@passioncode-ai/fabric-agent-adapter 0.22.0 → 0.23.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-estate.mjs

@@ -17,6 +17,8 @@ import { secretValue } from './fabric-secrets.mjs';
 export const ESTATE_RECORD_SCHEMA = 'estate-record/1';
 export const ESTATE_CHALLENGE_TYPE = 'estate-revision/1';
 export const MAX_VALIDITY_SECONDS = 30 * 24 * 60 * 60;
+/** How far ahead of the verifier's clock a signed `issuedAt` may be before it is `not-yet-valid` (DEC-0066). */
+export const CLOCK_SKEW_SECONDS = 60;
 export const ASSERTION_ALGORITHMS = Object.freeze(['ES256', 'EdDSA']);
 export const FLAGS = Object.freeze({ UP: 0x01, UV: 0x04, BE: 0x08, BS: 0x10, AT: 0x40, ED: 0x80 });
 
@@ -153,6 +155,34 @@ export function estateTime(value) {
   if (date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day || hour > 23 || minute > 59 || second > 59) return Number.NaN;
   return Date.parse(value);
 }
+const LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+/** `sign.` and at least two more labels, lower case: a signing RP ID is never a bare `sign.<tld>` (DEC-0063). */
+const SIGNING_RP = new RegExp(`^sign(?:\\.${LABEL}){2,}$`);
+
+/**
+ * Whether an RP ID is a dedicated signing RP (v4 §7, DEC-0063): first label `sign`, then the organization's or
+ * PassionCode's domain, lower case. A credential under any other RP ID is a sign-in credential and never signs.
+ */
+export const isSigningRpId = (rpId) => isString(rpId) && rpId.length <= 253 && SIGNING_RP.test(rpId);
+
+/** Whether a pinned origin may run a signing ceremony for `rpId`: https, no port, no path, the RP ID or a host under it. */
+export function originWithin(origin, rpId) {
+  const host = isString(origin) ? /^https:\/\/([a-z0-9.-]{1,253})$/.exec(origin)?.[1] : undefined;
+  return host !== undefined && (host === rpId || host.endsWith(`.${rpId}`));
+}
+
+/** FAC-SEM-092 on one signing credential: a signing RP ID, and every pinned origin within it. */
+function signingCredential(credential, path, flag) {
+  const value = isObject(credential) ? credential : {};
+  if (!isSigningRpId(value.rpId)) {
+    flag(`${path}/rpId`, 'a passkey signs only under a dedicated signing RP, sign.<domain>, never under the RP ID it signs in with');
+    return;
+  }
+  (Array.isArray(value.origins) ? value.origins : []).forEach((origin, index) => {
+    if (!originWithin(origin, value.rpId)) flag(`${path}/origins/${index}`, `a signing ceremony runs only on ${value.rpId} or a host under it, over https without a port`);
+  });
+}
+
 const revocationKey = (entry) => `${String(entry.kind)} ${String(entry.ref)}`;
 const clockOf = (at) => (at instanceof Date ? at.getTime() : (typeof at === 'number' && Number.isFinite(at) ? at * 1000 : Number.NaN));
 
@@ -206,13 +236,18 @@ export function verifyEstateRecord(record, trust) {
     credentialId: String(authority.credentialId), alg: String(authority.alg), publicKey: isObject(authority.publicKey) ? authority.publicKey : {},
     rpId: String(authority.rpId), origins: Array.isArray(authority.origins) ? authority.origins.filter(isString) : [],
   };
+  // DEC-0063: the estate passkey is a signing credential. An RP ID that is not sign.<domain> is wrong-rp before the
+  // assertion is read; an origin outside the RP ID is not pinned, so a ceremony that ran there is wrong-origin.
+  if (!isSigningRpId(authority.rpId)) return { ok: false, problem: 'wrong-rp' };
+  credential.origins = credential.origins.filter((origin) => originWithin(origin, credential.rpId));
   const assertion = verifyAssertion(signature, credential, estateChallenge(digest));
   if (!assertion.ok) return { ok: false, problem: assertion.problem };
 
   const issuedAt = estateTime(record.issuedAt);
   const validUntil = estateTime(record.validUntil);
   if (!Number.isFinite(issuedAt) || !Number.isFinite(validUntil) || validUntil <= issuedAt || validUntil - issuedAt > MAX_VALIDITY_SECONDS * 1000) return { ok: false, problem: 'too-long-lived' };
-  if (at < issuedAt) return { ok: false, problem: 'not-yet-valid' };
+  // A revision issued a moment ahead of this clock is admitted within the skew every relay time allows (DEC-0066).
+  if (at < issuedAt - CLOCK_SKEW_SECONDS * 1000) return { ok: false, problem: 'not-yet-valid' };
   if (at > validUntil) return { ok: false, problem: 'expired' };
   const codes = [...new Set(recordFindings(record).map((finding) => finding.code))];
   if (codes.length > 0) return { ok: false, problem: 'rule-violation', codes };
@@ -227,19 +262,50 @@ export function placementTrust(record, machineId, agentRef) {
   return { publisher: list(record.publisherKeys).filter((key) => key.kid === placement.publisherKid) };
 }
 
+const MAX_WINDOW_MS = MAX_VALIDITY_SECONDS * 1000;
+const isRevision = (value) => Number.isSafeInteger(value) && value >= 1;
+const refused = (fault, detail) => ({ certified: false, fault, detail });
+
 /**
- * DL-14 with DEC-0055: trust a token's `kid` only while a current revision certifies it for a machine and does not revoke
- * it. `record` is a revision the caller verified; `x` the key the published key set gives for `kid`; `at` the clock.
+ * DL-14 (DEC-0055, DEC-0060): whether `record` certifies the delegation key `kid` with the published key's `x` at `at`
+ * (a Date or epoch seconds), for a verifier whose machine applied `applied` (`{revision, digest?}`). `extraRevocations`
+ * are the revocation delta's entries applied since the revision (DEC-0054). The contract's `hubKeyCertified`, in its
+ * order; never throws. Answers `{certified: true, machine, revision}` or `{certified: false, fault, detail}`: fault
+ * `token` (`kid-not-certified`), `estate` (`estate-unreadable`, `estate-outside-window`, `estate-rolled-back`,
+ * `estate-forked`) or `clock` (`no-clock`).
  */
-export function hubKeyCertified(record, kid, x, at) {
+export function hubKeyCertified(record, kid, x, at, applied, options) {
   const now = clockOf(at);
-  if (!isObject(record) || !Number.isFinite(now)) return false;
+  if (Number.isNaN(now)) return refused('clock', 'no-clock');
+  if (!isObject(record) || !isRevision(record.revision) || !isString(record.digest) || !Array.isArray(record.machines)) return refused('estate', 'estate-unreadable');
+  if (record.revocations !== undefined && !Array.isArray(record.revocations)) return refused('estate', 'estate-unreadable');
+  const extra = options?.extraRevocations;
+  if (extra !== undefined && !Array.isArray(extra)) return refused('estate', 'estate-unreadable');
   const issuedAt = estateTime(record.issuedAt);
   const validUntil = estateTime(record.validUntil);
-  if (!(Number.isFinite(issuedAt) && Number.isFinite(validUntil) && issuedAt <= now && now <= validUntil)) return false;
-  const revoked = new Set(list(record.revocations).map(revocationKey));
-  return list(record.machines).some((machine) => isObject(machine.hubKey) && machine.hubKey.kid === kid && machine.hubKey.x === x
-    && !revoked.has(`hub-key ${kid}`) && !revoked.has(`machine ${String(machine.id)}`));
+  // A window that is not a time, not positive or longer than 30 days is no window: NaN fails every comparison below.
+  if (Number.isNaN(issuedAt) || Number.isNaN(validUntil) || validUntil <= issuedAt || validUntil - issuedAt > MAX_WINDOW_MS) return refused('estate', 'estate-unreadable');
+  if (applied !== undefined) {
+    if (!isObject(applied) || !isRevision(applied.revision) || (applied.digest !== undefined && !isString(applied.digest))) return refused('estate', 'estate-unreadable');
+    // An older revision may still be inside its window and list a key the applied one revokes (a rollback).
+    if (record.revision < applied.revision) return refused('estate', 'estate-rolled-back');
+    if (record.revision === applied.revision && applied.digest !== undefined && record.digest !== applied.digest) return refused('estate', 'estate-forked');
+  }
+  // The window verifyEstateRecord admits the revision in: from 60 s before issuedAt to validUntil (DEC-0066).
+  if (now < issuedAt - CLOCK_SKEW_SECONDS * 1000 || now > validUntil) return refused('estate', 'estate-outside-window');
+
+  const revocations = [...(record.revocations ?? []), ...(extra ?? [])];
+  // A ref is compared exactly, never as a string conversion.
+  const revokes = (kind, ref) => revocations.some((entry) => isObject(entry) && entry.kind === kind && entry.ref === ref);
+  if (!isString(kid) || revokes('hub-key', kid)) return refused('token', 'kid-not-certified');
+  const holders = record.machines.filter((machine) => isObject(machine) && isObject(machine.hubKey) && machine.hubKey.kid === kid);
+  // Two machines under one kid break FAC-SEM-073; such a revision certifies neither.
+  if (holders.length !== 1) return refused('token', 'kid-not-certified');
+  const [machine] = holders;
+  // A missing x never equals a missing x: the published key must be the certified one.
+  if (!isString(x) || machine.hubKey.x !== x) return refused('token', 'kid-not-certified');
+  if (revokes('machine', machine.id)) return refused('token', 'kid-not-certified');
+  return { certified: true, machine: String(machine.id), revision: record.revision };
 }
 
 // ---- FAC-SEM-072…076 ----
@@ -396,6 +462,8 @@ function recordFindings(value) {
   placements(value, flagger(findings, 'FAC-SEM-074'));
   secretReferences(value, flagger(findings, 'FAC-SEM-075'));
   grantsAndRevocations(value, flagger(findings, 'FAC-SEM-076'));
+  // FAC-SEM-092 (DEC-0063) on each passkey the record lists.
+  list(value.authorities).forEach((authority, index) => signingCredential(authority, `/authorities/${index}`, flagger(findings, 'FAC-SEM-092')));
   return findings;
 }
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -52,7 +52,8 @@ const TRACE_ID = /^(?!0{32}$)[0-9a-f]{32}$/;
 const SPAN_ID = /^(?!0{16}$)[0-9a-f]{16}$/;
 const O_EXLOCK = 0x20; // BSD/macOS: open(2) takes flock(LOCK_EX); absent from fs.constants
 // DEC-0032: a local path starts with ~/ (or ~\ on Windows), / (never //) or a drive letter; a network share never does.
-const LOCAL_PATH = /^(~[\\/]|\/(?!\/)|[A-Za-z]:[\\/])/;
+// DEC-0057: `//server/…` and `/\\server…` are shares on Windows too, so a leading slash is followed by neither.
+const LOCAL_PATH = /^(~[\\/]|\/(?![\\/])|[A-Za-z]:[\\/])/;
 export const MANAGERS = Object.freeze(['launchd', 'systemd', 'task-scheduler', 'none']);
 const AUTH_HEADER = /^[A-Za-z][A-Za-z0-9-]{0,63}$/;
 const UNIT = /^[A-Za-z0-9][A-Za-z0-9:_.@-]{0,250}\.service$/;
@@ -63,7 +64,8 @@ export const DEFAULT_EXIT_TIMEOUT = 15;
 export class ServiceError extends Error {}
 export class AlreadyRunning extends ServiceError {
   constructor(holderPid, lockPath) {
-    super(`Another copy is already running (${holderPid ? `process ${holderPid}` : 'another process'} holds ${lockPath}).`);
+    // FAC-SEM-078: a copy that cannot learn the holder's pid says the holder is unknown.
+    super(`Another copy is already running (${holderPid ? `process ${holderPid}` : 'an unknown process'} holds ${lockPath}).`);
     this.holderPid = holderPid;
     this.lockPath = lockPath;
   }
@@ -209,25 +211,92 @@ function readPid(file) {
   }
 }
 
+/** The managers a supervisor marker may name (DEC-0057): the three systems' supervisors and Project Observatory's node. */
+export const SUPERVISORS = Object.freeze(['launchd', 'systemd', 'task-scheduler', 'node']);
+/** The argument form of the marker, for a supervisor whose start carries no environment (a Scheduled Task's action). */
+export const SUPERVISOR_ARG = '--fabric-supervisor';
+
+/**
+ * The marker values an argument vector carries after the executable and before `--`. A bare `--fabric-supervisor`
+ * followed by nothing, by `--` or by another `--…` flag is a marker with an empty value and consumes nothing.
+ */
+function markerArguments(argv) {
+  const values = [];
+  if (!Array.isArray(argv)) return values;
+  for (let index = 1; index < argv.length; index += 1) {
+    const item = argv[index];
+    if (item === '--') break;
+    if (item === SUPERVISOR_ARG) {
+      const next = argv[index + 1];
+      if (typeof next === 'string' && !next.startsWith('--')) {
+        values.push(next);
+        index += 1;
+      } else {
+        values.push('');
+      }
+    } else if (typeof item === 'string' && item.startsWith(`${SUPERVISOR_ARG}=`)) {
+      values.push(item.slice(SUPERVISOR_ARG.length + 1));
+    }
+  }
+  return values;
+}
+
+/**
+ * How this copy was started (DEC-0057), from `FABRIC_SERVICE_SUPERVISOR=<manager>` and `--fabric-supervisor <manager>` /
+ * `--fabric-supervisor=<manager>` (`env` and `argv` default to this process's; `argv[0]` is the executable or script):
+ * `{kind: 'supervised', manager, forms}` when every marker present names the same manager of SUPERVISORS;
+ * `{kind: 'conflict', values, forms}` when they disagree (an empty or bare argument beside a variable disagrees with it):
+ * the copy exits 75 at once, before it takes the lock; `{kind: 'manual', forms, unreadable?}` with no marker (only an
+ * empty variable counts as none) or one that names no manager. Never inferred from the parent process. The contract's
+ * `supervisorMarker`.
+ */
+export function supervisorMarker({ env = process.env, argv = process.argv.slice(1) } = {}) {
+  const variable = env?.[SUPERVISOR_ENV];
+  const fromEnv = typeof variable === 'string' && variable !== '' ? [variable] : [];
+  const fromArgs = markerArguments(argv);
+  const forms = [...(fromEnv.length ? ['environment'] : []), ...(fromArgs.length ? ['argument'] : [])];
+  const values = [...new Set([...fromEnv, ...fromArgs])];
+  if (values.length > 1) return { kind: 'conflict', values, forms };
+  if (values.length === 0) return { kind: 'manual', forms };
+  return SUPERVISORS.includes(values[0]) ? { kind: 'supervised', manager: values[0], forms } : { kind: 'manual', unreadable: values[0], forms };
+}
+
+/** How long a copy started so may wait for the lock, in seconds: 300 when supervised, else not at all. */
+export const lockWaitBudgetSeconds = (marker) => (marker?.kind === 'supervised' ? LOCK_WAIT_SUPERVISED_SECONDS : 0);
+
+/** The one sentence a copy whose markers disagree exits with, naming the markers present. */
+export function markerConflictMessage(marker) {
+  const shown = marker.values.map((v) => JSON.stringify(v)).join(', ');
+  return marker.forms.length === 2
+    ? `${SUPERVISOR_ENV} and ${SUPERVISOR_ARG} disagree (${shown}); not starting unsupervised.`
+    : `${SUPERVISOR_ARG} is given with different values (${shown}); not starting unsupervised.`;
+}
+
+/** True when a supervisor that restarts on exit started this process and said so with the marker. */
+export const supervised = (start) => supervisorMarker(start).kind === 'supervised';
 /** True when launchd started this process from a plist that says so (FABRIC_SERVICE_SUPERVISOR=launchd). */
-export const supervisedByLaunchd = () => process.env[SUPERVISOR_ENV] === 'launchd';
-export const SUPERVISORS = Object.freeze(['launchd', 'systemd', 'task-scheduler']);
-/** True when a supervisor that restarts on exit started this process and said so (launchd, systemd). */
-export const supervised = () => SUPERVISORS.includes(process.env[SUPERVISOR_ENV]);
+export const supervisedByLaunchd = (start) => supervisorMarker(start).manager === 'launchd';
 
 const sleepSeconds = (s) => new Promise((resolve) => setTimeout(resolve, s * 1000));
 
 /**
- * Take the lock or exit 75 with one sentence naming the holder. Started by hand, a held lock exits
- * 75 at once. Under launchd (KeepAlive) an immediate exit is a respawn every ThrottleInterval,
+ * Take the lock or exit 75 with one sentence naming the holder (DEC-0057, FAC-SEM-078). Markers that
+ * disagree exit 75 before the lock. Started by hand, a held lock exits 75 at once. Under a
+ * supervisor that restarts on exit (launchd's KeepAlive) an immediate exit is a respawn every ThrottleInterval,
  * forever; so a supervised copy first backs off in-process (0.5 s doubling to 30 s,
  * LOCK_WAIT_SUPERVISED_SECONDS in all), takes over if the holder leaves, and exits 75 only when
  * the wait runs out. `waitSeconds` overrides the choice (0 = never wait).
  */
 export async function holdSingleInstance(dataDir, {
-  waitSeconds, sleep = sleepSeconds, clock = () => performance.now() / 1000, exit = (code) => process.exit(code),
+  waitSeconds, sleep = sleepSeconds, clock = () => performance.now() / 1000, exit = (code) => process.exit(code), env, argv,
 } = {}) {
-  const wait = waitSeconds ?? (supervised() ? LOCK_WAIT_SUPERVISED_SECONDS : 0);
+  // DEC-0057: markers that disagree exit 75 at once, before the lock, naming them.
+  const marker = supervisorMarker({ ...(env === undefined ? {} : { env }), ...(argv === undefined ? {} : { argv }) });
+  if (marker.kind === 'conflict') {
+    process.stderr.write(`${markerConflictMessage(marker)}\n`);
+    return exit(EXIT_ALREADY_RUNNING);
+  }
+  const wait = waitSeconds ?? lockWaitBudgetSeconds(marker);
   const deadline = clock() + Math.max(0, wait);
   let delay = LOCK_BACKOFF_FIRST_SECONDS;
   let announced = false;
@@ -263,9 +332,8 @@ export function ensureToken(file) {
 
 /**
  * Refuse a symlink, a file owned by someone else, or one others can read. On Windows the rule is
- * service.md "Windows token files" (DEC-0032, DEC-0033): a regular file whose real path is in the
- * profile, owned by the current user, SYSTEM or Administrators, every granting ACE naming one of
- * those three; a refusal names the SID, never the contents.
+ * service.md "Windows token files" (DEC-0032, DEC-0033, DEC-0057): windowsTokenAclProblem over the
+ * file's flags, owner and ACEs; a refusal names the SID, never the contents.
  */
 export function readToken(file) {
   const info = fs.lstatSync(file);
@@ -286,30 +354,68 @@ export function readToken(file) {
 // Node has no ACL API. Windows PowerShell (5.1, present on every Windows) reads the list through .NET
 // and icacls writes it; both get the path through the environment, never argv, and print no contents.
 
+export const SYSTEM_SID = 'S-1-5-18';
+export const ADMINISTRATORS_SID = 'S-1-5-32-544';
+/** A string SID: revision 1, an identifier authority and up to 15 sub-authorities of 32 bits each. */
+const SID_TEXT = /^S-1-\d{1,15}(-\d{1,10}){0,15}$/i;
+/** A readable SID in upper case (SIDs compare case-insensitively on their S), or undefined. */
+const sidOf = (value) => (typeof value === 'string' && SID_TEXT.test(value) && value.split('-').slice(3).every((part) => Number(part) <= 0xffffffff) ? value.toUpperCase() : undefined);
+
 /**
- * service.md "Windows token files", rules 2 and 3, on SIDs already read: the owner is the current
- * user, SYSTEM or Administrators (DEC-0033), and every SID an allow ACE grants anything to is one of
- * those three. Deny ACEs are not passed in: they do not change the decision.
+ * service.md "Windows token files" (DEC-0032, DEC-0033, DEC-0057, FAC-SEM-079) on what a reader has read: `file` is
+ * `{isRegularFile, isReparsePoint, realPathInProfile, ownerSid, aces: [{type, sid, mask}]}`, the mask the ACE's unsigned
+ * 32-bit access mask. The first refusal `{problem, at, sid?, message}`, or null when the file may be read: a regular
+ * file, not a reparse point, inside the profile; owned by the user, SYSTEM or Administrators; every allow ACE with a
+ * non-zero mask naming one of those three; deny ACEs ignored; any other ACE type refused; anything unreadable refused.
+ * The contract's `windowsTokenAclProblem`; a refusal names the SID, never the contents.
  */
-export function tokenAclProblem(file, owner, granting, user) {
-  if (owner !== user && !WINDOWS_TRUSTED.includes(owner)) {
-    return `Token file ${file} is owned by ${owner || 'nobody'}, not by this user (${user}), SYSTEM or Administrators.`;
-  }
-  for (const sid of granting) {
-    if (sid !== user && !WINDOWS_TRUSTED.includes(sid)) return `Token file ${file} grants access to ${sid}; only this user, SYSTEM and Administrators may hold any.`;
+export function windowsTokenAclProblem(file, currentUserSid) {
+  const refuse = (problem, at, message, sid) => (sid === undefined ? { problem, at, message } : { problem, at, sid, message });
+  const user = sidOf(currentUserSid);
+  if (user === undefined) return refuse('unreadable', '/currentUserSid', "the current user's SID is unreadable");
+  if (typeof file !== 'object' || file === null || Array.isArray(file)) return refuse('unreadable', '/file', "the token file's metadata is unreadable");
+  for (const flag of ['isRegularFile', 'isReparsePoint', 'realPathInProfile']) {
+    if (typeof file[flag] !== 'boolean') return refuse('unreadable', `/file/${flag}`, `${flag} is unreadable`);
+  }
+  if (file.isReparsePoint) return refuse('reparse-point', '/file/isReparsePoint', 'the token file is a reparse point (a symlink or a junction)');
+  if (!file.isRegularFile) return refuse('not-regular-file', '/file/isRegularFile', 'the token file is not a regular file');
+  if (!file.realPathInProfile) return refuse('outside-profile', '/file/realPathInProfile', "the token file's real path lies outside the user's profile");
+  const trusted = new Set([user, SYSTEM_SID, ADMINISTRATORS_SID]);
+  const owner = sidOf(file.ownerSid);
+  if (owner === undefined) return refuse('unreadable', '/file/ownerSid', 'the owner SID is unreadable');
+  if (!trusted.has(owner)) return refuse('owner', '/file/ownerSid', `the token file is owned by ${owner}, not by the current user, SYSTEM or Administrators`, owner);
+  if (!Array.isArray(file.aces)) return refuse('unreadable', '/file/aces', 'the ACL is unreadable');
+  for (const [index, ace] of file.aces.entries()) {
+    const at = `/file/aces/${index}`;
+    if (typeof ace !== 'object' || ace === null || Array.isArray(ace)) return refuse('unreadable', at, `ACE ${index} is unreadable`);
+    if (typeof ace.type !== 'string') return refuse('unreadable', `${at}/type`, `ACE ${index} has an unreadable type`);
+    const trustee = sidOf(ace.sid);
+    if (trustee === undefined) return refuse('unreadable', `${at}/sid`, `ACE ${index} names an unreadable SID`);
+    if (typeof ace.mask !== 'number' || !Number.isInteger(ace.mask) || ace.mask < 0 || ace.mask > 0xffffffff) return refuse('unreadable', `${at}/mask`, `ACE ${index} has an unreadable access mask`);
+    if (ace.type === 'deny') continue;
+    if (ace.type !== 'allow') return refuse('ace-type', `${at}/type`, `ACE ${index} for ${trustee} is of a type the rule does not read`, trustee);
+    if (ace.mask === 0) continue;
+    if (!trusted.has(trustee)) return refuse('ace-sid', `${at}/sid`, `the token file grants access to ${trustee}; only the current user, SYSTEM and Administrators may hold any`, trustee);
   }
   return null;
 }
 
+/** windowsTokenAclProblem as one sentence naming the file and the refusal, or null. */
+export function tokenFileProblem(file, metadata, user) {
+  const problem = windowsTokenAclProblem(metadata, user);
+  return problem ? `Token file ${file} refused: ${problem.message}.` : null;
+}
+
+// The raw descriptor, through .NET: every ACE's type, its trustee's SID and its access mask as read (a signed int;
+// parseAclReport converts it to the unsigned mask). An inherit-only ACE applies to children only and is left out.
 const ACL_SCRIPT = [
   "$ErrorActionPreference = 'Stop'",
-  '$sid = [System.Security.Principal.SecurityIdentifier]',
   '$acl = [System.IO.File]::GetAccessControl($env:FABRIC_ACL_PATH)',
-  "$null_dacl = $acl.GetSecurityDescriptorSddlForm('Access') -match 'NO_ACCESS_CONTROL' -or $acl.GetSecurityDescriptorSddlForm('Access') -eq ''",
-  // InheritOnly (2) applies to children, not to the file itself.
-  "$granting = @($acl.GetAccessRules($true, $true, $sid) | Where-Object { $_.AccessControlType -eq 'Allow' -and -not ([int]$_.PropagationFlags -band 2) } | ForEach-Object { $_.IdentityReference.Value })",
+  "$raw = New-Object System.Security.AccessControl.RawSecurityDescriptor($acl.GetSecurityDescriptorSddlForm('Owner, Access'))",
+  '$dacl = $raw.DiscretionaryAcl',
+  "$aces = @(if ($dacl) { $dacl | Where-Object { -not ([int]$_.AceFlags -band 8) } | ForEach-Object { @{ type = [string]$_.AceType; sid = $(if ($_.SecurityIdentifier) { $_.SecurityIdentifier.Value } else { '' }); mask = [int64]$_.AccessMask } } })",
   '$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value',
-  '[Console]::Out.Write((ConvertTo-Json -Compress @{ owner = $acl.GetOwner($sid).Value; granting = $granting; nullDacl = [bool]$null_dacl; user = $user }))',
+  '[Console]::Out.Write((ConvertTo-Json -Compress -Depth 4 @{ owner = $raw.Owner.Value; aces = $aces; nullDacl = [bool](-not $dacl); user = $user }))',
 ].join('; ');
 
 function windowsHelper(command, args, extraEnv = {}) {
@@ -323,14 +429,24 @@ function windowsHelper(command, args, extraEnv = {}) {
   return result.stdout;
 }
 
-/** The ACL report PowerShell prints, reduced to (owner, granting SIDs, current user). */
+/** .NET's AceType names as the rule's ACE type: allow and deny are read, every other type is refused (DEC-0057). */
+const ACE_TYPES = { AccessAllowed: 'allow', AccessDenied: 'deny', AccessAllowedObject: 'allow-object', AccessDeniedObject: 'deny-object',
+  AccessAllowedCallback: 'allow-callback', AccessDeniedCallback: 'deny-callback', AccessAllowedCallbackObject: 'allow-object-callback',
+  AccessDeniedCallbackObject: 'deny-object-callback' };
+
+/**
+ * The ACL report PowerShell prints, as (owner SID, ACEs `{type, sid, mask}`, current user). The mask arrives signed
+ * (GENERIC_READ 0x80000000 is negative in .NET) and is read as the unsigned 32-bit mask; a NULL DACL grants everyone
+ * everything and is read as an allow ACE for Everyone (S-1-1-0).
+ */
 export function parseAclReport(text) {
   const report = JSON.parse(text);
-  const granting = report.nullDacl ? ['S-1-1-0'] : [].concat(report.granting ?? []);
-  return { owner: report.owner ?? '', granting, user: report.user };
+  const aces = report.nullDacl ? [{ type: 'allow', sid: 'S-1-1-0', mask: 0x1f01ff }]
+    : [].concat(report.aces ?? []).map((ace) => ({ type: ACE_TYPES[ace.type] ?? String(ace.type), sid: ace.sid, mask: Number.isInteger(ace.mask) ? ace.mask >>> 0 : ace.mask }));
+  return { owner: report.owner ?? '', aces, user: report.user };
 }
 
-/** (owner SID, SIDs of every allow ACE on the file itself, the current user's SID). */
+/** (owner SID, the ACEs on the file itself, the current user's SID). */
 export function windowsAcl(file) {
   return parseAclReport(windowsHelper('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', ACL_SCRIPT], { FABRIC_ACL_PATH: file }));
 }
@@ -356,13 +472,14 @@ export function windowsProtect(target, { folder }) {
 }
 
 function windowsTokenProblem(file, info) {
-  if (!info.isFile()) return `Token file ${file} is not a regular file (a link or junction); refusing it.`;
   const profile = fs.realpathSync.native(process.env.USERPROFILE || os.homedir()).toLowerCase();
   const real = fs.realpathSync.native(file).toLowerCase();
   const inside = path.win32.relative(profile, real);
-  if (!inside || inside.startsWith('..') || path.win32.isAbsolute(inside)) return `Token file ${file} lies outside the user's profile; refusing it.`;
-  const { owner, granting, user } = windowsAcl(file);
-  return tokenAclProblem(file, owner, granting, user);
+  const { owner, aces, user } = windowsAcl(file);
+  return tokenFileProblem(file, {
+    isRegularFile: info.isFile(), isReparsePoint: info.isSymbolicLink(),
+    realPathInProfile: Boolean(inside) && !inside.startsWith('..') && !path.win32.isAbsolute(inside), ownerSid: owner, aces,
+  }, user);
 }
 
 export function tokenMatches(presented, token, scheme = 'Bearer') {
@@ -431,6 +548,10 @@ export function validateDescriptor(d) {
     problems.push('a launchd service declares label and plist');
   }
   if (life.plist !== undefined && !LOCAL_PATH.test(String(life.plist))) problems.push('lifecycle.plist must be a local path');
+  // DEC-0057: a descriptor names one supervisor; launchd's label and plist never sit beside another.
+  for (const field of ['label', 'plist']) {
+    if (life[field] !== undefined && ['systemd', 'task-scheduler'].includes(manager)) problems.push(`lifecycle.${field} belongs to launchd, not to ${manager}`);
+  }
   // DEC-0032: `unit` goes with systemd and `task` with Task Scheduler, and with nothing else.
   for (const [field, owner, pattern] of [['unit', 'systemd', UNIT], ['task', 'task-scheduler', TASK]]) {
     if (manager === owner && life[field] === undefined) problems.push(`a ${owner} service declares ${field}`);
@@ -1564,6 +1685,11 @@ function plain(value, what) {
   return value;
 }
 
+/** The supervisor file's writer writes the marker itself; one already in the arguments could only disagree with it. */
+function noMarkerArgument(argv) {
+  if (markerArguments(argv).length) throw new ServiceError(`${SUPERVISOR_ARG} is written by the supervisor file's writer; leave it out of the program arguments.`);
+}
+
 function noSecretInSupervisorFile(argv, environment) {
   // No supervisor file carries a secret (service.md): not in an argument, an environment name or its value.
   for (const arg of argv) {
@@ -1592,7 +1718,8 @@ export function systemdUnit(unit, programArguments, { workingDirectory, environm
   const env = { ...environment };
   for (const name of Object.keys(env)) if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new ServiceError(`Environment name ${JSON.stringify(name)} is not a variable name.`);
   noSecretInSupervisorFile(argv, env);
-  env[SUPERVISOR_ENV] ??= 'systemd';
+  noMarkerArgument(programArguments.map(String));
+  env[SUPERVISOR_ENV] = 'systemd'; // the unit's writer writes the marker, whatever the caller passed
   const cwd = plain(String(workingDirectory), 'The working directory');
   if (!cwd.startsWith('/')) throw new ServiceError("A systemd unit's working directory is absolute.");
   return [
@@ -1666,6 +1793,10 @@ export function taskXml(task, programArguments, { workingDirectory, description,
   plain(String(workingDirectory), 'The working directory');
   plain(description ?? task, 'The description');
   noSecretInSupervisorFile(argv, {});
+  noMarkerArgument(argv);
+  // A task's Exec action carries no environment, so the marker is an argument (DEC-0057), before any `--`.
+  const cut = argv.includes('--') ? argv.indexOf('--') : argv.length;
+  argv.splice(cut, 0, SUPERVISOR_ARG, 'task-scheduler');
   const who = user ?? (process.env.USERNAME ? `${process.env.USERDOMAIN ?? ''}\\${process.env.USERNAME}` : '');
   if (!who) throw new ServiceError('Name the user the task runs as (DOMAIN\\user); USERNAME is not set.');
   plain(who, 'The user');

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -309,7 +309,7 @@ def _key_for(jwks: Dict[str, Any], kid: str) -> Dict[str, Any]:
         return {"problem": "unusable-key"}
     if is_small_order_key(raw):
         return {"problem": "small-order-key"}  # refused before any verification (DEC-0045, CT-29)
-    return {"key": raw}
+    return {"key": raw, "x": jwk["x"]}
 
 
 def _has_keys(jwks: Any) -> bool:
@@ -331,7 +331,7 @@ def _authentic(token: Any, jwks: Dict[str, Any], typ: str) -> Dict[str, Any]:
         return {"problem": found["problem"], "issuer": found["problem"] != "unknown-key"}
     if len(compact["signature"]) != 64 or not ed25519_verify(found["key"], compact["signing_input"], compact["signature"]):
         return {"problem": "bad-signature"}
-    return {"compact": compact, "kid": kid}
+    return {"compact": compact, "kid": kid, "x": found["x"]}
 
 
 def chain_depth(act: Any) -> float:
@@ -432,30 +432,58 @@ def _approval_shape(payload: Dict[str, Any]) -> bool:
     return payload.get("method") in ("prompt", "operator-channel")  # DEC-0045: `device` is removed
 
 
-def _estate_problem(estate: Any, jwks: Dict[str, Any], kid: str, now: float) -> Optional[Tuple[str, str]]:
-    """DL-14 with DEC-0055: a verifier that reads the estate record trusts a kid only while a current revision certifies
-    it for a machine and does not revoke it. `estate` is a revision the caller verified (fabric_estate.
-    verify_estate_record) or a callable returning the current one; None skips the rule. (refusal kind, detail) or None."""
+#: ECMAScript's time range in seconds (±8.64e15 ms): a NumericDate outside it is no instant a Date can hold.
+MAX_CLOCK_SECONDS = 8.64e12
+
+
+def _readable_clock(now: Any) -> bool:
+    """A clock the time rows can compare: a finite number of seconds within a Date's range (DEC-0060). NaN or text
+    would make every time row false and let an expired token through."""
+    if not isinstance(now, (int, float)) or isinstance(now, bool):
+        return False
+    try:
+        return math.isfinite(now) and abs(now) <= MAX_CLOCK_SECONDS
+    except OverflowError:
+        return False
+
+
+def _estate_problem(estate: Any, kid: str, x: str, now: float, applied: Any = None,
+                    revocations: Any = None) -> Optional[Tuple[str, str]]:
+    """DL-14 row 4a (DEC-0055, DEC-0060), right after the signature: when the callee reads the estate record, the
+    token's kid and the published key must be certified by that revision. `estate` is a revision the caller verified
+    (fabric_estate.verify_estate_record) and its machine applied, or a callable returning it; None skips the rule (a
+    callable returning None is an unreadable source). `applied` is the highest revision the machine applied
+    (`{"revision", "digest"?}`); `revocations` the revocation delta's entries applied since (a list or a callable). A
+    source that raises is unreadable, never a pass. Returns ("token" | "issuer", detail) or None."""
     if estate is None:
         return None
     try:
         record = estate() if callable(estate) else estate
-    except Exception:  # an unreadable record certifies nothing; it is never a pass
+        extra = revocations() if callable(revocations) else revocations
+    except Exception:
         return ("issuer", "estate-unreadable")
     import fabric_estate  # beside this file; imported here, since fabric_estate imports this module
-    jwk = next((k for k in jwks["keys"] if isinstance(k, dict) and k.get("kid") == kid), {})
-    if not fabric_estate.hub_key_certified(record, kid, jwk.get("x"), now):
-        return ("token", "kid-not-certified")
-    return None
+    verdict = fabric_estate.hub_key_certified(record, kid, x, now, applied,
+                                              fabric_estate._MISSING if extra is None else extra)
+    if verdict["certified"]:
+        return None
+    # The clock was refused before row 1, so a verdict here is the token's or the trust source's.
+    return ("token" if verdict["fault"] == "token" else "issuer", verdict["detail"])
 
 
 def verify_delegation(token: Any, *, audience: str, jwks: Any, now: float, capability: str, effect: str,
-                      issuer: Optional[str], read_only: bool = False, estate: Any = None) -> Dict[str, Any]:
+                      issuer: Optional[str], read_only: bool = False, estate: Any = None,
+                      estate_applied: Any = None, estate_revocations: Any = None) -> Dict[str, Any]:
     """DL-13, in its fixed order: nothing about a token is believed before its signature is.
     `now` is seconds since the epoch. Returns {ok: True, claims, principal, caller, chain, kid} or a refusal
     {ok: False, code, detail[, data]} whose detail is a short machine word, never the token. `issuer` is required.
     With `estate` (a verified estate revision, or a callable returning the current one), the token's kid must be one
-    the revision certifies for a machine (DL-14, DEC-0055)."""
+    the revision certifies for a machine (DL-14, DEC-0055, DEC-0060); `estate_applied` is the highest revision the
+    machine applied and `estate_revocations` the revocation delta's entries since. A clock that is not a number of
+    seconds is refused `unknown-state` `no-clock` before row 1."""
+    # Before row 1: every time row compares against the clock, and a comparison with NaN is always false.
+    if not _readable_clock(now):
+        return _refuse("unknown-state", "no-clock")
     if not _is_string(issuer):
         return _refuse("issuer-unavailable", "no-trusted-issuer")
     if not _has_keys(jwks):
@@ -463,7 +491,7 @@ def verify_delegation(token: Any, *, audience: str, jwks: Any, now: float, capab
     checked = _authentic(token, jwks, DELEGATION_TYP)
     if "problem" in checked:
         return _refuse("issuer-unavailable" if checked.get("issuer") else "unauthenticated", checked["problem"])
-    uncertified = _estate_problem(estate, jwks, checked["kid"], now)
+    uncertified = _estate_problem(estate, checked["kid"], checked["x"], now, estate_applied, estate_revocations)
     if uncertified:
         return _refuse("issuer-unavailable" if uncertified[0] == "issuer" else "unauthenticated", uncertified[1])
     claims = checked["compact"]["payload"]
@@ -565,13 +593,16 @@ UNSAFE_NO_JTI_STORE = _NoReplayProtection()
 
 
 def verify_approval(approval: Optional[str], *, audience: str, jwks: Any, now: float, action_digest: str,
-                    jti_store: Any, issuer: Optional[str], estate: Any = None) -> Dict[str, Any]:
+                    jti_store: Any, issuer: Optional[str], estate: Any = None, estate_applied: Any = None,
+                    estate_revocations: Any = None) -> Dict[str, Any]:
     """DL-18: a missing approval is approval-required carrying the action digest; any fault of the document is
     approval-invalid; a second use is approval-reused. The jti is consumed last."""
     if approval is None or approval == "":
         return _refuse("approval-required", "no-approval", {"actionDigest": action_digest})
     if jti_store is None or not callable(getattr(jti_store, "consume", None)):
         return _refuse("unknown-state", "no-jti-store")
+    if not _readable_clock(now):
+        return _refuse("unknown-state", "no-clock")
     if not _is_string(issuer):
         return _refuse("issuer-unavailable", "no-trusted-issuer")
     if not _has_keys(jwks):
@@ -579,7 +610,7 @@ def verify_approval(approval: Optional[str], *, audience: str, jwks: Any, now: f
     checked = _authentic(approval, jwks, APPROVAL_TYP)
     if "problem" in checked:
         return _refuse("issuer-unavailable" if checked.get("issuer") else "approval-invalid", checked["problem"])
-    uncertified = _estate_problem(estate, jwks, checked["kid"], now)
+    uncertified = _estate_problem(estate, checked["kid"], checked["x"], now, estate_applied, estate_revocations)
     if uncertified:
         return _refuse("issuer-unavailable" if uncertified[0] == "issuer" else "approval-invalid", uncertified[1])
     claims = checked["compact"]["payload"]
@@ -820,7 +851,8 @@ TIERS = ("T0", "T1", "T2")
 
 
 def delegation_gate(*, audience: str, jwks: Any, effects: Mapping[str, str], issuer: str,
-                    read_only: bool = False, clock: Callable[[], float] = time.time, estate: Any = None) -> Callable[..., Dict[str, Any]]:
+                    read_only: bool = False, clock: Callable[[], float] = time.time, estate: Any = None,
+                    estate_applied: Any = None, estate_revocations: Any = None) -> Callable[..., Dict[str, Any]]:
     """A check for one tools/call: `gate(tool, headers, tier="T2")` answers the accepted delegation or a DL-19
     refusal. `effects` maps each tool to its declared effect class (its manifest entry); a tool with none is
     refused rather than guessed. `jwks` is a JwksCache or a key set; `issuer` (auth.delegation.issuer) is required.
@@ -830,7 +862,8 @@ def delegation_gate(*, audience: str, jwks: Any, effects: Mapping[str, str], iss
     relayed from off the machine. A T0 or T1 caller is never required to present a token: with none, the call
     passes with no delegation ({ok: True, tier, principal: None, ...}). A present token is verified at every tier
     and refused when invalid. Unknown tiers count as T2. `estate` (a callable returning the current verified estate
-    revision) makes the gate trust only kids that revision certifies (DL-14, DEC-0055)."""
+    revision) makes the gate trust only kids that revision certifies (DL-14, DEC-0055, DEC-0060); `estate_applied` and
+    `estate_revocations` pass the applied mark and the revocation delta's entries through."""
     if not _is_string(issuer):
         raise ValueError("the gate needs the issuer it trusts (auth.delegation.issuer)")
 
@@ -845,7 +878,8 @@ def delegation_gate(*, audience: str, jwks: Any, effects: Mapping[str, str], iss
             return _refuse("unauthenticated", "no-token")
         keys = jwks.get(_kid_of(carried["token"])) if isinstance(jwks, JwksCache) else jwks
         verdict = verify_delegation(carried["token"], audience=audience, jwks=keys, now=clock(), capability=tool,
-                                    effect=effect, issuer=issuer, read_only=read_only, estate=estate)
+                                    effect=effect, issuer=issuer, read_only=read_only, estate=estate,
+                                    estate_applied=estate_applied, estate_revocations=estate_revocations)
         if verdict["ok"]:
             verdict["tier"] = tier if tier in TIERS else "T2"
         return verdict