@passioncode-ai/fabric-agent-adapter 0.23.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,87 @@
 # Changelog
 
+## 0.25.0 - 2026-10-13
+
+Identifier equality by normal form (contract DEC-0076) in both kits, and the contract pin moves from `fe55fc6` to
+contract `main` `a046f57` (FAA-39). `fe55fc6` joins the supported revisions. DEC-0077 (`com.directory` pages) is in the
+pin. Its consumer is the kits' board client, which is not built yet (FAA-12b), so nothing reads it.
+
+### Added
+
+- **`normal_identifier` / `normalIdentifier` and `same_identifier` / `sameIdentifier`** (`fabric_identifiers.py`,
+  byte-identical in both skills, and `fabric-identifiers.mjs`). They port the contract's `src/identifiers.ts` and are
+  held to its `identifiers.json` (33 normal forms, 8 same, 8 different, 6 lax-port mistakes).
+  - A URI follows RFC 3986 §6.2.2.
+  - A `urn:` follows RFC 8141 §3.1 (the NSS's case is kept and nothing is decoded).
+  - Any other string is its own normal form.
+
+### Changed
+
+- **Compared by normal form:**
+  - FAC-SEM-030, FAC-SEM-032 and FAC-SEM-034 compare a revision reference's id and the project and capability of
+    admissions, bindings and events;
+  - FAC-SEM-076 compares share grants and `grant` revocations;
+  - FAC-SEM-014 compares a provider entry's `providerId`.
+
+  Two spellings of one identifier now read as one, and two identifiers stay two.
+- **Written in normal form:** the scaffolded `provider.id`, `identity.subject` and capability `id`, and the `providerId`
+  that `write_provider_entry` stores.
+
+### Evidence
+
+- The route and estate generators now add respelled-id cases (`urn` and the NID upper-cased, and the NSS's case
+  changed), each answered by the contract's own functions. The contract's fixtures are in normal form, so without these
+  cases the kits' byte comparisons stayed green.
+- The compiled-schema revision tests pass at `2ce3922` → `a046f57`.
+- 20 planted defects, all caught.
+- The scenario eval `identifiers-by-normal-form` was written before the prose.
+
+## 0.24.0 - 2026-10-13
+
+An app's own descriptor (contract DEC-0069) and the descriptor for listings (DEC-0061) in both kits (FAA-34). The contract
+pin does not move: both decisions are at `fe55fc6`.
+
+### Added
+
+- **`lifecycle.manager` `node` and `person`.** `node`: Project Observatory's node supervises the service as its child,
+  with no supervisor file, so `label`, `plist`, `unit` and `task` are refused beside it. `person`: an app a person
+  installs and starts — `lifecycle.app` is required, `origin` is optional (its live origin is in the app's own liveness
+  file), and `installedBy` is `{by: "person", role, tool}`. `write_descriptor` / `writeDescriptor` claim no port for
+  it, and `check_service.py` reads it as installed, never running: `descriptor.app-installed`, no port claim, and the
+  well-known document `NOT_RUN`.
+- **`installedBy` by role, `runner` and `peer`.**
+  - `installedBy` is a string or `{by, role?, tool}`.
+  - `runner` is `{kind?, credentialKind}`, a kind and never a credential.
+  - `peer` is `{endpoint, custody, residency, maxDataClass}`. An offer needs `runner` and never a subscription.
+  - FAC-SEM-085 refuses a peer on a reserved name. FAC-SEM-086 refuses a value shaped like a credential in `runner` or
+    `installedBy`, naming its place.
+- **Ports held to the contract's vectors:** `peer_refusal` / `peerRefusal` (`service-peer.json`),
+  `app_descriptor_action` / `appDescriptorAction` and `app_descriptor_stale` / `appDescriptorStale`
+  (`app-descriptor.json`).
+- **`fabric_button_presence` / `fabricButtonPresence`** answer whether Fabric's button may show. The answer is
+  `present` only while Fabric's own descriptor (`fabric.default.json`) is registered and, for an app's descriptor,
+  its app is still installed. A server sets `data-fabric="absent"` otherwise.
+- **Usage:** `make_usage_receipt` / `makeUsageReceipt` accept `route: "platform-metered"`. A configuration's route
+  stays `subscription` or `key`.
+
+### Changed
+
+- `register_remote` / `registerRemote` and the sample's `register` write `installedBy` in its object form
+  (`{by: "person", role: "operator", tool}`). `register_remote` / `registerRemote` also take `runner` and `peer`.
+
+### Fixed
+
+- `check_service.py` reported two descriptors without an origin as claiming the same port.
+- `write_descriptor` / `writeDescriptor` failed on a descriptor without one.
+
+### Evidence
+
+- Every service-descriptor fixture of the contract at `fe55fc6` is held through both validators: 10 valid accepted;
+  every invalid one refused except the six local-channel negatives (DEC-0075, not a kit surface), a set the tests pin.
+- The FAC-SEM-085/086 semantic fixtures answer at the contract's places.
+- 32 planted defects, all caught.
+- The scenario eval `app-descriptor-and-listing` was written before the prose.
+
 ## 0.23.0 - 2026-10-13
 
 The contract pin moves from `b291bf0` (DEC-0055) to contract `main` `fe55fc6`, and both kits follow every rule in that

package/README.md

@@ -235,7 +235,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`
+- commit: `a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b`
 
 Every other mention of the default contract revision — this section, the skills' metadata, the
 skill card, `adapt_project.py` — must equal it; `python3 test/validate.py` fails a tree

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.23.0"
+  version: "0.25.0"
   contract-version: "0.1.0"
-  contract-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
+  contract-commit: "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`.
+- commit `a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -21,10 +21,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
+CONTRACT_COMMIT = "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"
@@ -47,6 +47,15 @@ class AdaptationError(Exception):
     """Expected user-facing adaptation error."""
 
 
+
+def _normal_identifier(value: str) -> str:
+    """DEC-0076's normal form, from fabric_identifiers.py beside this file (byte-identical to the service kit's)."""
+    import importlib.util
+    spec = importlib.util.spec_from_file_location("fabric_identifiers", Path(__file__).resolve().parent / "fabric_identifiers.py")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module.normal_identifier(value)
+
 def _read_text(path: Path, limit: int = 262_144) -> str:
     try:
         if path.stat().st_size > limit:
@@ -237,24 +246,27 @@ def _generated_files(args: argparse.Namespace) -> Dict[str, str]:
             raise AdaptationError("a runtime argument carries a credential; argv is visible to every process (LC-21): read it from a secret reference instead")
 
     created_at = dt.datetime.now(dt.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+    # DEC-0076: a writer emits identifiers in their normal form, so every reader finds them under one spelling.
+    provider_id = _normal_identifier(args.provider_id)
+    capability_id = _normal_identifier(args.capability_id)
     manifest = {
         "contractVersion": CONTRACT_VERSION,
         "provider": {
-            "id": args.provider_id,
+            "id": provider_id,
             "revision": 1,
             "contentHash": "sha256:" + ("0" * 64),
             "createdAt": created_at,
             "createdBy": "urn:fabric:adapter:author",
             "name": args.provider_name,
             "identity": {
-                "subject": args.provider_id,
+                "subject": provider_id,
                 "method": "local-install" if args.profile == "local-runner" or (args.profile == "mcp" and args.mcp_mode == "stdio") else "tls",
             },
             "supportedContractVersions": [CONTRACT_VERSION],
         },
         "capabilities": [
             {
-                "id": args.capability_id,
+                "id": capability_id,
                 "name": args.capability_name,
                 "inputSchema": _schema_uri(args.schema_base, "schemas/capability-input.schema.json"),
                 "outputSchema": _schema_uri(args.schema_base, "schemas/capability-output.schema.json"),

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_identifiers.py

@@ -0,0 +1,182 @@
+"""Identifier equality (contract DEC-0076): two identifiers are the same when their normal forms are equal.
+
+A port of the contract's `src/identifiers.ts`, held to its `fixtures/vectors/identifiers.json`. The normal form of a URI
+is RFC 3986 §6.2.2 syntax-based normalization: the scheme and the host lower-cased and percent-encoding hex upper-cased
+(§6.2.2.1), percent-encoded unreserved characters decoded (§6.2.2.2), dot segments removed from a hierarchical path
+(§6.2.2.3), and only the leading ones from a rootless path; nothing scheme-based (§6.2.3). A `urn:` URI follows RFC 8141
+§3.1 instead: the scheme and the NID lower-cased, percent-encoding hex upper-cased, nothing decoded, the NSS's case kept,
+the r-, q- and f-components ignored. A string that is not a URI by RFC 3986's `URI` production is its own normal form.
+Nothing here raises. Standard library only; this file is byte-identical in both skills' `scripts/`."""
+from __future__ import annotations
+
+import re
+from typing import Any, Optional, Tuple
+
+_UNRESERVED = r"A-Za-z0-9\-._~"
+_SUB_DELIMS = r"!$&'()*+,;="
+_PCT = r"%[0-9A-Fa-f]{2}"
+
+
+def _run(chars: str) -> "re.Pattern[str]":
+    """`*( <chars> / pct-encoded )`, linear: one character class beside one fixed triplet."""
+    return re.compile(r"(?:[%s]|%s)*" % (chars, _PCT), re.ASCII)
+
+
+_USERINFO = _run(_UNRESERVED + _SUB_DELIMS + ":")
+_REG_NAME = _run(_UNRESERVED + _SUB_DELIMS)
+_PATH = _run(_UNRESERVED + _SUB_DELIMS + ":@/")
+_QUERY = _run(_UNRESERVED + _SUB_DELIMS + ":@/?")
+_PORT = re.compile(r"[0-9]*", re.ASCII)
+_SCHEME = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*", re.ASCII)
+
+# RFC 3986 §3.2.2: IP-literal = "[" ( IPv6address / IPvFuture ) "]".
+_H16 = "[0-9A-Fa-f]{1,4}"
+_DEC_OCTET = "(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])"
+_IPV4 = r"%s(?:\.%s){3}" % (_DEC_OCTET, _DEC_OCTET)
+_LS32 = "(?:%s:%s|%s)" % (_H16, _H16, _IPV4)
+_IPV6 = "|".join([
+    "(?:%s:){6}%s" % (_H16, _LS32),
+    "::(?:%s:){5}%s" % (_H16, _LS32),
+    "(?:%s)?::(?:%s:){4}%s" % (_H16, _H16, _LS32),
+    "(?:(?:%s:){0,1}%s)?::(?:%s:){3}%s" % (_H16, _H16, _H16, _LS32),
+    "(?:(?:%s:){0,2}%s)?::(?:%s:){2}%s" % (_H16, _H16, _H16, _LS32),
+    "(?:(?:%s:){0,3}%s)?::%s:%s" % (_H16, _H16, _H16, _LS32),
+    "(?:(?:%s:){0,4}%s)?::%s" % (_H16, _H16, _LS32),
+    "(?:(?:%s:){0,5}%s)?::%s" % (_H16, _H16, _H16),
+    "(?:(?:%s:){0,6}%s)?::" % (_H16, _H16),
+])
+_IP_LITERAL = re.compile(r"\[(?:%s|[Vv][0-9A-Fa-f]+\.[%s%s:]+)\]" % (_IPV6, _UNRESERVED, _SUB_DELIMS), re.ASCII)
+
+# RFC 8141 §2: NID = (alphanum) 0*30(ldh) (alphanum), then ":" and a non-empty NSS.
+_URN_NAME = re.compile(r"([A-Za-z0-9][A-Za-z0-9-]{0,30}[A-Za-z0-9]):(.+)", re.ASCII | re.DOTALL)
+_SPLIT = re.compile(r"([^:/?#]+):(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?", re.DOTALL)
+_TRIPLET = re.compile(r"%([0-9A-Fa-f]{2})")
+_UNRESERVED_CHAR = re.compile(r"[A-Za-z0-9\-._~]", re.ASCII)
+
+
+def _percent(text: str, keep_encoded: bool = False) -> str:
+    """Percent-encoding hex upper-cased (§6.2.2.1), and unreserved characters decoded unless ``keep_encoded``."""
+    def one(match: "re.Match[str]") -> str:
+        char = chr(int(match.group(1), 16))
+        return char if not keep_encoded and _UNRESERVED_CHAR.fullmatch(char) else "%" + match.group(1).upper()
+    return _TRIPLET.sub(one, text)
+
+
+def _strip_leading_dots(path: str) -> str:
+    """A rootless path loses its leading "./" and "../" segments while what is left stays rootless (DEC-0076)."""
+    start = 0
+    while path.startswith("./", start) or path.startswith("../", start):
+        start += 2 if path.startswith("./", start) else 3
+    rest = path[start:]
+    return path if rest == "" or rest.startswith("/") else rest
+
+
+def _remove_dot_segments(path: str) -> str:
+    """RFC 3986 §5.2.4 remove_dot_segments over a path whose "." and ".." are already decoded."""
+    absolute = path.startswith("/")
+    segments = (path[1:] if absolute else path).split("/")
+    output = []
+    for index, segment in enumerate(segments):
+        last = index == len(segments) - 1
+        if segment in (".", ".."):
+            if segment == ".." and output:
+                output.pop()
+            if last:  # a dot segment that ends the path leaves it ending in "/"
+                output.append("")
+            continue
+        output.append(segment)
+    return ("/" if absolute else "") + "/".join(output)
+
+
+def _authority_parts(authority: str) -> Optional[Tuple[Optional[str], str, Optional[str]]]:
+    at = authority.rfind("@")
+    userinfo = None if at == -1 else authority[:at]
+    host_port = authority if at == -1 else authority[at + 1:]
+    bracket = host_port.find("]") if host_port.startswith("[") else -1
+    colon = host_port.find(":", 0 if bracket == -1 else bracket)
+    host = host_port if colon == -1 else host_port[:colon]
+    port = None if colon == -1 else host_port[colon + 1:]
+    if userinfo is not None and not _USERINFO.fullmatch(userinfo):
+        return None
+    if port is not None and not _PORT.fullmatch(port):
+        return None
+    if not (_IP_LITERAL.fullmatch(host) if host.startswith("[") else _REG_NAME.fullmatch(host)):
+        return None
+    return userinfo, host, port
+
+
+def _parse(text: str) -> Optional[Tuple[str, Optional[str], str, Optional[str], Optional[str]]]:
+    """RFC 3986 Appendix B's split, then each component checked against its §3 production; None when one fails."""
+    match = _SPLIT.fullmatch(text)
+    if not match:
+        return None
+    scheme, authority, path, query, fragment = match.groups()
+    path = path or ""
+    if not _SCHEME.fullmatch(scheme) or not _PATH.fullmatch(path):
+        return None
+    if query is not None and not _QUERY.fullmatch(query):
+        return None
+    if fragment is not None and not _QUERY.fullmatch(fragment):
+        return None
+    if authority is not None and _authority_parts(authority) is None:
+        return None
+    if authority is None and path == "":
+        return None
+    return scheme, authority, path, query, fragment
+
+
+def _urn_form(authority: Optional[str], path: str, query: Optional[str]) -> str:
+    name = _URN_NAME.fullmatch(path)
+    path = "%s:%s" % (name.group(1).lower(), _percent(name.group(2), True)) if name else _percent(path, True)
+    # A "?" not followed by "+" or "=" is no URN component (RFC 8141 §2): it is kept, never dropped unread.
+    kept = "?" + _percent(query, True) if query is not None and not re.match(r"[+=]", query) else ""
+    auth = "//" + _percent(authority, True) if authority is not None else ""
+    return "urn:%s%s%s" % (auth, path, kept)
+
+
+def _generic_form(scheme: str, authority: Optional[str], path: str, query: Optional[str], fragment: Optional[str]) -> str:
+    auth = ""
+    if authority is not None:
+        userinfo, host, port = _authority_parts(authority)  # type: ignore[misc]
+        # The host is case-insensitive (§3.2.2); its remaining percent triplets keep upper-case hex.
+        lowered = re.sub(r"%[0-9a-f]{2}", lambda m: m.group(0).upper(), _percent(host).lower())
+        auth = "//%s%s%s" % ("" if userinfo is None else _percent(userinfo) + "@", lowered, "" if port is None else ":" + port)
+    decoded = _percent(path)
+    hierarchical = authority is not None or decoded.startswith("/")
+    out = _remove_dot_segments(decoded) if hierarchical else _strip_leading_dots(decoded)
+    if authority is None and out.startswith("//"):  # it would read as an authority: keep the decoded path
+        out = decoded
+    q = "" if query is None else "?" + _percent(query)
+    f = "" if fragment is None else "#" + _percent(fragment)
+    return "%s:%s%s%s%s" % (scheme.lower(), auth, out, q, f)
+
+
+def normal_identifier(value: Any) -> Optional[str]:
+    """The normal form of an identifier: a URI's syntax-normalized form (RFC 3986 §6.2.2; RFC 8141 §3.1 for `urn:`),
+    any other string as it is, None for a value that is not a string. The contract's `normalIdentifier`."""
+    if not isinstance(value, str):
+        return None
+    parts = _parse(value)
+    if parts is None:
+        return value
+    scheme, authority, path, query, fragment = parts
+    return _urn_form(authority, path, query) if scheme.lower() == "urn" else _generic_form(scheme, authority, path, query, fragment)
+
+
+def _strict_equal(a: Any, b: Any) -> bool:
+    """JavaScript's === on parsed JSON: numbers by value, booleans only with booleans, objects by identity."""
+    if isinstance(a, bool) or isinstance(b, bool):
+        return isinstance(a, bool) and isinstance(b, bool) and a == b
+    if isinstance(a, (int, float)) and isinstance(b, (int, float)):
+        return a == b
+    if isinstance(a, (dict, list)) or isinstance(b, (dict, list)):
+        return a is b
+    return type(a) is type(b) and a == b
+
+
+def same_identifier(a: Any, b: Any) -> bool:
+    """Two identifiers are the same when their normal forms are equal (DEC-0076). A value that is not a string is no
+    identifier and is compared as it is (JavaScript's ===). The contract's `sameIdentifier`."""
+    if not isinstance(a, str) or not isinstance(b, str):
+        return _strict_equal(a, b)
+    return normal_identifier(a) == normal_identifier(b)

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_provider.py

@@ -142,7 +142,8 @@ def _run_problems(run: Any) -> List[str]:
 
 
 def manifest_problems(entry: Dict[str, Any]) -> List[str]:
-    """FAC-SEM-014 (DEC-0017), URI half: the manifest resolves and its provider.id equals providerId."""
+    """FAC-SEM-014 (DEC-0017), URI half: the manifest resolves and its provider.id equals providerId, compared by normal
+    form (DEC-0076)."""
     try:
         manifest = json.loads(Path(os.path.expanduser(str(entry["manifest"]))).read_text(encoding="utf-8"))
     except (OSError, ValueError):
@@ -150,7 +151,8 @@ def manifest_problems(entry: Dict[str, Any]) -> List[str]:
     provider = manifest.get("provider") if isinstance(manifest, dict) else None
     if not isinstance(provider, dict) or not isinstance(manifest.get("capabilities"), list):
         return ["%s is not a provider manifest (FAC-SEM-014)" % entry["manifest"]]
-    if provider.get("id") != entry["providerId"]:
+    import fabric_identifiers  # noqa: E402 - beside this file; DEC-0076: URIs compared by normal form
+    if not fabric_identifiers.same_identifier(provider.get("id"), entry["providerId"]):
         return ["providerId %s is not the manifest's provider.id %s (FAC-SEM-014)" % (entry["providerId"], provider.get("id"))]
     return []
 
@@ -195,6 +197,9 @@ def write_provider_entry(entry: Dict[str, Any], directory: Optional[Path] = None
     clash = _service_ids(services or services_dir()).get(entry["id"])
     if clash:
         raise ProviderError("%s is already a service (%s); an id is a service or a provider, never both (FAC-SEM-013)." % (entry["id"], clash))
+    import fabric_identifiers  # noqa: E402 - beside this file
+    # DEC-0076: written in its normal form, so a reader that looks it up finds one spelling.
+    entry = dict(entry, providerId=fabric_identifiers.normal_identifier(entry["providerId"]))
     target = (directory or providers_dir()) / ("%s.json" % entry["id"])
     _atomic_write(target, (json.dumps(entry, indent=2, ensure_ascii=False) + "\n").encode())
     return target

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.23.0"
+  version: "0.25.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
+  extension-commit: "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b"
 ---
 
 # Building Fabric services
@@ -323,8 +323,11 @@ this estate needs.
 
 ## When something is missing
 
-- **Not macOS / no launchd:** declare `lifecycle.manager: "none"`; hosts show the
-  service read-only. Keep every other rule.
+- **Not macOS / no launchd:** the kits write a systemd user unit (Linux) or a per-user Scheduled Task (Windows); with
+  no supervisor at all declare `lifecycle.manager: "none"`, and hosts show the service read-only. Keep every other rule.
+- **A desktop app with no supervisor** (DEC-0069): its descriptor says `manager: "person"` with `lifecycle.app`, no
+  origin, `installedBy {by: "person", role, tool}`; its live origin is in its own liveness file
+  (the lifecycle reference, *An app's own descriptor and the node*).
 - **No Python:** use the Node kit; run the probe from any machine that has Python and
   can reach the port, or mark the probe `NOT_RUN` with the reason.
 - **Neither kit fits the framework:** implement the four routes and the lock by hand

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-kit.md

@@ -100,10 +100,13 @@ service. Load it after the stylesheet, with ids only:
   — or one shaped like a credential — means no button, never a bad link. A press opens a view in Fabric and starts
   nothing (FB-8).
 - **The host (FB-6):** when the host's `fabric_button` cookie says `owner=host`, the page hides its own button.
-- **Fabric absent (FB-5):** when the cookie says `fabric=absent`, or `data-fabric="absent"` (a local service whose
-  server checked for Fabric's hub document), or when the page is still visible and focused 1.5 s after a link was
-  followed, the menu says "Fabric is not installed — get it at passioncode.ai/fabric". Nothing downloads, nothing
-  retries.
+- **Fabric absent (FB-5):** when the cookie says `fabric=absent`, or `data-fabric="absent"`, or when the page is still
+  visible and focused 1.5 s after a link was followed, the menu says "Fabric is not installed — get it at
+  passioncode.ai/fabric". Nothing downloads, nothing retries. A local service's server decides `data-fabric` with
+  `fabric_button_presence()` / `fabricButtonPresence()`: `present` while Fabric's own descriptor
+  (`services/fabric.default.json`, Fabric ADR-0139) is registered and, for an app's descriptor (`manager: "person"`,
+  DEC-0069), its app is still installed; `absent` otherwise. A press only follows a link, so the button never reads
+  Fabric's liveness file; a caller that sends Fabric anything reads that file and checks the process first.
 
 `window.FabricButton` exposes `buildFabricLink`, `parseFabricLink` and `parseButtonCookie` for a page that needs
 them. The button is optional: a page without the script has no button.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -104,6 +104,22 @@ never infers supervision from its parent process.
   starts against a held lock are recorded and read as `FAC-SEM-078` reads them
   (`test/*supervisors*`).
 
+## An app's own descriptor and the node
+
+**An app** a person installs and starts has no supervisor (contract DEC-0069). Its descriptor says
+`"lifecycle": {"manager": "person", "app": "<the installed bundle or executable>"}`, `installedBy {by: "person", role,
+tool}` and no `origin`: it says the app is installed, never that it runs. The installer writes it; where there is none
+(a macOS app dragged into Applications), the app writes it on a start when `app_descriptor_action` /
+`appDescriptorAction` answers `write` — no descriptor yet, another version in `installedBy.tool`, or another path than
+`lifecycle.app` — and never from an App Translocation path. Its live origin and process id go in its own liveness file,
+rewritten on every start and removed on quit; a caller that sends anything reads that file and checks the process.
+`write_descriptor` claims no port for it, and a reader that finds `lifecycle.app` gone treats the descriptor as stale.
+
+**The node** (DEC-0061): `"lifecycle": {"manager": "node"}` is a local service Project Observatory's node installed and
+supervises as its child. There is no supervisor file, so `label`, `plist`, `unit` and `task` are refused beside it; the
+node starts the child with the supervisor marker (`--fabric-supervisor node` or the variable) and owns Install, Off,
+Code, Uninstall and state.
+
 ## Directories
 
 | What | macOS | Linux | Windows (DEC-0032) |
@@ -206,7 +222,9 @@ CI job has the real `schtasks` create, read back and delete such a task. The des
 A task cannot set an environment variable, so `task_xml` / `taskXml` write the marker as an
 argument, `--fabric-supervisor task-scheduler`, before any `--`: a copy the Task Scheduler starts
 backs off in-process like one under launchd or systemd. `IgnoreNew` keeps the scheduler from
-starting a second copy.
+starting a second copy. Measured (FAA-38, [report](https://github.com/passioncode-ai/fabric-agent-adapter/blob/main/docs/reports/2026-10-13-faa-38-windows-exit75/README.md)):
+`RestartOnFailure` does not restart a task whose action exits 75, so that wait is the only recovery there; a copy
+that still exits 75 stays down until the next logon.
 
 **One copy on each system.** The Python kit takes `flock` (Linux) or a locked byte
 (Windows); the Node kit cannot, so it holds a name instead — an abstract unix socket on Linux,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,13 +1,14 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`
+Pinned to `fabric-agent-contract` commit `a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
 canonical forms DEC-0043; `degraded[].setup` and `run.mcp.stdio.scope` DEC-0044; delegation sealed and trust tiers
 DEC-0045; runner and model profiles DEC-0046; the estate record DEC-0055; one copy under any supervisor and its marker,
 the Windows token-file reader DEC-0057; the hub key the estate certifies DEC-0060; signing credentials DEC-0063; the
-estate record's 60 s skew DEC-0066). The contract's schemas are normative;
+estate record's 60 s skew DEC-0066; an app's own descriptor DEC-0069; the descriptor for listings DEC-0061; identifier equality
+by normal form DEC-0076). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
@@ -31,13 +32,26 @@ File `<id>.<instance>.json`, mode 0600 (on Windows a protected ACL), atomic.
 | `protocol` | `"fabric-service/0.1"` |
 | `id`, `instance` | `^[a-z][a-z0-9-]{1,62}$`, `^[a-z][a-z0-9-]{0,31}$` (default `default`); the pair is unique per machine |
 | `name`, `summary` | ≤ 80 and ≤ 200 characters |
-| `origin` | `http://127.0.0.1:<port>`; the port is a machine-wide claim |
+| `origin` | `http://127.0.0.1:<port>`; the port is a machine-wide claim. Optional for an app's descriptor only (`manager: "person"`, DEC-0069): its live origin and process id are in the app's own liveness file, and a descriptor without an origin claims no port (`FAC-SEM-010`) |
 | `auth` | `tokenFile` (0600; on Windows a protected ACL — owner and every granting entry the current user, SYSTEM or Administrators: service.md *Windows token files*, DEC-0032, DEC-0033); `header` default `Authorization` with `scheme` `Bearer`; any other header carries the raw token with `scheme: "none"` |
-| `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032). Both kits and the probe accept all four; both kits write the unit and the task (`systemd_unit`, `task_xml` / `systemdUnit`, `taskXml`) |
+| `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task), `node` (Project Observatory's node supervises it as its child, with no supervisor file, DEC-0061), `person` (an app a person installs and starts, then `app`, the installed app, DEC-0069) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032), `label` and `plist` beside any but `launchd` (DEC-0057), `app` beside any but `person`. Both kits and the probe accept all six; both kits write the unit and the task (`systemd_unit`, `task_xml` / `systemdUnit`, `taskXml`). An app's descriptor says it is installed, never that it runs: the probe checks `app` is still there (`descriptor.app-installed`) and reads no well-known document; a reader that finds the app gone treats the descriptor as stale (`app_descriptor_stale` / `appDescriptorStale`), and an app that writes its own descriptor rewrites it only when `app_descriptor_action` / `appDescriptorAction` says `write` |
 | `paths` | `data` (required), `logs[]`, optional `config`, `cache` |
 | `commands` | only `doctor` and `update`, argument arrays whose first item is an absolute or `~/` path (Windows: also `C:\…`, `C:/…` or `~\…`, never a network share — DEC-0032) |
 | `source.repository`, `fabricManifest` | optional |
-| `installedAt`, `installedBy` | when and by which installer version |
+| `installedAt`, `installedBy` | when, and who installed it: the installer and its version as a string, or `{by, role?, tool}` (DEC-0061) — `by` `person` (with `role` `operator` or `administrator`), `node` or `organization`; `role` for a person only; `tool` the installer and its version. It names a role, never a person. An app's descriptor uses the object form with `by: "person"`. `register_remote` / `registerRemote` and the sample write the object form |
+| `runner` | optional `{kind?, credentialKind}` (DEC-0061): `credentialKind` `subscription`, `key`, `platform-metered` or `none` — a kind, never a credential (`FAC-SEM-086` refuses a credential-shaped value here or in `installedBy`); a subscription names its vendor's runner (`claude-code`, `kimi-code`, `codex`) |
+| `peer` | optional `{endpoint, custody, residency, maxDataClass}` (DEC-0061): the service is offered to others. `endpoint` `https://<dns-name>[:<port>][/<path>]`, never a reserved name (`FAC-SEM-085`); `custody` `organization-managed` or `personal`; `residency` 1–32 ISO 3166-1 alpha-2 codes, `EU` admitted, user-assigned codes refused; `maxDataClass` `public` < `internal` < `confidential` < `restricted`. An offer needs `runner` and never runs on a subscription. A host sends a request from anyone but the operator only when `peer_refusal` / `peerRefusal` answers null (`FAC-SEM-088`); usage rows may take `route: "platform-metered"` |
+
+## Identifier equality (DEC-0076)
+
+Two identifiers are the same when their normal forms are equal. `normal_identifier` / `normalIdentifier` and
+`same_identifier` / `sameIdentifier` (`fabric_identifiers.py`, `fabric-identifiers.mjs`, ports of the contract's
+`src/identifiers.ts`, held to its `identifiers.json`) apply RFC 3986 §6.2.2 to a URI: scheme and host lower-cased,
+percent-encoding hex upper-cased, unreserved characters decoded, dot segments removed. A `urn:` follows RFC 8141 §3.1
+instead: `urn` and the NID lower-cased, nothing decoded, the NSS's case kept. Any other string is its own normal form,
+and a value that is not a string is compared as it is. The kits compare by it in FAC-SEM-030/032/034 (routes, bindings,
+events), FAC-SEM-076 (estate grants and their revocations) and FAC-SEM-014 (a provider entry's `providerId`), and they
+write the identifiers they scaffold in normal form.
 
 ## Well-known document — `GET /.well-known/fabric-service`
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -189,10 +189,23 @@ class Probe:
                 continue
             if key == me:
                 clashes.append("%s declared again in %s" % (me, path.name))
-            elif not self.remote and fs.placement_of(other) != "remote" and other.get("origin") == self.d.get("origin"):
+            # DEC-0069: a descriptor without an origin (an app's) claims no port, so two of them never clash.
+            elif (not self.remote and "origin" in self.d and fs.placement_of(other) != "remote"
+                  and other.get("origin") == self.d.get("origin")):
                 clashes.append("port %d also claimed by %s" % (self.port, key))
-        unique = "a remote origin claims no port here" if self.remote else "port %d is unique" % self.port
+        if self.remote:
+            unique = "a remote origin claims no port here"
+        elif "origin" not in self.d:
+            unique = "an app's descriptor names no origin, so it claims no port (FAC-SEM-010)"
+        else:
+            unique = "port %d is unique" % self.port
         self.add("descriptor.port-claim", "FAIL" if clashes else "PASS", "; ".join(clashes) or unique)
+        if (self.d.get("lifecycle") or {}).get("manager") == "person":
+            # DEC-0069: installed, never running — a reader checks the app is still there; liveness is the app's own file.
+            present = fs.app_present(self.d)
+            self.add("descriptor.app-installed", "PASS" if present else "FAIL",
+                     "%s is installed" % self.d["lifecycle"].get("app") if present
+                     else "%s is gone: a reader treats this descriptor as stale" % self.d["lifecycle"].get("app"))
 
     # well-known ----------------------------------------------------------------
     def well_known_rules(self) -> None:
@@ -762,6 +775,10 @@ class Probe:
 
     def run(self) -> List[Result]:
         self.descriptor_rules()
+        if "origin" not in self.d and not self.remote:
+            self.add("well-known.answers", "NOT_RUN",
+                     "an app's descriptor says it is installed, never that it runs; its live origin is in its own liveness file (DEC-0069)")
+            return self.results
         if not self.port:
             return self.results
         self.well_known_rules()

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-estate.mjs

@@ -12,6 +12,7 @@
 
 import crypto from 'node:crypto';
 import { jcs } from './fabric-delegation.mjs';
+import { normalIdentifier } from './fabric-identifiers.mjs';
 import { secretValue } from './fabric-secrets.mjs';
 
 export const ESTATE_RECORD_SCHEMA = 'estate-record/1';
@@ -428,12 +429,14 @@ function secretReferences(value, flag) {
 }
 
 function grantsAndRevocations(value, flag) {
+  // A grant's id is a URI, so grants and their revocations are keyed by its normal form (DEC-0076).
+  const grantKey = (id) => (typeof id === 'string' ? normalIdentifier(id) : id);
   const grantIds = new Set();
   list(value.shareGrants).forEach((grant, index) => {
     if (grant.principalKind !== 'external') flag(`/shareGrants/${index}/principalKind`, 'a share grant is to a principal outside the estate: principalKind external');
     const id = isObject(grant.meta) ? grant.meta.id : undefined;
-    if (grantIds.has(id)) flag(`/shareGrants/${index}/meta/id`, `grant ${String(id)} is listed twice`);
-    grantIds.add(id);
+    if (grantIds.has(grantKey(id))) flag(`/shareGrants/${index}/meta/id`, `grant ${String(id)} is listed twice`);
+    grantIds.add(grantKey(id));
   });
   const machines = list(value.machines);
   // A Map, so a kind such as `constructor` or `__proto__` reads nothing from Object.prototype.
@@ -448,10 +451,11 @@ function grantsAndRevocations(value, flag) {
   }));
   const seen = new Set();
   list(value.revocations).forEach((revocation, index) => {
-    const key = `${String(revocation.kind)} ${String(revocation.ref)}`;
+    const ref = revocation.kind === 'grant' ? grantKey(revocation.ref) : revocation.ref;
+    const key = `${String(revocation.kind)} ${String(ref)}`;
     if (seen.has(key)) flag(`/revocations/${index}`, `the ${String(revocation.kind)} ${String(revocation.ref)} is revoked twice`);
     seen.add(key);
-    if (listed.get(String(revocation.kind))?.has(revocation.ref)) flag(`/revocations/${index}/ref`, `the record still lists the ${String(revocation.kind)} it revokes: revocation outranks addition`);
+    if (listed.get(String(revocation.kind))?.has(ref)) flag(`/revocations/${index}/ref`, `the record still lists the ${String(revocation.kind)} it revokes: revocation outranks addition`);
   });
 }