@passioncode-ai/fabric-agent-adapter 0.23.0 → 0.24.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 0.24.0 - 2026-10-13
+
+An app's own descriptor (contract DEC-0069) and the descriptor for listings (DEC-0061) in both kits (FAA-34). The contract
+pin does not move: both decisions are at `fe55fc6`.
+
+### Added
+
+- **`lifecycle.manager` `node` and `person`.** `node`: Project Observatory's node supervises the service as its child,
+  with no supervisor file, so `label`, `plist`, `unit` and `task` are refused beside it. `person`: an app a person
+  installs and starts — `lifecycle.app` is required, `origin` is optional (its live origin is in the app's own liveness
+  file), and `installedBy` is `{by: "person", role, tool}`. `write_descriptor` / `writeDescriptor` claim no port for
+  it, and `check_service.py` reads it as installed, never running: `descriptor.app-installed`, no port claim, and the
+  well-known document `NOT_RUN`.
+- **`installedBy` by role, `runner` and `peer`.**
+  - `installedBy` is a string or `{by, role?, tool}`.
+  - `runner` is `{kind?, credentialKind}`, a kind and never a credential.
+  - `peer` is `{endpoint, custody, residency, maxDataClass}`. An offer needs `runner` and never a subscription.
+  - FAC-SEM-085 refuses a peer on a reserved name. FAC-SEM-086 refuses a value shaped like a credential in `runner` or
+    `installedBy`, naming its place.
+- **Ports held to the contract's vectors:** `peer_refusal` / `peerRefusal` (`service-peer.json`),
+  `app_descriptor_action` / `appDescriptorAction` and `app_descriptor_stale` / `appDescriptorStale`
+  (`app-descriptor.json`).
+- **`fabric_button_presence` / `fabricButtonPresence`** answer whether Fabric's button may show. The answer is
+  `present` only while Fabric's own descriptor (`fabric.default.json`) is registered and, for an app's descriptor,
+  its app is still installed. A server sets `data-fabric="absent"` otherwise.
+- **Usage:** `make_usage_receipt` / `makeUsageReceipt` accept `route: "platform-metered"`. A configuration's route
+  stays `subscription` or `key`.
+
+### Changed
+
+- `register_remote` / `registerRemote` and the sample's `register` write `installedBy` in its object form
+  (`{by: "person", role: "operator", tool}`). `register_remote` / `registerRemote` also take `runner` and `peer`.
+
+### Fixed
+
+- `check_service.py` reported two descriptors without an origin as claiming the same port.
+- `write_descriptor` / `writeDescriptor` failed on a descriptor without one.
+
+### Evidence
+
+- Every service-descriptor fixture of the contract at `fe55fc6` is held through both validators: 10 valid accepted;
+  every invalid one refused except the six local-channel negatives (DEC-0075, not a kit surface), a set the tests pin.
+- The FAC-SEM-085/086 semantic fixtures answer at the contract's places.
+- 32 planted defects, all caught.
+- The scenario eval `app-descriptor-and-listing` was written before the prose.
+
 ## 0.23.0 - 2026-10-13
 
 The contract pin moves from `b291bf0` (DEC-0055) to contract `main` `fe55fc6`, and both kits follow every rule in that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.23.0"
+  version: "0.24.0"
   contract-version: "0.1.0"
   contract-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,7 +16,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.23.0"
+  version: "0.24.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
@@ -323,8 +323,11 @@ this estate needs.
 
 ## When something is missing
 
-- **Not macOS / no launchd:** declare `lifecycle.manager: "none"`; hosts show the
-  service read-only. Keep every other rule.
+- **Not macOS / no launchd:** the kits write a systemd user unit (Linux) or a per-user Scheduled Task (Windows); with
+  no supervisor at all declare `lifecycle.manager: "none"`, and hosts show the service read-only. Keep every other rule.
+- **A desktop app with no supervisor** (DEC-0069): its descriptor says `manager: "person"` with `lifecycle.app`, no
+  origin, `installedBy {by: "person", role, tool}`; its live origin is in its own liveness file
+  (the lifecycle reference, *An app's own descriptor and the node*).
 - **No Python:** use the Node kit; run the probe from any machine that has Python and
   can reach the port, or mark the probe `NOT_RUN` with the reason.
 - **Neither kit fits the framework:** implement the four routes and the lock by hand

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-kit.md

@@ -100,10 +100,13 @@ service. Load it after the stylesheet, with ids only:
   — or one shaped like a credential — means no button, never a bad link. A press opens a view in Fabric and starts
   nothing (FB-8).
 - **The host (FB-6):** when the host's `fabric_button` cookie says `owner=host`, the page hides its own button.
-- **Fabric absent (FB-5):** when the cookie says `fabric=absent`, or `data-fabric="absent"` (a local service whose
-  server checked for Fabric's hub document), or when the page is still visible and focused 1.5 s after a link was
-  followed, the menu says "Fabric is not installed — get it at passioncode.ai/fabric". Nothing downloads, nothing
-  retries.
+- **Fabric absent (FB-5):** when the cookie says `fabric=absent`, or `data-fabric="absent"`, or when the page is still
+  visible and focused 1.5 s after a link was followed, the menu says "Fabric is not installed — get it at
+  passioncode.ai/fabric". Nothing downloads, nothing retries. A local service's server decides `data-fabric` with
+  `fabric_button_presence()` / `fabricButtonPresence()`: `present` while Fabric's own descriptor
+  (`services/fabric.default.json`, Fabric ADR-0139) is registered and, for an app's descriptor (`manager: "person"`,
+  DEC-0069), its app is still installed; `absent` otherwise. A press only follows a link, so the button never reads
+  Fabric's liveness file; a caller that sends Fabric anything reads that file and checks the process first.
 
 `window.FabricButton` exposes `buildFabricLink`, `parseFabricLink` and `parseButtonCookie` for a page that needs
 them. The button is optional: a page without the script has no button.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -104,6 +104,22 @@ never infers supervision from its parent process.
   starts against a held lock are recorded and read as `FAC-SEM-078` reads them
   (`test/*supervisors*`).
 
+## An app's own descriptor and the node
+
+**An app** a person installs and starts has no supervisor (contract DEC-0069). Its descriptor says
+`"lifecycle": {"manager": "person", "app": "<the installed bundle or executable>"}`, `installedBy {by: "person", role,
+tool}` and no `origin`: it says the app is installed, never that it runs. The installer writes it; where there is none
+(a macOS app dragged into Applications), the app writes it on a start when `app_descriptor_action` /
+`appDescriptorAction` answers `write` — no descriptor yet, another version in `installedBy.tool`, or another path than
+`lifecycle.app` — and never from an App Translocation path. Its live origin and process id go in its own liveness file,
+rewritten on every start and removed on quit; a caller that sends anything reads that file and checks the process.
+`write_descriptor` claims no port for it, and a reader that finds `lifecycle.app` gone treats the descriptor as stale.
+
+**The node** (DEC-0061): `"lifecycle": {"manager": "node"}` is a local service Project Observatory's node installed and
+supervises as its child. There is no supervisor file, so `label`, `plist`, `unit` and `task` are refused beside it; the
+node starts the child with the supervisor marker (`--fabric-supervisor node` or the variable) and owns Install, Off,
+Code, Uninstall and state.
+
 ## Directories
 
 | What | macOS | Linux | Windows (DEC-0032) |
@@ -206,7 +222,9 @@ CI job has the real `schtasks` create, read back and delete such a task. The des
 A task cannot set an environment variable, so `task_xml` / `taskXml` write the marker as an
 argument, `--fabric-supervisor task-scheduler`, before any `--`: a copy the Task Scheduler starts
 backs off in-process like one under launchd or systemd. `IgnoreNew` keeps the scheduler from
-starting a second copy.
+starting a second copy. Measured (FAA-38, [report](https://github.com/passioncode-ai/fabric-agent-adapter/blob/main/docs/reports/2026-10-13-faa-38-windows-exit75/README.md)):
+`RestartOnFailure` does not restart a task whose action exits 75, so that wait is the only recovery there; a copy
+that still exits 75 stays down until the next logon.
 
 **One copy on each system.** The Python kit takes `flock` (Linux) or a locked byte
 (Windows); the Node kit cannot, so it holds a name instead — an abstract unix socket on Linux,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -31,13 +31,15 @@ File `<id>.<instance>.json`, mode 0600 (on Windows a protected ACL), atomic.
 | `protocol` | `"fabric-service/0.1"` |
 | `id`, `instance` | `^[a-z][a-z0-9-]{1,62}$`, `^[a-z][a-z0-9-]{0,31}$` (default `default`); the pair is unique per machine |
 | `name`, `summary` | ≤ 80 and ≤ 200 characters |
-| `origin` | `http://127.0.0.1:<port>`; the port is a machine-wide claim |
+| `origin` | `http://127.0.0.1:<port>`; the port is a machine-wide claim. Optional for an app's descriptor only (`manager: "person"`, DEC-0069): its live origin and process id are in the app's own liveness file, and a descriptor without an origin claims no port (`FAC-SEM-010`) |
 | `auth` | `tokenFile` (0600; on Windows a protected ACL — owner and every granting entry the current user, SYSTEM or Administrators: service.md *Windows token files*, DEC-0032, DEC-0033); `header` default `Authorization` with `scheme` `Bearer`; any other header carries the raw token with `scheme: "none"` |
-| `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032). Both kits and the probe accept all four; both kits write the unit and the task (`systemd_unit`, `task_xml` / `systemdUnit`, `taskXml`) |
+| `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task), `node` (Project Observatory's node supervises it as its child, with no supervisor file, DEC-0061), `person` (an app a person installs and starts, then `app`, the installed app, DEC-0069) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032), `label` and `plist` beside any but `launchd` (DEC-0057), `app` beside any but `person`. Both kits and the probe accept all six; both kits write the unit and the task (`systemd_unit`, `task_xml` / `systemdUnit`, `taskXml`). An app's descriptor says it is installed, never that it runs: the probe checks `app` is still there (`descriptor.app-installed`) and reads no well-known document; a reader that finds the app gone treats the descriptor as stale (`app_descriptor_stale` / `appDescriptorStale`), and an app that writes its own descriptor rewrites it only when `app_descriptor_action` / `appDescriptorAction` says `write` |
 | `paths` | `data` (required), `logs[]`, optional `config`, `cache` |
 | `commands` | only `doctor` and `update`, argument arrays whose first item is an absolute or `~/` path (Windows: also `C:\…`, `C:/…` or `~\…`, never a network share — DEC-0032) |
 | `source.repository`, `fabricManifest` | optional |
-| `installedAt`, `installedBy` | when and by which installer version |
+| `installedAt`, `installedBy` | when, and who installed it: the installer and its version as a string, or `{by, role?, tool}` (DEC-0061) — `by` `person` (with `role` `operator` or `administrator`), `node` or `organization`; `role` for a person only; `tool` the installer and its version. It names a role, never a person. An app's descriptor uses the object form with `by: "person"`. `register_remote` / `registerRemote` and the sample write the object form |
+| `runner` | optional `{kind?, credentialKind}` (DEC-0061): `credentialKind` `subscription`, `key`, `platform-metered` or `none` — a kind, never a credential (`FAC-SEM-086` refuses a credential-shaped value here or in `installedBy`); a subscription names its vendor's runner (`claude-code`, `kimi-code`, `codex`) |
+| `peer` | optional `{endpoint, custody, residency, maxDataClass}` (DEC-0061): the service is offered to others. `endpoint` `https://<dns-name>[:<port>][/<path>]`, never a reserved name (`FAC-SEM-085`); `custody` `organization-managed` or `personal`; `residency` 1–32 ISO 3166-1 alpha-2 codes, `EU` admitted, user-assigned codes refused; `maxDataClass` `public` < `internal` < `confidential` < `restricted`. An offer needs `runner` and never runs on a subscription. A host sends a request from anyone but the operator only when `peer_refusal` / `peerRefusal` answers null (`FAC-SEM-088`); usage rows may take `route: "platform-metered"` |
 
 ## Well-known document — `GET /.well-known/fabric-service`
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -189,10 +189,23 @@ class Probe:
                 continue
             if key == me:
                 clashes.append("%s declared again in %s" % (me, path.name))
-            elif not self.remote and fs.placement_of(other) != "remote" and other.get("origin") == self.d.get("origin"):
+            # DEC-0069: a descriptor without an origin (an app's) claims no port, so two of them never clash.
+            elif (not self.remote and "origin" in self.d and fs.placement_of(other) != "remote"
+                  and other.get("origin") == self.d.get("origin")):
                 clashes.append("port %d also claimed by %s" % (self.port, key))
-        unique = "a remote origin claims no port here" if self.remote else "port %d is unique" % self.port
+        if self.remote:
+            unique = "a remote origin claims no port here"
+        elif "origin" not in self.d:
+            unique = "an app's descriptor names no origin, so it claims no port (FAC-SEM-010)"
+        else:
+            unique = "port %d is unique" % self.port
         self.add("descriptor.port-claim", "FAIL" if clashes else "PASS", "; ".join(clashes) or unique)
+        if (self.d.get("lifecycle") or {}).get("manager") == "person":
+            # DEC-0069: installed, never running — a reader checks the app is still there; liveness is the app's own file.
+            present = fs.app_present(self.d)
+            self.add("descriptor.app-installed", "PASS" if present else "FAIL",
+                     "%s is installed" % self.d["lifecycle"].get("app") if present
+                     else "%s is gone: a reader treats this descriptor as stale" % self.d["lifecycle"].get("app"))
 
     # well-known ----------------------------------------------------------------
     def well_known_rules(self) -> None:
@@ -762,6 +775,10 @@ class Probe:
 
     def run(self) -> List[Result]:
         self.descriptor_rules()
+        if "origin" not in self.d and not self.remote:
+            self.add("well-known.answers", "NOT_RUN",
+                     "an app's descriptor says it is installed, never that it runs; its live origin is in its own liveness file (DEC-0069)")
+            return self.results
         if not self.port:
             return self.results
         self.well_known_rules()

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -54,7 +54,11 @@ const O_EXLOCK = 0x20; // BSD/macOS: open(2) takes flock(LOCK_EX); absent from f
 // DEC-0032: a local path starts with ~/ (or ~\ on Windows), / (never //) or a drive letter; a network share never does.
 // DEC-0057: `//server/…` and `/\\server…` are shares on Windows too, so a leading slash is followed by neither.
 const LOCAL_PATH = /^(~[\\/]|\/(?![\\/])|[A-Za-z]:[\\/])/;
-export const MANAGERS = Object.freeze(['launchd', 'systemd', 'task-scheduler', 'none']);
+// DEC-0061: `node` (Project Observatory's node supervises its children, no supervisor file); DEC-0069: `person` (an app a
+// person installs and starts; its descriptor says it is installed, never that it runs).
+export const MANAGERS = Object.freeze(['launchd', 'systemd', 'task-scheduler', 'node', 'person', 'none']);
+/** Managers that write no launchd label or plist (DEC-0057, DEC-0061, DEC-0069). */
+const NOT_LAUNCHD = Object.freeze(['systemd', 'task-scheduler', 'node', 'person']);
 const AUTH_HEADER = /^[A-Za-z][A-Za-z0-9-]{0,63}$/;
 const UNIT = /^[A-Za-z0-9][A-Za-z0-9:_.@-]{0,250}\.service$/;
 const TASK = /^\\[A-Za-z0-9 ._\\-]{1,254}$/;
@@ -521,7 +525,9 @@ export function validateDescriptor(d) {
   const problems = [];
   const remote = placementOf(d) === 'remote';
   if (d.placement !== undefined && !PLACEMENTS.includes(d.placement)) problems.push('placement must be local or remote');
-  const required = ['protocol', 'id', 'instance', 'name', 'origin', 'auth', 'lifecycle', 'installedAt', 'installedBy'];
+  // DEC-0069: an app's descriptor says it is installed, never that it runs; its live origin is in its own liveness file.
+  const app = d.lifecycle?.manager === 'person';
+  const required = ['protocol', 'id', 'instance', 'name', ...(app ? [] : ['origin']), 'auth', 'lifecycle', 'installedAt', 'installedBy'];
   for (const key of remote ? required : [...required, 'paths']) {
     if (!(key in d)) problems.push(`missing ${key}`);
   }
@@ -530,7 +536,7 @@ export function validateDescriptor(d) {
   if (!ID.test(d.id)) problems.push(`id must match ${ID}`);
   if (!INSTANCE.test(d.instance)) problems.push(`instance must match ${INSTANCE}`);
   if (remote) problems.push(...remoteOriginProblems(d.origin));
-  else if (!ORIGIN.test(d.origin)) problems.push('origin must be http://127.0.0.1:<port>');
+  else if (d.origin !== undefined && !ORIGIN.test(d.origin)) problems.push('origin must be http://127.0.0.1:<port>');
   if (!d.auth?.tokenFile) problems.push('auth.tokenFile is required');
   else if (!LOCAL_PATH.test(String(d.auth.tokenFile))) problems.push('auth.tokenFile must be a local path, never a network share');
   for (const value of [...(d.paths?.data !== undefined ? [d.paths.data] : []), ...(d.paths?.logs ?? [])]) {
@@ -543,14 +549,18 @@ export function validateDescriptor(d) {
   }
   const life = d.lifecycle ?? {};
   const manager = life.manager;
-  if (!MANAGERS.includes(manager)) problems.push('lifecycle.manager must be launchd, systemd, task-scheduler or none');
+  if (!MANAGERS.includes(manager)) problems.push('lifecycle.manager must be launchd, systemd, task-scheduler, node, person or none');
+  // DEC-0069: `app` is the installed app of a person's descriptor, and nothing else's.
+  if (manager === 'person' && life.app === undefined) problems.push("a person's app declares lifecycle.app, the installed app");
+  if (life.app !== undefined && manager !== 'person') problems.push('lifecycle.app belongs to manager person only');
+  if (life.app !== undefined && !LOCAL_PATH.test(String(life.app))) problems.push('lifecycle.app must be a local path');
   if (manager === 'launchd' && !(life.label && String(life.plist ?? '').endsWith('.plist'))) {
     problems.push('a launchd service declares label and plist');
   }
   if (life.plist !== undefined && !LOCAL_PATH.test(String(life.plist))) problems.push('lifecycle.plist must be a local path');
-  // DEC-0057: a descriptor names one supervisor; launchd's label and plist never sit beside another.
+  // DEC-0057, DEC-0061, DEC-0069: a descriptor names one supervisor; launchd's label and plist never sit beside another.
   for (const field of ['label', 'plist']) {
-    if (life[field] !== undefined && ['systemd', 'task-scheduler'].includes(manager)) problems.push(`lifecycle.${field} belongs to launchd, not to ${manager}`);
+    if (life[field] !== undefined && NOT_LAUNCHD.includes(manager)) problems.push(`lifecycle.${field} belongs to launchd, not to ${manager}`);
   }
   // DEC-0032: `unit` goes with systemd and `task` with Task Scheduler, and with nothing else.
   for (const [field, owner, pattern] of [['unit', 'systemd', UNIT], ['task', 'task-scheduler', TASK]]) {
@@ -565,6 +575,7 @@ export function validateDescriptor(d) {
     }
     if (d.commands?.update !== undefined) problems.push('a remote service declares no update command');
   }
+  problems.push(...descriptorMemberProblems(d));
   for (const [name, argv] of Object.entries(d.commands ?? {})) {
     if (!['doctor', 'update'].includes(name)) problems.push(`unknown command ${name}`);
     else if (!Array.isArray(argv) || !argv.length || !argv.every((a) => typeof a === 'string')) problems.push(`command ${name} must be an argument array`);
@@ -574,6 +585,127 @@ export function validateDescriptor(d) {
 }
 
 /** DEC-0019: `local` unless the descriptor says `remote`. */
+// --- DEC-0061 and DEC-0069: who installed it, how its model calls sign in, offered to others, an app's own descriptor ---
+
+/** The organization edition's data classes, least sensitive first (DEC-0061, DEC-0053). */
+export const PEER_DATA_CLASSES = Object.freeze(['public', 'internal', 'confidential', 'restricted']);
+/** The kind of a runner's sign-in, never a credential's value (DEC-0061). */
+export const CREDENTIAL_KINDS = Object.freeze(['subscription', 'key', 'platform-metered', 'none']);
+/** A subscription runs only in its vendor's runner (DEC-0046): runner kind → login. */
+export const SUBSCRIPTION_RUNNERS = Object.freeze({ 'claude-code': 'claude', 'kimi-code': 'kimi', codex: 'chatgpt' });
+const PEER_ENDPOINT = /^https:\/\/((?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?$/;
+const RESIDENCY = /^(A[B-Z]|[B-PR-WY][A-Z]|Q[A-L]|Z[A-Y])$/;
+const RUNNER_KIND_NAME = /^[a-z][a-z0-9-]{1,62}$/;
+const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const text = (v, low = 1, high = 200) => typeof v === 'string' && v.length >= low && v.length <= high;
+/** A JSON Pointer token (RFC 6901 §4). */
+const pointer = (name) => String(name).replace(/~/g, '~0').replace(/\//g, '~1');
+
+/**
+ * DEC-0061 and DEC-0069 on a descriptor's `installedBy`, `runner` and `peer`, as the schema shapes them, with FAC-SEM-085
+ * (a peer on a reserved name) and FAC-SEM-086 (a credential-shaped value in `runner` or `installedBy`, named by its
+ * place, never its value).
+ */
+export function descriptorMemberProblems(d) {
+  const problems = [];
+  const life = isObj(d.lifecycle) ? d.lifecycle : {};
+  const by = d.installedBy;
+  const places = [];
+  if (typeof by === 'string') {
+    if (!text(by)) problems.push('installedBy is the installer and its version, 1 to 200 characters');
+    places.push(['/installedBy', by]);
+  } else if (isObj(by)) {
+    for (const k of Object.keys(by)) if (!['by', 'role', 'tool'].includes(k)) problems.push(`installedBy has no member ${k}`);
+    if (!['person', 'node', 'organization'].includes(by.by)) problems.push('installedBy.by is person, node or organization');
+    if (by.by === 'person' && !['operator', 'administrator'].includes(by.role)) problems.push('installedBy.role is operator or administrator for a person');
+    if (by.by !== 'person' && 'role' in by) problems.push('installedBy.role belongs to a person only');
+    if (!text(by.tool)) problems.push('installedBy.tool is the installer and its version, 1 to 200 characters');
+    for (const [k, v] of Object.entries(by)) places.push([`/installedBy/${pointer(k)}`, v]);
+  } else problems.push("installedBy is the installer's name or {by, role?, tool}");
+  if (life.manager === 'person' && !(isObj(by) && by.by === 'person')) problems.push("an app's descriptor names who installed it as a person: installedBy {by: person, role, tool} (DEC-0069)");
+  let runner = d.runner;
+  if ('runner' in d) {
+    if (!isObj(runner)) { problems.push('runner is {kind?, credentialKind}'); runner = {}; }
+    for (const k of Object.keys(runner)) if (!['kind', 'credentialKind'].includes(k)) problems.push(`runner has no member ${k}`);
+    if (!CREDENTIAL_KINDS.includes(runner.credentialKind)) problems.push('runner.credentialKind is subscription, key, platform-metered or none');
+    if ('kind' in runner && !(typeof runner.kind === 'string' && RUNNER_KIND_NAME.test(runner.kind))) problems.push("runner.kind is a runner kind's name");
+    if (runner.credentialKind === 'subscription' && !Object.hasOwn(SUBSCRIPTION_RUNNERS, runner.kind)) problems.push("a subscription runs only in its vendor's runner: runner.kind claude-code, kimi-code or codex");
+    for (const [k, v] of Object.entries(runner)) places.push([`/runner/${pointer(k)}`, v]);
+  }
+  if ('peer' in d) {
+    let peer = d.peer;
+    if (!isObj(peer)) { problems.push('peer is {endpoint, custody, residency, maxDataClass}'); peer = {}; }
+    for (const k of Object.keys(peer)) if (!['endpoint', 'custody', 'residency', 'maxDataClass'].includes(k)) problems.push(`peer has no member ${k}`);
+    const m = typeof peer.endpoint === 'string' && peer.endpoint.length <= 2048 ? PEER_ENDPOINT.exec(peer.endpoint) : null;
+    if (!m) problems.push('peer.endpoint is https://<dns-name>[:<port>][/<path>], no query, fragment, userinfo or IP literal');
+    else if (RESERVED_HOST.test(m[1])) problems.push(`FAC-SEM-085: a service offered to others cannot be reached at the reserved name ${m[1]}`);
+    if (!['organization-managed', 'personal'].includes(peer.custody)) problems.push('peer.custody is organization-managed or personal');
+    const r = peer.residency;
+    if (!Array.isArray(r) || r.length < 1 || r.length > 32 || new Set(r.map((x) => JSON.stringify(x))).size !== r.length || !r.every((x) => typeof x === 'string' && RESIDENCY.test(x))) {
+      problems.push('peer.residency is 1 to 32 distinct ISO 3166-1 alpha-2 codes in upper case, EU admitted, no user-assigned code');
+    }
+    if (!PEER_DATA_CLASSES.includes(peer.maxDataClass)) problems.push('peer.maxDataClass is public, internal, confidential or restricted');
+    if (!('runner' in d)) problems.push('a service offered to others declares runner (DEC-0061)');
+    else if (isObj(runner) && runner.credentialKind === 'subscription') problems.push('a service offered to others never runs on a subscription (DEC-0061)');
+  }
+  for (const [place, value] of places) {
+    if (typeof value === 'string' && secretArgument(value)) problems.push(`FAC-SEM-086: ${place} holds a value shaped like a credential; it names a kind, a role or an installer`);
+  }
+  return problems;
+}
+
+/**
+ * The host's check before it routes a request from anyone but the service's operator (DEC-0061, FAC-SEM-088):
+ * `not-offered`, `peer-invalid`, `data-class-unknown` or `above-max-data-class`; null when it may. The contract's `peerRefusal`.
+ */
+export function peerRefusal(descriptor, dataClass) {
+  if (!isObj(descriptor) || !isObj(descriptor.peer)) return 'not-offered';
+  const max = typeof descriptor.peer.maxDataClass === 'string' ? PEER_DATA_CLASSES.indexOf(descriptor.peer.maxDataClass) : -1;
+  if (max < 0) return 'peer-invalid';
+  const asked = typeof dataClass === 'string' ? PEER_DATA_CLASSES.indexOf(dataClass) : -1;
+  if (asked < 0) return 'data-class-unknown';
+  return asked > max ? 'above-max-data-class' : null;
+}
+
+/**
+ * What an app that writes its own descriptor does with it on a start (DEC-0069): `keep` from a translocated copy (macOS
+ * App Translocation); otherwise `write` when there is none, when it is not an app's descriptor, or when its version
+ * (`installedBy.tool`) or its path (`lifecycle.app`) differs; `keep` otherwise. The contract's `appDescriptorAction`.
+ */
+export function appDescriptorAction(existing, tool, appPath) {
+  if (appPath.includes('/AppTranslocation/')) return 'keep';
+  if (!isObj(existing) || !isObj(existing.installedBy)) return 'write';
+  const recorded = isObj(existing.lifecycle) ? existing.lifecycle.app : undefined;
+  return existing.installedBy.tool === tool && recorded === appPath ? 'keep' : 'write';
+}
+
+/** Whether a reader treats a descriptor as stale (DEC-0069): an app's descriptor whose installed app it did not find. */
+export function appDescriptorStale(descriptor, appPresent) {
+  if (!isObj(descriptor) || !isObj(descriptor.lifecycle) || descriptor.lifecycle.manager !== 'person') return false;
+  return !appPresent;
+}
+
+/** Whether `lifecycle.app` of an app's descriptor exists on this machine (a bundle is a folder, an executable a file). */
+export function appPresent(descriptor) {
+  const app = isObj(descriptor?.lifecycle) ? descriptor.lifecycle.app : undefined;
+  try { return typeof app === 'string' && fs.existsSync(expand(app)); } catch { return false; }
+}
+
+/** Fabric's own descriptor (Fabric ADR-0139): `services/fabric.default.json`. */
+export const FABRIC_SERVICE = Object.freeze(['fabric', 'default']);
+
+/**
+ * `present` or `absent` for Fabric's button (DEC-0040 FB-5, DEC-0069, Fabric SCN-142): present when Fabric's own
+ * descriptor is registered and, for an app's descriptor, its app is still installed; a server sets `data-fabric="absent"`
+ * on the button's script otherwise. The button only follows a link, so the liveness file is not read here.
+ */
+export function fabricButtonPresence(dir = servicesDir()) {
+  let found;
+  try { found = JSON.parse(fs.readFileSync(descriptorPath(...FABRIC_SERVICE, dir), 'utf8')); } catch { return 'absent'; }
+  if (!isObj(found) || validateDescriptor(found).length) return 'absent';
+  return appDescriptorStale(found, appPresent(found)) ? 'absent' : 'present';
+}
+
 export function placementOf(d) {
   return d?.placement === 'remote' ? 'remote' : 'local';
 }
@@ -597,8 +729,8 @@ export function writeDescriptor(d, dir = servicesDir()) {
   const problems = validateDescriptor(d);
   if (problems.length) throw new ServiceError(`Descriptor is invalid: ${problems.join('; ')}.`);
   const me = `${d.id}.${d.instance}`;
-  // DEC-0019: only a local placement claims a port on this computer.
-  const port = placementOf(d) === 'remote' ? null : portOf(d.origin);
+  // DEC-0019: only a local placement claims a port on this computer; DEC-0069: an app's descriptor names none.
+  const port = placementOf(d) === 'remote' || d.origin === undefined ? null : portOf(d.origin);
   for (const [file, other] of readDescriptors(dir)) {
     const key = `${other.id}.${other.instance ?? 'default'}`;
     if (key === me) continue;
@@ -661,6 +793,8 @@ const PROFILE_ID = /^[a-z][a-z0-9-]{0,62}$/;
 const RUNNER_KIND = /^[a-z][a-z0-9-]{1,62}$/;
 const MODEL_ID = /^[a-z0-9][a-z0-9._-]{0,63}\/[a-z0-9][a-z0-9._:-]{0,127}$/;
 export const ROUTES = Object.freeze(['subscription', 'key']);
+/** A usage row's route (DEC-0046, DEC-0061): beside a configuration's two, the hosting platform's own metered models. */
+export const USAGE_ROUTES = Object.freeze([...ROUTES, 'platform-metered']);
 
 /** DEC-0046: the well-known `configuration` — {slots, resolved} as service-well-known.schema.json types it. */
 export function configurationProblems(doc) {
@@ -766,7 +900,7 @@ export function makeUsageReceipt(provider, model, { inputTokens, outputTokens, c
   if (costUsd !== null && (typeof costUsd !== 'number' || !Number.isFinite(costUsd) || costUsd < 0)) throw new ServiceError('costUsd must be a non-negative number or null.');
   const basis = costBasis ?? (costUsd === null ? 'unknown' : 'provider');
   if (!COST_BASES.includes(basis) || (costUsd === null) !== (basis === 'unknown')) throw new ServiceError('costBasis is provider or price-list with a cost, unknown without one.');
-  if (route !== undefined && !ROUTES.includes(route)) throw new ServiceError('route is subscription or key (DEC-0046).');
+  if (route !== undefined && !USAGE_ROUTES.includes(route)) throw new ServiceError('route is subscription, key or platform-metered (DEC-0046, DEC-0061).');
   return { at: at ?? nowIso(), provider, model, ...counts, costUsd, costBasis: basis, ...(route === undefined ? {} : { route }) };
 }
 
@@ -1650,13 +1784,20 @@ export function remoteTokenFile(id, instance = 'default', dir = servicesDir()) {
  * a secret. Returns the descriptor path. `token` is read from the caller — a file or stdin —
  * never from an argument vector.
  */
-export function registerRemote({ id, instance = 'default', name, summary, origin, token, doctor, dir = servicesDir(), installedBy = 'fabric-service register-remote' }) {
+/**
+ * DEC-0019, installer side: register an online service on THIS computer — the token file (0600, never printed) and the
+ * descriptor. DEC-0061: `installedBy` defaults to `{by: 'person', role: 'operator', tool: 'fabric-service register-remote'}`
+ * (a person runs this); `runner` (`{kind?, credentialKind}`) says how its model calls sign in, as a kind and never a
+ * credential; `peer` (`{endpoint, custody, residency, maxDataClass}`) offers it to others and needs `runner`.
+ */
+export function registerRemote({ id, instance = 'default', name, summary, origin, token, doctor, dir = servicesDir(),
+  installedBy = { by: 'person', role: 'operator', tool: 'fabric-service register-remote' }, runner, peer }) {
   if (!token || String(token).trim().length < 16) throw new ServiceError('the service token must be at least 16 characters.');
   const tokenFile = remoteTokenFile(id, instance, dir);
   const d = {
     protocol: PROTOCOL, id, instance, name, ...(summary ? { summary } : {}), placement: 'remote', origin,
     auth: { tokenFile }, lifecycle: { manager: 'none' }, ...(doctor ? { commands: { doctor } } : {}),
-    installedAt: nowIso(), installedBy,
+    installedAt: nowIso(), installedBy, ...(runner ? { runner: { ...runner } } : {}), ...(peer ? { peer: { ...peer } } : {}),
   };
   const problems = validateDescriptor(d);
   if (problems.length) throw new ServiceError(`Descriptor is invalid: ${problems.join('; ')}.`);

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -90,7 +90,11 @@ _SPAN_ID = re.compile(r"^(?!0{16}$)[0-9a-f]{16}$")
 # DEC-0057: `//server/…` and `/\\server…` are shares on Windows too, so a leading slash is followed by neither.
 _LOCAL_PATH = re.compile(r"^(~[\\/]|/(?![\\/])|[A-Za-z]:[\\/])")
 # DEC-0032: the supervisor per system and the field that names its job.
-MANAGERS = ("launchd", "systemd", "task-scheduler", "none")
+# DEC-0061: `node` (Project Observatory's node supervises its children, no supervisor file); DEC-0069: `person` (an app
+# a person installs and starts; its descriptor says it is installed, never that it runs).
+MANAGERS = ("launchd", "systemd", "task-scheduler", "node", "person", "none")
+#: Managers that write no launchd label or plist (DEC-0057, DEC-0061, DEC-0069).
+_NOT_LAUNCHD = ("systemd", "task-scheduler", "node", "person")
 _AUTH_HEADER = re.compile(r"[A-Za-z][A-Za-z0-9-]{0,63}")
 _UNIT = re.compile(r"^[A-Za-z0-9][A-Za-z0-9:_.@-]{0,250}\.service$")
 _TASK = re.compile(r"^\\[A-Za-z0-9 ._\\-]{1,254}$")
@@ -886,7 +890,10 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
     remote = placement_of(descriptor) == "remote"
     if "placement" in descriptor and descriptor["placement"] not in PLACEMENTS:
         problems.append("placement must be local or remote")
-    required = ("protocol", "id", "instance", "name", "origin", "auth", "lifecycle", "installedAt", "installedBy")
+    life_in = descriptor.get("lifecycle") if isinstance(descriptor.get("lifecycle"), dict) else {}
+    app = life_in.get("manager") == "person"
+    # DEC-0069: an app's descriptor says it is installed, never that it runs; its live origin is in its own liveness file.
+    required = ("protocol", "id", "instance", "name", "auth", "lifecycle", "installedAt", "installedBy") + (() if app else ("origin",))
     if not remote:
         required = required + ("paths",)
     for key in required:
@@ -902,7 +909,7 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
         problems.append("instance must match %s" % _INSTANCE.pattern)
     if remote:
         problems.extend(remote_origin_problems(descriptor["origin"]))
-    elif not _ORIGIN.match(str(descriptor["origin"])):
+    elif "origin" in descriptor and not _ORIGIN.match(str(descriptor["origin"])):
         problems.append("origin must be http://127.0.0.1:<port>")
     auth = descriptor.get("auth") or {}
     if "tokenFile" not in auth:
@@ -924,14 +931,21 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
     life = descriptor.get("lifecycle") or {}
     manager = life.get("manager")
     if manager not in MANAGERS:
-        problems.append("lifecycle.manager must be launchd, systemd, task-scheduler or none")
+        problems.append("lifecycle.manager must be launchd, systemd, task-scheduler, node, person or none")
+    # DEC-0069: `app` is the installed app of a person's descriptor, and nothing else's.
+    if manager == "person" and "app" not in life:
+        problems.append("a person's app declares lifecycle.app, the installed app")
+    if "app" in life and manager != "person":
+        problems.append("lifecycle.app belongs to manager person only")
+    if "app" in life and not _LOCAL_PATH.match(str(life["app"])):
+        problems.append("lifecycle.app must be a local path")
     if manager == "launchd" and not (life.get("label") and str(life.get("plist", "")).endswith(".plist")):
         problems.append("a launchd service declares label and plist")
     if "plist" in life and not _LOCAL_PATH.match(str(life["plist"])):
         problems.append("lifecycle.plist must be a local path")
-    # DEC-0057: a descriptor names one supervisor; launchd's label and plist never sit beside another.
+    # DEC-0057, DEC-0061, DEC-0069: a descriptor names one supervisor; launchd's label and plist never sit beside another.
     for field in ("label", "plist"):
-        if field in life and manager in ("systemd", "task-scheduler"):
+        if field in life and manager in _NOT_LAUNCHD:
             problems.append("lifecycle.%s belongs to launchd, not to %s" % (field, manager))
     # DEC-0032: `unit` goes with systemd and `task` with Task Scheduler, and with nothing else.
     for field, owner, pattern in (("unit", "systemd", _UNIT), ("task", "task-scheduler", _TASK)):
@@ -949,6 +963,7 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
                 problems.append("a remote service has no %s %s" % (of, field))
         if "update" in (descriptor.get("commands") or {}):
             problems.append("a remote service declares no update command")
+    problems.extend(descriptor_member_problems(descriptor))
     for name, argv in (descriptor.get("commands") or {}).items():
         if name not in ("doctor", "update"):
             problems.append("unknown command %s" % name)
@@ -959,6 +974,166 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
     return problems
 
 
+# --- DEC-0061 and DEC-0069: who installed it, how its model calls sign in, offered to others, an app's own descriptor ---
+
+#: The organization edition's data classes, least sensitive first (DEC-0061, DEC-0053).
+PEER_DATA_CLASSES = ("public", "internal", "confidential", "restricted")
+#: The kind of a runner's sign-in, never a credential's value (DEC-0061).
+CREDENTIAL_KINDS = ("subscription", "key", "platform-metered", "none")
+#: A subscription runs only in its vendor's runner (DEC-0046): runner kind → login.
+SUBSCRIPTION_RUNNERS = {"claude-code": "claude", "kimi-code": "kimi", "codex": "chatgpt"}
+_PEER_ENDPOINT = re.compile(r"^https://(?P<host>([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?$", re.ASCII)
+_RESIDENCY = re.compile(r"^(A[B-Z]|[B-PR-WY][A-Z]|Q[A-L]|Z[A-Y])$", re.ASCII)
+_RUNNER_KIND_NAME = re.compile(r"^[a-z][a-z0-9-]{1,62}$", re.ASCII)
+
+
+def _pointer(name: str) -> str:
+    """A JSON Pointer token (RFC 6901 §4)."""
+    return str(name).replace("~", "~0").replace("/", "~1")
+
+
+def _text(value: Any, low: int = 1, high: int = 200) -> bool:
+    return isinstance(value, str) and low <= len(value) <= high
+
+
+def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
+    """DEC-0061 and DEC-0069 on a descriptor's `installedBy`, `runner` and `peer`, as the schema shapes them, with
+    FAC-SEM-085 (a peer on a reserved name) and FAC-SEM-086 (a credential-shaped value in `runner` or `installedBy`,
+    named by its place, never its value)."""
+    import fabric_secrets  # noqa: E402 - beside this file; the contract's detector (DEC-0044)
+    problems: List[str] = []
+    life = descriptor.get("lifecycle") if isinstance(descriptor.get("lifecycle"), dict) else {}
+    by = descriptor.get("installedBy")
+    places: List[Tuple[str, Any]] = []
+    if isinstance(by, str):
+        if not _text(by):
+            problems.append("installedBy is the installer and its version, 1 to 200 characters")
+        places.append(("/installedBy", by))
+    elif isinstance(by, dict):
+        problems += ["installedBy has no member %s" % k for k in by if k not in ("by", "role", "tool")]
+        if by.get("by") not in ("person", "node", "organization"):
+            problems.append("installedBy.by is person, node or organization")
+        if by.get("by") == "person" and by.get("role") not in ("operator", "administrator"):
+            problems.append("installedBy.role is operator or administrator for a person")
+        if by.get("by") != "person" and "role" in by:
+            problems.append("installedBy.role belongs to a person only")
+        if not _text(by.get("tool")):
+            problems.append("installedBy.tool is the installer and its version, 1 to 200 characters")
+        places += [("/installedBy/%s" % _pointer(k), v) for k, v in by.items()]
+    else:
+        problems.append("installedBy is the installer's name or {by, role?, tool}")
+    if life.get("manager") == "person" and not (isinstance(by, dict) and by.get("by") == "person"):
+        problems.append("an app's descriptor names who installed it as a person: installedBy {by: person, role, tool} (DEC-0069)")
+    runner = descriptor.get("runner")
+    if "runner" in descriptor:
+        if not isinstance(runner, dict):
+            problems.append("runner is {kind?, credentialKind}")
+            runner = {}
+        problems += ["runner has no member %s" % k for k in runner if k not in ("kind", "credentialKind")]
+        if runner.get("credentialKind") not in CREDENTIAL_KINDS:
+            problems.append("runner.credentialKind is subscription, key, platform-metered or none")
+        if "kind" in runner and not (isinstance(runner["kind"], str) and _RUNNER_KIND_NAME.match(runner["kind"])):
+            problems.append("runner.kind is a runner kind's name")
+        if runner.get("credentialKind") == "subscription" and runner.get("kind") not in SUBSCRIPTION_RUNNERS:
+            problems.append("a subscription runs only in its vendor's runner: runner.kind claude-code, kimi-code or codex")
+        places += [("/runner/%s" % _pointer(k), v) for k, v in runner.items()]
+    if "peer" in descriptor:
+        peer = descriptor.get("peer")
+        if not isinstance(peer, dict):
+            problems.append("peer is {endpoint, custody, residency, maxDataClass}")
+            peer = {}
+        problems += ["peer has no member %s" % k for k in peer if k not in ("endpoint", "custody", "residency", "maxDataClass")]
+        endpoint = peer.get("endpoint")
+        match = _PEER_ENDPOINT.match(endpoint) if isinstance(endpoint, str) and len(endpoint) <= 2048 else None
+        if not match:
+            problems.append("peer.endpoint is https://<dns-name>[:<port>][/<path>], no query, fragment, userinfo or IP literal")
+        elif _RESERVED_HOST.search(match.group("host")):
+            problems.append("FAC-SEM-085: a service offered to others cannot be reached at the reserved name %s" % match.group("host"))
+        if peer.get("custody") not in ("organization-managed", "personal"):
+            problems.append("peer.custody is organization-managed or personal")
+        residency = peer.get("residency")
+        if (not isinstance(residency, list) or not 1 <= len(residency) <= 32 or len(set(map(json.dumps, residency))) != len(residency)
+                or not all(isinstance(r, str) and _RESIDENCY.match(r) for r in residency)):
+            problems.append("peer.residency is 1 to 32 distinct ISO 3166-1 alpha-2 codes in upper case, EU admitted, no user-assigned code")
+        if peer.get("maxDataClass") not in PEER_DATA_CLASSES:
+            problems.append("peer.maxDataClass is public, internal, confidential or restricted")
+        if "runner" not in descriptor:
+            problems.append("a service offered to others declares runner (DEC-0061)")
+        elif isinstance(runner, dict) and runner.get("credentialKind") == "subscription":
+            problems.append("a service offered to others never runs on a subscription (DEC-0061)")
+    for place, value in places:
+        if isinstance(value, str) and fabric_secrets.secret_argument(value):
+            problems.append("FAC-SEM-086: %s holds a value shaped like a credential; it names a kind, a role or an installer" % place)
+    return problems
+
+
+def peer_refusal(descriptor: Any, data_class: Any) -> Optional[str]:
+    """The host's check before it routes a request from anyone but the service's operator (DEC-0061, FAC-SEM-088):
+    `not-offered` (no `peer`), `peer-invalid` (its maximum is not one of the four classes), `data-class-unknown` (the
+    request's class is not one of them, exactly as written) or `above-max-data-class`; None when it may. The contract's
+    `peerRefusal`."""
+    if not isinstance(descriptor, dict) or not isinstance(descriptor.get("peer"), dict):
+        return "not-offered"
+    ceiling = descriptor["peer"].get("maxDataClass")
+    if not isinstance(ceiling, str) or ceiling not in PEER_DATA_CLASSES:
+        return "peer-invalid"
+    if not isinstance(data_class, str) or data_class not in PEER_DATA_CLASSES:
+        return "data-class-unknown"
+    return "above-max-data-class" if PEER_DATA_CLASSES.index(data_class) > PEER_DATA_CLASSES.index(ceiling) else None
+
+
+def app_descriptor_action(existing: Any, tool: str, app_path: str) -> str:
+    """What an app that writes its own descriptor does with it on a start (DEC-0069): `keep` when it runs from a
+    translocated copy (macOS App Translocation); otherwise `write` when there is none, when it is not an app's descriptor,
+    when its version (`installedBy.tool`) or its path (`lifecycle.app`) differs; `keep` otherwise. The contract's
+    `appDescriptorAction`."""
+    if "/AppTranslocation/" in app_path:
+        return "keep"
+    if not isinstance(existing, dict) or not isinstance(existing.get("installedBy"), dict):
+        return "write"
+    recorded = existing["lifecycle"].get("app", _MISSING_APP) if isinstance(existing.get("lifecycle"), dict) else _MISSING_APP
+    return "keep" if existing["installedBy"].get("tool", _MISSING_APP) == tool and recorded == app_path else "write"
+
+
+_MISSING_APP = object()
+
+
+def app_descriptor_stale(descriptor: Any, app_present: bool) -> bool:
+    """Whether a reader treats a descriptor as stale (DEC-0069): an app's descriptor whose installed app it did not find.
+    A supervised service's descriptor is never stale by this test. The contract's `appDescriptorStale`."""
+    life = descriptor.get("lifecycle") if isinstance(descriptor, dict) else None
+    return isinstance(life, dict) and life.get("manager") == "person" and not app_present
+
+
+def app_present(descriptor: Dict[str, Any]) -> bool:
+    """Whether `lifecycle.app` of an app's descriptor exists on this machine (a bundle is a folder, an executable a file)."""
+    life = descriptor.get("lifecycle") if isinstance(descriptor.get("lifecycle"), dict) else {}
+    app = life.get("app")
+    try:
+        return isinstance(app, str) and expand(app).exists()
+    except ServiceError:  # not a local path: nothing installed there
+        return False
+
+
+#: Fabric's own descriptor (Fabric ADR-0139): `services/fabric.default.json`.
+FABRIC_SERVICE = ("fabric", "default")
+
+
+def fabric_button_presence(directory: Optional[Path] = None) -> str:
+    """`present` or `absent` for Fabric's button (DEC-0040 FB-5, DEC-0069, Fabric SCN-142): present when Fabric's own
+    descriptor is registered and, for an app's descriptor, its app is still installed. A server sets
+    `data-fabric="absent"` on the button's script otherwise. The button only follows a link, so the liveness file is
+    not read here; a caller that sends anything reads it."""
+    path = descriptor_path(*FABRIC_SERVICE, directory=directory)
+    try:
+        found = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return "absent"
+    if not isinstance(found, dict) or validate_descriptor(found):
+        return "absent"
+    return "absent" if app_descriptor_stale(found, app_present(found)) else "present"
+
+
 def placement_of(descriptor: Dict[str, Any]) -> str:
     """DEC-0019: ``local`` unless the descriptor says ``remote``."""
     return "remote" if (descriptor or {}).get("placement") == "remote" else "local"
@@ -990,11 +1165,11 @@ def write_descriptor(descriptor: Dict[str, Any], directory: Optional[Path] = Non
         raise ServiceError("Descriptor is invalid: %s." % "; ".join(problems))
     root = directory or services_dir()
     me = "%s.%s" % (descriptor["id"], descriptor["instance"])
-    # DEC-0019: only a local placement claims a port on this computer.
-    port = None if placement_of(descriptor) == "remote" else port_of(descriptor["origin"])
+    # DEC-0019: only a local placement claims a port on this computer; DEC-0069: an app's descriptor names none.
+    port = None if placement_of(descriptor) == "remote" or "origin" not in descriptor else port_of(descriptor["origin"])
     for path, other in read_descriptors(root):
         key = "%s.%s" % (other.get("id"), other.get("instance", "default"))
-        if key == me or port is None:  # a remote origin's port is another computer's
+        if key == me or port is None:  # a remote origin's port is another computer's; an app claims none
             continue
         try:
             other_port = port_of(str(other.get("origin", "")))
@@ -1096,6 +1271,8 @@ _PROFILE_ID = re.compile(r"^[a-z][a-z0-9-]{0,62}$")
 _RUNNER_KIND = re.compile(r"^[a-z][a-z0-9-]{1,62}$")
 _MODEL_ID = re.compile(r"^[a-z0-9][a-z0-9._-]{0,63}/[a-z0-9][a-z0-9._:-]{0,127}$")
 ROUTES = ("subscription", "key")
+#: A usage row's route (DEC-0046, DEC-0061): beside a configuration's two, the hosting platform's own metered models.
+USAGE_ROUTES = ROUTES + ("platform-metered",)
 
 
 def configuration_problems(doc: Any) -> List[str]:
@@ -1289,12 +1466,12 @@ def make_usage_receipt(provider: str, model: str, *, input_tokens: int, output_t
     basis = cost_basis or ("unknown" if cost_usd is None else "provider")
     if basis not in COST_BASES or (cost_usd is None) != (basis == "unknown"):
         raise ServiceError("cost_basis is provider or price-list with a cost, unknown without one.")
-    if route is not None and route not in ROUTES:
-        raise ServiceError("route is subscription or key (DEC-0046).")
+    if route is not None and route not in USAGE_ROUTES:
+        raise ServiceError("route is subscription, key or platform-metered (DEC-0046, DEC-0061).")
     receipt = {"at": at or now_iso(), "provider": provider, "model": model, **counts,
                "costUsd": None if cost_usd is None else float(cost_usd), "costBasis": basis}
     if route is not None:
-        receipt["route"] = route  # the operator's own login in its vendor's runner, or an issued key
+        receipt["route"] = route  # the operator's own login in its vendor's runner, an issued key, or the platform's metered models
     return receipt
 
 
@@ -2346,18 +2523,30 @@ def remote_token_file(service_id: str, instance: str = "default", directory: Opt
 
 def register_remote(*, service_id: str, name: str, origin: str, token: str, instance: str = "default",
                     summary: Optional[str] = None, doctor: Optional[List[str]] = None,
-                    directory: Optional[Path] = None, installed_by: str = "fabric-service register-remote") -> Path:
+                    directory: Optional[Path] = None, installed_by: Any = None,
+                    runner: Optional[Dict[str, str]] = None, peer: Optional[Dict[str, Any]] = None) -> Path:
     """DEC-0019, installer side: register an online service on THIS computer — the token file
-    (0600, never printed) and the descriptor. The same token is set on the platform as a secret."""
+    (0600, never printed) and the descriptor. The same token is set on the platform as a secret.
+
+    DEC-0061: ``installed_by`` defaults to ``{"by": "person", "role": "operator", "tool": "fabric-service
+    register-remote"}`` (a person runs this); pass ``role: "administrator"`` for an organization's administrator, or a
+    string as before. ``runner`` (``{kind?, credentialKind}``) says how its model calls sign in, as a kind and never a
+    credential; ``peer`` (``{endpoint, custody, residency, maxDataClass}``) offers it to others and needs ``runner``."""
     if not token or len(token.strip()) < 16:
         raise ServiceError("the service token must be at least 16 characters.")
     root = directory or services_dir()
     token_file = remote_token_file(service_id, instance, root)
     descriptor: Dict[str, Any] = {"protocol": PROTOCOL, "id": service_id, "instance": instance, "name": name,
                                   "placement": "remote", "origin": origin, "auth": {"tokenFile": str(token_file)},
-                                  "lifecycle": {"manager": "none"}, "installedAt": now_iso(), "installedBy": installed_by}
+                                  "lifecycle": {"manager": "none"}, "installedAt": now_iso(),
+                                  "installedBy": installed_by if installed_by is not None else
+                                  {"by": "person", "role": "operator", "tool": "fabric-service register-remote"}}
     if summary:
         descriptor["summary"] = summary
+    if runner is not None:
+        descriptor["runner"] = dict(runner)
+    if peer is not None:
+        descriptor["peer"] = dict(peer)
     if doctor:
         descriptor["commands"] = {"doctor": list(doctor)}
     problems = validate_descriptor(descriptor)

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/sample_service.py

@@ -350,7 +350,8 @@ def register(args: argparse.Namespace) -> int:
         else {"manager": "none"},
         "paths": {"data": str(data), "logs": []},
         "fabricManifest": str(manifest),
-        "installedAt": fs.now_iso(), "installedBy": "sample_service.py register",
+        # DEC-0061: who installed it, by role and never by name — a person runs this register command.
+        "installedAt": fs.now_iso(), "installedBy": {"by": "person", "role": "operator", "tool": "sample_service.py register %s" % VERSION},
     }
     try:
         path = fs.write_descriptor(descriptor, Path(args.services_dir) if args.services_dir else None)

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.23.0"
+  version: "0.24.0"
   contract-version: "0.1.0"
   contract-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
 ---

package/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -18,7 +18,7 @@ compatibility: >-
   this plugin; Codex and Kimi Code get the session-start preamble hook on the person's consent.
 metadata:
   author: PassionCode.ai
-  version: "0.23.0"
+  version: "0.24.0"
 ---
 
 # Working with Fabric

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session.py

@@ -60,7 +60,7 @@ WATCH_MAX_BACKOFF_S = 900
 SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 LOCAL_ORIGIN = re.compile(r'"origin": "http://(?:127\.0\.0\.1|localhost)')
-VERSION = "0.23.0"
+VERSION = "0.24.0"
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code"}
 # A session Fabric launched. FABRIC_LAUNCHED_SESSION=1 is the marker Fabric is asked to set (need D6); the others are
 # what Fabric already gives a launched session (fabric sessionBundle.ts): only their NAMES are looked at, never a value