@passioncode-ai/fabric-agent-adapter 0.25.0 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 0.27.0 - 2026-10-13
+
+The usage report's window and spend by project, and OpenRouter attribution for a product's own traffic (contract
+DEC-0065, FAA-33). Pin unchanged at `a046f57`.
+
+### Added
+
+- **Spend by project.** `make_usage_receipt` / `makeUsageReceipt` take `project_id` / `projectId`, a URI kept in its
+  normal form (DEC-0076), and `task_run_id` / `taskRunId`. `usage_report` / `usageReport` then write `byProject`: each
+  project once, each task run once within it, with calls, unpriced calls and cost. It names no caller, session or
+  person.
+- **FAC-SEM-025 whole:** `usage_findings` / `usageFindings` check the arithmetic, the window (every day exists, is not
+  after `generatedAt`'s UTC date and is at most 30 days before it) and the projects. The projects' calls, priced calls
+  and known costs are bounded by the days' (CT-40).
+- **OpenRouter attribution, off by default:** `attribution_headers` / `attributionHeaders` and
+  `attribution_setting_findings` / `attributionSettingFindings` (FAC-SEM-098). The answer adds `HTTP-Referer`,
+  `X-OpenRouter-Title` and `X-OpenRouter-Categories` only with a valid setting, only to `https://openrouter.ai` (read as
+  a browser reads the URL), only for traffic the product originates, and never over a user's own attribution.
+- **`check_service.py`** `usage.report` reads each row's route (`platform-metered` included), the window and
+  `byProject`.
+
+### Evidence
+
+- Both kits pass the contract's 34 attribution cases.
+- Both kits give the contract's `usageRules` answer on 21 reports: its six positive usage fixtures and 15 edits of the
+  by-project one.
+- 23 planted defects, all caught.
+- The scenario eval `usage-by-project-and-attribution` was written before the prose.
+
+## 0.26.0 - 2026-10-13
+
+Feed events carry machine-readable `data` (contract DEC-0070, FAA-35), and a service says which protocol revisions it
+accepts (DEC-0067, FAA-37). Both are in the pin `a046f57`, which does not move.
+
+### Added
+
+- **`data` on an event.**
+  - `make_event` / `makeEvent` and `JsonlEventLog.append` take `data={schema, value}`.
+  - `schema` is the absolute URI of a payload schema the service publishes.
+  - `value` holds at most 32 members. Each is a scalar (a string of at most 500 characters), a list of at most 32
+    scalars, or an object of at most 32 scalar members.
+  - FAC-SEM-101 refuses a string under a credential's name or of a credential's shape, at either level. The refusal names
+    the place, never the value.
+  - `feed_data_findings` / `feedDataFindings` and `feed_data_problems` / `feedDataProblems`.
+- **Protocol revisions.**
+  - `PROTOCOL_REVISIONS` (the contract's register), `parse_revision`, `accepted_revisions` (N and N−1),
+    `negotiate_revision` / `negotiateRevision` (`schema-unsupported`, or the receiver's own `no-accepted-revisions`) and
+    `protocols_findings` / `protocolsFindings` (FAC-SEM-099).
+  - `build_well_known` / `buildWellKnown` take `protocols`. List them only once your hosts are pinned at or after
+    DEC-0067, because the document is closed for an older reader.
+- **`check_service.py`** reads `well-known.protocols` and `events.data`.
+
+### Evidence
+
+Every case below is answered by the contract's own functions at `a046f57` (`vendor_vectors.mjs`):
+- the 7 `negotiateRevision` cases and the register;
+- FAC-SEM-099 over 14 lists;
+- every events-page and well-known-protocols fixture as the catalogue lists it;
+- FAC-SEM-101 over 10 pages.
+
+N and N−1 cannot occur at this pin, because each protocol has one revision. That rule is held on a register with three
+revisions. 20 planted defects were all caught. The scenario eval `feed-data-and-protocols` was written before the prose.
+
 ## 0.25.0 - 2026-10-13
 
 Identifier equality by normal form (contract DEC-0076) in both kits, and the contract pin moves from `fe55fc6` to
@@ -711,7 +774,7 @@ DEC-0020 and DEC-0019 revisions stay valid.
   code and reads the declared `minWidth`. Without Playwright every rule is `NOT_RUN`. It measures a settled
   page: after the load it waits for the page's own requests to finish, and at each width for two frames,
   250 ms and two more frames, so a header that grows when its data arrives is not measured between its new
-  size and the kit's reaction to it (seen once on the brand board at 360 px: a false ED-5).
+  size and the kit's reaction to it (seen once on an adopting service's dashboard at 360 px: a false ED-5).
 - **`check_service.py` rule `dashboard.declared`** (ED-9): PASS for a valid declaration (and names a newer
   kit), FAIL for an invalid one, NOT_RUN for no dashboard or a legacy one.
 - **`dashboard_extension()` / `dashboardExtension()`** in both kits, and `extensions` in `build_well_known` /

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.25.0"
+  version: "0.27.0"
   contract-version: "0.1.0"
   contract-commit: "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,7 +16,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.25.0"
+  version: "0.27.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b"

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -116,6 +116,24 @@ empty, or `null` for an empty log. Retain at least seven days or 1000 events.
 path on the service origin, never an absolute URL. Optional SSE stream at
 `surfaces.events.stream` carrying the same objects.
 
+**Machine-readable `data` (DEC-0070).** An event may carry `data {schema, value}` beside its sentence: `schema` is the
+absolute URI of a payload schema the service publishes; `value` is an object of at most 32 members, each a scalar (a
+string of at most 500 characters, a number, a boolean, null), a list of at most 32 scalars, or an object of at most 32
+scalar members. `text` stays the event: a host that ignores `data` loses nothing, and one that does not know the schema
+treats `value` as opaque. No string in `value` sits under a credential's name or has a credential's shape
+(`FAC-SEM-101`); personal data is the service's own duty. `make_event` / `makeEvent` (and `JsonlEventLog.append`) take
+`data=` and refuse one that breaks either rule, naming the place, never the value; `check_service.py` checks the feed it
+fetches (`events.data`). A host pinned before DEC-0070 that validates events against a closed copy refuses the member.
+
+**Protocol revisions (DEC-0067).** The well-known document may list `protocols`, the revisions the service accepts: at
+most N and N−1 per protocol, consecutive in the contract's register, each `<name>/<revision>` once, 1 to 64 entries
+(`FAC-SEM-099`). `build_well_known` / `buildWellKnown` take `protocols=` and check it; list them only once your hosts
+are pinned at or after DEC-0067, because the document is closed for an older reader. A service that receives a document
+in a revision it does not read answers `negotiate_revision` / `negotiateRevision`'s `schema-unsupported` refusal before
+reading it further (HTTP 400, or an MCP `isError` result's `structuredContent`); a receiver that accepts none answers its
+own fault `no-accepted-revisions`. `PROTOCOL_REVISIONS` is the contract's register; `check_service.py` reads
+`well-known.protocols`.
+
 ## Login code and the operator session — `POST /fabric/v1/login-code`
 
 Token required → `{ "url": "/fabric/v1/login?code=<16–256 url-safe chars>", "expiresAt": "…" }`,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/usage.md

@@ -5,6 +5,14 @@ Fabric Agent Contract DEC-0021, `docs/specification/service.md` → *Usage repor
 offer it, so Fabric Dashboards (Spend, MCP `spend`) and Fabric can show each agent's spend beside
 its health without knowing any provider.
 
+## Contents
+
+- What to record
+- What to answer
+- By project (DEC-0065)
+- OpenRouter attribution (DEC-0065)
+- Verify
+
 ## What to record
 
 One **receipt per model call**, built from the numbers the provider returned:
@@ -78,9 +86,36 @@ Call `ledger.prune()` at start (or daily) to keep the file at the reported windo
 `JsonlUsageLedger` appends 0600 JSON lines. A line torn by a killed writer is skipped, and the
 next receipt never glues onto it.
 
+## By project (DEC-0065)
+
+Pass `project_id` / `projectId` (the URI of the project the service ran the call for) and, optionally, `task_run_id` /
+`taskRunId` (the service's own run id) to `make_usage_receipt` / `makeUsageReceipt`. The report then carries `byProject`:
+each project once, by the normal form of its id (DEC-0076, so `URN:PROJECT:a` and `urn:project:a` are one row), with
+its calls, unpriced calls, cost and `taskRuns`. A call for no project is in no row. It is the service's own run
+attribution and names no caller, session or person. `usage_findings` / `usageFindings` port FAC-SEM-025 whole:
+- the arithmetic;
+- the window: every day exists, is not after `generatedAt`'s UTC date, and is at most 30 days before it;
+- the projects: each project and task run once, and their calls, priced calls and known costs within the days' (CT-40).
+
+A row's `route` may be `platform-metered`: the hosting platform's own metered models under the deployment's account.
+
+## OpenRouter attribution (DEC-0065)
+
+A product credits its own OpenRouter traffic with `attribution_headers(setting, request)` / `attributionHeaders`. The
+setting is `{product, title, categories?}`: a lower-case slug (the app is `https://passioncode.ai/<product>/`), a printable
+title, and at most two of OpenRouter's recognized categories (FAC-SEM-098, `attribution_setting_findings`). Attribution
+is off by default: without a setting nothing is sent. The answer adds `HTTP-Referer`, `X-OpenRouter-Title` and
+`X-OpenRouter-Categories` only when all of these hold:
+- the request goes to `https://openrouter.ai` (read as a browser reads a URL);
+- the product itself originated the traffic;
+- the request carries no attribution header of the user's own.
+
+Otherwise it answers why not. It never reads, moves or returns a key.
+
 ## Verify
 
 `check_service.py <id>` reads a declared report: `usage.requires-token` (401 without the token)
-and `usage.report` (identity, USD, dates forward, null for all-unpriced rows, sums). The
+and `usage.report` (identity, USD, dates forward, null for all-unpriced rows, sums, each row's route, the window and
+`byProject`). The
 `sample_service.py` serves one. Fabric Dashboards → **Spend** shows it within a minute of opening
 the page.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -260,6 +260,11 @@ class Probe:
         if "events" not in (wk.get("surfaces") or {}):
             problems.append("surfaces.events missing")
         self.add("well-known.shape", "FAIL" if problems else "PASS", "; ".join(problems) or "protocol, build, status, degraded, surfaces")
+        if "protocols" in wk:
+            # DEC-0067, FAC-SEM-099: the revisions it accepts, N and N−1 per protocol, each once.
+            findings = fs.protocols_findings(wk["protocols"])
+            self.add("well-known.protocols", "FAIL" if findings else "PASS",
+                     "; ".join("%s %s" % (f["instancePath"], f["message"]) for f in findings) or ", ".join(wk["protocols"]))
         self.configuration_rule()
         svc = wk.get("service") or {}
         answered = "%s.%s" % (svc.get("id"), svc.get("instance"))
@@ -346,6 +351,11 @@ class Probe:
                 bad.append("%s (text is not a sentence)" % e.get("id"))
         self.add("events.page", "FAIL" if bad else "PASS",
                  ("bad events: " + ", ".join(bad)) if bad else "%d event(s), cursor %r" % (len(events), page["cursor"]))
+        # DEC-0070, FAC-SEM-101: an event's data never carries a credential; the finding names the place, never the value.
+        leaks = fs.feed_data_findings(page)
+        if any(isinstance(e, dict) and "data" in e for e in events) or leaks:
+            self.add("events.data", "FAIL" if leaks else "PASS",
+                     "; ".join("%s: %s" % (f["instancePath"], f["message"]) for f in leaks) or "every event's data is free of credentials")
 
     def usage_rules(self) -> None:
         """DEC-0021: a declared usage report requires the token and adds up (FAC-SEM-025)."""
@@ -870,6 +880,16 @@ def usage_problems(report: Any, service_id: str, instance: str) -> List[str]:
         known = sum(m["costUsd"] for m in models if isinstance(m.get("costUsd"), (int, float)))
         if isinstance(day.get("costUsd"), (int, float)) and abs(day["costUsd"] - known) > 1e-6:
             out.append("%s: costUsd is not the sum of its models' known costs" % at)
+        for j, m in enumerate(models):
+            # DEC-0046, DEC-0061: a row's route is a login in its vendor's runner, an issued key, or the platform's
+            # own metered models (a listing in the cloud).
+            if "route" in m and m["route"] not in fs.USAGE_ROUTES:
+                out.append("%s.byModel[%d]: route %r is not subscription, key or platform-metered" % (at, j, m["route"]))
+    # DEC-0065: the window and the project attribution, as the contract's usageRules reads them (FAC-SEM-025).
+    for finding in fs.usage_findings(report):
+        path, message = finding["instancePath"], finding["message"]
+        if path.startswith(("/byProject", "/generatedAt")) or "generatedAt" in message or "exists in its month" in message:
+            out.append("%s: %s" % (path or "/", message))
     return out
 
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -9,7 +9,8 @@ import fs from 'node:fs';
 import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
-import { credentialName, secretArgument, secretValue } from './fabric-secrets.mjs';
+import { normalIdentifier } from './fabric-identifiers.mjs';
+import { credentialName, secretArgument, secretUrl, secretValue } from './fabric-secrets.mjs';
 
 export const PROTOCOL = 'fabric-service/0.1';
 export const EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/service/0.1';
@@ -818,7 +819,7 @@ export function configurationProblems(doc) {
   return problems;
 }
 
-export function buildWellKnown({ id, instance, name, version, build, startedAt, status, degraded = [], surfaces, summary, updateAvailable = null, pid = process.pid, extensions, configuration }) {
+export function buildWellKnown({ id, instance, name, version, build, startedAt, status, degraded = [], surfaces, summary, updateAvailable = null, pid = process.pid, extensions, configuration, protocols }) {
   if (!STATUSES.includes(status)) throw new ServiceError(`status must be one of ${STATUSES.join(', ')}.`);
   if (!surfaces?.events) throw new ServiceError('surfaces.events is required.');
   if (!(build?.commit || build?.digest)) throw new ServiceError('build needs a commit or a digest.');
@@ -844,12 +845,132 @@ export function buildWellKnown({ id, instance, name, version, build, startedAt,
     if (problems.length) throw new ServiceError(`configuration: ${problems.join('; ')}.`);
     doc.configuration = configuration;
   }
+  if (protocols !== undefined) {
+    // DEC-0067: the revisions this service accepts. The document is closed for a reader pinned before DEC-0067, so a
+    // service lists them only once its hosts are pinned at or after it.
+    const problems = protocolsFindings(protocols);
+    if (problems.length) throw new ServiceError(`protocols: ${problems.map((f) => f.message).join('; ')}.`);
+    doc.protocols = [...protocols];
+  }
   return doc;
 }
 
 // An event about traced work carries traceId and spanId together (fabric-interop/0.1 C3.4 c);
 // traceIds(traceparent) in fabric-interop.mjs gives both.
-export function makeEvent(id, at, kind, level, text, { subject, link, notify, traceId, spanId } = {}) {
+// --- DEC-0067: protocol revisions; DEC-0070: an event's machine-readable data ---------------------------------------
+
+/** Each contract protocol's published revisions, oldest first (the contract's `PROTOCOL_REVISIONS`); a test holds it equal to the contract's. */
+export const PROTOCOL_REVISIONS = new Map(Object.entries({
+  'access-log': ['1'], approval: ['1'], 'activity-summary': ['1'], 'estate-record': ['1'], 'execution-packet': ['1'],
+  'fabric-activity': ['0.1'], 'fabric-dashboard': ['0.1'], 'fabric-delegation': ['0.1'], 'fabric-device': ['0.1'],
+  'fabric-interop': ['0.1'], 'fabric-local-channel': ['0.1'], 'fabric-local-runner': ['0.1'], 'fabric-operator-channel': ['0.1'],
+  'fabric-package': ['1'], 'fabric-project-comms': ['0.1'], 'fabric-proposal': ['1'], 'fabric-provider': ['0.1'], 'fabric-relay': ['0.1'],
+  'fabric-secret-envelope': ['1'], 'fabric-service': ['0.1'], 'fabric-settings-backup': ['1'], heartbeat: ['1'], 'learning-note': ['1'],
+  memory: ['0.1'], pipeline: ['0.1'], 'revocation-delta': ['1'], 'session-handoff': ['1'], 'window-lease': ['1'],
+}));
+export const MAX_PROTOCOLS = 64;
+const REVISION = /^([a-z][a-z0-9.-]{0,63})\/([0-9]{1,4}(?:\.[0-9]{1,4}){0,2})$/;
+
+/** `<name>/<revision>` split, or undefined. */
+export function parseRevision(value) {
+  const m = typeof value === 'string' ? REVISION.exec(value) : null;
+  return m ? { name: m[1], revision: m[2] } : undefined;
+}
+
+/** The revisions a receiver implementing `name` up to `newest` accepts: N and, when the register has one, N−1. */
+export function acceptedRevisions(name, newest) {
+  const known = PROTOCOL_REVISIONS.get(name);
+  if (!known?.length) return [];
+  const top = newest === undefined ? known.length - 1 : known.indexOf(newest);
+  if (top < 0) return [];
+  return known.slice(Math.max(0, top - 1), top + 1).reverse().map((r) => `${name}/${r}`);
+}
+
+/**
+ * A receiver's answer to a document naming `received` (DEC-0067, the contract's `negotiateRevision`): `{ok: true}`, the
+ * `schema-unsupported` refusal naming what was received (at most 80 characters) and the accepted revisions of that
+ * protocol (all of them when it names none the receiver reads), or `{fault: 'no-accepted-revisions'}`.
+ */
+export function negotiateRevision(received, accepted) {
+  const usable = [...new Set((Array.isArray(accepted) ? accepted : []).filter((e) => parseRevision(e) !== undefined))].slice(0, MAX_PROTOCOLS);
+  if (!usable.length) return { fault: 'no-accepted-revisions' };
+  if (typeof received === 'string' && usable.includes(received)) return { ok: true };
+  const parsed = parseRevision(received);
+  const same = parsed ? usable.filter((e) => parseRevision(e)?.name === parsed.name) : [];
+  return { error: { code: 'schema-unsupported', message: 'this receiver does not read that protocol revision',
+    data: { protocol: typeof received === 'string' ? Array.from(received).slice(0, 80).join('') : '', accepted: same.length ? same : usable } } };
+}
+
+/** FAC-SEM-099 (DEC-0067): 1 to 64 entries, each once; at most N and N−1 of one protocol, consecutive in the register. */
+export function protocolsFindings(protocols, prefix = '/protocols') {
+  const flag = (instancePath, message) => ({ code: 'FAC-SEM-099', instancePath, message });
+  if (!Array.isArray(protocols)) return [flag(prefix, 'protocols is a list of protocol revisions')];
+  if (protocols.length === 0 || protocols.length > MAX_PROTOCOLS) return [flag(prefix, `protocols lists 1 to ${MAX_PROTOCOLS} revisions`)];
+  const findings = [];
+  const byName = new Map();
+  const seen = new Set();
+  protocols.forEach((entry, i) => {
+    const at = `${prefix}/${i}`;
+    const parsed = parseRevision(entry);
+    if (!parsed) { findings.push(flag(at, 'a protocol revision is <name>/<revision>, such as fabric-service/0.1')); return; }
+    if (seen.has(entry)) { findings.push(flag(at, 'each protocol revision once')); return; }
+    seen.add(entry);
+    const known = PROTOCOL_REVISIONS.get(parsed.name);
+    if (known && !known.includes(parsed.revision)) { findings.push(flag(at, `${parsed.name} has no published revision ${parsed.revision}`)); return; }
+    const indices = byName.get(parsed.name) ?? [];
+    indices.push(known ? known.indexOf(parsed.revision) : -1);
+    byName.set(parsed.name, indices);
+    if (indices.length > 2) findings.push(flag(at, 'at most 2 revisions of one protocol: N and N−1'));
+    else if (known && indices.length === 2 && Math.abs(indices[0] - indices[1]) !== 1) findings.push(flag(at, 'two revisions of one protocol are N and N−1, consecutive in the register'));
+  });
+  return findings;
+}
+
+const SCHEMA_URI = /^[A-Za-z][A-Za-z0-9+.-]*:\S+$/;
+const scalar = (v) => v === null || typeof v === 'boolean' || (typeof v === 'number' && Number.isFinite(v)) || (typeof v === 'string' && Array.from(v).length <= 500);
+const isPlain = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const pointerToken = (name) => String(name).replace(/~/g, '~0').replace(/\//g, '~1');
+
+/** FAC-SEM-101 over an events page (the contract's `feedDataFindings`): no credential's name or shape in an event's data. */
+export function feedDataFindings(page) {
+  const findings = [];
+  const check = (named, member, at) => {
+    if (typeof member !== 'string') return;
+    if (named) findings.push({ code: 'FAC-SEM-101', instancePath: at, message: "an event's data puts no string under a credential's name" });
+    else if (secretValue(member) || secretUrl(member)) findings.push({ code: 'FAC-SEM-101', instancePath: at, message: "an event's data carries no value shaped like a credential" });
+  };
+  (Array.isArray(page?.events) ? page.events : []).forEach((event, i) => {
+    if (!isPlain(event) || !isPlain(event.data) || !isPlain(event.data.value)) return;
+    for (const [key, member] of Object.entries(event.data.value)) {
+      const at = `/events/${i}/data/value/${pointerToken(key)}`;
+      const named = credentialName(key);
+      check(named, member, at);
+      if (Array.isArray(member)) member.forEach((item, j) => check(named, item, `${at}/${j}`));
+      else if (isPlain(member)) for (const [inner, leaf] of Object.entries(member)) check(named || credentialName(inner), leaf, `${at}/${pointerToken(inner)}`);
+    }
+  });
+  return findings;
+}
+
+/** DEC-0070's `data {schema, value}` as the schema bounds it, then FAC-SEM-101. */
+export function feedDataProblems(data) {
+  if (!isPlain(data) || Object.keys(data).length !== 2 || !('schema' in data) || !('value' in data)) return ['data is {schema, value}'];
+  const problems = [];
+  if (!(typeof data.schema === 'string' && SCHEMA_URI.test(data.schema))) problems.push('data.schema is the absolute URI of a payload schema the service publishes');
+  const value = data.value;
+  if (!isPlain(value) || Object.keys(value).length > 32) return [...problems, 'data.value is an object of at most 32 members'];
+  for (const [key, member] of Object.entries(value)) {
+    if (scalar(member)) continue;
+    if (Array.isArray(member) && member.length <= 32 && member.every(scalar)) continue;
+    if (isPlain(member) && Object.keys(member).length <= 32 && Object.values(member).every(scalar)) continue;
+    problems.push(`data.value.${key} is a scalar (a string of at most 500 characters), a list of at most 32 scalars or an object of at most 32 scalar members`);
+  }
+  if (problems.length) return problems;
+  return feedDataFindings({ events: [{ data }] }).map((f) => `FAC-SEM-101: ${f.instancePath.replace('/events/0', '')} ${f.message}`);
+}
+
+/** One activity event. `data` (DEC-0070) adds machine-readable fields, `{schema, value}`, never a secret: refused here, so no feed carries one. */
+export function makeEvent(id, at, kind, level, text, { subject, link, notify, traceId, spanId, data } = {}) {
   if (!LEVELS.includes(level)) throw new ServiceError(`level must be one of ${LEVELS.join(', ')}.`);
   if (!KIND.test(kind)) throw new ServiceError(`kind ${kind} must be dotted lowercase.`);
   const sentence = String(text).split(/\s+/).filter(Boolean).join(' ');
@@ -862,6 +983,11 @@ export function makeEvent(id, at, kind, level, text, { subject, link, notify, tr
   if (link) event.link = link;
   if (notify) event.notify = true;
   if (traceId !== undefined) Object.assign(event, { traceId, spanId });
+  if (data !== undefined) {
+    const problems = feedDataProblems(data);
+    if (problems.length) throw new ServiceError(`Event data: ${problems.join('; ')}.`);
+    event.data = { schema: data.schema, value: data.value };
+  }
   return event;
 }
 
@@ -891,7 +1017,11 @@ const COUNTS = ['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTok
  * One model call, from the provider's own usage numbers. No prompt, output or caller.
  * `costUsd` null means it cannot be priced: the report counts it as unpriced, never as $0.
  */
-export function makeUsageReceipt(provider, model, { inputTokens, outputTokens, cacheReadTokens = 0, cacheWriteTokens = 0, costUsd = null, costBasis, at, route } = {}) {
+/**
+ * One model call. `projectId` (a URI, kept in its normal form, DEC-0076) and `taskRunId` (the service's own run id) attribute
+ * it to the project the service ran it for (DEC-0065); they never name a caller, session or person.
+ */
+export function makeUsageReceipt(provider, model, { inputTokens, outputTokens, cacheReadTokens = 0, cacheWriteTokens = 0, costUsd = null, costBasis, at, route, projectId, taskRunId } = {}) {
   if (!PROVIDER.test(provider ?? '')) throw new ServiceError('provider must be a lowercase name such as anthropic or openrouter.');
   model = String(model ?? '').trim();
   if (!model || model.length > 128) throw new ServiceError('model must be 1 to 128 characters.');
@@ -901,7 +1031,34 @@ export function makeUsageReceipt(provider, model, { inputTokens, outputTokens, c
   const basis = costBasis ?? (costUsd === null ? 'unknown' : 'provider');
   if (!COST_BASES.includes(basis) || (costUsd === null) !== (basis === 'unknown')) throw new ServiceError('costBasis is provider or price-list with a cost, unknown without one.');
   if (route !== undefined && !USAGE_ROUTES.includes(route)) throw new ServiceError('route is subscription, key or platform-metered (DEC-0046, DEC-0061).');
-  return { at: at ?? nowIso(), provider, model, ...counts, costUsd, costBasis: basis, ...(route === undefined ? {} : { route }) };
+  if (taskRunId !== undefined && projectId === undefined) throw new ServiceError('a task run belongs to a project: give projectId with taskRunId.');
+  if (projectId !== undefined && !(typeof projectId === 'string' && /^[A-Za-z][A-Za-z0-9+.-]*:\S+$/.test(projectId))) throw new ServiceError('projectId is the URI of the project the service ran the call for.');
+  if (taskRunId !== undefined && !(typeof taskRunId === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(taskRunId))) throw new ServiceError("taskRunId is the service's own run id: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$.");
+  return { at: at ?? nowIso(), provider, model, ...counts, costUsd, costBasis: basis, ...(route === undefined ? {} : { route }),
+    ...(projectId === undefined ? {} : { projectId: normalIdentifier(projectId) }), ...(taskRunId === undefined ? {} : { taskRunId }) };
+}
+
+/** DEC-0065's `byProject`: the window's calls by project (normal form, DEC-0076), each task run once within it. */
+function byProject(receipts, first, last) {
+  const projects = new Map();
+  const add = (row, r) => { row.calls += 1; if (r.costUsd === null || r.costUsd === undefined) row.unpricedCalls += 1; else row.cost += r.costUsd; };
+  for (const r of receipts) {
+    const date = String(r.at ?? '').slice(0, 10);
+    if (date < first || date > last || !r.projectId) continue;
+    if (!projects.has(r.projectId)) projects.set(r.projectId, { projectId: r.projectId, calls: 0, unpricedCalls: 0, cost: 0, runs: new Map() });
+    const row = projects.get(r.projectId);
+    add(row, r);
+    if (r.taskRunId) {
+      if (!row.runs.has(r.taskRunId)) row.runs.set(r.taskRunId, { taskRunId: r.taskRunId, calls: 0, unpricedCalls: 0, cost: 0 });
+      add(row.runs.get(r.taskRunId), r);
+    }
+  }
+  const close = ({ cost, ...rest }) => ({ ...rest, costUsd: rest.calls && rest.unpricedCalls === rest.calls ? null : Math.round(cost * 1e6) / 1e6 });
+  return [...projects.keys()].sort().map((key) => {
+    const { runs, ...row } = projects.get(key);
+    const taskRuns = [...runs.keys()].sort().map((id) => close(runs.get(id)));
+    return { ...close(row), ...(taskRuns.length ? { taskRuns } : {}) };
+  });
 }
 
 const utcDate = (ms) => new Date(ms).toISOString().slice(0, 10);
@@ -916,6 +1073,181 @@ function closeRow(row) {
  * model; days without calls are omitted. A row whose calls are all unpriced costs null; totals
  * are the sums of the model rows (FAC-SEM-025).
  */
+// --- FAC-SEM-025 whole (DEC-0021, DEC-0065, CT-40, DEC-0076): the contract's `usageRules` --------------------------------
+
+const usageCount = (v) => (Number.isSafeInteger(v) && v >= 0 ? v : 0);
+const usageCost = (v) => (typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : 0);
+const exceeds = (a, b) => a - b > 0.000001 + 1e-9 * Math.max(Math.abs(a), Math.abs(b));
+const usd = (v) => String(Math.round(v * 1e6) / 1e6);
+const usageList = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'object' && x !== null && !Array.isArray(x)) : []);
+const RFC3339_TIME = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
+function strictTime(value) {
+  const m = typeof value === 'string' ? RFC3339_TIME.exec(value) : null;
+  if (!m) return NaN;
+  const [y, mo, d, h, mi, s] = m.slice(1, 7).map(Number);
+  const date = new Date(0);
+  date.setUTCFullYear(y, mo - 1, d);
+  if (date.getUTCMonth() !== mo - 1 || date.getUTCDate() !== d || h > 23 || mi > 59 || s > 59) return NaN;
+  return Date.parse(value);
+}
+function utcDateMs(value) {
+  const m = typeof value === 'string' ? /^(\d{4})-(\d{2})-(\d{2})$/.exec(value) : null;
+  if (!m) return NaN;
+  const [y, mo, d] = m.slice(1).map(Number);
+  const ms = Date.UTC(y, mo - 1, d);
+  const date = new Date(ms);
+  return date.getUTCFullYear() === y && date.getUTCMonth() === mo - 1 && date.getUTCDate() === d ? ms : NaN;
+}
+function pricedRow(row, at) {
+  const calls = usageCount(row.calls), unpriced = usageCount(row.unpricedCalls);
+  const flag = (p, message) => [{ code: 'FAC-SEM-025', instancePath: p, message }];
+  if (unpriced > calls) return flag(`${at}/unpricedCalls`, 'more unpriced calls than calls');
+  if (calls > 0 && unpriced === calls && row.costUsd !== null) return flag(`${at}/costUsd`, 'every call is unpriced, so the cost is unknown (null), not a number');
+  if (unpriced < calls && row.costUsd === null) return flag(`${at}/costUsd`, 'priced calls carry a cost; null is only for a row with no priced call');
+  return [];
+}
+
+/**
+ * FAC-SEM-025 over a usage report, in the contract's order (`src/usage-rules.ts`): the arithmetic, the window (every
+ * date exists, not after `generatedAt`'s UTC date, at most 30 days before it) and the project attribution (each project
+ * once by its normal form, each task run once; calls, priced calls and known costs bounded). Never throws.
+ */
+export function usageFindings(report) {
+  const value = typeof report === 'object' && report !== null && !Array.isArray(report) ? report : {};
+  const findings = [];
+  const flag = (instancePath, message) => findings.push({ code: 'FAC-SEM-025', instancePath, message });
+  const days = usageList(value.days);
+  let previous = '';
+  days.forEach((day, i) => {
+    const at = `/days/${i}`;
+    const date = String(day.date ?? '');
+    if (date <= previous) flag(`${at}/date`, `days must run forward without a repeat (${date} after ${previous})`);
+    previous = date;
+    findings.push(...pricedRow(day, at));
+    const models = usageList(day.byModel);
+    models.forEach((m, j) => findings.push(...pricedRow(m, `${at}/byModel/${j}`)));
+    if (!models.length) {
+      const spent = ['calls', 'inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens'].some((f) => Number(day[f] ?? 0) > 0) || Number(day.costUsd ?? 0) > 0;
+      if (spent) flag(`${at}/byModel`, 'a day with calls, tokens or cost names the models they belong to');
+      return;
+    }
+    for (const field of ['calls', 'unpricedCalls', 'inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens']) {
+      const sum = models.reduce((n, m) => n + Number(m[field] ?? 0), 0);
+      if (Number(day[field] ?? 0) !== sum) flag(`${at}/${field}`, `the day's ${field} is not the sum of its models (${String(day[field] ?? 0)} ≠ ${sum})`);
+    }
+    const known = models.map((m) => (typeof m.costUsd === 'number' ? m.costUsd : null)).filter((x) => x !== null).reduce((n, x) => n + x, 0);
+    if (typeof day.costUsd === 'number' && Math.abs(day.costUsd - known) > 0.000001 + 1e-9 * Math.max(Math.abs(day.costUsd), Math.abs(known))) flag(`${at}/costUsd`, "the day's cost is not the sum of its models' known costs");
+  });
+  if (days.length) {
+    const generated = strictTime(value.generatedAt);
+    if (Number.isNaN(generated)) flag('/generatedAt', 'generatedAt is an RFC 3339 date-time with an offset, so the window can be read');
+    else {
+      const today = Math.floor(generated / 86_400_000) * 86_400_000;
+      const oldest = today - 30 * 86_400_000;
+      days.forEach((day, i) => {
+        const date = utcDateMs(day.date);
+        if (Number.isNaN(date)) flag(`/days/${i}/date`, "a day's date exists in its month");
+        else if (date > today) flag(`/days/${i}/date`, 'a day is not after the UTC date of generatedAt');
+        else if (date < oldest) flag(`/days/${i}/date`, 'a day is within the last 31 UTC days of generatedAt');
+      });
+    }
+  }
+  if (Array.isArray(value.byProject)) {
+    const seen = new Map();
+    let projectCalls = 0, projectCost = 0;
+    value.byProject.forEach((project, p) => {
+      if (typeof project !== 'object' || project === null || Array.isArray(project)) return;
+      const at = `/byProject/${p}`;
+      const normal = normalIdentifier(project.projectId);
+      if (normal !== undefined) {
+        if (seen.has(normal)) flag(`${at}/projectId`, `each project is one row: ${String(project.projectId)} names the project ${seen.get(normal)} already names`);
+        else seen.set(normal, String(project.projectId));
+      }
+      projectCalls += usageCount(project.calls);
+      projectCost += usageCost(project.costUsd);
+      findings.push(...pricedRow(project, at));
+      const runs = new Set();
+      let runCalls = 0, runCost = 0, runPriced = 0;
+      usageList(project.taskRuns).forEach((run, r) => {
+        if (typeof run.taskRunId === 'string') {
+          if (runs.has(run.taskRunId)) flag(`${at}/taskRuns/${r}/taskRunId`, 'each task run is one row within its project');
+          runs.add(run.taskRunId);
+        }
+        runCalls += usageCount(run.calls);
+        runCost += usageCost(run.costUsd);
+        runPriced += Math.max(0, usageCount(run.calls) - usageCount(run.unpricedCalls));
+        findings.push(...pricedRow(run, `${at}/taskRuns/${r}`));
+      });
+      const projectPriced = Math.max(0, usageCount(project.calls) - usageCount(project.unpricedCalls));
+      if (runCalls > usageCount(project.calls)) flag(`${at}/taskRuns`, `a project's task runs hold more calls than the project (${runCalls} > ${usageCount(project.calls)})`);
+      else if (runPriced > projectPriced) flag(`${at}/taskRuns`, `a project's task runs hold more priced calls than the project (${runPriced} > ${projectPriced})`);
+      else if (usageCost(project.costUsd) === project.costUsd && exceeds(runCost, usageCost(project.costUsd))) flag(`${at}/taskRuns`, `a project's task runs cost more than the project (${usd(runCost)} > ${usd(usageCost(project.costUsd))})`);
+    });
+    const dayCalls = days.reduce((n, d) => n + usageCount(d.calls), 0);
+    if (projectCalls > dayCalls) flag('/byProject', `the projects hold more calls than the days (${projectCalls} > ${dayCalls})`);
+    const dayCost = days.reduce((n, d) => n + usageCost(d.costUsd), 0);
+    if (exceeds(projectCost, dayCost)) flag('/byProject', `the projects cost more than the days (${usd(projectCost)} > ${usd(dayCost)})`);
+  }
+  return findings;
+}
+
+// --- OpenRouter attribution (DEC-0065): the contract's `attributionHeaders`, off by default ------------------------------
+
+export const OPENROUTER_CATEGORIES = Object.freeze(['cli-agent', 'ide-extension', 'cloud-agent', 'programming-app', 'native-app-builder',
+  'creative-writing', 'video-gen', 'image-gen', 'audio-gen', 'writing-assistant', 'general-chat', 'personal-agent', 'legal', 'roleplay', 'game']);
+const ATTR_PRODUCT = /^[a-z][a-z0-9-]{0,62}$/;
+const ATTR_TITLE = /^[\x21-\x7e](?:[\x20-\x7e]{0,98}[\x21-\x7e])?$/;
+const ATTRIBUTION_HEADER_NAMES = new Set(['http-referer', 'referer', 'x-openrouter-title', 'x-title', 'x-openrouter-categories']);
+
+/** FAC-SEM-098: a product's setting names a product slug, a printable title and at most two recognized categories. */
+export function attributionSettingFindings(value) {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return [{ code: 'FAC-SEM-098', instancePath: '', message: 'an attribution setting is an object' }];
+  const findings = [];
+  const flag = (instancePath, message) => findings.push({ code: 'FAC-SEM-098', instancePath, message });
+  if (typeof value.product !== 'string' || !ATTR_PRODUCT.test(value.product)) flag('/product', 'the product is a lower-case slug, the last segment of its product page');
+  if (typeof value.title !== 'string' || !ATTR_TITLE.test(value.title)) flag('/title', "the title is the product's full name: printable ASCII, 1 to 100 characters, no space at either end");
+  if (value.categories !== undefined) {
+    if (!Array.isArray(value.categories)) flag('/categories', 'categories are a list');
+    else {
+      if (value.categories.length > 2) flag('/categories', 'at most 2 categories per request');
+      const seen = new Set();
+      value.categories.forEach((c, i) => {
+        if (typeof c !== 'string' || !OPENROUTER_CATEGORIES.includes(c)) flag(`/categories/${i}`, 'a category is one OpenRouter recognizes; it drops others without an error');
+        else if (seen.has(c)) flag(`/categories/${i}`, 'each category once');
+        else seen.add(c);
+      });
+    }
+  }
+  return findings;
+}
+
+function isOpenRouter(url) {
+  try {
+    const u = new URL(url);
+    return u.protocol === 'https:' && u.hostname === 'openrouter.ai' && u.port === '' && u.username === '' && u.password === '';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The headers a product adds to one request (DEC-0065, the contract's `attributionHeaders`), or none with the reason:
+ * `no-setting` (off by default), `invalid-setting`, `not-openrouter`, `forwarded`, `user-set`. Only `HTTP-Referer`,
+ * `X-OpenRouter-Title` and `X-OpenRouter-Categories`; it never reads, moves or returns a key.
+ */
+export function attributionHeaders(setting, given) {
+  const request = typeof given === 'object' && given !== null ? given : {};
+  if (setting === undefined || setting === null) return { headers: {}, none: 'no-setting' };
+  if (attributionSettingFindings(setting).length) return { headers: {}, none: 'invalid-setting' };
+  if (typeof request.url !== 'string' || !isOpenRouter(request.url)) return { headers: {}, none: 'not-openrouter' };
+  if (request.originated !== true) return { headers: {}, none: 'forwarded' };
+  const present = typeof request.headers === 'object' && request.headers !== null ? Object.keys(request.headers).map((n) => n.toLowerCase()) : [];
+  if (present.some((n) => ATTRIBUTION_HEADER_NAMES.has(n))) return { headers: {}, none: 'user-set' };
+  const headers = { 'HTTP-Referer': `https://passioncode.ai/${setting.product}/`, 'X-OpenRouter-Title': setting.title };
+  if (setting.categories?.length) headers['X-OpenRouter-Categories'] = setting.categories.join(',');
+  return { headers };
+}
+
 /**
  * `budgets` (DEC-0027) lists every spending limit the service applies, enforced or not. A machine limit with a
  * calendar `period` and no `spentUsd` is counted here from the receipts, the way `budget` is, so the two never
@@ -952,6 +1284,8 @@ export function usageReport(receipts, { id, instance = 'default', now = Date.now
     return { ...closeRow(day), byModel: models };
   });
   const report = { protocol: PROTOCOL, service: { id, instance }, generatedAt: new Date(now).toISOString().replace(/\.\d{3}Z$/, 'Z'), currency: 'USD', days: outDays };
+  const projects = byProject(receipts, first, last);
+  if (projects.length) report.byProject = projects;
   if (budget !== undefined) {
     if (!['day', 'month'].includes(budget?.period) || typeof budget.limitUsd !== 'number' || !(budget.limitUsd > 0)) throw new ServiceError('budget is {period: day|month, limitUsd > 0}.');
     report.budget = { period: budget.period, limitUsd: budget.limitUsd, spentUsd: spentIn(outDays, budget.period, last) };

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -1305,7 +1305,8 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
                      surfaces: Dict[str, Any], summary: Optional[Sequence[Dict[str, Any]]] = None,
                      update_available: Optional[str] = None, pid: Optional[int] = None,
                      extensions: Optional[Dict[str, Any]] = None,
-                     configuration: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+                     configuration: Optional[Dict[str, Any]] = None,
+                     protocols: Optional[Sequence[str]] = None) -> Dict[str, Any]:
     """The unauthenticated identity answer. `degraded` is always present; ready means empty.
     `configuration` (DEC-0046) says what the operator can configure and what applies now; fabric_profiles builds it.
     `extensions` is kept as given (a reader ignores keys it does not know); a dashboard declaration
@@ -1339,15 +1340,182 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
         if problems:
             raise ServiceError("configuration: %s." % "; ".join(problems))
         doc["configuration"] = configuration
+    if protocols is not None:
+        # DEC-0067: the revisions this service accepts. The document is closed for a reader pinned before DEC-0067, so
+        # a service lists them only once its hosts are pinned at or after it.
+        problems = protocols_findings(list(protocols))
+        if problems:
+            raise ServiceError("protocols: %s." % "; ".join(f["message"] for f in problems))
+        doc["protocols"] = list(protocols)
     return doc
 
 
+# --- DEC-0067: protocol revisions; DEC-0070: an event's machine-readable data --------------------------------------
+
+#: Each contract protocol's published revisions, oldest first (the contract's `PROTOCOL_REVISIONS`, DEC-0067); a test
+#: holds it equal to the contract's register at the pin.
+PROTOCOL_REVISIONS: Dict[str, Tuple[str, ...]] = {
+    "access-log": ("1",), "approval": ("1",), "activity-summary": ("1",), "estate-record": ("1",), "execution-packet": ("1",),
+    "fabric-activity": ("0.1",), "fabric-dashboard": ("0.1",), "fabric-delegation": ("0.1",), "fabric-device": ("0.1",),
+    "fabric-interop": ("0.1",), "fabric-local-channel": ("0.1",), "fabric-local-runner": ("0.1",),
+    "fabric-operator-channel": ("0.1",), "fabric-package": ("1",), "fabric-project-comms": ("0.1",), "fabric-proposal": ("1",),
+    "fabric-provider": ("0.1",), "fabric-relay": ("0.1",), "fabric-secret-envelope": ("1",), "fabric-service": ("0.1",),
+    "fabric-settings-backup": ("1",), "heartbeat": ("1",), "learning-note": ("1",), "memory": ("0.1",), "pipeline": ("0.1",),
+    "revocation-delta": ("1",), "session-handoff": ("1",), "window-lease": ("1",),
+}
+MAX_PROTOCOLS = 64
+_REVISION = re.compile(r"([a-z][a-z0-9.-]{0,63})/([0-9]{1,4}(?:\.[0-9]{1,4}){0,2})", re.ASCII)
+
+
+def parse_revision(value: Any) -> Optional[Tuple[str, str]]:
+    """`<name>/<revision>` split, or None."""
+    match = _REVISION.fullmatch(value) if isinstance(value, str) else None
+    return (match.group(1), match.group(2)) if match else None
+
+
+def accepted_revisions(name: str, newest: Optional[str] = None) -> List[str]:
+    """The revisions a receiver implementing ``name`` up to ``newest`` accepts: N and, when the register has one, N−1."""
+    known = PROTOCOL_REVISIONS.get(name, ())
+    if not known:
+        return []
+    top = len(known) - 1 if newest is None else (known.index(newest) if newest in known else -1)
+    if top < 0:
+        return []
+    return ["%s/%s" % (name, r) for r in reversed(known[max(0, top - 1):top + 1])]
+
+
+def negotiate_revision(received: Any, accepted: Sequence[Any]) -> Dict[str, Any]:
+    """A receiver's answer to a document naming ``received`` (DEC-0067, the contract's `negotiateRevision`):
+    ``{"ok": True}``; the `schema-unsupported` refusal naming what was received (at most 80 characters) and the accepted
+    revisions of that protocol (all of them when it names none the receiver reads); or ``{"fault":
+    "no-accepted-revisions"}``, the receiver's own, when it accepts no well-formed revision. Revisions compare exactly."""
+    usable: List[str] = []
+    for entry in accepted if isinstance(accepted, (list, tuple)) else []:
+        if parse_revision(entry) and entry not in usable:
+            usable.append(entry)
+    usable = usable[:MAX_PROTOCOLS]
+    if not usable:
+        return {"fault": "no-accepted-revisions"}
+    if isinstance(received, str) and received in usable:
+        return {"ok": True}
+    parsed = parse_revision(received)
+    same = [e for e in usable if parsed and parse_revision(e)[0] == parsed[0]]
+    return {"error": {"code": "schema-unsupported", "message": "this receiver does not read that protocol revision",
+                      "data": {"protocol": received[:80] if isinstance(received, str) else "", "accepted": same or usable}}}
+
+
+def protocols_findings(protocols: Any, prefix: str = "/protocols") -> List[Dict[str, str]]:
+    """FAC-SEM-099 (DEC-0067): 1 to 64 entries, each `<name>/<revision>` once; at most two revisions of one protocol (an
+    unpublished one refused and not counted), and two of a contract protocol are N and N−1, consecutive in the register."""
+    flag = lambda at, message: {"code": "FAC-SEM-099", "instancePath": at, "message": message}  # noqa: E731
+    if not isinstance(protocols, list):
+        return [flag(prefix, "protocols is a list of protocol revisions")]
+    if not 1 <= len(protocols) <= MAX_PROTOCOLS:
+        return [flag(prefix, "protocols lists 1 to %d revisions" % MAX_PROTOCOLS)]
+    findings: List[Dict[str, str]] = []
+    by_name: Dict[str, List[int]] = {}
+    seen: List[str] = []
+    for i, entry in enumerate(protocols):
+        at = "%s/%d" % (prefix, i)
+        parsed = parse_revision(entry)
+        if not parsed:
+            findings.append(flag(at, "a protocol revision is <name>/<revision>, such as fabric-service/0.1"))
+            continue
+        if entry in seen:
+            findings.append(flag(at, "each protocol revision once"))
+            continue
+        seen.append(entry)
+        known = PROTOCOL_REVISIONS.get(parsed[0])
+        if known and parsed[1] not in known:
+            findings.append(flag(at, "%s has no published revision %s" % parsed))
+            continue
+        indices = by_name.setdefault(parsed[0], [])
+        indices.append(known.index(parsed[1]) if known else -1)
+        if len(indices) > 2:
+            findings.append(flag(at, "at most 2 revisions of one protocol: N and N−1"))
+        elif known and len(indices) == 2 and abs(indices[0] - indices[1]) != 1:
+            findings.append(flag(at, "two revisions of one protocol are N and N−1, consecutive in the register"))
+    return findings
+
+
+_SCHEMA_URI = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*:[^\s]+", re.ASCII)
+
+
+def _scalar(value: Any) -> bool:
+    return value is None or isinstance(value, (bool, int, float)) or (isinstance(value, str) and len(value) <= 500)
+
+
+def feed_data_problems(data: Any) -> List[str]:
+    """DEC-0070's `data {schema, value}` as the schema bounds it, then FAC-SEM-101: no string in `value`, at either
+    level, under a credential's name or of a credential's shape (named by its place, never its value)."""
+    import fabric_secrets  # noqa: E402 - beside this file; the contract's detector
+    if not isinstance(data, dict) or set(data) != {"schema", "value"}:
+        return ["data is {schema, value}"]
+    problems: List[str] = []
+    if not (isinstance(data["schema"], str) and _SCHEMA_URI.fullmatch(data["schema"])):
+        problems.append("data.schema is the absolute URI of a payload schema the service publishes")
+    value = data["value"]
+    if not isinstance(value, dict) or len(value) > 32:
+        return problems + ["data.value is an object of at most 32 members"]
+    for key, member in value.items():
+        if _scalar(member):
+            continue
+        if isinstance(member, list) and len(member) <= 32 and all(_scalar(m) for m in member):
+            continue
+        if isinstance(member, dict) and len(member) <= 32 and all(_scalar(m) for m in member.values()):
+            continue
+        problems.append("data.value.%s is a scalar (a string of at most 500 characters), a list of at most 32 scalars or an object of at most 32 scalar members" % key)
+    if problems:
+        return problems
+    for finding in feed_data_findings({"events": [{"data": data}]}):
+        problems.append("FAC-SEM-101: %s %s" % (finding["instancePath"].replace("/events/0", ""), finding["message"]))
+    return problems
+
+
+def _pointer_token(name: str) -> str:
+    return str(name).replace("~", "~0").replace("/", "~1")
+
+
+def feed_data_findings(page: Any) -> List[Dict[str, str]]:
+    """FAC-SEM-101 over an events page (the contract's `feedDataFindings`): a list's items and an object's members sit
+    under the outer name too; a number is a count, never a credential."""
+    import fabric_secrets  # noqa: E402
+    findings: List[Dict[str, str]] = []
+
+    def check(named: bool, member: Any, at: str) -> None:
+        if not isinstance(member, str):
+            return
+        if named:
+            findings.append({"code": "FAC-SEM-101", "instancePath": at, "message": "an event's data puts no string under a credential's name"})
+        elif fabric_secrets.secret_value(member) or fabric_secrets.secret_url(member):
+            findings.append({"code": "FAC-SEM-101", "instancePath": at, "message": "an event's data carries no value shaped like a credential"})
+
+    events = page.get("events") if isinstance(page, dict) else None
+    for i, event in enumerate(events if isinstance(events, list) else []):
+        data = event.get("data") if isinstance(event, dict) else None
+        value = data.get("value") if isinstance(data, dict) else None
+        if not isinstance(value, dict):
+            continue
+        for key, member in value.items():
+            at = "/events/%d/data/value/%s" % (i, _pointer_token(key))
+            named = fabric_secrets.credential_name(key)
+            check(named, member, at)
+            if isinstance(member, list):
+                for j, item in enumerate(member):
+                    check(named, item, "%s/%d" % (at, j))
+            elif isinstance(member, dict):
+                for inner, leaf in member.items():
+                    check(named or fabric_secrets.credential_name(inner), leaf, "%s/%s" % (at, _pointer_token(inner)))
+    return findings
+
+
 # --- events ------------------------------------------------------------------
 
 def make_event(event_id: Any, at: str, kind: str, level: str, text: str, *, subject: Optional[Dict[str, str]] = None,
                link: Optional[str] = None, notify: bool = False, trace_id: Optional[str] = None,
-               span_id: Optional[str] = None) -> Dict[str, Any]:
-    """One activity event: one sentence a person reads, never a machine id.
+               span_id: Optional[str] = None, data: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+    """One activity event: one sentence a person reads, never a machine id. `data` (DEC-0070) adds machine-readable
+    fields beside the sentence, `{schema, value}`, never a secret: it is refused here, so no feed carries one.
 
     An event about traced work carries its trace as a pair, `trace_id` and `span_id`
     (fabric-interop/0.1 C3.4 c); fabric_interop.trace_ids(traceparent) gives both."""
@@ -1373,6 +1541,11 @@ def make_event(event_id: Any, at: str, kind: str, level: str, text: str, *, subj
         event["notify"] = True
     if trace_id is not None:
         event["traceId"], event["spanId"] = trace_id, span_id
+    if data is not None:
+        problems = feed_data_problems(data)
+        if problems:
+            raise ServiceError("Event data: %s." % "; ".join(problems))
+        event["data"] = {"schema": data["schema"], "value": data["value"]}
     return event
 
 
@@ -1445,9 +1618,13 @@ _PROVIDER = re.compile(r"^[a-z][a-z0-9._-]{0,63}$")
 def make_usage_receipt(provider: str, model: str, *, input_tokens: int, output_tokens: int,
                        cache_read_tokens: int = 0, cache_write_tokens: int = 0,
                        cost_usd: Optional[float] = None, cost_basis: Optional[str] = None,
-                       at: Optional[str] = None, route: Optional[str] = None) -> Dict[str, Any]:
+                       at: Optional[str] = None, route: Optional[str] = None,
+                       project_id: Optional[str] = None, task_run_id: Optional[str] = None) -> Dict[str, Any]:
     """One model call, from the provider's own usage numbers. No prompt, output or caller.
 
+    `project_id` (a URI, kept in its normal form, DEC-0076) and `task_run_id` (the service's own run id) attribute the
+    call to the project the service ran it for (DEC-0065); they never name a caller, session or person.
+
     `cost_usd` is None when the call cannot be priced: the report counts it as unpriced and
     never as $0. `cost_basis` is `provider` (the provider reported the charge) or `price-list`
     (computed from a published price list); it is `unknown` when there is no cost."""
@@ -1472,9 +1649,55 @@ def make_usage_receipt(provider: str, model: str, *, input_tokens: int, output_t
                "costUsd": None if cost_usd is None else float(cost_usd), "costBasis": basis}
     if route is not None:
         receipt["route"] = route  # the operator's own login in its vendor's runner, an issued key, or the platform's metered models
+    if task_run_id is not None and project_id is None:
+        raise ServiceError("a task run belongs to a project: give project_id with task_run_id.")
+    if project_id is not None:
+        import fabric_identifiers  # noqa: E402 - beside this file
+        if not (isinstance(project_id, str) and _URI.fullmatch(project_id)):
+            raise ServiceError("project_id is the URI of the project the service ran the call for.")
+        receipt["projectId"] = fabric_identifiers.normal_identifier(project_id)
+    if task_run_id is not None:
+        if not (isinstance(task_run_id, str) and _TASK_RUN_ID.fullmatch(task_run_id)):
+            raise ServiceError("task_run_id is the service's own run id: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$.")
+        receipt["taskRunId"] = task_run_id
     return receipt
 
 
+_URI = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*:\S+", re.ASCII)
+_TASK_RUN_ID = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,127}", re.ASCII)
+
+
+def _by_project(receipts: List[Dict[str, Any]], first: str, last: str) -> List[Dict[str, Any]]:
+    """DEC-0065's `byProject`: the window's calls by the project the service ran them for, each project once (by its
+    normal form, DEC-0076) and each task run once within it. A call for no project is in no row."""
+    projects: Dict[str, Dict[str, Any]] = {}
+    for r in receipts:
+        if not (first <= str(r.get("at", ""))[:10] <= last) or not r.get("projectId"):
+            continue
+        row = projects.setdefault(r["projectId"], {"projectId": r["projectId"], "calls": 0, "unpricedCalls": 0, "_cost": 0.0, "_runs": {}})
+        row["calls"] += 1
+        if r.get("costUsd") is None:
+            row["unpricedCalls"] += 1
+        else:
+            row["_cost"] += float(r["costUsd"])
+        if r.get("taskRunId"):
+            run = row["_runs"].setdefault(r["taskRunId"], {"taskRunId": r["taskRunId"], "calls": 0, "unpricedCalls": 0, "_cost": 0.0})
+            run["calls"] += 1
+            if r.get("costUsd") is None:
+                run["unpricedCalls"] += 1
+            else:
+                run["_cost"] += float(r["costUsd"])
+    out = []
+    for key in sorted(projects):
+        row = projects[key]
+        runs = [_close_totals(run) for _, run in sorted(row.pop("_runs").items())]
+        row = _close_totals(row)
+        if runs:
+            row["taskRuns"] = runs
+        out.append(row)
+    return out
+
+
 def _add_totals(row: Dict[str, Any], receipt: Dict[str, Any]) -> None:
     row["calls"] += 1
     for name in ("inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens"):
@@ -1491,6 +1714,246 @@ def _close_totals(row: Dict[str, Any]) -> Dict[str, Any]:
     return row
 
 
+# --- FAC-SEM-025 whole (DEC-0021, DEC-0065, CT-40, DEC-0076): the contract's `usageRules` -----------------------------
+
+_USAGE_WINDOW_DAYS = 31
+_DAY_MS = 86_400_000
+
+
+def _usage_count(value: Any) -> int:
+    return value if isinstance(value, int) and not isinstance(value, bool) and 0 <= value <= 2 ** 53 - 1 else 0
+
+
+def _usage_cost(value: Any) -> float:
+    return float(value) if isinstance(value, (int, float)) and not isinstance(value, bool) and value == value and value >= 0 and value != float("inf") else 0.0
+
+
+def _exceeds(a: float, b: float) -> bool:
+    return a - b > 0.000001 + 1e-9 * max(abs(a), abs(b))
+
+
+def _usd(value: float) -> str:
+    rounded = round(value * 1e6) / 1e6
+    return str(int(rounded)) if rounded == int(rounded) else repr(rounded)
+
+
+def _utc_date_ms(value: Any) -> float:
+    match = re.fullmatch(r"([0-9]{4})-([0-9]{2})-([0-9]{2})", value, re.ASCII) if isinstance(value, str) else None
+    if not match:
+        return float("nan")
+    try:
+        day = _dt.date(int(match.group(1)), int(match.group(2)), int(match.group(3)))
+    except ValueError:
+        return float("nan")
+    return float((day - _dt.date(1970, 1, 1)).days * _DAY_MS)
+
+
+def _usage_list(value: Any) -> List[Dict[str, Any]]:
+    return [x for x in value if isinstance(x, dict)] if isinstance(value, list) else []
+
+
+def _priced_row(row: Dict[str, Any], at: str) -> List[Dict[str, str]]:
+    calls, unpriced = _usage_count(row.get("calls")), _usage_count(row.get("unpricedCalls"))
+    flag = lambda path, message: [{"code": "FAC-SEM-025", "instancePath": path, "message": message}]  # noqa: E731
+    if unpriced > calls:
+        return flag(at + "/unpricedCalls", "more unpriced calls than calls")
+    if calls > 0 and unpriced == calls and row.get("costUsd", _MISSING_COST) is not None:
+        return flag(at + "/costUsd", "every call is unpriced, so the cost is unknown (null), not a number")
+    if unpriced < calls and row.get("costUsd", _MISSING_COST) is None:
+        return flag(at + "/costUsd", "priced calls carry a cost; null is only for a row with no priced call")
+    return []
+
+
+_MISSING_COST = object()
+
+
+def usage_findings(report: Any) -> List[Dict[str, str]]:
+    """FAC-SEM-025 over a usage report, in the contract's order (`src/usage-rules.ts`): the arithmetic of days and
+    models, the window (every date exists, not after `generatedAt`'s UTC date, at most 30 days before it), and the
+    project attribution (each project once by its normal form, each task run once; calls, priced calls and known costs
+    bounded). Malformed input answers findings or none, never an exception."""
+    import fabric_identifiers  # noqa: E402
+    import fabric_estate  # noqa: E402 - the strict RFC 3339 reader
+    value = report if isinstance(report, dict) else {}
+    findings: List[Dict[str, str]] = []
+    flag = lambda path, message: findings.append({"code": "FAC-SEM-025", "instancePath": path, "message": message})  # noqa: E731
+    days = _usage_list(value.get("days"))
+    # The arithmetic.
+    previous = ""
+    for i, day in enumerate(days):
+        at = "/days/%d" % i
+        date = day.get("date")
+        date = "" if date is None else (date if isinstance(date, str) else json.dumps(date))
+        if date <= previous:
+            flag(at + "/date", "days must run forward without a repeat (%s after %s)" % (date, previous))
+        previous = date
+        findings.extend(_priced_row(day, at))
+        models = _usage_list(day.get("byModel"))
+        for j, m in enumerate(models):
+            findings.extend(_priced_row(m, "%s/byModel/%d" % (at, j)))
+        if not models:
+            spent = any((day.get(f) or 0) > 0 for f in ("calls", "inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens")
+                        if isinstance(day.get(f) or 0, (int, float))) or (isinstance(day.get("costUsd"), (int, float)) and day["costUsd"] > 0)
+            if spent:
+                flag(at + "/byModel", "a day with calls, tokens or cost names the models they belong to")
+            continue
+        for field in ("calls", "unpricedCalls", "inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens"):
+            total = sum(m.get(field) or 0 for m in models if isinstance(m.get(field) or 0, (int, float)))
+            if (day.get(field) or 0) != total:
+                flag("%s/%s" % (at, field), "the day's %s is not the sum of its models (%s ≠ %s)" % (field, day.get(field) or 0, total))
+        known = sum(m["costUsd"] for m in models if isinstance(m.get("costUsd"), (int, float)) and not isinstance(m.get("costUsd"), bool))
+        day_cost = day.get("costUsd")
+        if isinstance(day_cost, (int, float)) and not isinstance(day_cost, bool) and abs(day_cost - known) > 0.000001 + 1e-9 * max(abs(day_cost), abs(known)):
+            flag(at + "/costUsd", "the day's cost is not the sum of its models' known costs")
+    # The window.
+    if days:
+        generated = fabric_estate.estate_time(value.get("generatedAt"))
+        if generated != generated:
+            flag("/generatedAt", "generatedAt is an RFC 3339 date-time with an offset, so the window can be read")
+        else:
+            today = (generated // _DAY_MS) * _DAY_MS
+            oldest = today - (_USAGE_WINDOW_DAYS - 1) * _DAY_MS
+            for i, day in enumerate(days):
+                date = _utc_date_ms(day.get("date"))
+                if date != date:
+                    flag("/days/%d/date" % i, "a day's date exists in its month")
+                elif date > today:
+                    flag("/days/%d/date" % i, "a day is not after the UTC date of generatedAt")
+                elif date < oldest:
+                    flag("/days/%d/date" % i, "a day is within the last %d UTC days of generatedAt" % _USAGE_WINDOW_DAYS)
+    # The projects.
+    if isinstance(value.get("byProject"), list):
+        seen: Dict[str, str] = {}
+        project_calls, project_cost = 0, 0.0
+        for p, project in enumerate(value["byProject"]):
+            if not isinstance(project, dict):
+                continue
+            at = "/byProject/%d" % p
+            normal = fabric_identifiers.normal_identifier(project.get("projectId"))
+            if normal is not None:
+                if normal in seen:
+                    flag(at + "/projectId", "each project is one row: %s names the project %s already names" % (project["projectId"], seen[normal]))
+                else:
+                    seen[normal] = project["projectId"]
+            project_calls += _usage_count(project.get("calls"))
+            project_cost += _usage_cost(project.get("costUsd"))
+            findings.extend(_priced_row(project, at))
+            runs: List[str] = []
+            run_calls, run_cost, run_priced = 0, 0.0, 0
+            for r, run in enumerate(_usage_list(project.get("taskRuns"))):
+                if isinstance(run.get("taskRunId"), str):
+                    if run["taskRunId"] in runs:
+                        flag("%s/taskRuns/%d/taskRunId" % (at, r), "each task run is one row within its project")
+                    runs.append(run["taskRunId"])
+                run_calls += _usage_count(run.get("calls"))
+                run_cost += _usage_cost(run.get("costUsd"))
+                run_priced += max(0, _usage_count(run.get("calls")) - _usage_count(run.get("unpricedCalls")))
+                findings.extend(_priced_row(run, "%s/taskRuns/%d" % (at, r)))
+            project_priced = max(0, _usage_count(project.get("calls")) - _usage_count(project.get("unpricedCalls")))
+            known_cost = isinstance(project.get("costUsd"), (int, float)) and not isinstance(project.get("costUsd"), bool) and _usage_cost(project.get("costUsd")) == project.get("costUsd")
+            if run_calls > _usage_count(project.get("calls")):
+                flag(at + "/taskRuns", "a project's task runs hold more calls than the project (%d > %d)" % (run_calls, _usage_count(project.get("calls"))))
+            elif run_priced > project_priced:
+                flag(at + "/taskRuns", "a project's task runs hold more priced calls than the project (%d > %d)" % (run_priced, project_priced))
+            elif known_cost and _exceeds(run_cost, _usage_cost(project.get("costUsd"))):
+                flag(at + "/taskRuns", "a project's task runs cost more than the project (%s > %s)" % (_usd(run_cost), _usd(_usage_cost(project.get("costUsd")))))
+        day_calls = sum(_usage_count(d.get("calls")) for d in days)
+        if project_calls > day_calls:
+            flag("/byProject", "the projects hold more calls than the days (%d > %d)" % (project_calls, day_calls))
+        day_cost_total = sum(_usage_cost(d.get("costUsd")) for d in days)
+        if _exceeds(project_cost, day_cost_total):
+            flag("/byProject", "the projects cost more than the days (%s > %s)" % (_usd(project_cost), _usd(day_cost_total)))
+    return findings
+
+
+# --- OpenRouter attribution (DEC-0065): the contract's `attributionHeaders`, off by default -----------------------------
+
+OPENROUTER_CATEGORIES = ("cli-agent", "ide-extension", "cloud-agent", "programming-app", "native-app-builder",
+                         "creative-writing", "video-gen", "image-gen", "audio-gen", "writing-assistant", "general-chat",
+                         "personal-agent", "legal", "roleplay", "game")
+_ATTR_PRODUCT = re.compile(r"[a-z][a-z0-9-]{0,62}", re.ASCII)
+_ATTR_TITLE = re.compile(r"[\x21-\x7e](?:[\x20-\x7e]{0,98}[\x21-\x7e])?", re.ASCII)
+_ATTRIBUTION_HEADERS = ("http-referer", "referer", "x-openrouter-title", "x-title", "x-openrouter-categories")
+
+
+def attribution_setting_findings(value: Any) -> List[Dict[str, str]]:
+    """FAC-SEM-098: a product's setting names a product slug, a printable title and at most two recognized categories."""
+    if not isinstance(value, dict):
+        return [{"code": "FAC-SEM-098", "instancePath": "", "message": "an attribution setting is an object"}]
+    findings: List[Dict[str, str]] = []
+    flag = lambda at, message: findings.append({"code": "FAC-SEM-098", "instancePath": at, "message": message})  # noqa: E731
+    if not (isinstance(value.get("product"), str) and _ATTR_PRODUCT.fullmatch(value["product"])):
+        flag("/product", "the product is a lower-case slug, the last segment of its product page")
+    if not (isinstance(value.get("title"), str) and _ATTR_TITLE.fullmatch(value["title"])):
+        flag("/title", "the title is the product's full name: printable ASCII, 1 to 100 characters, no space at either end")
+    if "categories" in value:
+        categories = value["categories"]
+        if not isinstance(categories, list):
+            flag("/categories", "categories are a list")
+        else:
+            if len(categories) > 2:
+                flag("/categories", "at most 2 categories per request")
+            seen: List[str] = []
+            for i, category in enumerate(categories):
+                if not (isinstance(category, str) and category in OPENROUTER_CATEGORIES):
+                    flag("/categories/%d" % i, "a category is one OpenRouter recognizes; it drops others without an error")
+                elif category in seen:
+                    flag("/categories/%d" % i, "each category once")
+                else:
+                    seen.append(category)
+    return findings
+
+
+def _is_openrouter(url: Any) -> bool:
+    """Whether a URL's WHATWG reading is https, host openrouter.ai, the default port and no credentials (`new URL`):
+    leading and trailing spaces and controls trimmed, tabs and newlines removed, backslashes read as slashes, the
+    slashes after the scheme optional, the host case-folded, port 443 the default."""
+    if not isinstance(url, str):
+        return False
+    text = url.strip("".join(chr(c) for c in range(0x21))).replace("\t", "").replace("\n", "").replace("\r", "")
+    if not text[:6].lower() == "https:":
+        return False
+    rest = text[6:].lstrip("/\\")
+    end = len(rest)
+    for stop in "/\\?#":
+        found = rest.find(stop)
+        if found != -1:
+            end = min(end, found)
+    authority = rest[:end]
+    if "@" in authority:
+        userinfo, authority = authority.rsplit("@", 1)
+        if userinfo not in ("", ":"):
+            return False
+    host, _, port = authority.partition(":")
+    if port and not (port.isdigit() and int(port) == 443):
+        return False
+    return host.lower() == "openrouter.ai"
+
+
+def attribution_headers(setting: Any, request: Any) -> Dict[str, Any]:
+    """The headers a product adds to one request (DEC-0065, the contract's `attributionHeaders`), or none with the reason:
+    `no-setting` (attribution is off by default), `invalid-setting` (FAC-SEM-098), `not-openrouter` (only
+    `https://openrouter.ai`), `forwarded` (only traffic the product originates), `user-set` (a request that already
+    carries an attribution header keeps the user's own). Only `HTTP-Referer`, `X-OpenRouter-Title` and
+    `X-OpenRouter-Categories`; it never reads, moves or returns a key."""
+    req = request if isinstance(request, dict) else {}
+    if setting is None:
+        return {"headers": {}, "none": "no-setting"}
+    if attribution_setting_findings(setting):
+        return {"headers": {}, "none": "invalid-setting"}
+    if not _is_openrouter(req.get("url")):
+        return {"headers": {}, "none": "not-openrouter"}
+    if req.get("originated") is not True:
+        return {"headers": {}, "none": "forwarded"}
+    present = [str(name).lower() for name in req["headers"]] if isinstance(req.get("headers"), dict) else []
+    if any(name in _ATTRIBUTION_HEADERS for name in present):
+        return {"headers": {}, "none": "user-set"}
+    headers = {"HTTP-Referer": "https://passioncode.ai/%s/" % setting["product"], "X-OpenRouter-Title": setting["title"]}
+    if setting.get("categories"):
+        headers["X-OpenRouter-Categories"] = ",".join(setting["categories"])
+    return {"headers": headers}
+
+
 def usage_report(receipts: Iterable[Dict[str, Any]], *, service_id: str, instance: str = "default",
                  now: Optional[_dt.datetime] = None,
                  budget: Optional[Dict[str, Any]] = None,
@@ -1541,6 +2004,9 @@ def usage_report(receipts: Iterable[Dict[str, Any]], *, service_id: str, instanc
         out_days.append(day)
     report: Dict[str, Any] = {"protocol": PROTOCOL, "service": {"id": service_id, "instance": instance},
                               "generatedAt": now.strftime("%Y-%m-%dT%H:%M:%SZ"), "currency": "USD", "days": out_days}
+    projects = _by_project(receipts, first, last)
+    if projects:
+        report["byProject"] = projects
     if budget is not None:
         if budget.get("period") not in ("day", "month") or not isinstance(budget.get("limitUsd"), (int, float)) or budget["limitUsd"] <= 0:
             raise ServiceError("budget is {period: day|month, limitUsd > 0}.")

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.25.0"
+  version: "0.27.0"
   contract-version: "0.1.0"
   contract-commit: "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b"
 ---

package/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -18,7 +18,7 @@ compatibility: >-
   this plugin; Codex and Kimi Code get the session-start preamble hook on the person's consent.
 metadata:
   author: PassionCode.ai
-  version: "0.25.0"
+  version: "0.27.0"
 ---
 
 # Working with Fabric

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session.py

@@ -60,7 +60,7 @@ WATCH_MAX_BACKOFF_S = 900
 SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 LOCAL_ORIGIN = re.compile(r'"origin": "http://(?:127\.0\.0\.1|localhost)')
-VERSION = "0.25.0"
+VERSION = "0.27.0"
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code"}
 # A session Fabric launched. FABRIC_LAUNCHED_SESSION=1 is the marker Fabric is asked to set (need D6); the others are
 # what Fabric already gives a launched session (fabric sessionBundle.ts): only their NAMES are looked at, never a value