code', kimi: 'kimi-code', chatgpt: 'codex' });
+export const MAX_PROBE_MS = 5000;
+const BARE_BINARY = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+export class ProfileError extends Error {}
+
+const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const list = (value) => (Array.isArray(value) ? value.filter(isObject) : []);
+const strings = (value) => (Array.isArray(value) ? value.filter((item) => typeof item === 'string') : []);
+const jsonEqual = (a, b) => JSON.stringify(sortKeys(a)) === JSON.stringify(sortKeys(b));
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (isObject(value)) return Object.fromEntries(Object.keys(value).sort().map((k) => [k, sortKeys(value[k])]));
+  return value;
+}
+
+/** FAC-SEM-060: the request's profile, else the agent's, else the binding's or project's, else the estate default. */
+export function resolveModelProfile({ catalogue, profiles, choices = {}, policy } = {}) {
+  const level = RESOLUTION_ORDER.find((name) => typeof choices?.[name] === 'string');
+  if (level === undefined) return { refused: 'no-profile' };
+  const id = choices[level];
+  const profile = list(profiles).find((item) => item.id === id);
+  if (!profile) return { refused: 'unknown-profile', profile: id };
+  const models = strings(profile.models);
+  if (!isObject(policy) || !Array.isArray(policy.modelClasses)) return { from: level, profile: id, models };
+  const allowed = new Set(strings(policy.modelClasses));
+  const rows = new Map(list(isObject(catalogue) ? catalogue.models : undefined).map((row) => [row.id, row]));
+  const within = models.filter((model) => { const row = rows.get(model); return row !== undefined && strings(row.classes).every((name) => allowed.has(name)); });
+  if (within.length) return { from: level, profile: id, models: within };
+  const meta = isObject(policy.meta) ? policy.meta : {};
+  return { refused: 'model-classes-empty', profile: id, policy: { id: String(meta.id), revision: Number(meta.revision) } };
+}
+
+const finding = (code, instancePath, message) => ({ code, instancePath, message });
+
+function modelCatalogue(value) {
+  const findings = [];
+  const seen = new Set();
+  list(value.models).forEach((row, index) => {
+    if (seen.has(row.id)) findings.push(finding('FAC-SEM-058', `/models/${index}/id`, `model ${String(row.id)} is catalogued more than once`));
+    seen.add(row.id);
+    const routing = isObject(row.provider) ? row.provider : {};
+    const ignored = new Set(strings(routing.ignore));
+    for (const slug of strings(routing.order)) {
+      if (ignored.has(slug) || ignored.has(slug.split('/')[0])) findings.push(finding('FAC-SEM-058', `/models/${index}/provider`, `model ${String(row.id)} both orders and ignores provider ${slug}`));
+    }
+  });
+  return findings;
+}
+
+function modelProfiles(value) {
+  const findings = [];
+  const seen = new Set();
+  list(value.profiles).forEach((profile, index) => {
+    if (seen.has(profile.id)) findings.push(finding('FAC-SEM-058', `/profiles/${index}/id`, `model profile ${String(profile.id)} is declared more than once`));
+    seen.add(profile.id);
+  });
+  return findings;
+}
+
+function runnerProfile(value) {
+  const findings = [];
+  if (value.route === 'subscription' && isObject(value.subscription)) {
+    const login = String(value.subscription.login);
+    const runner = Object.hasOwn(SUBSCRIPTION_RUNNER, login) ? SUBSCRIPTION_RUNNER[login] : undefined;
+    if (runner !== value.runnerKind) findings.push(finding('FAC-SEM-059', '/runnerKind', `a ${login} subscription runs only in ${runner ?? "its vendor's runner"}, not in ${String(value.runnerKind)}; another runner takes the key route`));
+  }
+  if (value.route === 'key' && isObject(value.key)) {
+    if (value.key.modelAllowList !== value.modelProfile) findings.push(finding('FAC-SEM-059', '/key/modelAllowList', `the key admits the models of ${String(value.key.modelAllowList)}, but the profile runs ${String(value.modelProfile)}`));
+    if (typeof value.key.ref === 'string' && secretValue(value.key.ref)) findings.push(finding('FAC-SEM-059', '/key/ref', 'the key is named by its secret reference, never by its value'));
+  }
+  return findings;
+}
+
+function profileResolution(value) {
+  const findings = [];
+  const catalogued = new Set(list(isObject(value.catalogue) ? value.catalogue.models : undefined).map((row) => row.id));
+  const ids = new Set();
+  list(value.profiles).forEach((profile, i) => {
+    if (ids.has(profile.id)) findings.push(finding('FAC-SEM-060', `/profiles/${i}/id`, `profile id ${String(profile.id)} is offered more than once to one resolution`));
+    ids.add(profile.id);
+    strings(profile.models).forEach((model, j) => {
+      if (!catalogued.has(model)) findings.push(finding('FAC-SEM-060', `/profiles/${i}/models/${j}`, `profile ${String(profile.id)} names ${model}, which the catalogue does not hold`));
+    });
+  });
+  const choices = isObject(value.choices) ? value.choices : {};
+  const expected = resolveModelProfile({ catalogue: value.catalogue, profiles: value.profiles, choices, policy: value.policy });
+  if (value.resolved === undefined || !jsonEqual(value.resolved, expected)) findings.push(finding('FAC-SEM-060', '/resolved', `the resolution is ${JSON.stringify(expected)}`));
+  return findings;
+}
+
+/** The contract's profileRules: findings for a model-catalogue, model-profiles, runner-profile or profile-resolution; else undefined. */
+export function profileProblems(kind, value) {
+  return { 'model-catalogue': modelCatalogue, 'model-profiles': modelProfiles, 'runner-profile': runnerProfile, 'profile-resolution': profileResolution }[kind]?.(value);
+}
+
+// ---- the doctor's checks ----
+
+const argvOf = (value, label) => {
+  if (!Array.isArray(value) || !value.every((a) => typeof a === 'string')) throw new ProfileError(`${label} is an argument array, never a shell string`);
+  return [...value];
+};
+
+function which(name, searchPath) {
+  for (const dir of String(searchPath ?? '').split(path.delimiter).filter(Boolean)) {
+    const candidate = path.join(dir, name);
+    try { fs.accessSync(candidate, fs.constants.X_OK); if (fs.statSync(candidate).isFile()) return candidate; } catch { /* next */ }
+  }
+  return null;
+}
+
+/**
+ * runners.md C2: is the catalogued runner installed, which version answers, and is it signed in. Only a bare
+ * catalogued binary on PATH is run, only with the catalogued version (and auth) argv, without a shell, within its
+ * timeout (at most 5 s). An entry outside these rules is refused and nothing runs.
+ */
+export function runnerCheck(entry, { searchPath = process.env.PATH, run = spawnSync } = {}) {
+  const { kind, binaries } = entry ?? {};
+  if (!Array.isArray(binaries) || !binaries.length || !binaries.every((b) => typeof b === 'string' && BARE_BINARY.test(b) && !b.includes('..'))) throw new ProfileError('binaries are bare executable names, never paths');
+  const version = isObject(entry.version) ? entry.version : {};
+  const versionArgv = argvOf(version.argv, 'version.argv');
+  if (typeof version.pattern !== 'string') throw new ProfileError('version.pattern is a regular expression');
+  const timeoutMs = version.timeoutMs ?? MAX_PROBE_MS;
+  if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_PROBE_MS) throw new ProfileError(`version.timeoutMs is at most ${MAX_PROBE_MS}`);
+  const authArgv = 'auth' in entry ? argvOf(entry.auth, 'auth') : null;
+  const out = { kind, installed: false, binary: null, version: null, signedIn: null, problems: [] };
+  const binary = binaries.map((name) => which(name, searchPath)).find(Boolean) ?? null;
+  if (!binary) { out.problems.push(`${kind} is not installed: none of ${binaries.join(', ')} is on PATH`); return out; }
+  Object.assign(out, { installed: true, binary });
+  const probe = (argv) => {
+    const result = run(binary, argv, { encoding: 'utf8', timeout: timeoutMs, shell: false });
+    if (result.error?.code === 'ETIMEDOUT' || result.signal === 'SIGTERM') { out.problems.push(`${kind} ${argv.join(' ')} did not answer within ${timeoutMs} ms`); return null; }
+    if (result.error) { out.problems.push(`${kind} could not be run: ${result.error.code ?? result.error.name}`); return null; }
+    return result;
+  };
+  const answered = probe(versionArgv);
+  if (answered) {
+    const re = new RegExp(version.pattern);
+    const match = re.exec(answered.stdout ?? '') ?? re.exec(answered.stderr ?? '');
+    if (match && match.length > 1) out.version = match[1];
+    else out.problems.push(`${kind} answered, but its version did not match the catalogue's pattern`);
+  }
+  if (authArgv) {
+    const signed = probe(authArgv);
+    if (signed) { out.signedIn = signed.status === 0; if (!out.signedIn) out.problems.push(`${kind} is installed but not signed in`); }
+  }
+  return out;
+}
+
+/** Problems with running `model` here: not in the catalogue, or a class the project's policy does not allow. */
+export function modelUsable(model, catalogue, policy) {
+  const rows = new Map(list(isObject(catalogue) ? catalogue.models : undefined).map((row) => [row.id, row]));
+  if (!rows.has(model)) return [`model ${model} is not in the model catalogue`];
+  if (isObject(policy) && Array.isArray(policy.modelClasses)) {
+    const allowed = new Set(strings(policy.modelClasses));
+    const outside = strings(rows.get(model).classes).filter((c) => !allowed.has(c));
+    if (outside.length) return [`model ${model} has class ${outside.join(', ')}, which policy ${String((isObject(policy.meta) ? policy.meta : {}).id)} does not allow`];
+  }
+  return [];
+}
+
+// ---- the well-known `configuration` and its tiles ----
+
+/** The well-known `configuration` (DEC-0046): read-only; a change is made in Fabric and reaches the agent through its binding. */
+export function configuration(slots, resolution, runnerProfileDoc) {
+  if ('refused' in resolution) throw new ProfileError(`the resolution was refused (${resolution.refused}); a refused resolution is not a configuration`);
+  const resolved = { from: resolution.from };
+  if (runnerProfileDoc) Object.assign(resolved, { runnerProfile: runnerProfileDoc.id, runnerKind: runnerProfileDoc.runnerKind, route: runnerProfileDoc.route });
+  Object.assign(resolved, { modelProfile: resolution.profile, models: [...(resolution.models ?? [])] });
+  const doc = { slots: [...slots], resolved: Object.fromEntries(Object.entries(resolved).filter(([, v]) => v !== undefined && v !== null)) };
+  const problems = configurationProblems(doc);
+  if (problems.length) throw new ProfileError(problems.join('; '));
+  return doc;
+}
+
+/** Summary tiles for the well-known document and the dashboard — "Runner & model". */
+export function configurationSummary(doc) {
+  const resolved = doc?.resolved ?? {};
+  const tiles = [];
+  if (resolved.runnerKind) tiles.push({ label: 'Runner', value: [resolved.runnerKind, resolved.route].filter(Boolean).join(' · ') });
+  if (resolved.modelProfile) tiles.push({ label: 'Model', value: [resolved.modelProfile, (resolved.models ?? [])[0]].filter(Boolean).join(' · ') });
+  return tiles;
+}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-secrets.mjs

@@ -0,0 +1,86 @@
+// The contract's one credential detector (Fabric Agent Contract DEC-0044, `src/secret-shape.ts` at the pin): a name
+// that can only carry a credential, a value shaped like one, a launch argument that carries one, and a URL that does
+// (LC-21). A port held to the contract's own answers by test/fixtures/contract/profile-vectors.json. No dependencies.
+
+/** A name's words: split at `.`, `_`, `-` and camelCase humps, lowercased (`APIKey` is `api key`). */
+export function nameWords(name) {
+  return name
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+    .split(/[\s._-]+/)
+    .filter(Boolean)
+    .map((word) => word.toLowerCase());
+}
+
+export const CREDENTIAL_WORDS = Object.freeze([
+  'token', 'secret', 'password', 'passwd', 'pass', 'passphrase', 'credential', 'credentials', 'cookie', 'authorization',
+  'bearer', 'jwt', 'otp', 'apikey', 'signature', 'sig',
+  'accesstoken', 'idtoken', 'authtoken', 'refreshtoken', 'sessionid', 'sessiontoken', 'logincode', 'authcode', 'privatekey',
+  'clientsecret', 'secretkey', 'accesskey',
+]);
+export const CREDENTIAL_PAIRS = Object.freeze({
+  key: ['private', 'api', 'access', 'secret', 'session', 'auth', 'signing', 'encryption', 'master', 'client', 'login', 'refresh'],
+  auth: ['token', 'code', 'header'],
+  session: ['token', 'id'],
+  code: ['login', 'auth', 'access', 'session'],
+});
+
+const withSingulars = (words) => [...words, ...words.filter((word) => word.length > 2 && word.endsWith('s')).map((word) => word.slice(0, -1))];
+
+/** Whether a name — a parameter, a header, an environment variable, a config key — can only carry a credential. */
+export function credentialName(name) {
+  const split = nameWords(name);
+  const words = withSingulars(split);
+  if (words.some((word) => CREDENTIAL_WORDS.includes(word))) return true;
+  if (split.length === 1 && words.some((word) => Object.hasOwn(CREDENTIAL_PAIRS, word))) return true;
+  return Object.entries(CREDENTIAL_PAIRS).some(([word, partners]) => words.includes(word) && partners.some((partner) => words.includes(partner)));
+}
+
+/** A JWT or JWS anywhere in a value. */
+export const JWT_SHAPE = /eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*/;
+/** A value that says it is a credential, or a provider key's shape. */
+export const SECRET_VALUE = /(^bearer\s.+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})/i;
+const LONG_RUN = /[A-Za-z0-9+/=_-]{40,}/g;
+const longSecret = (value) => (value.match(LONG_RUN) ?? []).some((run) => /[a-z]/.test(run) && /[A-Z]/.test(run) && /[0-9]/.test(run));
+
+/** Whether a value could be a credential: a JWT anywhere, a provider key or `Bearer …`, or a long secret-shaped run. */
+export const secretValue = (value) => JWT_SHAPE.test(value) || SECRET_VALUE.test(value) || longSecret(value);
+
+const BEARER_INSIDE = /\bbearer\s+(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{12,}=*/i;
+const PATH_LIKE = /^(?:[/~.]|[A-Za-z]:[\\/]|[a-z][a-z0-9+.-]*:\/\/)/i;
+const pathLike = (piece) =>
+  PATH_LIKE.test(piece) ||
+  (/[\\/]/.test(piece) && (/\.[A-Za-z0-9]{1,8}$/.test(piece) || piece.split(/[\\/]/).some((segment) => /^[a-z][a-z0-9_-]{2,}$/.test(segment))));
+
+/** The same for a launch argument or a server's command and URL: a long run is looked for between path separators. */
+export const secretArgument = (value) =>
+  JWT_SHAPE.test(value) || SECRET_VALUE.test(value) || BEARER_INSIDE.test(value) ||
+  value.split(/[\s=]/).some((piece) => (pathLike(piece) ? piece.split(/[\\/]/).some((part) => longSecret(part)) : longSecret(piece)));
+
+const decodeKeepingPlus = (raw) => { try { return decodeURIComponent(raw); } catch { return raw; } };
+
+/** Each query or fragment piece's raw value by its decoded name, with `+` kept. */
+export function rawValues(query) {
+  const values = new Map();
+  for (const piece of query.split('&')) {
+    if (piece === '') continue;
+    const at = piece.indexOf('=');
+    const name = [...new URLSearchParams(at < 0 ? piece : piece.slice(0, at)).keys()][0] ?? '';
+    values.set(name, [...(values.get(name) ?? []), at < 0 ? '' : decodeKeepingPlus(piece.slice(at + 1))]);
+  }
+  return values;
+}
+
+/** Whether a URL an MCP entry or a launch names carries a credential (LC-21). */
+export function secretUrl(value) {
+  if (secretArgument(value)) return true;
+  let url;
+  try { url = new URL(value); } catch { return false; }
+  if (url.password !== '') return true;
+  for (const part of [url.search, url.hash]) {
+    for (const [name, values] of rawValues(part.slice(1))) {
+      if (values.some((raw) => (raw !== '' && credentialName(name)) || secretValue(raw))) return true;
+    }
+  }
+  return false;
+}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -382,7 +382,34 @@ export function dashboardExtension({ minWidth = 360, appearance = ['scheme', 'th
 
 // `extensions` is kept as given (a reader ignores keys it does not know); a dashboard declaration in
 // it must be valid (dashboardExtension builds one).
-export function buildWellKnown({ id, instance, name, version, build, startedAt, status, degraded = [], surfaces, summary, updateAvailable = null, pid = process.pid, extensions }) {
+const PROFILE_ID = /^[a-z][a-z0-9-]{0,62}$/;
+const RUNNER_KIND = /^[a-z][a-z0-9-]{1,62}$/;
+const MODEL_ID = /^[a-z0-9][a-z0-9._-]{0,63}\/[a-z0-9][a-z0-9._:-]{0,127}$/;
+export const ROUTES = Object.freeze(['subscription', 'key']);
+
+/** DEC-0046: the well-known `configuration` — {slots, resolved} as service-well-known.schema.json types it. */
+export function configurationProblems(doc) {
+  if (doc === null || typeof doc !== 'object' || Array.isArray(doc)) return ['configuration is an object'];
+  const problems = Object.keys(doc).filter((k) => k !== 'slots' && k !== 'resolved').map((k) => `configuration has no member ${k}`);
+  const { slots, resolved } = doc;
+  if (!Array.isArray(slots) || slots.length > 2 || new Set(slots).size !== slots.length || !slots.every((s) => s === 'runner' || s === 'model')) problems.push('slots is a list of runner and model, each once');
+  if (resolved === null || typeof resolved !== 'object' || Array.isArray(resolved)) return [...problems, 'resolved is an object'];
+  const checks = {
+    from: (x) => ['request', 'agent', 'binding', 'estate'].includes(x),
+    runnerProfile: (x) => typeof x === 'string' && PROFILE_ID.test(x),
+    modelProfile: (x) => typeof x === 'string' && PROFILE_ID.test(x),
+    runnerKind: (x) => typeof x === 'string' && RUNNER_KIND.test(x),
+    route: (x) => ROUTES.includes(x),
+    models: (x) => Array.isArray(x) && x.length <= 16 && x.every((m) => typeof m === 'string' && MODEL_ID.test(m)),
+  };
+  for (const [k, v] of Object.entries(resolved)) {
+    if (!Object.hasOwn(checks, k)) problems.push(`resolved has no member ${k}`);
+    else if (!checks[k](v)) problems.push(`resolved.${k} is not valid`);
+  }
+  return problems;
+}
+
+export function buildWellKnown({ id, instance, name, version, build, startedAt, status, degraded = [], surfaces, summary, updateAvailable = null, pid = process.pid, extensions, configuration }) {
   if (!STATUSES.includes(status)) throw new ServiceError(`status must be one of ${STATUSES.join(', ')}.`);
   if (!surfaces?.events) throw new ServiceError('surfaces.events is required.');
   if (!(build?.commit || build?.digest)) throw new ServiceError('build needs a commit or a digest.');
@@ -403,6 +430,11 @@ export function buildWellKnown({ id, instance, name, version, build, startedAt,
     }
     doc.extensions = { ...extensions };
   }
+  if (configuration !== undefined) {
+    const problems = configurationProblems(configuration);
+    if (problems.length) throw new ServiceError(`configuration: ${problems.join('; ')}.`);
+    doc.configuration = configuration;
+  }
   return doc;
 }
 
@@ -450,7 +482,7 @@ const COUNTS = ['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTok
  * One model call, from the provider's own usage numbers. No prompt, output or caller.
  * `costUsd` null means it cannot be priced: the report counts it as unpriced, never as $0.
  */
-export function makeUsageReceipt(provider, model, { inputTokens, outputTokens, cacheReadTokens = 0, cacheWriteTokens = 0, costUsd = null, costBasis, at } = {}) {
+export function makeUsageReceipt(provider, model, { inputTokens, outputTokens, cacheReadTokens = 0, cacheWriteTokens = 0, costUsd = null, costBasis, at, route } = {}) {
   if (!PROVIDER.test(provider ?? '')) throw new ServiceError('provider must be a lowercase name such as anthropic or openrouter.');
   model = String(model ?? '').trim();
   if (!model || model.length > 128) throw new ServiceError('model must be 1 to 128 characters.');
@@ -459,7 +491,8 @@ export function makeUsageReceipt(provider, model, { inputTokens, outputTokens, c
   if (costUsd !== null && (typeof costUsd !== 'number' || !Number.isFinite(costUsd) || costUsd < 0)) throw new ServiceError('costUsd must be a non-negative number or null.');
   const basis = costBasis ?? (costUsd === null ? 'unknown' : 'provider');
   if (!COST_BASES.includes(basis) || (costUsd === null) !== (basis === 'unknown')) throw new ServiceError('costBasis is provider or price-list with a cost, unknown without one.');
-  return { at: at ?? nowIso(), provider, model, ...counts, costUsd, costBasis: basis };
+  if (route !== undefined && !ROUTES.includes(route)) throw new ServiceError('route is subscription or key (DEC-0046).');
+  return { at: at ?? nowIso(), provider, model, ...counts, costUsd, costBasis: basis, ...(route === undefined ? {} : { route }) };
 }
 
 const utcDate = (ms) => new Date(ms).toISOString().slice(0, 10);
@@ -482,8 +515,9 @@ export function usageReport(receipts, { id, instance = 'default', now = Date.now
     if (date < first || date > last) continue;
     const rows = days.get(date) ?? new Map();
     days.set(date, rows);
-    const k = `${r.provider}\u0000${r.model}`;
-    const row = rows.get(k) ?? emptyRow({ provider: r.provider, model: r.model, bases: new Set() });
+    const k = `${r.provider}\u0000${r.model}\u0000${r.route ?? ''}`;
+    // DEC-0046: rows of one model on two routes stay apart.
+    const row = rows.get(k) ?? emptyRow({ provider: r.provider, model: r.model, ...(r.route ? { route: r.route } : {}), bases: new Set() });
     rows.set(k, row);
     row.calls += 1;
     for (const c of COUNTS) row[c] += Number(r[c] ?? 0);
@@ -493,7 +527,7 @@ export function usageReport(receipts, { id, instance = 'default', now = Date.now
   const outDays = [...days.keys()].sort().map((date) => {
     const models = [...days.get(date).values()]
       .map(({ bases, ...row }) => closeRow({ ...row, costBasis: bases.size === 1 ? [...bases][0] : 'mixed' }))
-      .sort((a, b) => (a.provider + a.model < b.provider + b.model ? -1 : 1));
+      .sort((a, b) => (`${a.provider}\u0000${a.model}\u0000${a.route ?? ''}` < `${b.provider}\u0000${b.model}\u0000${b.route ?? ''}` ? -1 : 1));
     const day = emptyRow({ date });
     for (const m of models) {
       for (const c of ['calls', 'unpricedCalls', ...COUNTS]) day[c] += m[c];

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_profiles.py

@@ -0,0 +1,277 @@
+#!/usr/bin/env python3
+"""Runner and model profiles in the kit (Fabric Agent Contract DEC-0046, Fabric ADR-0147). A port of the contract's
+`src/profile-rules.ts` at the pin — `resolve_model_profile` and the FAC-SEM-058…060 checks — held to the contract's own
+answers by test/fixtures/contract/profile-vectors.json; plus what a service does with them: the doctor's runner and
+model checks (runners.md C2) and the well-known `configuration` with its summary tiles ("Runner & model").
+
+    import fabric_profiles as fp
+    resolution = fp.resolve_model_profile(catalogue=catalogue, profiles=profiles, choices={"binding": "default"}, policy=policy)
+    configuration = fp.configuration(["runner", "model"], resolution, runner_profile)   # well-known `configuration`
+    summary += fp.configuration_summary(configuration)                                    # the dashboard's tiles
+"""
+
+from __future__ import annotations
+
+import json
+import math
+import re
+import shutil
+import subprocess
+from typing import Any, Callable, Dict, List, Optional, Sequence
+
+import fabric_secrets as _secrets
+import fabric_service as _fs
+
+RESOLUTION_ORDER = ("request", "agent", "binding", "estate")
+# The vendor login each subscription is, and the one runner kind it runs in (DEC-0046, ADR-0147 decision 2).
+SUBSCRIPTION_RUNNER = {"claude": "claude-code", "kimi": "kimi-code", "chatgpt": "codex"}
+MAX_PROBE_MS = 5000
+_BARE_BINARY = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*$")
+
+
+class ProfileError(ValueError):
+    pass
+
+
+def _list(value: Any) -> List[Dict[str, Any]]:
+    return [item for item in value if isinstance(item, dict)] if isinstance(value, list) else []
+
+
+def _strings(value: Any) -> List[str]:
+    return [item for item in value if isinstance(item, str)] if isinstance(value, list) else []
+
+
+def _js_string(value: Any) -> str:
+    """JavaScript's String(value), which the contract's messages and policy ids use."""
+    if value is None:
+        return "undefined"
+    if value is True:
+        return "true"
+    if value is False:
+        return "false"
+    if isinstance(value, float) and value.is_integer():
+        return str(int(value))
+    if isinstance(value, (dict, list)):
+        return "[object Object]" if isinstance(value, dict) else ",".join(_js_string(v) for v in value)
+    return str(value)
+
+
+def _js_number(value: Any) -> Optional[float]:
+    """JavaScript's Number(value); NaN is None (JSON writes it as null)."""
+    if isinstance(value, bool):
+        return 1 if value else 0
+    if isinstance(value, (int, float)):
+        return value if not (isinstance(value, float) and math.isnan(value)) else None
+    if isinstance(value, str):
+        text = value.strip()
+        if text == "":
+            return 0
+        try:
+            number = float(text)
+        except ValueError:
+            return None
+        return int(number) if number.is_integer() else number
+    return None
+
+
+def resolve_model_profile(*, catalogue: Any, profiles: Any, choices: Any, policy: Any = None) -> Dict[str, Any]:
+    """FAC-SEM-060: the request's profile, else the agent's, else the binding's or project's, else the estate default.
+    When the project's policy names `modelClasses`, a model stays only if every class the catalogue gives it is
+    allowed; an empty result refuses the launch, naming the policy."""
+    choices = choices if isinstance(choices, dict) else {}
+    level = next((name for name in RESOLUTION_ORDER if isinstance(choices.get(name), str)), None)
+    if level is None:
+        return {"refused": "no-profile"}
+    profile_id = choices[level]
+    profile = next((item for item in _list(profiles) if item.get("id") == profile_id), None)
+    if profile is None:
+        return {"refused": "unknown-profile", "profile": profile_id}
+    models = _strings(profile.get("models"))
+    if not isinstance(policy, dict) or not isinstance(policy.get("modelClasses"), list):
+        return {"from": level, "profile": profile_id, "models": models}
+    allowed = set(_strings(policy["modelClasses"]))
+    rows = {}
+    for row in _list(catalogue.get("models") if isinstance(catalogue, dict) else None):
+        rows[json.dumps(row.get("id"))] = row
+    within = [m for m in models if json.dumps(m) in rows and all(c in allowed for c in _strings(rows[json.dumps(m)].get("classes")))]
+    if within:
+        return {"from": level, "profile": profile_id, "models": within}
+    meta = policy.get("meta") if isinstance(policy.get("meta"), dict) else {}
+    return {"refused": "model-classes-empty", "profile": profile_id, "policy": {"id": _js_string(meta.get("id")), "revision": _js_number(meta.get("revision"))}}
+
+
+def _finding(code: str, path: str, message: str) -> Dict[str, str]:
+    return {"code": code, "instancePath": path, "message": message}
+
+
+def _model_catalogue(value: Dict[str, Any]) -> List[Dict[str, str]]:
+    findings, seen = [], []
+    for index, row in enumerate(_list(value.get("models"))):
+        if row.get("id") in seen:
+            findings.append(_finding("FAC-SEM-058", "/models/%d/id" % index, "model %s is catalogued more than once" % _js_string(row.get("id"))))
+        seen.append(row.get("id"))
+        routing = row.get("provider") if isinstance(row.get("provider"), dict) else {}
+        ignored = set(_strings(routing.get("ignore")))
+        for slug in _strings(routing.get("order")):
+            if slug in ignored or slug.split("/")[0] in ignored:
+                findings.append(_finding("FAC-SEM-058", "/models/%d/provider" % index, "model %s both orders and ignores provider %s" % (_js_string(row.get("id")), slug)))
+    return findings
+
+
+def _model_profiles(value: Dict[str, Any]) -> List[Dict[str, str]]:
+    findings, seen = [], []
+    for index, profile in enumerate(_list(value.get("profiles"))):
+        if profile.get("id") in seen:
+            findings.append(_finding("FAC-SEM-058", "/profiles/%d/id" % index, "model profile %s is declared more than once" % _js_string(profile.get("id"))))
+        seen.append(profile.get("id"))
+    return findings
+
+
+def _runner_profile(value: Dict[str, Any]) -> List[Dict[str, str]]:
+    findings = []
+    if value.get("route") == "subscription" and isinstance(value.get("subscription"), dict):
+        login = _js_string(value["subscription"].get("login"))
+        runner = SUBSCRIPTION_RUNNER.get(login)
+        if runner != value.get("runnerKind"):
+            findings.append(_finding("FAC-SEM-059", "/runnerKind", "a %s subscription runs only in %s, not in %s; another runner takes the key route"
+                                     % (login, runner if runner is not None else "its vendor's runner", _js_string(value.get("runnerKind")))))
+    if value.get("route") == "key" and isinstance(value.get("key"), dict):
+        key = value["key"]
+        if key.get("modelAllowList") != value.get("modelProfile") or ("modelAllowList" in key) != ("modelProfile" in value):
+            findings.append(_finding("FAC-SEM-059", "/key/modelAllowList", "the key admits the models of %s, but the profile runs %s"
+                                     % (_js_string(key.get("modelAllowList")), _js_string(value.get("modelProfile")))))
+        if isinstance(key.get("ref"), str) and _secrets.secret_value(key["ref"]):
+            findings.append(_finding("FAC-SEM-059", "/key/ref", "the key is named by its secret reference, never by its value"))
+    return findings
+
+
+def _compact(value: Any) -> str:
+    return json.dumps(value, separators=(",", ":"), ensure_ascii=False)
+
+
+def _profile_resolution(value: Dict[str, Any]) -> List[Dict[str, str]]:
+    findings = []
+    catalogue = value.get("catalogue")
+    catalogued = [row.get("id") for row in _list(catalogue.get("models") if isinstance(catalogue, dict) else None)]
+    ids: List[Any] = []
+    for i, profile in enumerate(_list(value.get("profiles"))):
+        if profile.get("id") in ids:
+            findings.append(_finding("FAC-SEM-060", "/profiles/%d/id" % i, "profile id %s is offered more than once to one resolution" % _js_string(profile.get("id"))))
+        ids.append(profile.get("id"))
+        for j, model in enumerate(_strings(profile.get("models"))):
+            if model not in catalogued:
+                findings.append(_finding("FAC-SEM-060", "/profiles/%d/models/%d" % (i, j), "profile %s names %s, which the catalogue does not hold" % (_js_string(profile.get("id")), model)))
+    choices = value.get("choices") if isinstance(value.get("choices"), dict) else {}
+    expected = resolve_model_profile(catalogue=catalogue, profiles=value.get("profiles"), choices=choices, policy=value.get("policy"))
+    if "resolved" not in value or value["resolved"] != expected:
+        findings.append(_finding("FAC-SEM-060", "/resolved", "the resolution is %s" % _compact(expected)))
+    return findings
+
+
+def profile_problems(kind: str, value: Dict[str, Any]) -> Optional[List[Dict[str, str]]]:
+    """The contract's profileRules: findings for a `model-catalogue`, `model-profiles`, `runner-profile` or
+    `profile-resolution` document; None for another kind."""
+    return {"model-catalogue": _model_catalogue, "model-profiles": _model_profiles, "runner-profile": _runner_profile,
+            "profile-resolution": _profile_resolution}.get(kind, lambda v: None)(value)
+
+
+# --- the doctor's checks ----------------------------------------------------------------------------------------
+
+def _argv(value: Any, label: str) -> List[str]:
+    if not isinstance(value, list) or not all(isinstance(a, str) for a in value):
+        raise ProfileError("%s is an argument array, never a shell string" % label)
+    return list(value)
+
+
+def runner_check(entry: Dict[str, Any], *, path: Optional[str] = None,
+                 run: Callable[..., Any] = subprocess.run) -> Dict[str, Any]:
+    """runners.md C2: is the catalogued runner installed, which version answers, and is it signed in. Only a bare
+    catalogued binary found on PATH is run, only with the catalogued version argv (and `auth` argv), without a shell,
+    within its timeout (at most 5 s). A catalogue entry outside these rules is refused and nothing runs."""
+    kind = entry.get("kind")
+    binaries = entry.get("binaries")
+    if not isinstance(binaries, list) or not binaries or not all(isinstance(b, str) and _BARE_BINARY.match(b) and ".." not in b for b in binaries):
+        raise ProfileError("binaries are bare executable names, never paths")
+    version = entry.get("version") if isinstance(entry.get("version"), dict) else {}
+    version_argv = _argv(version.get("argv"), "version.argv")
+    pattern = version.get("pattern")
+    if not isinstance(pattern, str):
+        raise ProfileError("version.pattern is a regular expression")
+    timeout_ms = version.get("timeoutMs", MAX_PROBE_MS)
+    if not isinstance(timeout_ms, int) or isinstance(timeout_ms, bool) or not 0 < timeout_ms <= MAX_PROBE_MS:
+        raise ProfileError("version.timeoutMs is at most %d" % MAX_PROBE_MS)
+    auth_argv = _argv(entry["auth"], "auth") if "auth" in entry else None
+    out: Dict[str, Any] = {"kind": kind, "installed": False, "binary": None, "version": None, "signedIn": None, "problems": []}
+    binary = next((found for found in (shutil.which(name, path=path) for name in binaries) if found), None)
+    if binary is None:
+        out["problems"].append("%s is not installed: none of %s is on PATH" % (kind, ", ".join(binaries)))
+        return out
+    out.update(installed=True, binary=binary)
+
+    def probe(argv: List[str]) -> Optional[Any]:
+        try:
+            return run([binary] + argv, capture_output=True, text=True, timeout=timeout_ms / 1000.0, shell=False)
+        except subprocess.TimeoutExpired:
+            out["problems"].append("%s %s did not answer within %d ms" % (kind, " ".join(argv), timeout_ms))
+        except OSError as exc:
+            out["problems"].append("%s could not be run: %s" % (kind, exc.__class__.__name__))
+        return None
+
+    answered = probe(version_argv)
+    if answered is not None:
+        match = re.search(pattern, answered.stdout or "") or re.search(pattern, answered.stderr or "")
+        if match and match.groups():
+            out["version"] = match.group(1)
+        else:
+            out["problems"].append("%s answered, but its version did not match the catalogue's pattern" % kind)
+    if auth_argv is not None:
+        signed = probe(auth_argv)
+        if signed is not None:
+            out["signedIn"] = signed.returncode == 0
+            if not out["signedIn"]:
+                out["problems"].append("%s is installed but not signed in" % kind)
+    return out
+
+
+def model_usable(model: str, catalogue: Any, policy: Any = None) -> List[str]:
+    """Problems with running `model` here: not in the catalogue, or a class the project's policy does not allow."""
+    rows = {row.get("id"): row for row in _list(catalogue.get("models") if isinstance(catalogue, dict) else None)}
+    if model not in rows:
+        return ["model %s is not in the model catalogue" % model]
+    if isinstance(policy, dict) and isinstance(policy.get("modelClasses"), list):
+        allowed = set(_strings(policy["modelClasses"]))
+        outside = [c for c in _strings(rows[model].get("classes")) if c not in allowed]
+        if outside:
+            meta = policy.get("meta") if isinstance(policy.get("meta"), dict) else {}
+            return ["model %s has class %s, which policy %s does not allow" % (model, ", ".join(outside), _js_string(meta.get("id")))]
+    return []
+
+
+# --- the well-known `configuration` and its tiles --------------------------------------------------------------
+
+def configuration(slots: Sequence[str], resolution: Dict[str, Any], runner_profile: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+    """The well-known `configuration` (DEC-0046): the configurable slots, and the profiles that apply now. Read-only:
+    a change is made in Fabric and reaches the agent through its binding."""
+    if "refused" in resolution:
+        raise ProfileError("the resolution was refused (%s); a refused resolution is not a configuration" % resolution["refused"])
+    resolved: Dict[str, Any] = {"from": resolution.get("from")}
+    if runner_profile:
+        resolved.update(runnerProfile=runner_profile.get("id"), runnerKind=runner_profile.get("runnerKind"), route=runner_profile.get("route"))
+    resolved.update(modelProfile=resolution.get("profile"), models=list(resolution.get("models") or []))
+    doc = {"slots": list(slots), "resolved": {k: v for k, v in resolved.items() if v is not None}}
+    problems = _fs.configuration_problems(doc)
+    if problems:
+        raise ProfileError("; ".join(problems))
+    return doc
+
+
+def configuration_summary(doc: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """Summary tiles for the well-known document and the dashboard — "Runner & model"."""
+    resolved = doc.get("resolved") or {}
+    tiles = []
+    if resolved.get("runnerKind"):
+        tiles.append({"label": "Runner", "value": " · ".join(x for x in (resolved.get("runnerKind"), resolved.get("route")) if x)})
+    if resolved.get("modelProfile"):
+        first = (resolved.get("models") or [None])[0]
+        tiles.append({"label": "Model", "value": " · ".join(x for x in (resolved["modelProfile"], first) if x)})
+    return tiles