@passioncode-ai/fabric-agent-adapter 0.35.1 → 0.35.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.35.2 - 2026-10-18
+
+### Added
+
+- **`creating-fabric-agents` → resilience and autonomy, second pass**: retries moved at most once and only before the
+  first byte, a persisted `Retry-After`; deciding for a waiting peer and releasing a lease with its commit; live-only,
+  exactly-once hand-overs; protocols ported from shared vectors; bytecode cleared before mutation runs; blocking work
+  off request workers and interruptible socket waits; bounded recursive parsing, content-addressed revocation, no
+  refresh of a person's own credentials. From the same retrospective's later answers (2026-10-17/18).
+
 ## 0.35.1 - 2026-10-17
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.35.1",
+  "version": "0.35.2",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.35.1",
+  "version": "0.35.2",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.35.1"
+  version: "0.35.2"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -18,7 +18,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.35.1"
+  version: "0.35.2"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.35.1"
+  version: "0.35.2"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/references/resilience-and-autonomy.md

@@ -40,6 +40,10 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
    the next one. Retries there stalled a waiting user. Stagger many resumes; bound each worker's
    working set (a narrow time window, a prefix), so one stop does not become a burst.
 
+8. **Move a refused request to another account at most once, and only before any byte reached the
+   client** — a replay after streaming began duplicated output. Persist a provider's `Retry-After`
+   across restarts; a check inside the hold answers the stored observation instead of probing.
+
 ## Model answers are untrusted until accepted
 
 1. **"Answered" is not "usable".** Each call site has its own `accept(text)` — the parser the
@@ -117,9 +121,17 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 6. **Background chores never hold a finished command open**, unattended runs skip them, and an
    unattended `--yes` never reverses a "no" a person saved.
 
+7. **When a peer waits on your decision, make it**, mark it reversible, record it where the work
+   lives and reply naming the record; a platform once built nothing for days waiting on a
+   definition. Release a coordination lease in the same step as the commit that used it, the
+   failure path included.
+8. **Hand work over only while it is alive**, and claim each hand-over exactly once by an exclusive
+   create; a forgotten workflow was handed over twice.
+
 ## Verification you can believe
 
-1. **A test counts once it was watched failing against a planted defect**; a mutation battery
+1. **A test counts once it was watched failing against a planted defect** (clear bytecode caches
+   first — stale bytecode reported mutants killed); a mutation battery
    asserts its own reach ("no tests ran" is not "all plants survived"). Exercise every guard
    with a must-catch and a must-pass case.
 2. **Write expectations out; never compute them from the code under test**, and run a reference
@@ -141,7 +153,9 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 9. **Probe live after every deploy on every consumer channel**, not the default one; read the
    nightly full-suite result first when resuming work, and release from a full local run, not a
    selected subset.
-10. **Read an external contract from its raw documentation or a recorded live snapshot**, never
+10. **Port a protocol from the contract's shared vectors, never its prose** — vendored with a hash
+   per file and run case by case; a prose port accepted a year-0000 date the vectors refused.
+11. **Read an external contract from its raw documentation or a recorded live snapshot**, never
    from a summarising fetch; fail closed on a field nobody documented.
 
 ## Operations that survive restarts
@@ -178,6 +192,10 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 11. **Admit work only when the machine can carry it** — free disk, swap, a cap on concurrent
    sessions — and say why when you defer.
 
+12. **Keep blocking work off the workers that answer requests**, never let a read wait behind a long
+   transaction, and log a transaction held long with the step that held it. Every blocking network
+   wait is interruptible from outside, with its deadline on the socket, not between frames.
+
 ## Secrets and confinement
 
 1. **A secret never enters an environment, argv, URL or log a child can read.** Hand it over a
@@ -198,6 +216,11 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
    an error.
 8. **Widen an access configuration first, code second**, so nothing is over-scoped even briefly.
 
+9. **Bound every recursive parse of untrusted input** (a depth limit, tested at the limit and one
+   above). Revoke or retire by a content-addressed reference, never a reusable name: a re-keyed
+   machine keeps its key id. Never refresh a person's own credentials as a side effect; renew only
+   what you own.
+
 ## Checklist
 
 Before the first release, answer each with a file and a test: where a limit pauses and resumes;

package/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -19,7 +19,7 @@ compatibility: >-
   this plugin; Codex/Kimi use command hooks; Hermes/OpenCode/OpenClaw/Pi use native context plugins after opt-in.
 metadata:
   author: PassionCode.ai
-  version: "0.35.1"
+  version: "0.35.2"
 ---
 
 # Working with Fabric

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session.py

@@ -63,7 +63,7 @@ WATCH_MAX_BACKOFF_S = 900
 SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 LOCAL_ORIGIN = re.compile(r'"origin": "http://(?:127\.0\.0\.1|localhost)')
-VERSION = "0.35.1"
+VERSION = "0.35.2"
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",
          "hermes": "Hermes", "opencode": "OpenCode", "openclaw": "OpenClaw", "pi": "Pi"}
 NATIVE_PLUGIN_HOSTS = frozenset(("hermes", "opencode", "openclaw", "pi"))