@passioncode-ai/fabric-agent-adapter 0.35.2 → 0.35.4

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.35.4 - 2026-10-19
+
+### Changed
+
+- **The session hooks rejoin a session at most once a minute** (FAA-53). Every `fabric-mcp --rejoin-only` spends the
+  agent's Fabric request budget, which every session on the machine shares; with about forty Claude Code sessions,
+  agents waited minutes on "Fabric is rate limited". The worker marks a successful rejoin in the session's folder; a
+  turn within 60 s of it is spooled and delivered by the next worker, and the end of a session always starts one.
+  Fabric fixed its side in CO-334 (per-session charging, jitter after `Retry-After`) and advised this skip.
+- **`creating-fabric-agents` → resilience reference follows contract DEC-0087** (FAA-56, guidance part): the codes
+  are `quota-exhausted` and `outcome-unknown`; a job a limit only paused stays `working` with the pause grammar in its
+  `statusMessage`; a job its provider will not resume ends `failed` with `data: {retryable, resetsAt?}`; a caller acts
+  as `jobCallerAction` does. The kits' rules and vectors come with the repin (FAA-54).
+
+## 0.35.3 - 2026-10-19
+
+### Added
+
+- **`creating-fabric-agents`, resilience and autonomy, third pass**: a rerun calls read-only tools until its open
+  outcomes are reconciled; idempotency keys cover content as well as the run; every tool's input schema is pinned to
+  the domain schema by a test.
+- **`creating-fabric-agents`, text for people** (FAA-52): the intake grill asks whether the agent writes text a person
+  reads; if it does, its prompt forbids the em dash (U+2014) and any substitute for it, and a test fails on U+2014 in
+  its output from the first commit. The resilience reference gains *Text for people* (the rule, its exact exceptions,
+  a portable check, `accept` rewriting or refusing a model's slip) and a checklist line; a new eval scenario covers it.
+  `test/validate.py` fails a tree where the grill, the reference or the scenario loses it.
+
+### Fixed
+
+- **The resilience reference numbered two rules 9** under *Secrets and confinement*; the second is 10.
+
 ## 0.35.2 - 2026-10-18
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.35.2",
+  "version": "0.35.4",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.35.2",
+  "version": "0.35.4",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.35.2"
+  version: "0.35.4"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -18,7 +18,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.35.2"
+  version: "0.35.4"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.35.2"
+  version: "0.35.4"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---
@@ -53,6 +53,7 @@ No file is created until every row has an answer. An answer of "later" fails the
 | **Which profile?** | `mcp` when Fabric owns planning and retries and the capability has a schema; `a2a` when the provider owns its task lifecycle end to end; `local-runner` when it is a terminal agent Fabric drives. When unsure, the sibling skill's profile-selection reference is the decision record |
 | **What effects?** | declare anything money-, deletion-, or publication-adjacent now — the host's floor and grants are designed against these declarations, and one discovered late invalidates the admission |
 | **Which tenancy?** | record whether the agent assumes one operator; the assumption is cheap to write down and expensive to excavate |
+| **Text for people?** | if it writes anything a person reads (a reply, a message, a post, a report, a UI string), its prompt forbids the em dash (U+2014) and any substitute for it, and a test fails on U+2014 in new output, from the first commit (the resilience reference, *Text for people*) |
 
 ## Step 1 — the knowledge intake
 
@@ -207,7 +208,8 @@ Before the first stage that calls a model or spends money, read
 [resilience and autonomy](references/resilience-and-autonomy.md) and design its answers in:
 a limit pauses and resumes, every model answer passes the call site's own acceptance, fallbacks
 and checkers cross vendors, spend is a persisted ledger with idempotency keys, open questions
-become recorded decisions, and every fix has a test seen failing. Report its checklist with a
+become recorded decisions, every fix has a test seen failing, and text a person reads carries no
+em dash (U+2014), held by its prompt and a test. Report its checklist with a
 file and a test per line, or `NOT_RUN` where the agent has no such stage.
 
 ## Completion format

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/references/resilience-and-autonomy.md

@@ -14,13 +14,19 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 - Verification you can believe
 - Operations that survive restarts
 - Secrets and confinement
+- Text for people
 - Checklist
 
 ## Limits are pauses
 
-1. **A provider or subscription limit pauses the job; it never fails it.** Store a typed pause
-   (`quota_exhausted`, `retryable: true`, the reset time when known) and resume from the same
-   stage. Failing it cost callers whole jobs and resubmits.
+1. **A provider or subscription limit pauses the job; it never fails it.** Keep the job `working` and
+   write its `statusMessage` in the contract's pause grammar, `quota-exhausted` or
+   `quota-exhausted until <UTC instant>` (optionally `: <text>`, at most 500 characters), with
+   `pollIntervalMs` reaching the reset; resume from the same stage. Only a job its provider will not
+   resume ends `failed` with `error: {code: "quota-exhausted", message, data: {retryable, resetsAt?}}`:
+   `retryable: false` when a person must act, and `resetsAt` (UTC, `T` and `Z`, at most three
+   fraction digits) only when `retryable: true` (contract DEC-0087, `FAC-SEM-119`). Failing a job a
+   limit only paused cost callers whole jobs and resubmits.
 2. **Resume first.** Every worker reads its own state — checkpoint, worktree, branches, open
    pull requests, notes — before it acts, and continues from there. Relaunching from scratch
    after a limit recreated work over committed work and re-issued credentials already held.
@@ -87,7 +93,11 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 4. **A resend of an unknown outcome reuses its idempotency key — or does not happen.** Derive
    keys from the intent (action and entity, or run and step), never from a clock or a random
    value, and make them unique in storage: time-and-random keys let redelivered requests charge
-   again. A write whose effect is uncertain stops as `outcome_unknown`; a new key there pays twice.
+   again. A write whose effect is uncertain ends `failed` with the code `outcome-unknown`; only an
+   observed result settles it, and a new key there pays twice. A caller acts on each answer as the
+   contract's `jobCallerAction` does: wait out a pause, resend a retryable `quota-exhausted` under the
+   same key after `resetsAt`, hand a non-retryable one or `limit-reached` to a person, reconcile an
+   `outcome-unknown`, and never resend it.
 5. **A client error at submit is a rejection, not a lost task.** Settle it with known usage (zero
    if none), release the reserved money in the same transaction, and never resend the identical
    request; a 4xx while polling is still a lost task.
@@ -96,7 +106,10 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
 7. **Reuse what was paid for.** A restarted stage looks up the job's successful call with the
    same route, prompt version and inputs before calling again (one restart made 117 paid calls
    where 49 sufficed). Cache keys are content plus definition, never an identity alone.
-8. **Deny spending tools by enumerated name, and test the list** — a provider's newer tools were
+8. **A rerun after an interruption calls read-only tools until its open outcomes are reconciled**;
+   an idempotency key covers the content as well as the run, so a retried run that asks a new
+   question is not refused as a conflict.
+9. **Deny spending tools by enumerated name, and test the list**: a provider's newer tools were
    missing from a deny list while older ones were denied.
 
 ## Autonomy: decide, record, continue
@@ -209,22 +222,42 @@ mechanism that held after the fix. Every rule is cheaper to build in than to ret
    before merge: a `;` once let a private path reach a public branch.
 5. **Freeze every input at acceptance**, nested references included: copy it by hash and work on
    the copy, so a file swapped between acceptance and use is never read.
-6. **Treat what a run wrote as untrusted** before the service copies, reads or renders it: a
+6. **Pin every tool's input schema to the domain schema with a test.** A save tool that silently
+   dropped unknown fields once stored an agent set to send without the guards it was given.
+7. **Treat what a run wrote as untrusted** before the service copies, reads or renders it: a
    regular file whose real path is inside the run's own tree.
-7. **An artefact missing a secret refuses to start**, never runs unauthenticated: validation rejects
+8. **An artefact missing a secret refuses to start**, never runs unauthenticated: validation rejects
    placeholder-shaped values, and a test renders the configuration without the value and expects
    an error.
-8. **Widen an access configuration first, code second**, so nothing is over-scoped even briefly.
+9. **Widen an access configuration first, code second**, so nothing is over-scoped even briefly.
 
-9. **Bound every recursive parse of untrusted input** (a depth limit, tested at the limit and one
-   above). Revoke or retire by a content-addressed reference, never a reusable name: a re-keyed
-   machine keeps its key id. Never refresh a person's own credentials as a side effect; renew only
-   what you own.
+10. **Bound every recursive parse of untrusted input** (a depth limit, tested at the limit and one
+    above). Revoke or retire by a content-addressed reference, never a reusable name: a re-keyed
+    machine keeps its key id. Never refresh a person's own credentials as a side effect; renew only
+    what you own.
+
+## Text for people
+
+1. **Text a person reads carries no em dash** (U+2014) and no substitute for it: not `--`, not a
+   spaced hyphen used as a dash. The operator reads it as the mark of machine-written text. Use a
+   full stop, a comma, a colon or parentheses, or rewrite the sentence. This covers replies,
+   messages, posts, mail, reports, captions and UI strings, in every language.
+2. **Exceptions are exact, never stylistic:** exact quotations, code, commands, paths and
+   historical records keep the character as they are.
+3. **The rule lives in the prompt and in a test.** The prompt of every lane that writes for people
+   states it; a test feeds that lane's output (and every fixed template) through a check that
+   fails on U+2014, for example `assert "\u2014" not in text`, and is seen failing on a planted
+   dash. A spaced hyphen cannot be told from a range or a minus by a pattern: the prompt and a
+   reviewer carry that half, the check does not guess.
+4. **A model's slip is rewritten or refused, never shipped.** When an accepted answer still holds U+2014, the
+   call site's `accept` rewrites it or retries once, then refuses; it never sends the dash on.
 
 ## Checklist
 
-Before the first release, answer each with a file and a test: where a limit pauses and resumes;
-what `accept` each model call has; which vendors its fallback and checker use; where the attempt
-ledger and idempotency keys live; what happens to an unknown outcome; which waits are durable;
-who owns the run lock; what the next start sweeps; how a cancel reaches paid inner work; which
-outputs are capped; how a secret reaches a child; which test was seen failing for each fix.
+Before the first release, answer each with a file and a test: where a limit pauses and resumes; what
+`accept` each model call has; which vendors its fallback and checker use; where the attempt ledger
+and idempotency keys live; what happens to an unknown outcome; which waits are durable; who owns the
+run lock; what the next start sweeps; how a cancel reaches paid inner work; which outputs are
+capped; how a secret reaches a child; which test was seen failing for each fix; and, for an agent
+that writes text for people, where its prompt says no em dash and which test fails on U+2014 in its
+output.

package/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -19,7 +19,7 @@ compatibility: >-
   this plugin; Codex/Kimi use command hooks; Hermes/OpenCode/OpenClaw/Pi use native context plugins after opt-in.
 metadata:
   author: PassionCode.ai
-  version: "0.35.2"
+  version: "0.35.4"
 ---
 
 # Working with Fabric
@@ -105,7 +105,7 @@ and its answer is an error that names what Fabric waits for — never a fake suc
 |---|---|---|
 | Fabric is not running, or its hub is closed | no live hub | Step 1; Settings → Agent access in Fabric says why a hub is closed |
 | Fabric's hub could not be verified | foreign protocol, dead pid, token outside Fabric's folder | send nothing; ask the person to open Fabric |
-| the folder is not a project | no project holds this folder | the person opens it in Fabric (+ Project → Open a project) |
+| the folder is not a project | no project holds this folder yet | Fabric with automatic project admission creates or attaches the Project during enrollment; an older Fabric needs the person to open it (+ Project → Open a project) |
 | waiting for the operator to allow this coding agent | the consent prompt is on their screen | tell the person; call again in a moment; never loop fast |
 | denied | the operator said no | stop; the denial stands until they clear it in Agent access |
 | connecting | enrollment in progress | call again in a moment |

package/plugins/fabric-agent-adapter/skills/working-with-fabric/references/project-board.md

@@ -134,8 +134,9 @@ personal data or private path in a body or an artifact reference: name a vault s
 - Never enroll a second session from a hook or a script: a `fabric-mcp` started outside the agent's own connection
   enrolls a new session, and Fabric ends a binding's oldest live session past eight — the agent's own. The plugin's
   hooks and `watch-mail` only rejoin (`--rejoin-only`).
-- Never attach a folder to a Project, or create a Project, to make enrollment succeed. "The folder is not a project"
-  is the answer: tell the person; which Projects exist is their decision.
+- Never attach a folder or create a Project through a side channel to make enrollment succeed. Fabric's own
+  enrollment admits an eligible Git folder and records the Project it creates or attaches. If the answer is still
+  "the folder is not a project", report it; never write another product's registry or improvise a second admission path.
 
 ## Not yet available
 

package/plugins/fabric-agent-adapter/skills/working-with-fabric/references/session-hooks.md

@@ -87,6 +87,9 @@ only variable names are looked at, never a value (two of them carry the session'
 - **Start a second Fabric session.** A `fabric-mcp` started on its own would enroll a new session, and Fabric ends a
   binding's oldest live session past eight (ADR-0134 amendment 2) — the agent's own. The worker and `watch-mail` run
   `fabric-mcp --rejoin-only --runtime-session-id <id>`, and only when Fabric advertises `session-hooks/1`.
+- **Rejoin more than once a minute.** Every rejoin spends the agent's Fabric request budget, which every session of
+  the machine shares. A turn within 60 s of the session's last successful rejoin (the worker marks it as `rejoined`
+  in the session's folder) is spooled and waits for the next worker; the end of a session always starts one (FAA-53).
 - **Retry in a loop.** A refused call is logged by its error code and dropped; an answer that never came is logged
   as `outcome=unknown`. The calls carry an `idempotencyKey`, so a repeat is the same event.
 

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session.py

@@ -56,6 +56,9 @@ LOCK_STALE_S = 30.0
 #: A session folder untouched this long belongs to a session that will not spool again: its worker failed, or the
 #: session ended without SessionEnd. Nothing retries it, so the next spooling hook removes it (FAA-50).
 SESSION_STALE_S = 7 * 86400
+#: A session rejoins at most once in this span (FAA-53): every rejoin spends Fabric's per-agent request budget, which
+#: every session of the machine shares; a turn inside it waits in the spool for the next worker, an end never waits.
+REJOIN_MIN_INTERVAL_S = 60.0
 READ_CAP = 64 * 1024
 CONFIG_CAP = 32 * 1024 * 1024
 WATCH_MIN_INTERVAL_S = 10
@@ -63,7 +66,7 @@ WATCH_MAX_BACKOFF_S = 900
 SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 LOCAL_ORIGIN = re.compile(r'"origin": "http://(?:127\.0\.0\.1|localhost)')
-VERSION = "0.35.2"
+VERSION = "0.35.4"
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",
          "hermes": "Hermes", "opencode": "OpenCode", "openclaw": "OpenClaw", "pi": "Pi"}
 NATIVE_PLUGIN_HOSTS = frozenset(("hermes", "opencode", "openclaw", "pi"))
@@ -559,10 +562,21 @@ def hook_spool(payload: Dict[str, Any], event: str, env: Optional[Dict[str, str]
     if event == "end" and isinstance(payload.get("reason"), str):
         entry["reason"] = payload["reason"][:64]
     spool(directory, entry)
-    if event == "end" or not lock_held(directory):
-        spawn(directory)
-        return "spooled: worker started"
-    return "spooled: a worker is running"
+    if event != "end" and lock_held(directory):
+        return "spooled: a worker is running"
+    if event != "end" and rejoined_recently(directory):
+        return "spooled: rejoined recently"
+    spawn(directory)
+    return "spooled: worker started"
+
+
+def rejoined_recently(directory: Path, now: Optional[float] = None) -> bool:
+    """Whether this session's last rejoin succeeded within REJOIN_MIN_INTERVAL_S (the worker marks it)."""
+    try:
+        mark = (directory / "rejoined").stat().st_mtime
+    except OSError:
+        return False
+    return 0 <= (time.time() if now is None else now) - mark < REJOIN_MIN_INTERVAL_S
 
 
 def _remove_tree(directory: Path) -> None:
@@ -801,6 +815,7 @@ def deliver(directory: Path, env: Optional[Dict[str, str]] = None, deadline_s: f
                                       "clientInfo": {"name": "fabric-agent-adapter-hooks", "version": VERSION}})
         client.notify("notifications/initialized")
         names = _wait_for_session_tools(client, deadline)
+        _write_private(directory / "rejoined", "")
         while entries:
             for path in entries:
                 entry = json.loads(read_small(path) or "{}")