@passioncode-ai/fabric-agent-adapter 0.34.0 → 0.35.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 0.35.0 - 2026-10-16
+
+### Fixed
+
+- Codex SessionStart emits explicit JSON. Its preamble began with `[fabric-agent-adapter]`, which Codex treats as JSON-looking output and rejected with `hook returned invalid session start JSON output`.
+- The Codex hook installer updates a stale owned command while preserving its matcher, timeout and unrelated hooks; ambiguous duplicate entries are refused.
+
+### Added
+
+- Native bounded context adapters for Hermes prompt sections, OpenCode system transforms, OpenClaw `before_prompt_build`, and Pi `before_agent_start`; no model calls or lifecycle enrollment from these hooks.
+- Dry-run native installers with source preflight, config hash fences, managed-file checks and preservation of unrelated settings and explicit OpenClaw denials. Hermes opt-in uses its own CLI.
+- Optional native loader probes, negative permission and timeout tests, and a sourced capability survey of all 30 Switchboard hosts plus Tabby. Native context loading is separate from live Fabric admission.
+
+## 0.34.1 - 2026-10-15
+
+A review of 0.33.0 and 0.34.0 found the profile and route rules disagreeing with the contract on JSON they never met in
+its vectors. The kits now answer as the contract's TypeScript does on any input. The contract pin is unchanged
+(`d8146cf`).
+
+### Fixed
+
+- **FAC-SEM-059 (`runner-profile`) compared loosely.** Python read a missing member and `null` as the same and `1`
+  and `true` as equal: an unknown login with `runnerKind: null`, or an allow-list `true` against a profile `1`, passed.
+  Node threw on a login or runner kind whose own `toString` member is data. Both now compare with `===`, show such a
+  value as its JSON, and read only the vendor table's own members.
+- **FAC-SEM-060 compared a recorded resolution loosely.** Python's `!=` called `1` and `true` equal; Node's
+  `JSON.stringify` comparison called `NaN` and `null` equal. Both now use the contract's `jsonEqual`, where NaN equals
+  nothing.
+- **A refusal (`model-classes-empty`) named its policy wrongly on hostile input.** Node threw on an id or revision
+  whose own `toString` is data; Python wrote `[object Object]`, read `null` as `undefined`, and did not read a revision
+  as `Number()` does (`"0x10"`, `[5]`, `null`). Both now use the contract's `show` and `toNumber`; a revision that is
+  not a number is written as null.
+- **Route rules (FAC-SEM-028…034) threw or misread hostile JSON.** Node used `String()` where the contract uses `show`;
+  Python wrote `[object Object]`, and compared a probe's runner kind and a drive with `!=` (`1` equal to `true`).
+- **The doctor's `model_usable` raised on a catalogue row whose id is an object** (Python), and threw on a policy id
+  whose own `toString` is data (Node).
+- **Python wrote and compared JSON values unlike JavaScript** (found by an independent review of this fix):
+  - a lone surrogate (`"\ud800"`, valid JSON) raised `TypeError` wherever a message wrote a value, because
+    `_json_stringify` used the RFC 8785 writer that refuses one; it now escapes it as `JSON.stringify` does;
+  - members whose keys are array indexes came out in the order written, where JavaScript writes them first and
+    ascending, so two equal hostile runner kinds were not a FAC-SEM-028 duplicate;
+  - integers past 2**53 compared exactly, where JavaScript compares doubles (`9007199254740993` is
+    `9007199254740992`), and integers past the double range raised `OverflowError` where JavaScript reads Infinity;
+  - a probe index was written as an exact integer instead of JavaScript's number (`1e+21`).
+  These helpers are shared with the estate and identifier kits, whose vectors stay green.
+- **Node looked a rule kind up on inherited members**: `routeProblems("__proto__", …)` threw and `"constructor"`
+  answered the value; both now answer `undefined`, as the contract does.
+- **The task board broke the workspace's publication**: rows FAA-28 and FAA-27a split into six cells (an escaped
+  `\|`, and a fragment a 0.31.0 edit left behind). Both are fixed, and `test/validate.py` now refuses any board row that
+  does not split into the header's columns.
+
+### Evidence
+
+- 38 new profile cases and 21 new route cases (`make_profile_vectors.mjs`, `make_route_vectors.mjs`), each answered by
+  the contract's own rules; cases JavaScript cannot carry as an object (big integers, key order) keep their JSON text.
+  Against 0.34.0's kits the first 44 of them fail 27 Python subtests and two Node tests.
+- The reviewer's side-by-side comparison of the contract, the Node kit and the Python kit on 17 hostile inputs: 17 of
+  17 identical after the fix (Python 1 of 17 before).
+- Unit tests for the doctor and the rule dispatch on hostile input, in both kits; `BoardRowTests` for the board check.
+- Planted defects in the new code, all caught; two were redundant code, now removed.
+
 ## 0.34.0 - 2026-10-15
 
 The adapter is pinned at contract `d8146cf`. The profile kits now read what a lane reads (DEC-0083; FAA-45, contract

package/README.md

@@ -40,7 +40,10 @@ and the board's unread count; UserPromptSubmit adds one line only when that coun
 session left claimed. Stop, UserPromptSubmit and SessionEnd act only when the running Fabric advertises
 `session-hooks/1`. All are silent in a session Fabric launched, never block the session, read no token and always
 exit 0. `fabric_session.py watch-mail` waits for board mail under a background watcher, and `install-host-hooks
---host codex|kimi` adds the session-start preamble to Codex or Kimi Code (a dry run unless `--apply`). The
+--host codex|kimi|hermes|opencode|openclaw|pi` installs each host's native context bridge (dry run unless `--apply`).
+Codex receives structured SessionStart JSON; Hermes, OpenCode, OpenClaw and Pi use native plugin APIs.
+See the [native host matrix](plugins/fabric-agent-adapter/skills/working-with-fabric/references/native-host-hooks.md)
+for activation, reload and verification limits. The
 [hooks reference](plugins/fabric-agent-adapter/skills/working-with-fabric/references/session-hooks.md) lists what
 they need from Fabric; the [board reference](plugins/fabric-agent-adapter/skills/working-with-fabric/references/project-board.md)
 is the board-first workflow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.34.0"
+  version: "0.35.0"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_identifiers.py

@@ -163,12 +163,19 @@ def normal_identifier(value: Any) -> Optional[str]:
     return _urn_form(authority, path, query) if scheme.lower() == "urn" else _generic_form(scheme, authority, path, query, fragment)
 
 
+def _double(value: Any) -> float:
+    try:
+        return float(value)
+    except OverflowError:
+        return float("inf") if value > 0 else float("-inf")
+
+
 def _strict_equal(a: Any, b: Any) -> bool:
     """JavaScript's === on parsed JSON: numbers by value, booleans only with booleans, objects by identity."""
     if isinstance(a, bool) or isinstance(b, bool):
         return isinstance(a, bool) and isinstance(b, bool) and a == b
     if isinstance(a, (int, float)) and isinstance(b, (int, float)):
-        return a == b
+        return _double(a) == _double(b)  # as JavaScript holds them: 2**53 + 1 is 2**53
     if isinstance(a, (dict, list)) or isinstance(b, (dict, list)):
         return a is b
     return type(a) is type(b) and a == b

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -18,7 +18,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.34.0"
+  version: "0.35.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/profiles.md

@@ -39,7 +39,9 @@ and name the policy; never fall back to a model outside it. No level at all is `
 (a model catalogued once; a provider never both ordered and ignored, a base slug covering its variants), a
 `model-profiles` set (an id once), a `runner-profile` (a subscription only in its vendor's runner — Claude in Claude
 Code, Kimi in Kimi Code, ChatGPT in Codex; a key route's allow-list is its own model profile; a key named by reference,
-never by value) and a recorded `profile-resolution` (it equals the order's answer).
+never by value) and a recorded `profile-resolution` (it equals the order's answer). Every rule compares as the contract
+does — `===` (`1` and `true` differ, `null` is not absent) and its `jsonEqual` for a recorded resolution, where NaN
+equals nothing — and never raises on hostile JSON: a value whose own `toString` member is data is shown as its JSON.
 
 ## A lane that reads user content
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-profiles.mjs

@@ -36,12 +36,25 @@ const show = (value) => {
     return JSON.stringify(value) ?? typeof value;
   }
 };
-const jsonEqual = (a, b) => JSON.stringify(sortKeys(a)) === JSON.stringify(sortKeys(b));
-function sortKeys(value) {
-  if (Array.isArray(value)) return value.map(sortKeys);
-  if (isObject(value)) return Object.fromEntries(Object.keys(value).sort().map((k) => [k, sortKeys(value[k])]));
-  return value;
+/** The contract's jsonEqual: arrays by item, objects by own member whatever the order, anything else by ===, so 1 and
+ * true differ and NaN equals nothing (a JSON.stringify comparison would call NaN and null equal). */
+function jsonEqual(a, b) {
+  if (Array.isArray(a) || Array.isArray(b)) return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((item, i) => jsonEqual(item, b[i]));
+  if (isObject(a) || isObject(b)) {
+    if (!isObject(a) || !isObject(b)) return false;
+    const keys = Object.keys(a);
+    return keys.length === Object.keys(b).length && keys.every((key) => Object.hasOwn(b, key) && jsonEqual(a[key], b[key]));
+  }
+  return a === b;
 }
+/** The contract's toNumber: Number(value), or NaN where Number() throws (an object whose own toString is data). */
+const toNumber = (value) => {
+  try {
+    return Number(value);
+  } catch {
+    return Number.NaN;
+  }
+};
 
 /** FAC-SEM-060: the request's profile, else the agent's, else the binding's or project's, else the estate default. */
 export function resolveModelProfile({ catalogue, profiles, choices = {}, policy } = {}) {
@@ -62,7 +75,7 @@ export function resolveModelProfile({ catalogue, profiles, choices = {}, policy
   });
   if (within.length) return { from: level, profile: id, models: within };
   const meta = isObject(policy.meta) ? policy.meta : {};
-  return { refused: 'model-classes-empty', profile: id, policy: { id: String(meta.id), revision: Number(meta.revision) } };
+  return { refused: 'model-classes-empty', profile: id, policy: { id: show(meta.id), revision: toNumber(meta.revision) } };
 }
 
 const finding = (code, instancePath, message) => ({ code, instancePath, message });
@@ -95,12 +108,12 @@ function modelProfiles(value) {
 function runnerProfile(value) {
   const findings = [];
   if (value.route === 'subscription' && isObject(value.subscription)) {
-    const login = String(value.subscription.login);
+    const login = show(value.subscription.login);
     const runner = Object.hasOwn(SUBSCRIPTION_RUNNER, login) ? SUBSCRIPTION_RUNNER[login] : undefined;
-    if (runner !== value.runnerKind) findings.push(finding('FAC-SEM-059', '/runnerKind', `a ${login} subscription runs only in ${runner ?? "its vendor's runner"}, not in ${String(value.runnerKind)}; another runner takes the key route`));
+    if (runner !== value.runnerKind) findings.push(finding('FAC-SEM-059', '/runnerKind', `a ${login} subscription runs only in ${runner ?? "its vendor's runner"}, not in ${show(value.runnerKind)}; another runner takes the key route`));
   }
   if (value.route === 'key' && isObject(value.key)) {
-    if (value.key.modelAllowList !== value.modelProfile) findings.push(finding('FAC-SEM-059', '/key/modelAllowList', `the key admits the models of ${String(value.key.modelAllowList)}, but the profile runs ${String(value.modelProfile)}`));
+    if (value.key.modelAllowList !== value.modelProfile) findings.push(finding('FAC-SEM-059', '/key/modelAllowList', `the key admits the models of ${show(value.key.modelAllowList)}, but the profile runs ${show(value.modelProfile)}`));
     if (typeof value.key.ref === 'string' && secretValue(value.key.ref)) findings.push(finding('FAC-SEM-059', '/key/ref', 'the key is named by its secret reference, never by its value'));
   }
   return findings;
@@ -167,7 +180,9 @@ function openVendorRoutes(value) {
 
 /** The contract's profileRules: findings for a model-catalogue, model-profiles, runner-profile or profile-resolution; else undefined. */
 export function profileProblems(kind, value) {
-  return { 'model-catalogue': modelCatalogue, 'model-profiles': modelProfiles, 'runner-profile': runnerProfile, 'profile-resolution': (v) => [...profileResolution(v), ...openVendorRoutes(v)] }[kind]?.(value);
+  const table = { 'model-catalogue': modelCatalogue, 'model-profiles': modelProfiles, 'runner-profile': runnerProfile, 'profile-resolution': (v) => [...profileResolution(v), ...openVendorRoutes(v)] };
+  // Own members only: a kind such as `constructor` or `__proto__` names no rule.
+  return typeof kind === 'string' && Object.hasOwn(table, kind) ? table[kind](value) : undefined;
 }
 
 // ---- the doctor's checks ----
@@ -231,15 +246,16 @@ export function runnerCheck(entry, { searchPath = process.env.PATH, run = spawnS
 
 /** Problems with running `model` here: not in the catalogue, or a class the project's policy does not allow. */
 export function modelUsable(model, catalogue, policy) {
+  // The last row of an id wins, as the Map the resolver builds; a model that is not a string matches no row.
   const rows = new Map(list(isObject(catalogue) ? catalogue.models : undefined).map((row) => [row.id, row]));
-  if (!rows.has(model)) return [`model ${model} is not in the model catalogue`];
+  if (typeof model !== 'string' || !rows.has(model)) return [`model ${show(model)} is not in the model catalogue`];
   if (isObject(policy) && Array.isArray(policy.modelClasses)) {
     const allowed = new Set(strings(policy.modelClasses));
+    const policyId = show((isObject(policy.meta) ? policy.meta : {}).id);
     const admission = strings(rows.get(model).classes).filter((c) => c !== OPEN_VENDOR);
-    const policyId = String((isObject(policy.meta) ? policy.meta : {}).id);
     if (!admission.length) return [`model ${model} has no class but ${OPEN_VENDOR}, which admits nothing, so policy ${policyId} does not allow it`];
     const outside = admission.filter((c) => !allowed.has(c));
-    if (outside.length) return [`model ${model} has class ${outside.join(', ')}, which policy ${String((isObject(policy.meta) ? policy.meta : {}).id)} does not allow`];
+    if (outside.length) return [`model ${model} has class ${outside.join(', ')}, which policy ${policyId} does not allow`];
   }
   return [];
 }
@@ -277,14 +293,14 @@ export const PROBE_RESULTS = Object.freeze(['not-catalogued', 'not-admitted', 'n
 const routeCandidates = (value) => (Array.isArray(value?.candidates) ? value.candidates.filter(isObject) : []);
 const objectAt = (value, key) => (isObject(value?.[key]) ? value[key] : {});
 // A revision reference compared whole; its id is an identifier, so it enters the key in its normal form (DEC-0076).
-const refKey = (ref) => (isObject(ref) ? `${String(normalIdentifier(ref.id) ?? ref.id)}@${String(ref.revision)}#${String(ref.contentHash)}` : '');
+const refKey = (ref) => (isObject(ref) ? `${show(normalIdentifier(ref.id) ?? ref.id)}@${show(ref.revision)}#${show(ref.contentHash)}` : '');
 const sameRef = (a, b) => refKey(a) !== '' && refKey(a) === refKey(b);
 
 function runnerRoute(value) {
   const findings = [];
   const kinds = new Set();
   routeCandidates(value).forEach((candidate, index) => {
-    const kind = String(candidate.runnerKind);
+    const kind = show(candidate.runnerKind);
     if (kinds.has(kind)) findings.push(finding('FAC-SEM-028', `/candidates/${index}/runnerKind`, `runner kind ${kind} appears in the route more than once`));
     kinds.add(kind);
     const session = objectAt(candidate, 'session');
@@ -300,25 +316,25 @@ function routeBundle(value) {
   const findings = [];
   routeCandidates(route).forEach((candidate, index) => {
     const key = refKey(candidate.provider);
-    if (!admitted.has(key)) findings.push(finding('FAC-SEM-030', `/route/candidates/${index}/provider`, `candidate ${String(candidate.runnerKind)} names provider ${key}, which is not a revision admitted for ${String(route.capability)}`));
+    if (!admitted.has(key)) findings.push(finding('FAC-SEM-030', `/route/candidates/${index}/provider`, `candidate ${show(candidate.runnerKind)} names provider ${key}, which is not a revision admitted for ${show(route.capability)}`));
   });
   if (isObject(value.binding)) {
     const binding = value.binding;
     const disagree = (where, message) => findings.push(finding('FAC-SEM-032', `/binding/${where}`, message));
     // DEC-0076: project and capability are identifiers, compared by normal form.
-    if (!sameIdentifier(binding.project, route.project)) disagree('project', `the binding is for ${String(binding.project)}, the route for ${String(route.project)}`);
-    if (!sameIdentifier(binding.capability, route.capability)) disagree('capability', `the binding binds ${String(binding.capability)}, the route orders ${String(route.capability)}`);
-    if (binding.profileKind !== 'local-runner') disagree('profileKind', `a runner route serves the local-runner profile, not ${String(binding.profileKind)}`);
+    if (!sameIdentifier(binding.project, route.project)) disagree('project', `the binding is for ${show(binding.project)}, the route for ${show(route.project)}`);
+    if (!sameIdentifier(binding.capability, route.capability)) disagree('capability', `the binding binds ${show(binding.capability)}, the route orders ${show(route.capability)}`);
+    if (binding.profileKind !== 'local-runner') disagree('profileKind', `a runner route serves the local-runner profile, not ${show(binding.profileKind)}`);
     if (!routeCandidates(route).some((c) => sameRef(c.provider, binding.provider))) disagree('provider', `the binding's provider ${refKey(binding.provider)} is not a candidate of the route`);
     if (binding.runnerRoute !== undefined && !sameRef(binding.runnerRoute, route.meta)) disagree('runnerRoute', `the binding pins ${refKey(binding.runnerRoute)}, not this route ${refKey(route.meta)}`);
   }
   if (Array.isArray(value.catalogue)) {
-    const byKind = new Map(value.catalogue.filter(isObject).map((entry) => [String(entry.kind), entry]));
+    const byKind = new Map(value.catalogue.filter(isObject).map((entry) => [show(entry.kind), entry]));
     routeCandidates(route).forEach((candidate, index) => {
-      const kind = String(candidate.runnerKind);
+      const kind = show(candidate.runnerKind);
       const entry = byKind.get(kind);
       if (!entry) { findings.push(finding('FAC-SEM-033', `/route/candidates/${index}/runnerKind`, `runner kind ${kind} has no entry in the host's catalogue`)); return; }
-      if (candidate.drive !== undefined && !Object.hasOwn(objectAt(entry, 'drives'), String(candidate.drive))) findings.push(finding('FAC-SEM-033', `/route/candidates/${index}/drive`, `the catalogue entry for ${kind} offers no drive ${String(candidate.drive)}`));
+      if (candidate.drive !== undefined && !Object.hasOwn(objectAt(entry, 'drives'), show(candidate.drive))) findings.push(finding('FAC-SEM-033', `/route/candidates/${index}/drive`, `the catalogue entry for ${kind} offers no drive ${show(candidate.drive)}`));
     });
   }
   return findings;
@@ -331,14 +347,14 @@ function routeEvent(value) {
   const findings = [];
   const wrong = (where, message) => findings.push(finding('FAC-SEM-034', `/event${where}`, message));
   if (!sameRef(event.route, route.meta)) wrong('/route', `the event names route ${refKey(event.route)}, not ${refKey(route.meta)}`);
-  if (!sameIdentifier(event.project, route.project)) wrong('/project', `the event is for ${String(event.project)}, the route for ${String(route.project)}`);
-  if (!sameIdentifier(event.capability, route.capability)) wrong('/capability', `the event names ${String(event.capability)}, the route orders ${String(route.capability)}`);
+  if (!sameIdentifier(event.project, route.project)) wrong('/project', `the event is for ${show(event.project)}, the route for ${show(route.project)}`);
+  if (!sameIdentifier(event.capability, route.capability)) wrong('/capability', `the event names ${show(event.capability)}, the route orders ${show(route.capability)}`);
   const indexOf = (ref) => (typeof ref.index === 'number' && Number.isInteger(ref.index) ? ref.index : -1);
   const candidateAt = (ref, where) => {
     const index = indexOf(ref);
     const candidate = index >= 0 ? list[index] : undefined;
     if (!candidate || candidate.runnerKind !== ref.runnerKind || (ref.provider !== undefined && !sameRef(candidate.provider, ref.provider))) {
-      wrong(where, `candidate ${String(ref.index)} (${String(ref.runnerKind)}) is not that position of the route`);
+      wrong(where, `candidate ${show(ref.index)} (${show(ref.runnerKind)}) is not that position of the route`);
       return undefined;
     }
     return candidate;
@@ -346,8 +362,8 @@ function routeEvent(value) {
   const probes = Array.isArray(event.probes) ? event.probes.filter(isObject) : [];
   probes.forEach((probe, position) => {
     const candidate = candidateAt(probe, `/probes/${position}`);
-    if (candidate && probe.result === 'no-held-session' && objectAt(candidate, 'session').spawn !== 'never') wrong(`/probes/${position}/result`, `${String(probe.runnerKind)} may spawn, so finding no held session does not pass it over`);
-    if (candidate && probe.result === 'spawn-failed' && objectAt(candidate, 'session').spawn !== 'allowed') wrong(`/probes/${position}/result`, `${String(probe.runnerKind)} has spawn: never, so it cannot have failed to spawn`);
+    if (candidate && probe.result === 'no-held-session' && objectAt(candidate, 'session').spawn !== 'never') wrong(`/probes/${position}/result`, `${show(probe.runnerKind)} may spawn, so finding no held session does not pass it over`);
+    if (candidate && probe.result === 'spawn-failed' && objectAt(candidate, 'session').spawn !== 'allowed') wrong(`/probes/${position}/result`, `${show(probe.runnerKind)} has spawn: never, so it cannot have failed to spawn`);
   });
   const expectProbes = (count) => {
     const indexes = probes.map(indexOf);
@@ -365,9 +381,9 @@ function routeEvent(value) {
   const chosen = candidateAt(selected, '/selected');
   if (chosen) {
     const session = objectAt(chosen, 'session');
-    if (selected.session === 'attached' && session.attach !== 'preferred') wrong('/selected/session', `${String(selected.runnerKind)} has attach: never, so the host cannot attach it`);
-    if (selected.session === 'spawned' && session.spawn !== 'allowed') wrong('/selected/session', `${String(selected.runnerKind)} has spawn: never, so the host cannot spawn it`);
-    if (chosen.drive !== undefined && selected.drive !== undefined && selected.drive !== chosen.drive) wrong('/selected/drive', `the route runs ${String(selected.runnerKind)} through ${String(chosen.drive)}, not ${String(selected.drive)}`);
+    if (selected.session === 'attached' && session.attach !== 'preferred') wrong('/selected/session', `${show(selected.runnerKind)} has attach: never, so the host cannot attach it`);
+    if (selected.session === 'spawned' && session.spawn !== 'allowed') wrong('/selected/session', `${show(selected.runnerKind)} has spawn: never, so the host cannot spawn it`);
+    if (chosen.drive !== undefined && selected.drive !== undefined && selected.drive !== chosen.drive) wrong('/selected/drive', `the route runs ${show(selected.runnerKind)} through ${show(chosen.drive)}, not ${show(selected.drive)}`);
     if (event.sticky === true) {
       // A sticky relaunch keeps the conversation's runner and walks nothing above it.
       if (route.recovery === 'reprobe') wrong('/sticky', 'a route with recovery: reprobe walks from the top at every launch');
@@ -394,5 +410,6 @@ function routeEvent(value) {
  */
 export function routeProblems(kind, value) {
   if (!isObject(value)) return undefined;
-  return { 'runner-route': runnerRoute, 'route-bundle': routeBundle, 'route-event': routeEvent }[kind]?.(value);
+  const table = { 'runner-route': runnerRoute, 'route-bundle': routeBundle, 'route-event': routeEvent };
+  return typeof kind === 'string' && Object.hasOwn(table, kind) ? table[kind](value) : undefined;
 }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_estate.py

@@ -90,6 +90,14 @@ def _number(value: Any) -> bool:
     return isinstance(value, (int, float)) and not isinstance(value, bool)
 
 
+def _double(value: Any) -> float:
+    """A JSON number as JavaScript holds it: the nearest double, and an integer beyond the double range ±Infinity."""
+    try:
+        return float(value)
+    except OverflowError:
+        return math.inf if value > 0 else -math.inf
+
+
 def _same(a: Any, b: Any) -> bool:
     """JavaScript's === (and a Set's SameValueZero) on parsed JSON: an object equals only itself."""
     if a is _MISSING or b is _MISSING:
@@ -99,7 +107,7 @@ def _same(a: Any, b: Any) -> bool:
     if isinstance(a, bool) or isinstance(b, bool):
         return isinstance(a, bool) and isinstance(b, bool) and a == b
     if _number(a) and _number(b):
-        return a == b
+        return _double(a) == _double(b)  # 2**53 + 1 is 2**53 in JavaScript
     return type(a) is type(b) and a == b
 
 
@@ -137,7 +145,7 @@ def _js_to_number(value: Any) -> float:
         radix = _JS_RADIX.fullmatch(text)
         if radix:
             digits, base = next((radix.group(k), b) for k, b in (("x", 16), ("o", 8), ("b", 2)) if radix.group(k))
-            return float(int(digits, base))
+            return _double(int(digits, base))
     return math.nan
 
 
@@ -173,10 +181,37 @@ def _strict_string(value: Any) -> str:
     return _js_string(value)
 
 
+_INDEX_KEY = re.compile(r"0|[1-9][0-9]*", re.ASCII)
+
+
+def _js_keys(value: Dict[str, Any]) -> List[str]:
+    """An object's own keys in the order JavaScript lists them: array-index keys ("0" … "4294967294", no leading zero)
+    ascending, then the others in the order written."""
+    index = sorted((k for k in value if _INDEX_KEY.fullmatch(k) and int(k) <= 2 ** 32 - 2), key=int)
+    taken = set(index)
+    return index + [k for k in value if k not in taken]
+
+
+def _js_json_string(text: str) -> str:
+    """JSON.stringify of a string (well-formed, ES2019): a lone surrogate is escaped as \\uXXXX, never refused."""
+    out = ['"']
+    for ch in text:
+        code = ord(ch)
+        if ch in _delegation._ESCAPES:
+            out.append(_delegation._ESCAPES[ch])
+        elif code < 0x20 or 0xD800 <= code <= 0xDFFF:
+            out.append("\\u%04x" % code)
+        else:
+            out.append(ch)
+    out.append('"')
+    return "".join(out)
+
+
 def _json_stringify(value: Any) -> str:
-    """JSON.stringify for a parsed JSON value: members in their order, numbers as JavaScript writes them."""
+    """JSON.stringify for a parsed JSON value: members in JavaScript's key order, numbers as JavaScript writes them, a
+    lone surrogate escaped."""
     if isinstance(value, dict):
-        return "{" + ",".join(_delegation._string(k) + ":" + _json_stringify(v) for k, v in value.items()) + "}"
+        return "{" + ",".join(_js_json_string(k) + ":" + _json_stringify(value[k]) for k in _js_keys(value)) + "}"
     if isinstance(value, list):
         return "[" + ",".join(_json_stringify(v) for v in value) + "]"
     if value is None:
@@ -186,7 +221,7 @@ def _json_stringify(value: Any) -> str:
     if _number(value):
         text = _js_string(value)
         return "null" if text in ("NaN", "Infinity", "-Infinity") else text
-    return _delegation._string(value)
+    return _js_json_string(value)
 
 
 def _show(value: Any) -> str:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_identifiers.py

@@ -163,12 +163,19 @@ def normal_identifier(value: Any) -> Optional[str]:
     return _urn_form(authority, path, query) if scheme.lower() == "urn" else _generic_form(scheme, authority, path, query, fragment)
 
 
+def _double(value: Any) -> float:
+    try:
+        return float(value)
+    except OverflowError:
+        return float("inf") if value > 0 else float("-inf")
+
+
 def _strict_equal(a: Any, b: Any) -> bool:
     """JavaScript's === on parsed JSON: numbers by value, booleans only with booleans, objects by identity."""
     if isinstance(a, bool) or isinstance(b, bool):
         return isinstance(a, bool) and isinstance(b, bool) and a == b
     if isinstance(a, (int, float)) and isinstance(b, (int, float)):
-        return a == b
+        return _double(a) == _double(b)  # as JavaScript holds them: 2**53 + 1 is 2**53
     if isinstance(a, (dict, list)) or isinstance(b, (dict, list)):
         return a is b
     return type(a) is type(b) and a == b