@passioncode-ai/fabric-agent-adapter 0.35.1 → 0.35.3

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.35.3 - 2026-10-19
+
+### Added
+
+- **`creating-fabric-agents`, resilience and autonomy, third pass**: a rerun calls read-only tools until its open
+  outcomes are reconciled; idempotency keys cover content as well as the run; every tool's input schema is pinned to
+  the domain schema by a test.
+- **`creating-fabric-agents`, text for people** (FAA-52): the intake grill asks whether the agent writes text a person
+  reads; if it does, its prompt forbids the em dash (U+2014) and any substitute for it, and a test fails on U+2014 in
+  its output from the first commit. The resilience reference gains *Text for people* (the rule, its exact exceptions,
+  a portable check, `accept` rewriting or refusing a model's slip) and a checklist line; a new eval scenario covers it.
+  `test/validate.py` fails a tree where the grill, the reference or the scenario loses it.
+
+### Fixed
+
+- **The resilience reference numbered two rules 9** under *Secrets and confinement*; the second is 10.
+
+## 0.35.2 - 2026-10-18
+
+### Added
+
+- **`creating-fabric-agents` → resilience and autonomy, second pass**: retries moved at most once and only before the
+  first byte, a persisted `Retry-After`; deciding for a waiting peer and releasing a lease with its commit; live-only,
+  exactly-once hand-overs; protocols ported from shared vectors; bytecode cleared before mutation runs; blocking work
+  off request workers and interruptible socket waits; bounded recursive parsing, content-addressed revocation, no
+  refresh of a person's own credentials. From the same retrospective's later answers (2026-10-17/18).
+
 ## 0.35.1 - 2026-10-17
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.35.1",
+  "version": "0.35.3",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.35.1",
+  "version": "0.35.3",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.35.1"
+  version: "0.35.3"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -18,7 +18,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.35.1"
+  version: "0.35.3"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.35.1"
+  version: "0.35.3"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---
@@ -53,6 +53,7 @@ No file is created until every row has an answer. An answer of "later" fails the
 | **Which profile?** | `mcp` when Fabric owns planning and retries and the capability has a schema; `a2a` when the provider owns its task lifecycle end to end; `local-runner` when it is a terminal agent Fabric drives. When unsure, the sibling skill's profile-selection reference is the decision record |
 | **What effects?** | declare anything money-, deletion-, or publication-adjacent now — the host's floor and grants are designed against these declarations, and one discovered late invalidates the admission |
 | **Which tenancy?** | record whether the agent assumes one operator; the assumption is cheap to write down and expensive to excavate |
+| **Text for people?** | if it writes anything a person reads (a reply, a message, a post, a report, a UI string), its prompt forbids the em dash (U+2014) and any substitute for it, and a test fails on U+2014 in new output, from the first commit (the resilience reference, *Text for people*) |
 
 ## Step 1 — the knowledge intake
 
@@ -207,7 +208,8 @@ Before the first stage that calls a model or spends money, read
 [resilience and autonomy](references/resilience-and-autonomy.md) and design its answers in:
 a limit pauses and resumes, every model answer passes the call site's own acceptance, fallbacks
 and checkers cross vendors, spend is a persisted ledger with idempotency keys, open questions
-become recorded decisions, and every fix has a test seen failing. Report its checklist with a
+become recorded decisions, every fix has a test seen failing, and text a person reads carries no
+em dash (U+2014), held by its prompt and a test. Report its checklist with a
 file and a test per line, or `NOT_RUN` where the agent has no such stage.
 
 ## Completion format

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/references/resilience-and-autonomy.md

@@ -14,6 +14,7 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 - Verification you can believe
 - Operations that survive restarts
 - Secrets and confinement
+- Text for people
 - Checklist
 
 ## Limits are pauses
@@ -40,6 +41,10 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
    the next one. Retries there stalled a waiting user. Stagger many resumes; bound each worker's
    working set (a narrow time window, a prefix), so one stop does not become a burst.
 
+8. **Move a refused request to another account at most once, and only before any byte reached the
+   client** — a replay after streaming began duplicated output. Persist a provider's `Retry-After`
+   across restarts; a check inside the hold answers the stored observation instead of probing.
+
 ## Model answers are untrusted until accepted
 
 1. **"Answered" is not "usable".** Each call site has its own `accept(text)` — the parser the
@@ -92,7 +97,10 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 7. **Reuse what was paid for.** A restarted stage looks up the job's successful call with the
    same route, prompt version and inputs before calling again (one restart made 117 paid calls
    where 49 sufficed). Cache keys are content plus definition, never an identity alone.
-8. **Deny spending tools by enumerated name, and test the list** — a provider's newer tools were
+8. **A rerun after an interruption calls read-only tools until its open outcomes are reconciled**;
+   an idempotency key covers the content as well as the run, so a retried run that asks a new
+   question is not refused as a conflict.
+9. **Deny spending tools by enumerated name, and test the list**: a provider's newer tools were
    missing from a deny list while older ones were denied.
 
 ## Autonomy: decide, record, continue
@@ -117,9 +125,17 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 6. **Background chores never hold a finished command open**, unattended runs skip them, and an
    unattended `--yes` never reverses a "no" a person saved.
 
+7. **When a peer waits on your decision, make it**, mark it reversible, record it where the work
+   lives and reply naming the record; a platform once built nothing for days waiting on a
+   definition. Release a coordination lease in the same step as the commit that used it, the
+   failure path included.
+8. **Hand work over only while it is alive**, and claim each hand-over exactly once by an exclusive
+   create; a forgotten workflow was handed over twice.
+
 ## Verification you can believe
 
-1. **A test counts once it was watched failing against a planted defect**; a mutation battery
+1. **A test counts once it was watched failing against a planted defect** (clear bytecode caches
+   first — stale bytecode reported mutants killed); a mutation battery
    asserts its own reach ("no tests ran" is not "all plants survived"). Exercise every guard
    with a must-catch and a must-pass case.
 2. **Write expectations out; never compute them from the code under test**, and run a reference
@@ -141,7 +157,9 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 9. **Probe live after every deploy on every consumer channel**, not the default one; read the
    nightly full-suite result first when resuming work, and release from a full local run, not a
    selected subset.
-10. **Read an external contract from its raw documentation or a recorded live snapshot**, never
+10. **Port a protocol from the contract's shared vectors, never its prose** — vendored with a hash
+   per file and run case by case; a prose port accepted a year-0000 date the vectors refused.
+11. **Read an external contract from its raw documentation or a recorded live snapshot**, never
    from a summarising fetch; fail closed on a field nobody documented.
 
 ## Operations that survive restarts
@@ -178,6 +196,10 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 11. **Admit work only when the machine can carry it** — free disk, swap, a cap on concurrent
    sessions — and say why when you defer.
 
+12. **Keep blocking work off the workers that answer requests**, never let a read wait behind a long
+   transaction, and log a transaction held long with the step that held it. Every blocking network
+   wait is interruptible from outside, with its deadline on the socket, not between frames.
+
 ## Secrets and confinement
 
 1. **A secret never enters an environment, argv, URL or log a child can read.** Hand it over a
@@ -191,17 +213,42 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
    before merge: a `;` once let a private path reach a public branch.
 5. **Freeze every input at acceptance**, nested references included: copy it by hash and work on
    the copy, so a file swapped between acceptance and use is never read.
-6. **Treat what a run wrote as untrusted** before the service copies, reads or renders it: a
+6. **Pin every tool's input schema to the domain schema with a test.** A save tool that silently
+   dropped unknown fields once stored an agent set to send without the guards it was given.
+7. **Treat what a run wrote as untrusted** before the service copies, reads or renders it: a
    regular file whose real path is inside the run's own tree.
-7. **An artefact missing a secret refuses to start**, never runs unauthenticated: validation rejects
+8. **An artefact missing a secret refuses to start**, never runs unauthenticated: validation rejects
    placeholder-shaped values, and a test renders the configuration without the value and expects
    an error.
-8. **Widen an access configuration first, code second**, so nothing is over-scoped even briefly.
+9. **Widen an access configuration first, code second**, so nothing is over-scoped even briefly.
+
+10. **Bound every recursive parse of untrusted input** (a depth limit, tested at the limit and one
+    above). Revoke or retire by a content-addressed reference, never a reusable name: a re-keyed
+    machine keeps its key id. Never refresh a person's own credentials as a side effect; renew only
+    what you own.
+
+## Text for people
+
+1. **Text a person reads carries no em dash** (U+2014) and no substitute for it: not `--`, not a
+   spaced hyphen used as a dash. The operator reads it as the mark of machine-written text. Use a
+   full stop, a comma, a colon or parentheses, or rewrite the sentence. This covers replies,
+   messages, posts, mail, reports, captions and UI strings, in every language.
+2. **Exceptions are exact, never stylistic:** exact quotations, code, commands, paths and
+   historical records keep the character as they are.
+3. **The rule lives in the prompt and in a test.** The prompt of every lane that writes for people
+   states it; a test feeds that lane's output (and every fixed template) through a check that
+   fails on U+2014, for example `assert "\u2014" not in text`, and is seen failing on a planted
+   dash. A spaced hyphen cannot be told from a range or a minus by a pattern: the prompt and a
+   reviewer carry that half, the check does not guess.
+4. **A model's slip is rewritten or refused, never shipped.** When an accepted answer still holds U+2014, the
+   call site's `accept` rewrites it or retries once, then refuses; it never sends the dash on.
 
 ## Checklist
 
-Before the first release, answer each with a file and a test: where a limit pauses and resumes;
-what `accept` each model call has; which vendors its fallback and checker use; where the attempt
-ledger and idempotency keys live; what happens to an unknown outcome; which waits are durable;
-who owns the run lock; what the next start sweeps; how a cancel reaches paid inner work; which
-outputs are capped; how a secret reaches a child; which test was seen failing for each fix.
+Before the first release, answer each with a file and a test: where a limit pauses and resumes; what
+`accept` each model call has; which vendors its fallback and checker use; where the attempt ledger
+and idempotency keys live; what happens to an unknown outcome; which waits are durable; who owns the
+run lock; what the next start sweeps; how a cancel reaches paid inner work; which outputs are
+capped; how a secret reaches a child; which test was seen failing for each fix; and, for an agent
+that writes text for people, where its prompt says no em dash and which test fails on U+2014 in its
+output.

package/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -19,7 +19,7 @@ compatibility: >-
   this plugin; Codex/Kimi use command hooks; Hermes/OpenCode/OpenClaw/Pi use native context plugins after opt-in.
 metadata:
   author: PassionCode.ai
-  version: "0.35.1"
+  version: "0.35.3"
 ---
 
 # Working with Fabric
@@ -105,7 +105,7 @@ and its answer is an error that names what Fabric waits for — never a fake suc
 |---|---|---|
 | Fabric is not running, or its hub is closed | no live hub | Step 1; Settings → Agent access in Fabric says why a hub is closed |
 | Fabric's hub could not be verified | foreign protocol, dead pid, token outside Fabric's folder | send nothing; ask the person to open Fabric |
-| the folder is not a project | no project holds this folder | the person opens it in Fabric (+ Project → Open a project) |
+| the folder is not a project | no project holds this folder yet | Fabric with automatic project admission creates or attaches the Project during enrollment; an older Fabric needs the person to open it (+ Project → Open a project) |
 | waiting for the operator to allow this coding agent | the consent prompt is on their screen | tell the person; call again in a moment; never loop fast |
 | denied | the operator said no | stop; the denial stands until they clear it in Agent access |
 | connecting | enrollment in progress | call again in a moment |

package/plugins/fabric-agent-adapter/skills/working-with-fabric/references/project-board.md

@@ -134,8 +134,9 @@ personal data or private path in a body or an artifact reference: name a vault s
 - Never enroll a second session from a hook or a script: a `fabric-mcp` started outside the agent's own connection
   enrolls a new session, and Fabric ends a binding's oldest live session past eight — the agent's own. The plugin's
   hooks and `watch-mail` only rejoin (`--rejoin-only`).
-- Never attach a folder to a Project, or create a Project, to make enrollment succeed. "The folder is not a project"
-  is the answer: tell the person; which Projects exist is their decision.
+- Never attach a folder or create a Project through a side channel to make enrollment succeed. Fabric's own
+  enrollment admits an eligible Git folder and records the Project it creates or attaches. If the answer is still
+  "the folder is not a project", report it; never write another product's registry or improvise a second admission path.
 
 ## Not yet available
 

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session.py

@@ -63,7 +63,7 @@ WATCH_MAX_BACKOFF_S = 900
 SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 LOCAL_ORIGIN = re.compile(r'"origin": "http://(?:127\.0\.0\.1|localhost)')
-VERSION = "0.35.1"
+VERSION = "0.35.3"
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",
          "hermes": "Hermes", "opencode": "OpenCode", "openclaw": "OpenClaw", "pi": "Pi"}
 NATIVE_PLUGIN_HOSTS = frozenset(("hermes", "opencode", "openclaw", "pi"))