@passioncode-ai/fabric-agent-adapter 0.32.1 → 0.34.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-estate.mjs

@@ -26,6 +26,41 @@ export const FLAGS = Object.freeze({ UP: 0x01, UV: 0x04, BE: 0x08, BS: 0x10, AT:
 const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 const isString = (value) => typeof value === 'string';
 const list = (value) => (Array.isArray(value) ? value.filter(isObject) : []);
+/** The object items of an array with their index as written, so an instancePath names the item even after a non-object. */
+const indexed = (value) => (Array.isArray(value) ? value.flatMap((item, index) => (isObject(item) ? [[item, index]] : [])) : []);
+/** The contract's `show`: String(value), or its JSON where String() throws (an object whose own `toString` is data). */
+const show = (value) => {
+  if (typeof value === 'string') return value;
+  try {
+    return String(value);
+  } catch {
+    return JSON.stringify(value) ?? typeof value;
+  }
+};
+/** The contract's `toNumber`: Number(value), or NaN where Number() throws. */
+const toNumber = (value) => {
+  try {
+    return Number(value);
+  } catch {
+    return Number.NaN;
+  }
+};
+/** DEC-0082: the personal context, and an organization's context `org:<orgId>` (the contract's `context-route.ts`). */
+export const PERSONAL_CONTEXT = 'personal';
+export const ORG_CONTEXT_PREFIX = 'org:';
+const ORG_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+/** The context `value` names, or undefined: `personal` exactly, or `org:` and an organization id; compared as written. */
+export function parseContext(value) {
+  if (typeof value !== 'string') return undefined;
+  if (value === PERSONAL_CONTEXT) return { kind: 'personal' };
+  if (!value.startsWith(ORG_CONTEXT_PREFIX)) return undefined;
+  const org = value.slice(ORG_CONTEXT_PREFIX.length);
+  return ORG_ID.test(org) ? { kind: 'org', org } : undefined;
+}
+/** A placement's or a secret placement's context: its `context`, `personal` when absent (DEC-0082). */
+const contextOf = (entry) => (entry.context === undefined ? PERSONAL_CONTEXT : entry.context);
+/** A collision-free key over JSON values. */
+const keyOf = (...parts) => JSON.stringify(parts);
 const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest();
 const B64URL = /^[A-Za-z0-9_-]+$/;
 const bytes = (text) => Buffer.from(text, 'base64url');
@@ -255,10 +290,13 @@ export function verifyEstateRecord(record, trust) {
   return { ok: true, digest, revision: record.revision, signedBy: credential.credentialId, signCount: assertion.signCount };
 }
 
-/** What a package verifier trusts for a package placed on a machine; undefined when the record places no such agent there. */
-export function placementTrust(record, machineId, agentRef) {
+/**
+ * What a package verifier trusts for a package placed on a machine in a context (DEC-0082; `personal` when not given);
+ * undefined when the record places no such agent there in that context.
+ */
+export function placementTrust(record, machineId, agentRef, context = PERSONAL_CONTEXT) {
   const machine = list(record.machines).find((entry) => entry.id === machineId);
-  const placement = list(machine?.packages).find((entry) => entry.agentRef === agentRef);
+  const placement = list(machine?.packages).find((entry) => entry.agentRef === agentRef && contextOf(entry) === context);
   if (!placement) return undefined;
   return { publisher: list(record.publisherKeys).filter((key) => key.kid === placement.publisherKid) };
 }
@@ -335,7 +373,7 @@ function revisionChain(value) {
   const parent = isObject(value.parent) ? value.parent : {};
   const next = isObject(value.next) ? value.next : {};
   if (next.estate !== parent.estate) flag('/next/estate', "a revision continues its parent's estate");
-  if (next.revision !== Number(parent.revision) + 1) flag('/next/revision', `the revision after ${String(parent.revision)} is ${Number(parent.revision) + 1}: a revision never skips or repeats one`);
+  if (next.revision !== toNumber(parent.revision) + 1) flag('/next/revision', `the revision after ${show(parent.revision)} is ${toNumber(parent.revision) + 1}: a revision never skips or repeats one`);
   let parentDigest;
   try {
     parentDigest = estateRecordDigest(parent);
@@ -345,14 +383,14 @@ function revisionChain(value) {
   if (next.parent !== parentDigest) flag('/next/parent', 'parent names the digest of the revision before it');
   if (estateTime(next.issuedAt) < estateTime(parent.issuedAt)) flag('/next/issuedAt', 'a revision is never issued before its parent');
   const kept = new Set(list(next.revocations).map(revocationKey));
-  list(parent.revocations).forEach((entry, index) => {
-    if (!kept.has(revocationKey(entry))) flag(`/parent/revocations/${index}`, `the ${String(entry.kind)} revocation of ${String(entry.ref)} is dropped: a revision keeps every revocation before it`);
+  indexed(parent.revocations).forEach(([entry, index]) => {
+    if (!kept.has(revocationKey(entry))) flag(`/parent/revocations/${index}`, `the ${show(entry.kind)} revocation of ${show(entry.ref)} is dropped: a revision keeps every revocation before it`);
   });
   return findings;
 }
 
 const validDeviceKey = (key) => {
-  const raw = Buffer.from(String(key.publicKey ?? ''), 'base64');
+  const raw = Buffer.from(show(key.publicKey ?? ''), 'base64');
   return key.alg === 'ed25519' ? raw.length === 32 && !smallOrder(raw) : isValidP256Key(raw);
 };
 
@@ -360,69 +398,73 @@ function keys(value, flag) {
   const ids = new Set();
   const hubKids = new Set();
   const hubKeys = new Set();
-  list(value.machines).forEach((machine, m) => {
+  indexed(value.machines).forEach(([machine, m]) => {
     const at = `/machines/${m}`;
-    if (ids.has(machine.id)) flag(`${at}/id`, `machine ${String(machine.id)} is listed twice`);
+    if (ids.has(machine.id)) flag(`${at}/id`, `machine ${show(machine.id)} is listed twice`);
     ids.add(machine.id);
     const deviceKeys = list(machine.deviceKeys);
     if (deviceKeys.filter((key) => key.use === 'sig').length !== 1) flag(`${at}/deviceKeys`, 'a machine has exactly one signing device key, <id>#sig');
     if (deviceKeys.filter((key) => key.use === 'kem').length > 1) flag(`${at}/deviceKeys`, 'a machine has at most one key-agreement device key, <id>#kem');
     const seen = new Set();
     deviceKeys.forEach((key, k) => {
-      if (key.kid !== `${String(machine.id)}#${String(key.use)}`) flag(`${at}/deviceKeys/${k}/kid`, 'a device key is listed as <machine id>#sig or <machine id>#kem, by its role');
+      if (key.kid !== `${show(machine.id)}#${show(key.use)}`) flag(`${at}/deviceKeys/${k}/kid`, 'a device key is listed as <machine id>#sig or <machine id>#kem, by its role');
       if (!validDeviceKey(key)) flag(`${at}/deviceKeys/${k}/publicKey`, 'an Ed25519 key is never of small order (DEC-0045) and a P-256 key is a valid point (SEC 1 §3.2.2)');
       if (seen.has(key.publicKey)) flag(`${at}/deviceKeys/${k}/publicKey`, 'one key is never used for the other role');
       seen.add(key.publicKey);
     });
     if (isObject(machine.hubKey)) {
       const hub = machine.hubKey;
-      if (hubKids.has(hub.kid)) flag(`${at}/hubKey/kid`, `hub key ${String(hub.kid)} is certified for two machines: one kid per machine`);
+      if (hubKids.has(hub.kid)) flag(`${at}/hubKey/kid`, `hub key ${show(hub.kid)} is certified for two machines: one kid per machine`);
       hubKids.add(hub.kid);
       if (hubKeys.has(hub.x)) flag(`${at}/hubKey/x`, 'one hub public key is certified for two machines under two kids: one key per machine');
       hubKeys.add(hub.x);
-      if (smallOrder(Buffer.from(String(hub.x ?? ''), 'base64url'))) flag(`${at}/hubKey/x`, 'a hub key of small order verifies forged tokens and is never certified (DEC-0045)');
+      if (smallOrder(Buffer.from(show(hub.x ?? ''), 'base64url'))) flag(`${at}/hubKey/x`, 'a hub key of small order verifies forged tokens and is never certified (DEC-0045)');
     }
   });
   const credentials = new Set();
-  list(value.authorities).forEach((authority, index) => {
+  indexed(value.authorities).forEach(([authority, index]) => {
     if (credentials.has(authority.credentialId)) flag(`/authorities/${index}/credentialId`, 'a passkey is listed once');
     credentials.add(authority.credentialId);
-    if ('problem' in credentialKey(authority.publicKey, String(authority.alg))) flag(`/authorities/${index}/publicKey`, "a passkey's public key is a valid P-256 point for ES256 or an Ed25519 key of full order for EdDSA");
+    if ('problem' in credentialKey(authority.publicKey, show(authority.alg))) flag(`/authorities/${index}/publicKey`, "a passkey's public key is a valid P-256 point for ES256 or an Ed25519 key of full order for EdDSA");
   });
 }
 
 function placements(value, flag) {
   const kids = new Set();
-  list(value.publisherKeys).forEach((key, index) => {
-    if (kids.has(key.kid)) flag(`/publisherKeys/${index}/kid`, `publisher key ${String(key.kid)} is pinned twice`);
+  indexed(value.publisherKeys).forEach(([key, index]) => {
+    if (kids.has(key.kid)) flag(`/publisherKeys/${index}/kid`, `publisher key ${show(key.kid)} is pinned twice`);
     kids.add(key.kid);
   });
-  list(value.machines).forEach((machine, m) => {
+  indexed(value.machines).forEach(([machine, m]) => {
     const agents = new Set();
-    list(machine.packages).forEach((placement, p) => {
+    indexed(machine.packages).forEach(([placement, p]) => {
       const at = `/machines/${m}/packages/${p}`;
-      if (agents.has(placement.agentRef)) flag(`${at}/agentRef`, `${String(placement.agentRef)} is placed twice on one machine`);
-      agents.add(placement.agentRef);
-      if (!kids.has(placement.publisherKid)) flag(`${at}/publisherKid`, `publisher key ${String(placement.publisherKid)} is not in publisherKeys, so the machine pins no key to verify the package under`);
+      const key = keyOf(placement.agentRef, contextOf(placement));
+      if (agents.has(key)) flag(`${at}/agentRef`, `${show(placement.agentRef)} is placed twice on one machine in the context ${show(contextOf(placement))}`);
+      agents.add(key);
+      if (!kids.has(placement.publisherKid)) flag(`${at}/publisherKid`, `publisher key ${show(placement.publisherKid)} is not in publisherKeys, so the machine pins no key to verify the package under`);
     });
   });
 }
 
 function secretReferences(value, flag) {
   const machineIds = new Set(list(value.machines).map((machine) => machine.id));
-  list(value.machines).forEach((machine, m) => {
-    const placed = new Set(list(machine.packages).map((placement) => placement.agentRef));
+  indexed(value.machines).forEach(([machine, m]) => {
+    const placed = new Set(list(machine.packages).map((placement) => keyOf(placement.agentRef, contextOf(placement))));
     const slots = new Set();
-    list(machine.secrets).forEach((secret, s) => {
+    indexed(machine.secrets).forEach(([secret, s]) => {
       const at = `/machines/${m}/secrets/${s}`;
-      for (const field of ['slot', 'from', 'agentRef']) {
+      // The message never repeats the value, and no message of this rule repeats a secret placement's context.
+      for (const field of ['slot', 'from', 'agentRef', 'context']) {
         const text = secret[field];
         if (isString(text) && secretValue(text)) flag(`${at}/${field}`, 'a secret placement names a slot, never a value: this looks like a credential');
       }
-      if (!placed.has(secret.agentRef)) flag(`${at}/agentRef`, 'a secret goes only where a placed package declares it (v4 Path 2): this agent is not placed on this machine');
+      if (!placed.has(keyOf(secret.agentRef, contextOf(secret)))) flag(`${at}/agentRef`, "a secret goes only where a placed package declares it (v4 Path 2): this agent is not placed on this machine in the secret's context");
       if (!machineIds.has(secret.from)) flag(`${at}/from`, 'the slot is filled from a machine of this estate');
-      const key = `${String(secret.agentRef)} ${String(secret.slot)}`;
-      if (slots.has(key)) flag(`${at}/slot`, `slot ${String(secret.slot)} is placed twice for one agent on one machine`);
+      // An envelope names no context (DEC-0082), so an organization's instance fills its slot on its own machine.
+      else if (contextOf(secret) !== PERSONAL_CONTEXT && secret.from !== machine.id) flag(`${at}/from`, "an organization's instance fills its slot from its own machine's vault, never by an envelope from another machine");
+      const key = keyOf(secret.agentRef, secret.slot, contextOf(secret));
+      if (slots.has(key)) flag(`${at}/slot`, `slot ${show(secret.slot)} is placed twice for one agent in one context on one machine`);
       slots.add(key);
     });
   });
@@ -432,10 +474,10 @@ function grantsAndRevocations(value, flag) {
   // A grant's id is a URI, so grants and their revocations are keyed by its normal form (DEC-0076).
   const grantKey = (id) => (typeof id === 'string' ? normalIdentifier(id) : id);
   const grantIds = new Set();
-  list(value.shareGrants).forEach((grant, index) => {
+  indexed(value.shareGrants).forEach(([grant, index]) => {
     if (grant.principalKind !== 'external') flag(`/shareGrants/${index}/principalKind`, 'a share grant is to a principal outside the estate: principalKind external');
     const id = isObject(grant.meta) ? grant.meta.id : undefined;
-    if (grantIds.has(grantKey(id))) flag(`/shareGrants/${index}/meta/id`, `grant ${String(id)} is listed twice`);
+    if (grantIds.has(grantKey(id))) flag(`/shareGrants/${index}/meta/id`, `grant ${show(id)} is listed twice`);
     grantIds.add(grantKey(id));
   });
   const machines = list(value.machines);
@@ -450,12 +492,50 @@ function grantsAndRevocations(value, flag) {
     grant: grantIds,
   }));
   const seen = new Set();
-  list(value.revocations).forEach((revocation, index) => {
+  indexed(value.revocations).forEach(([revocation, index]) => {
     const ref = revocation.kind === 'grant' ? grantKey(revocation.ref) : revocation.ref;
-    const key = `${String(revocation.kind)} ${String(ref)}`;
-    if (seen.has(key)) flag(`/revocations/${index}`, `the ${String(revocation.kind)} ${String(revocation.ref)} is revoked twice`);
+    const key = `${show(revocation.kind)} ${show(ref)}`;
+    if (seen.has(key)) flag(`/revocations/${index}`, `the ${show(revocation.kind)} ${show(revocation.ref)} is revoked twice`);
     seen.add(key);
-    if (listed.get(String(revocation.kind))?.has(ref)) flag(`/revocations/${index}/ref`, `the record still lists the ${String(revocation.kind)} it revokes: revocation outranks addition`);
+    if (listed.get(show(revocation.kind))?.has(ref)) flag(`/revocations/${index}/ref`, `the record still lists the ${show(revocation.kind)} it revokes: revocation outranks addition`);
+  });
+}
+
+/**
+ * FAC-SEM-110 (DEC-0082): a grant to a principal outside the estate (`principalKind: external`) is used in that
+ * principal's organization, so its `context` is never `personal`; absent means not stated.
+ */
+export function grantContextFindings(grant, at) {
+  if (!isObject(grant) || grant.principalKind !== 'external' || grant.context !== PERSONAL_CONTEXT) return [];
+  return [{ code: 'FAC-SEM-110', instancePath: `${at}/context`, message: "a grant to a principal outside the estate is used in that principal's organization, never in the personal context: name the organization's org:<orgId>, or leave context out" }];
+}
+
+/**
+ * FAC-SEM-111 (DEC-0082) for one placement: an instance in an organization's context names, in `grant`, a share grant
+ * of the same record (by the normal form of its id, DEC-0076) whose `context` is the placement's, as written, and that
+ * the record does not revoke; a personal instance names none; a malformed context fails closed.
+ */
+function placementGrantProblems(record, placement) {
+  const context = contextOf(placement);
+  if (context === PERSONAL_CONTEXT) {
+    return placement.grant === undefined ? [] : [['/grant', "a personal instance runs under no share grant: only a placement in an organization's context names one"]];
+  }
+  if (typeof placement.grant !== 'string') return [['/grant', `an instance placed in the context ${show(context)} names the share grant it runs under, by its id`]];
+  const id = normalIdentifier(placement.grant);
+  const grants = list(record.shareGrants).filter((grant) => isObject(grant.meta) && typeof grant.meta.id === 'string' && normalIdentifier(grant.meta.id) === id);
+  const problems = [];
+  if (grants.length === 0) problems.push(['/grant', `the record has no share grant ${placement.grant}`]);
+  else if (parseContext(context)?.kind !== 'org') problems.push(['/context', `${show(context)} is not an organization's context id (org:<orgId>), so no share grant matches it`]);
+  else if (!grants.some((grant) => grant.context === context)) problems.push(['/grant', `the share grant ${placement.grant} is not for the context ${show(context)}: its context must be the placement's, as written`]);
+  if (list(record.revocations).some((entry) => entry.kind === 'grant' && typeof entry.ref === 'string' && normalIdentifier(entry.ref) === id)) problems.push(['/grant', `the record revokes the share grant ${placement.grant}, so no instance runs under it`]);
+  return problems;
+}
+
+function placementGrants(value, flag) {
+  indexed(value.machines).forEach(([machine, m]) => {
+    indexed(machine.packages).forEach(([placement, p]) => {
+      for (const [suffix, message] of placementGrantProblems(value, placement)) flag(`/machines/${m}/packages/${p}${suffix}`, message);
+    });
   });
 }
 
@@ -466,8 +546,10 @@ function recordFindings(value) {
   placements(value, flagger(findings, 'FAC-SEM-074'));
   secretReferences(value, flagger(findings, 'FAC-SEM-075'));
   grantsAndRevocations(value, flagger(findings, 'FAC-SEM-076'));
+  indexed(value.shareGrants).forEach(([grant, index]) => findings.push(...grantContextFindings(grant, `/shareGrants/${index}`)));
+  placementGrants(value, flagger(findings, 'FAC-SEM-111'));
   // FAC-SEM-092 (DEC-0063) on each passkey the record lists.
-  list(value.authorities).forEach((authority, index) => signingCredential(authority, `/authorities/${index}`, flagger(findings, 'FAC-SEM-092')));
+  indexed(value.authorities).forEach(([authority, index]) => signingCredential(authority, `/authorities/${index}`, flagger(findings, 'FAC-SEM-092')));
   return findings;
 }
 
@@ -480,8 +562,7 @@ function installation(value) {
   const findings = [];
   const record = isObject(value.record) ? value.record : {};
   const pkg = isObject(value.package) ? value.package : {};
-  const machineIndex = list(record.machines).findIndex((entry) => entry.id === value.machine);
-  const machine = list(record.machines)[machineIndex];
+  const [machine, machineIndex] = indexed(record.machines).find(([entry]) => entry.id === value.machine) ?? [undefined, -1];
   let digest;
   try {
     digest = packageDigest(pkg);
@@ -490,18 +571,23 @@ function installation(value) {
   }
   const flag074 = flagger(findings, 'FAC-SEM-074');
   if (!machine) {
-    flag074('/machine', `machine ${String(value.machine)} is not in the estate record`);
+    flag074('/machine', `machine ${show(value.machine)} is not in the estate record`);
     return findings;
   }
   if (digest === undefined || digest !== pkg.digest) flag074('/package/digest', 'the package is not the one its digest names: it changed after it was packed');
-  const placement = list(machine.packages).find((entry) => entry.agentRef === pkg.agentRef);
-  if (!placement) flag074('/package/agentRef', `the record places no ${String(pkg.agentRef)} on machine ${String(value.machine)}`);
-  else if (placement.digest !== digest) flag074('/package', `the record places ${String(placement.digest)} of this agent on this machine, not this package`);
+  const context = contextOf(value);
+  const [placement, placementIndex] = indexed(machine.packages).find(([entry]) => entry.agentRef === pkg.agentRef && contextOf(entry) === context) ?? [undefined, -1];
+  if (!placement) flag074('/package/agentRef', `the record places no ${show(pkg.agentRef)} on machine ${show(value.machine)} in the context ${show(context)}`);
+  else if (placement.digest !== digest) flag074('/package', `the record places ${show(placement.digest)} of this agent on this machine in this context, not this package`);
   const declared = new Set(list(pkg.secrets).map((slot) => slot.name));
   const flag075 = flagger(findings, 'FAC-SEM-075');
-  list(machine.secrets).forEach((secret, index) => {
-    if (secret.agentRef === pkg.agentRef && !declared.has(secret.slot)) flag075(`/record/machines/${machineIndex}/secrets/${index}/slot`, `the package declares no slot ${String(secret.slot)}: a secret goes only where a placed package declares it`);
+  indexed(machine.secrets).forEach(([secret, index]) => {
+    if (secret.agentRef === pkg.agentRef && contextOf(secret) === context && !declared.has(secret.slot)) flag075(`/record/machines/${machineIndex}/secrets/${index}/slot`, `the package declares no slot ${show(secret.slot)}: a secret goes only where a placed package declares it`);
   });
+  if (placement) {
+    const flag111 = flagger(findings, 'FAC-SEM-111');
+    for (const [suffix, message] of placementGrantProblems(record, placement)) flag111(`/record/machines/${machineIndex}/packages/${placementIndex}${suffix}`, message);
+  }
   return findings;
 }
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-profiles.mjs

@@ -21,6 +21,21 @@ export class ProfileError extends Error {}
 const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 const list = (value) => (Array.isArray(value) ? value.filter(isObject) : []);
 const strings = (value) => (Array.isArray(value) ? value.filter((item) => typeof item === 'string') : []);
+/** The object items of an array with their index as written, so an instancePath names the item even after a non-object. */
+const indexed = (value) => (Array.isArray(value) ? value.flatMap((item, index) => (isObject(item) ? [[item, index]] : [])) : []);
+/** DEC-0083: the model class of a model whose vendor publishes its weights openly — descriptive: a policy admits and
+ * excludes nothing by it — and what a lane reads when it reads what a member, a client or the public sends. */
+export const OPEN_VENDOR = 'open-vendor';
+export const USER_CONTENT = 'user-content';
+/** The contract's `show`: String(value), or its JSON where String() throws (an object whose own `toString` is data). */
+const show = (value) => {
+  if (typeof value === 'string') return value;
+  try {
+    return String(value);
+  } catch {
+    return JSON.stringify(value) ?? typeof value;
+  }
+};
 const jsonEqual = (a, b) => JSON.stringify(sortKeys(a)) === JSON.stringify(sortKeys(b));
 function sortKeys(value) {
   if (Array.isArray(value)) return value.map(sortKeys);
@@ -39,7 +54,12 @@ export function resolveModelProfile({ catalogue, profiles, choices = {}, policy
   if (!isObject(policy) || !Array.isArray(policy.modelClasses)) return { from: level, profile: id, models };
   const allowed = new Set(strings(policy.modelClasses));
   const rows = new Map(list(isObject(catalogue) ? catalogue.models : undefined).map((row) => [row.id, row]));
-  const within = models.filter((model) => { const row = rows.get(model); return row !== undefined && strings(row.classes).every((name) => allowed.has(name)); });
+  // The descriptive class open-vendor is not checked (DEC-0083), and a model with no other class does not stay.
+  const within = models.filter((model) => {
+    const row = rows.get(model);
+    const admission = row === undefined ? [] : strings(row.classes).filter((name) => name !== OPEN_VENDOR);
+    return admission.length > 0 && admission.every((name) => allowed.has(name));
+  });
   if (within.length) return { from: level, profile: id, models: within };
   const meta = isObject(policy.meta) ? policy.meta : {};
   return { refused: 'model-classes-empty', profile: id, policy: { id: String(meta.id), revision: Number(meta.revision) } };
@@ -50,13 +70,13 @@ const finding = (code, instancePath, message) => ({ code, instancePath, message
 function modelCatalogue(value) {
   const findings = [];
   const seen = new Set();
-  list(value.models).forEach((row, index) => {
-    if (seen.has(row.id)) findings.push(finding('FAC-SEM-058', `/models/${index}/id`, `model ${String(row.id)} is catalogued more than once`));
+  indexed(value.models).forEach(([row, index]) => {
+    if (seen.has(row.id)) findings.push(finding('FAC-SEM-058', `/models/${index}/id`, `model ${show(row.id)} is catalogued more than once`));
     seen.add(row.id);
     const routing = isObject(row.provider) ? row.provider : {};
     const ignored = new Set(strings(routing.ignore));
     for (const slug of strings(routing.order)) {
-      if (ignored.has(slug) || ignored.has(slug.split('/')[0])) findings.push(finding('FAC-SEM-058', `/models/${index}/provider`, `model ${String(row.id)} both orders and ignores provider ${slug}`));
+      if (ignored.has(slug) || ignored.has(slug.split('/')[0])) findings.push(finding('FAC-SEM-058', `/models/${index}/provider`, `model ${show(row.id)} both orders and ignores provider ${slug}`));
     }
   });
   return findings;
@@ -65,8 +85,8 @@ function modelCatalogue(value) {
 function modelProfiles(value) {
   const findings = [];
   const seen = new Set();
-  list(value.profiles).forEach((profile, index) => {
-    if (seen.has(profile.id)) findings.push(finding('FAC-SEM-058', `/profiles/${index}/id`, `model profile ${String(profile.id)} is declared more than once`));
+  indexed(value.profiles).forEach(([profile, index]) => {
+    if (seen.has(profile.id)) findings.push(finding('FAC-SEM-058', `/profiles/${index}/id`, `model profile ${show(profile.id)} is declared more than once`));
     seen.add(profile.id);
   });
   return findings;
@@ -90,11 +110,11 @@ function profileResolution(value) {
   const findings = [];
   const catalogued = new Set(list(isObject(value.catalogue) ? value.catalogue.models : undefined).map((row) => row.id));
   const ids = new Set();
-  list(value.profiles).forEach((profile, i) => {
-    if (ids.has(profile.id)) findings.push(finding('FAC-SEM-060', `/profiles/${i}/id`, `profile id ${String(profile.id)} is offered more than once to one resolution`));
+  indexed(value.profiles).forEach(([profile, i]) => {
+    if (ids.has(profile.id)) findings.push(finding('FAC-SEM-060', `/profiles/${i}/id`, `profile id ${show(profile.id)} is offered more than once to one resolution`));
     ids.add(profile.id);
-    strings(profile.models).forEach((model, j) => {
-      if (!catalogued.has(model)) findings.push(finding('FAC-SEM-060', `/profiles/${i}/models/${j}`, `profile ${String(profile.id)} names ${model}, which the catalogue does not hold`));
+    (Array.isArray(profile.models) ? profile.models : []).forEach((model, j) => {
+      if (typeof model === 'string' && !catalogued.has(model)) findings.push(finding('FAC-SEM-060', `/profiles/${i}/models/${j}`, `profile ${show(profile.id)} names ${model}, which the catalogue does not hold`));
     });
   });
   const choices = isObject(value.choices) ? value.choices : {};
@@ -103,9 +123,51 @@ function profileResolution(value) {
   return findings;
 }
 
+/**
+ * FAC-SEM-112 (DEC-0083) for one profile: the models that run when the lane reads user content and none of them is an
+ * open-vendor model, or undefined when the profile does not read user content or its route has one. Under
+ * `between-turns` every model may run; under `none`, or any other value (failing closed), only the first. A model the
+ * catalogue does not hold, or whose row is not `open-vendor`, counts as closed. Never throws.
+ */
+export function closedUserContentRoute(profile, catalogue) {
+  if (!isObject(profile) || !strings(profile.reads).includes(USER_CONTENT)) return undefined;
+  const models = Array.isArray(profile.models) ? profile.models : [];
+  const route = profile.fallback === 'between-turns' ? models : models.slice(0, 1);
+  const open = new Set();
+  for (const row of list(isObject(catalogue) ? catalogue.models : undefined)) {
+    if (typeof row.id === 'string' && strings(row.classes).includes(OPEN_VENDOR)) open.add(row.id);
+  }
+  if (route.some((model) => typeof model === 'string' && open.has(model))) return undefined;
+  return route.map((model) => show(model));
+}
+
+/** FAC-SEM-112: a profile that reads user content has an open-vendor route, so the lane never runs on closed vendors alone. */
+const closedRoute = (fallback, closed) => (fallback === 'between-turns' ? 'none of its models is' : `its first model, ${closed[0] ?? 'none'}, is not`);
+
+/** FAC-SEM-112 on the profiles and on the resolution's outcome: the models the policy leaves keep an open-vendor route. */
+function openVendorRoutes(value) {
+  const findings = [];
+  const profiles = list(value.profiles);
+  indexed(value.profiles).forEach(([profile, i]) => {
+    const closed = closedUserContentRoute(profile, value.catalogue);
+    if (closed === undefined) return;
+    findings.push(finding('FAC-SEM-112', `/profiles/${i}/models`, `profile ${show(profile.id)} reads user content, but ${closedRoute(profile.fallback, closed)} open-vendor in the catalogue: the lane would run on closed vendors alone`));
+  });
+  const choices = isObject(value.choices) ? value.choices : {};
+  const outcome = resolveModelProfile({ catalogue: value.catalogue, profiles: value.profiles, choices, policy: value.policy });
+  if (!('models' in outcome)) return findings;
+  const profile = profiles.find((item) => item.id === outcome.profile);
+  if (!profile || closedUserContentRoute(profile, value.catalogue) !== undefined) return findings;
+  const closed = closedUserContentRoute({ ...profile, models: outcome.models }, value.catalogue);
+  if (closed === undefined) return findings;
+  const meta = isObject(value.policy) && isObject(value.policy.meta) ? value.policy.meta : {};
+  findings.push(finding('FAC-SEM-112', '/resolved/models', `the policy ${show(meta.id)} leaves profile ${show(profile.id)}'s lane on closed vendors alone: of the models it admits, ${closedRoute(profile.fallback, closed)} open-vendor in the catalogue`));
+  return findings;
+}
+
 /** The contract's profileRules: findings for a model-catalogue, model-profiles, runner-profile or profile-resolution; else undefined. */
 export function profileProblems(kind, value) {
-  return { 'model-catalogue': modelCatalogue, 'model-profiles': modelProfiles, 'runner-profile': runnerProfile, 'profile-resolution': profileResolution }[kind]?.(value);
+  return { 'model-catalogue': modelCatalogue, 'model-profiles': modelProfiles, 'runner-profile': runnerProfile, 'profile-resolution': (v) => [...profileResolution(v), ...openVendorRoutes(v)] }[kind]?.(value);
 }
 
 // ---- the doctor's checks ----
@@ -173,7 +235,10 @@ export function modelUsable(model, catalogue, policy) {
   if (!rows.has(model)) return [`model ${model} is not in the model catalogue`];
   if (isObject(policy) && Array.isArray(policy.modelClasses)) {
     const allowed = new Set(strings(policy.modelClasses));
-    const outside = strings(rows.get(model).classes).filter((c) => !allowed.has(c));
+    const admission = strings(rows.get(model).classes).filter((c) => c !== OPEN_VENDOR);
+    const policyId = String((isObject(policy.meta) ? policy.meta : {}).id);
+    if (!admission.length) return [`model ${model} has no class but ${OPEN_VENDOR}, which admits nothing, so policy ${policyId} does not allow it`];
+    const outside = admission.filter((c) => !allowed.has(c));
     if (outside.length) return [`model ${model} has class ${outside.join(', ')}, which policy ${String((isObject(policy.meta) ? policy.meta : {}).id)} does not allow`];
   }
   return [];