@passioncode-ai/fabric-agent-adapter 0.22.0 → 0.24.0

package/CHANGELOG.md

@@ -1,5 +1,103 @@
 # Changelog
 
+## 0.24.0 - 2026-10-13
+
+An app's own descriptor (contract DEC-0069) and the descriptor for listings (DEC-0061) in both kits (FAA-34). The contract
+pin does not move: both decisions are at `fe55fc6`.
+
+### Added
+
+- **`lifecycle.manager` `node` and `person`.** `node`: Project Observatory's node supervises the service as its child,
+  with no supervisor file, so `label`, `plist`, `unit` and `task` are refused beside it. `person`: an app a person
+  installs and starts — `lifecycle.app` is required, `origin` is optional (its live origin is in the app's own liveness
+  file), and `installedBy` is `{by: "person", role, tool}`. `write_descriptor` / `writeDescriptor` claim no port for
+  it, and `check_service.py` reads it as installed, never running: `descriptor.app-installed`, no port claim, and the
+  well-known document `NOT_RUN`.
+- **`installedBy` by role, `runner` and `peer`.**
+  - `installedBy` is a string or `{by, role?, tool}`.
+  - `runner` is `{kind?, credentialKind}`, a kind and never a credential.
+  - `peer` is `{endpoint, custody, residency, maxDataClass}`. An offer needs `runner` and never a subscription.
+  - FAC-SEM-085 refuses a peer on a reserved name. FAC-SEM-086 refuses a value shaped like a credential in `runner` or
+    `installedBy`, naming its place.
+- **Ports held to the contract's vectors:** `peer_refusal` / `peerRefusal` (`service-peer.json`),
+  `app_descriptor_action` / `appDescriptorAction` and `app_descriptor_stale` / `appDescriptorStale`
+  (`app-descriptor.json`).
+- **`fabric_button_presence` / `fabricButtonPresence`** answer whether Fabric's button may show. The answer is
+  `present` only while Fabric's own descriptor (`fabric.default.json`) is registered and, for an app's descriptor,
+  its app is still installed. A server sets `data-fabric="absent"` otherwise.
+- **Usage:** `make_usage_receipt` / `makeUsageReceipt` accept `route: "platform-metered"`. A configuration's route
+  stays `subscription` or `key`.
+
+### Changed
+
+- `register_remote` / `registerRemote` and the sample's `register` write `installedBy` in its object form
+  (`{by: "person", role: "operator", tool}`). `register_remote` / `registerRemote` also take `runner` and `peer`.
+
+### Fixed
+
+- `check_service.py` reported two descriptors without an origin as claiming the same port.
+- `write_descriptor` / `writeDescriptor` failed on a descriptor without one.
+
+### Evidence
+
+- Every service-descriptor fixture of the contract at `fe55fc6` is held through both validators: 10 valid accepted;
+  every invalid one refused except the six local-channel negatives (DEC-0075, not a kit surface), a set the tests pin.
+- The FAC-SEM-085/086 semantic fixtures answer at the contract's places.
+- 32 planted defects, all caught.
+- The scenario eval `app-descriptor-and-listing` was written before the prose.
+
+## 0.23.0 - 2026-10-13
+
+The contract pin moves from `b291bf0` (DEC-0055) to contract `main` `fe55fc6`, and both kits follow every rule in that
+range that touches what they already do (FAA-32; the contract's hand-over of 2026-10-12, its CT-18 row). `b291bf0`
+joins the supported revisions. What the range adds beyond that is its own row: FAA-33…37.
+
+### Changed
+
+- **The supervisor marker comes as an argument too** (DEC-0057, CT-01, P4-01): `supervisor_marker` /
+  `supervisorMarker` read `FABRIC_SERVICE_SUPERVISOR=<manager>` and `--fabric-supervisor <manager>` /
+  `--fabric-supervisor=<manager>` (after the executable, before `--`; a bare flag consumes no `--…` token), with `node`
+  among the managers. Markers that disagree — the two forms, the argument twice, a bare or empty argument beside the
+  variable — exit 75 at once, before the lock, naming both. `supervised()` and `supervised_by_launchd()` take the
+  marker; `hold_single_instance` / `holdSingleInstance` take `env` and `argv`. A holder whose pid cannot be read is
+  named unknown (`FAC-SEM-078`).
+- **Writers:** `task_xml` / `taskXml` write `--fabric-supervisor task-scheduler` in the task's `Arguments`, before any
+  `--` (a task's action carries no environment, so a Task Scheduler copy now waits like one under launchd);
+  `systemd_unit` / `systemdUnit` set the variable unconditionally; every writer refuses a marker in the program
+  arguments. `add_supervisor_argument(parser)` lets a service's argparse accept the flag; the sample service uses it.
+- **DL-HUBKEY** (DEC-0060): `hub_key_certified` / `hubKeyCertified(record, kid, x, at, applied, extra)` answer the
+  contract's verdict — `{certified, machine, revision}` or `{certified: false, fault, detail}` — instead of a boolean.
+  A revision outside its window, unreadable, lower than the applied one or forking it is the trust source's fault
+  (`issuer-unavailable`: `estate-outside-window`, `estate-unreadable`, `estate-rolled-back`, `estate-forked`); a `kid`
+  on two machines, a missing `x` and a numeric `kid` never certify; revocation refs compare exactly. The verifiers
+  take `estate_applied` / `estateApplied` and `estate_revocations` / `estateRevocations`; in the Node kit only an
+  absent `estate` skips the check (`null` is an unreadable source). Every verifier refuses a clock that is not a number
+  of seconds `unknown-state` `no-clock` before row 1.
+- **The estate record** (DEC-0063, DEC-0066): `verify_estate_record` / `verifyEstateRecord` admit `issuedAt` up to 60 s
+  ahead (`CLOCK_SKEW_SECONDS`); the signing passkey must be under a `sign.<domain>` RP (`wrong-rp`) and its origins
+  within it (`wrong-origin`); the record's rules add `FAC-SEM-092`.
+- **The Windows token-file reader** (DEC-0057, `FAC-SEM-079`): `windows_token_acl_problem` /
+  `windowsTokenAclProblem` decide over the file's flags, owner and ACEs `{type, sid, mask}`: an object or callback ACE
+  is refused, an allow with an empty mask and every deny grant nothing, SIDs compare case-insensitively, anything
+  unreadable is refused. The Python kit reads the ACEs from SDDL (`acl_from_sddl`), the Node kit through .NET's raw
+  descriptor with the mask read unsigned. `windows_acl` / `windowsAcl` now answer ACEs; `token_acl_problem` /
+  `tokenAclProblem` are replaced by `token_file_problem` / `tokenFileProblem`.
+- **The descriptor** (DEC-0057 item 5): `label` and `plist` are refused beside `systemd` and `task-scheduler`; a
+  `localPath` starting `//` or `/\` is a share and refused.
+
+### Evidence
+
+- Vendored from the contract at `fe55fc6` and re-answered by its own functions (`test/fixtures/contract/vendor_vectors.mjs`):
+  `hub-key-vectors.json` (51 cases, 14 verifier answers; the hub seeds dropped), `supervisor-vectors.json` (22 marker
+  cases, 11 `FAC-SEM-078` records), `windows-token-vectors.json` (30 cases), `descriptor-negatives.json` (DEC-0057's
+  seven); `estate-vectors.json` regenerated (49 verify cases). Both kits answer every case as the contract does.
+- The kits' own starts against a held lock — by hand, the node, a task, an unknown holder, three conflicts — are
+  recorded and read by a port of `lockOutcomeRules` that itself reads the contract's 11 records as it does.
+- The sample service, started with `--fabric-supervisor=node`, serves a well-known document, usage report and events
+  page valid under the `fe55fc6` schemas; the descriptors the kit writes under every manager are valid too.
+- 34 planted defects, all caught.
+- The `--fabric-supervisor` scenario eval (`supervised-by-argument`) was written before the prose.
+
 ## 0.22.0 - 2026-10-12
 
 `working-with-fabric`, the fourth skill, the plugin's session hooks, and coding agents as participants of Fabric's

package/README.md

@@ -235,7 +235,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `b291bf09e0a9f9fd3c16cf540832cd021203b7d1`
+- commit: `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`
 
 Every other mention of the default contract revision — this section, the skills' metadata, the
 skill card, `adapt_project.py` — must equal it; `python3 test/validate.py` fails a tree

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.22.0"
+  version: "0.24.0"
   contract-version: "0.1.0"
-  contract-commit: "b291bf09e0a9f9fd3c16cf540832cd021203b7d1"
+  contract-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `b291bf09e0a9f9fd3c16cf540832cd021203b7d1`.
+- commit `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -21,10 +21,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "b291bf09e0a9f9fd3c16cf540832cd021203b7d1"
+CONTRACT_COMMIT = "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.22.0"
+  version: "0.24.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "b291bf09e0a9f9fd3c16cf540832cd021203b7d1"
+  extension-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
 ---
 
 # Building Fabric services
@@ -323,8 +323,11 @@ this estate needs.
 
 ## When something is missing
 
-- **Not macOS / no launchd:** declare `lifecycle.manager: "none"`; hosts show the
-  service read-only. Keep every other rule.
+- **Not macOS / no launchd:** the kits write a systemd user unit (Linux) or a per-user Scheduled Task (Windows); with
+  no supervisor at all declare `lifecycle.manager: "none"`, and hosts show the service read-only. Keep every other rule.
+- **A desktop app with no supervisor** (DEC-0069): its descriptor says `manager: "person"` with `lifecycle.app`, no
+  origin, `installedBy {by: "person", role, tool}`; its live origin is in its own liveness file
+  (the lifecycle reference, *An app's own descriptor and the node*).
 - **No Python:** use the Node kit; run the probe from any machine that has Python and
   can reach the port, or mark the probe `NOT_RUN` with the reason.
 - **Neither kit fits the framework:** implement the four routes and the lock by hand

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-kit.md

@@ -100,10 +100,13 @@ service. Load it after the stylesheet, with ids only:
   — or one shaped like a credential — means no button, never a bad link. A press opens a view in Fabric and starts
   nothing (FB-8).
 - **The host (FB-6):** when the host's `fabric_button` cookie says `owner=host`, the page hides its own button.
-- **Fabric absent (FB-5):** when the cookie says `fabric=absent`, or `data-fabric="absent"` (a local service whose
-  server checked for Fabric's hub document), or when the page is still visible and focused 1.5 s after a link was
-  followed, the menu says "Fabric is not installed — get it at passioncode.ai/fabric". Nothing downloads, nothing
-  retries.
+- **Fabric absent (FB-5):** when the cookie says `fabric=absent`, or `data-fabric="absent"`, or when the page is still
+  visible and focused 1.5 s after a link was followed, the menu says "Fabric is not installed — get it at
+  passioncode.ai/fabric". Nothing downloads, nothing retries. A local service's server decides `data-fabric` with
+  `fabric_button_presence()` / `fabricButtonPresence()`: `present` while Fabric's own descriptor
+  (`services/fabric.default.json`, Fabric ADR-0139) is registered and, for an app's descriptor (`manager: "person"`,
+  DEC-0069), its app is still installed; `absent` otherwise. A press only follows a link, so the button never reads
+  Fabric's liveness file; a caller that sends Fabric anything reads that file and checks the process first.
 
 `window.FabricButton` exposes `buildFabricLink`, `parseFabricLink` and `parseButtonCookie` for a page that needs
 them. The button is optional: a page without the script has no button.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -95,16 +95,19 @@ itself (`isSmallOrderKey`), because Node before 26 lets OpenSSL accept a signatu
 
 ## Keys the estate record certifies
 
-A verifier that also reads the estate's record (DEC-0055, [the estate record reference](estate-record.md)) trusts a
-`kid` only while a current revision certifies it for a machine and does not revoke it (DL-14). Pass the current
-verified revision as `estate=` / `{ estate }`, as a value or as a function returning it, to `delegation_gate`,
+A verifier that also reads the estate's record (DEC-0055, DEC-0060, [the estate record reference](estate-record.md))
+trusts a `kid` only while the revision it reads certifies it (DL-14, row 4a, right after the signature). Pass the
+current verified revision as `estate=` / `{ estate }`, as a value or as a function returning it, with
+`estate_applied` / `estateApplied` and `estate_revocations` / `estateRevocations`, to `delegation_gate`,
 `verify_delegation` or `verify_approval`.
-- An uncertified `kid` is refused `unauthenticated` (`approval-invalid` for an approval), with detail
+- An uncertified `kid` is the token's fault: `unauthenticated` (`approval-invalid` for an approval), detail
   `kid-not-certified`.
-- An unreadable record is refused `issuer-unavailable`, with detail `estate-unreadable`.
+- A revision that cannot be read, is outside its window, is lower than the applied one or forks it is the trust
+  source's fault: `issuer-unavailable`, detail `estate-unreadable`, `estate-outside-window`, `estate-rolled-back` or
+  `estate-forked`.
 - Without `estate`, nothing changes.
-- Pass only a revision `verify_estate_record` accepted, and the highest one the machine has applied. The rule trusts
-  what it is given, so an unverified or older revision would certify a key the current one revoked.
+- Every verifier refuses a clock that is not a number of seconds `unknown-state` `no-clock` before row 1: a NaN clock
+  would make every time row false and pass an expired token.
 
 ## What the kit does not do
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/estate-record.md

@@ -43,12 +43,16 @@ It checks, in the order of the ER table:
    parent, and no revocation dropped.
 5. **The signer.** The signing passkey must be among the trusted ones and not revoked by the parent. A revision may
    revoke its own signer: that is rotation.
-6. **The assertion.**
+6. **The assertion.** The passkey is a signing credential (DEC-0063): an RP ID that is not a dedicated signing RP,
+   `sign.<domain>` in lower case, is `wrong-rp` before the assertion is read, and an origin outside the RP ID is not
+   pinned, so a ceremony that ran there is `wrong-origin`.
    - Client data: type, challenge, origin, no cross-origin use.
    - The RP ID hash, and the user-presence and user-verification flags.
    - The signature: ES256 or EdDSA, under a key validated first (a valid P-256 point; an Ed25519 key of full order).
-7. **The window.** At most 30 days.
-8. **The record's own rules.** A violation is `rule-violation` with its `codes`.
+7. **The window.** At most 30 days. A revision may be issued up to 60 s ahead of the verifier's clock (DEC-0066,
+   `CLOCK_SKEW_SECONDS`); earlier than that it is `not-yet-valid`.
+8. **The record's own rules.** A violation is `rule-violation` with its `codes`, `FAC-SEM-072…076` and `FAC-SEM-092`
+   (each passkey the record lists is a signing credential, its origins within its RP ID).
 
 Dates are strict RFC 3339: a `T`, an offset, and a day that exists. `:60` and a space are refused. Passkey JWK `x`
 and `y` must be canonical base64url. The Python kit verifies ES256 in pure Python (P-256, strict DER), and the Node
@@ -56,22 +60,35 @@ kit through `node:crypto`.
 
 ## Trusting a delegation key
 
-A delegation verifier that reads the estate record trusts a token's `kid` only while a current revision certifies it
-for a machine and does not revoke it (DL-14, contract CT-20). Give the gate the current verified revision, or a
-function that returns it:
+A delegation verifier that reads the estate record trusts a token's `kid` only while the revision it reads certifies
+it (DL-14, contract DEC-0060): exactly one machine's `hubKey` has that `kid` and the published key's `x`, the clock is
+inside the revision's window (from 60 s before `issuedAt`, DEC-0066, to `validUntil`), and neither the revision nor the
+revocation delta's entries applied since it revoke `hub-key <kid>` or `machine <id>`. It is checked right after the
+signature (DL-13 row 4a). Give the gate the current verified revision, or a function that returns it, the highest
+revision the machine applied, and the delta's revocations:
 
 ```python
-gate = fd.delegation_gate(audience=..., jwks=keys, issuer=..., effects=..., estate=lambda: current)
+gate = fd.delegation_gate(audience=..., jwks=keys, issuer=..., effects=..., estate=lambda: current,
+                          estate_applied={"revision": applied_number, "digest": applied_digest},
+                          estate_revocations=lambda: delta_entries)
 ```
 
-- A `kid` the record does not certify is refused like an unknown key: `unauthenticated` (for an approval,
-  `approval-invalid`) with detail `kid-not-certified`. The same holds when the record names another key under that
-  kid, revokes it, or is outside its window.
-- A record that cannot be read certifies nothing: `issuer-unavailable` with detail `estate-unreadable`.
-- **What you pass in.** Pass only a revision that `verify_estate_record` accepted, and the highest revision the
-  machine has applied. The rule trusts the record it is given. A record nobody verified, or an older revision still
-  inside its window, would certify a key the current revision revoked (a rollback).
-- `hub_key_certified(record, kid, x, at)` / `hubKeyCertified(...)` answers the question on its own.
+- **The token's fault** — no such certification, another key under that `kid`, a `kid` on two machines, a revoked hub
+  key or machine — is `unauthenticated` (for an approval, `approval-invalid`) with detail `kid-not-certified`.
+- **The trust source's fault** is `issuer-unavailable`: `estate-unreadable` (a source that throws or answers nothing
+  readable, a revision without a number or digest, a window of zero or over 30 days, dates read strictly, `machines` or
+  `revocations` not arrays), `estate-outside-window`, `estate-rolled-back` (lower than the applied revision) and
+  `estate-forked` (the applied number with another digest). A caller cannot cure these by minting again.
+- An unreadable clock — not a finite number of seconds a `Date` can hold — is refused `unknown-state` `no-clock`
+  before row 1, in every verifier.
+- Only an absent `estate` skips the check. In the Node kit `null` is an unreadable source; in Python, where `None` is
+  the absent value, pass a function returning `None` for a source that has nothing.
+- **What you pass in.** Pass only a revision that `verify_estate_record` accepted and whose number is not lower than
+  the highest the machine applied; a higher one only when you verified its chain from the applied revision.
+- `hub_key_certified(record, kid, x, at, applied, extra_revocations)` /
+  `hubKeyCertified(record, kid, x, at, applied, {extraRevocations})` answers the question on its own:
+  `{certified: true, machine, revision}` or `{certified: false, fault, detail}`. Both kits are held to the contract's
+  `fixtures/vectors/hub-key.json` (`test/fixtures/contract/hub-key-vectors.json`).
 
 ## Checking a record you produce
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -73,12 +73,52 @@ operator's real jobs.
 ## One copy under a supervisor
 
 Started by hand, a copy that finds `service.lock` held prints one sentence naming the
-holder and exits 75 at once. Under launchd that exit is a respawn every `ThrottleInterval`
-(10 s), forever, and under systemd one every `RestartSec`. So a copy whose plist or unit
-carries `FABRIC_SERVICE_SUPERVISOR=launchd` (or `systemd`) backs off in-process — 0.5 s doubling to 30 s, 300 s in all — takes over if the holder leaves,
-and exits 75 only when the wait runs out: a few starts an hour instead of 360. It touches
-nothing while it waits. Two installs sharing one data directory are still the defect to
-remove; the back-off only stops the loop from costing the machine.
+holder (or saying the holder is unknown, when its pid cannot be read) and exits 75 at once.
+Under launchd that exit is a respawn every `ThrottleInterval` (10 s), forever, and under
+systemd one every `RestartSec`. So a copy its supervisor started, and that says so with the
+**supervisor marker**, backs off in-process — 0.5 s doubling to 30 s, 300 s in all — takes over
+if the holder leaves, and exits 75 only when the wait runs out: a few starts an hour instead of
+360. It touches nothing while it waits. Two installs sharing one data directory are still the
+defect to remove; the back-off only stops the loop from costing the machine.
+
+The marker (contract DEC-0057, CT-01) is the variable `FABRIC_SERVICE_SUPERVISOR=<manager>` or
+the argument `--fabric-supervisor <manager>` (also `--fabric-supervisor=<manager>`), after the
+executable and before any `--`; `<manager>` is `launchd`, `systemd`, `task-scheduler` or `node`
+(Project Observatory's node, which supervises the services it starts). The writer of the
+supervisor file writes it: `launchd_plist` and `systemd_unit` / `systemdUnit` set the variable,
+always; `task_xml` / `taskXml` put the argument in the task's `Arguments`, because a task's action
+carries no environment. Each writer refuses a marker already in the program arguments. A copy
+never infers supervision from its parent process.
+
+- `supervisor_marker(env, argv)` / `supervisorMarker({env, argv})` reads both forms and answers
+  `supervised` (with the manager), `manual` or `conflict`. Only an empty variable counts as no
+  marker; a bare `--fabric-supervisor` (followed by nothing, by `--` or by another `--…` flag,
+  none of which it consumes) names no manager.
+- Markers that disagree — the variable and the argument with different values, the argument
+  twice, or a bare or empty argument beside the variable — exit 75 at once, before the lock and
+  whether or not it is held, naming both markers.
+- A service's own argument parser accepts the flag in both spellings and ignores it: in Python,
+  `add_supervisor_argument(parser)` (argparse otherwise exits 2 on an unknown flag); the sample
+  service adds it to the parser and to each command.
+- The kits are held to the contract's `fixtures/vectors/service-supervisor.json`, and their
+  starts against a held lock are recorded and read as `FAC-SEM-078` reads them
+  (`test/*supervisors*`).
+
+## An app's own descriptor and the node
+
+**An app** a person installs and starts has no supervisor (contract DEC-0069). Its descriptor says
+`"lifecycle": {"manager": "person", "app": "<the installed bundle or executable>"}`, `installedBy {by: "person", role,
+tool}` and no `origin`: it says the app is installed, never that it runs. The installer writes it; where there is none
+(a macOS app dragged into Applications), the app writes it on a start when `app_descriptor_action` /
+`appDescriptorAction` answers `write` — no descriptor yet, another version in `installedBy.tool`, or another path than
+`lifecycle.app` — and never from an App Translocation path. Its live origin and process id go in its own liveness file,
+rewritten on every start and removed on quit; a caller that sends anything reads that file and checks the process.
+`write_descriptor` claims no port for it, and a reader that finds `lifecycle.app` gone treats the descriptor as stale.
+
+**The node** (DEC-0061): `"lifecycle": {"manager": "node"}` is a local service Project Observatory's node installed and
+supervises as its child. There is no supervisor file, so `label`, `plist`, `unit` and `task` are refused beside it; the
+node starts the child with the supervisor marker (`--fabric-supervisor node` or the variable) and owns Install, Off,
+Code, Uninstall and state.
 
 ## Directories
 
@@ -151,7 +191,7 @@ control character (a line break would end a unit line early).
 **Linux — a systemd user unit.** `systemd_unit(unit, argv, working_directory=…)` /
 `systemdUnit(unit, argv, {workingDirectory})` writes `Restart=always`, `RestartSec=10`,
 `TimeoutStopSec` above the drain (15 s default), `KillMode=mixed`, `WantedBy=default.target`
-and `FABRIC_SERVICE_SUPERVISOR=systemd`, quoting every argument (`%` → `%%`, `$` → `$$`).
+and `FABRIC_SERVICE_SUPERVISOR=systemd` (always, whatever the caller passed), quoting every argument (`%` → `%%`, `$` → `$$`).
 `WorkingDirectory=` is written unquoted: systemd reads it as the rest of the line, so quotes would
 become part of the path and the unit would be refused (`systemd-analyze verify` checks it in CI). The
 descriptor says `"lifecycle": {"manager": "systemd", "unit": "<id>.<instance>.service"}`.
@@ -179,9 +219,12 @@ CI job has the real `schtasks` create, read back and delete such a task. The des
 | stop, keep off | `schtasks /End /TN <task>`, then `schtasks /Change /TN <task> /DISABLE` |
 | uninstall | `task_uninstall` / `taskUninstall`: `/End`, then `/Delete /F` |
 
-A task cannot set an environment variable, so a copy Task Scheduler restarts does not back off
-in-process; `IgnoreNew` keeps the scheduler from starting a second copy, and a hand-started copy
-holding the lock makes the scheduled one exit 75 once a minute until it leaves.
+A task cannot set an environment variable, so `task_xml` / `taskXml` write the marker as an
+argument, `--fabric-supervisor task-scheduler`, before any `--`: a copy the Task Scheduler starts
+backs off in-process like one under launchd or systemd. `IgnoreNew` keeps the scheduler from
+starting a second copy. Measured (FAA-38, [report](https://github.com/passioncode-ai/fabric-agent-adapter/blob/main/docs/reports/2026-10-13-faa-38-windows-exit75/README.md)):
+`RestartOnFailure` does not restart a task whose action exits 75, so that wait is the only recovery there; a copy
+that still exits 75 stays down until the next logon.
 
 **One copy on each system.** The Python kit takes `flock` (Linux) or a locked byte
 (Windows); the Node kit cannot, so it holds a name instead — an abstract unix socket on Linux,
@@ -192,7 +235,14 @@ holds the same name beside its file lock, so the two kits exclude each other eve
 
 **Token files on Windows.** The privacy of `service.token` is its ACL (service.md *Windows
 token files*): the kits write a protected list — the user, SYSTEM and Administrators, set before the
-token's bytes go in, any entry already there dropped — and refuse
-on read a link, a file outside the profile, another owner, or any other granted SID, naming the
-SID. The Node kit reads the list with Windows PowerShell 5.1 (.NET, no modules) and writes it
-with `icacls`; the path goes through the environment, never a command line.
+token's bytes go in, any entry already there dropped. On read, `windows_token_acl_problem` /
+`windowsTokenAclProblem` decide over what was read — the file's flags, its owner SID and each ACE
+as `{type, sid, mask}` (DEC-0057, `FAC-SEM-079`, held to the contract's
+`fixtures/vectors/windows-token.json`): a reparse point, a directory, a real path outside the
+profile, another owner, an allow ACE with a non-zero mask for any other SID, an ACE of another type
+than allow or deny (an object or callback ACE), or anything unreadable is refused, naming the SID;
+deny ACEs and an allow with an empty mask grant nothing; SIDs compare case-insensitively. The Python
+kit reads the ACEs from the file's SDDL (`acl_from_sddl`); the Node kit reads them with Windows
+PowerShell 5.1 (.NET's raw descriptor, no modules), converting .NET's signed mask to the unsigned
+one, and writes the list with `icacls`; the path goes through the environment, never a command line.
+An inherit-only ACE applies to children, not to the file, and is not read.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,11 +1,13 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `b291bf09e0a9f9fd3c16cf540832cd021203b7d1`
+Pinned to `fabric-agent-contract` commit `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
 canonical forms DEC-0043; `degraded[].setup` and `run.mcp.stdio.scope` DEC-0044; delegation sealed and trust tiers
-DEC-0045; runner and model profiles DEC-0046). The contract's schemas are normative;
+DEC-0045; runner and model profiles DEC-0046; the estate record DEC-0055; one copy under any supervisor and its marker,
+the Windows token-file reader DEC-0057; the hub key the estate certifies DEC-0060; signing credentials DEC-0063; the
+estate record's 60 s skew DEC-0066). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
@@ -29,13 +31,15 @@ File `<id>.<instance>.json`, mode 0600 (on Windows a protected ACL), atomic.
 | `protocol` | `"fabric-service/0.1"` |
 | `id`, `instance` | `^[a-z][a-z0-9-]{1,62}$`, `^[a-z][a-z0-9-]{0,31}$` (default `default`); the pair is unique per machine |
 | `name`, `summary` | ≤ 80 and ≤ 200 characters |
-| `origin` | `http://127.0.0.1:<port>`; the port is a machine-wide claim |
+| `origin` | `http://127.0.0.1:<port>`; the port is a machine-wide claim. Optional for an app's descriptor only (`manager: "person"`, DEC-0069): its live origin and process id are in the app's own liveness file, and a descriptor without an origin claims no port (`FAC-SEM-010`) |
 | `auth` | `tokenFile` (0600; on Windows a protected ACL — owner and every granting entry the current user, SYSTEM or Administrators: service.md *Windows token files*, DEC-0032, DEC-0033); `header` default `Authorization` with `scheme` `Bearer`; any other header carries the raw token with `scheme: "none"` |
-| `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032). Both kits and the probe accept all four; both kits write the unit and the task (`systemd_unit`, `task_xml` / `systemdUnit`, `taskXml`) |
+| `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task), `node` (Project Observatory's node supervises it as its child, with no supervisor file, DEC-0061), `person` (an app a person installs and starts, then `app`, the installed app, DEC-0069) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032), `label` and `plist` beside any but `launchd` (DEC-0057), `app` beside any but `person`. Both kits and the probe accept all six; both kits write the unit and the task (`systemd_unit`, `task_xml` / `systemdUnit`, `taskXml`). An app's descriptor says it is installed, never that it runs: the probe checks `app` is still there (`descriptor.app-installed`) and reads no well-known document; a reader that finds the app gone treats the descriptor as stale (`app_descriptor_stale` / `appDescriptorStale`), and an app that writes its own descriptor rewrites it only when `app_descriptor_action` / `appDescriptorAction` says `write` |
 | `paths` | `data` (required), `logs[]`, optional `config`, `cache` |
 | `commands` | only `doctor` and `update`, argument arrays whose first item is an absolute or `~/` path (Windows: also `C:\…`, `C:/…` or `~\…`, never a network share — DEC-0032) |
 | `source.repository`, `fabricManifest` | optional |
-| `installedAt`, `installedBy` | when and by which installer version |
+| `installedAt`, `installedBy` | when, and who installed it: the installer and its version as a string, or `{by, role?, tool}` (DEC-0061) — `by` `person` (with `role` `operator` or `administrator`), `node` or `organization`; `role` for a person only; `tool` the installer and its version. It names a role, never a person. An app's descriptor uses the object form with `by: "person"`. `register_remote` / `registerRemote` and the sample write the object form |
+| `runner` | optional `{kind?, credentialKind}` (DEC-0061): `credentialKind` `subscription`, `key`, `platform-metered` or `none` — a kind, never a credential (`FAC-SEM-086` refuses a credential-shaped value here or in `installedBy`); a subscription names its vendor's runner (`claude-code`, `kimi-code`, `codex`) |
+| `peer` | optional `{endpoint, custody, residency, maxDataClass}` (DEC-0061): the service is offered to others. `endpoint` `https://<dns-name>[:<port>][/<path>]`, never a reserved name (`FAC-SEM-085`); `custody` `organization-managed` or `personal`; `residency` 1–32 ISO 3166-1 alpha-2 codes, `EU` admitted, user-assigned codes refused; `maxDataClass` `public` < `internal` < `confidential` < `restricted`. An offer needs `runner` and never runs on a subscription. A host sends a request from anyone but the operator only when `peer_refusal` / `peerRefusal` answers null (`FAC-SEM-088`); usage rows may take `route: "platform-metered"` |
 
 ## Well-known document — `GET /.well-known/fabric-service`
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -172,8 +172,11 @@ class Probe:
         self.add("descriptor.valid", "FAIL" if problems else "PASS", "; ".join(problems) or str(self.path))
         if fs.WINDOWS:
             # DEC-0032: on Windows the file's ACL is its privacy.
-            owner, granting = fs.windows_acl(self.path)
-            problem = fs.token_acl_problem(self.path, owner, granting, fs.windows_user_sid())
+            owner, aces = fs.windows_acl(self.path)
+            info = os.lstat(self.path)
+            problem = fs.windows_token_acl_problem({"isRegularFile": stat.S_ISREG(info.st_mode), "isReparsePoint": stat.S_ISLNK(info.st_mode),
+                                                    "realPathInProfile": True, "ownerSid": owner, "aces": aces}, fs.windows_user_sid())
+            problem = problem and problem["message"]
             self.add("descriptor.private", "FAIL" if problem else "PASS", problem or "owner-only ACL")
         else:
             mode = stat.S_IMODE(os.stat(self.path).st_mode)
@@ -186,10 +189,23 @@ class Probe:
                 continue
             if key == me:
                 clashes.append("%s declared again in %s" % (me, path.name))
-            elif not self.remote and fs.placement_of(other) != "remote" and other.get("origin") == self.d.get("origin"):
+            # DEC-0069: a descriptor without an origin (an app's) claims no port, so two of them never clash.
+            elif (not self.remote and "origin" in self.d and fs.placement_of(other) != "remote"
+                  and other.get("origin") == self.d.get("origin")):
                 clashes.append("port %d also claimed by %s" % (self.port, key))
-        unique = "a remote origin claims no port here" if self.remote else "port %d is unique" % self.port
+        if self.remote:
+            unique = "a remote origin claims no port here"
+        elif "origin" not in self.d:
+            unique = "an app's descriptor names no origin, so it claims no port (FAC-SEM-010)"
+        else:
+            unique = "port %d is unique" % self.port
         self.add("descriptor.port-claim", "FAIL" if clashes else "PASS", "; ".join(clashes) or unique)
+        if (self.d.get("lifecycle") or {}).get("manager") == "person":
+            # DEC-0069: installed, never running — a reader checks the app is still there; liveness is the app's own file.
+            present = fs.app_present(self.d)
+            self.add("descriptor.app-installed", "PASS" if present else "FAIL",
+                     "%s is installed" % self.d["lifecycle"].get("app") if present
+                     else "%s is gone: a reader treats this descriptor as stale" % self.d["lifecycle"].get("app"))
 
     # well-known ----------------------------------------------------------------
     def well_known_rules(self) -> None:
@@ -759,6 +775,10 @@ class Probe:
 
     def run(self) -> List[Result]:
         self.descriptor_rules()
+        if "origin" not in self.d and not self.remote:
+            self.add("well-known.answers", "NOT_RUN",
+                     "an app's descriptor says it is installed, never that it runs; its live origin is in its own liveness file (DEC-0069)")
+            return self.results
         if not self.port:
             return self.results
         self.well_known_rules()