@passioncode-ai/fabric-agent-adapter 0.38.0 → 0.39.1

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/estate-record.md

@@ -1,7 +1,8 @@
-# The estate record — what the operator's machines are, signed by their passkey (DEC-0055)
+# The estate record: what the operator's machines are, signed by their passkey (DEC-0055)
 
 Fabric Agent Contract DEC-0055, `docs/specification/estate-record.md`, schema `schemas/estate-record.schema.json`,
-rules `FAC-SEM-072…076`, with contexts (DEC-0082, `docs/specification/contexts.md`, `FAC-SEM-110`, `FAC-SEM-111`).
+rules `FAC-SEM-072…076`, with contexts (DEC-0082, `docs/specification/contexts.md`, `FAC-SEM-110`, `FAC-SEM-111`) and a
+partner's scoped publisher key (DEC-0090, `docs/specification/partner-channel.md`, `FAC-SEM-122`).
 One revision of one person's estate lists:
 - the passkeys that sign it;
 - the machines, with their device keys and a certificate of each machine's hub key;
@@ -56,7 +57,7 @@ It checks, in the order of the ER table:
 7. **The window.** At most 30 days. A revision may be issued up to 60 s ahead of the verifier's clock (DEC-0066,
    `CLOCK_SKEW_SECONDS`); earlier than that it is `not-yet-valid`.
 8. **The record's own rules.** A violation is `rule-violation` with its `codes`, `FAC-SEM-072…076`, `FAC-SEM-110`,
-   `FAC-SEM-111` and `FAC-SEM-092`
+   `FAC-SEM-111`, `FAC-SEM-122` and `FAC-SEM-092`
    (each passkey the record lists is a signing credential, its origins within its RP ID).
 
 Dates are strict RFC 3339: a `T`, an offset, and a day that exists. `:60` and a space are refused. Passkey JWK `x`
@@ -78,13 +79,13 @@ gate = fd.delegation_gate(audience=..., jwks=keys, issuer=..., effects=..., esta
                           estate_revocations=lambda: delta_entries)
 ```
 
-- **The token's fault** — no such certification, another key under that `kid`, a `kid` on two machines, a revoked hub
-  key or machine — is `unauthenticated` (for an approval, `approval-invalid`) with detail `kid-not-certified`.
+- **The token's fault** (no such certification, another key under that `kid`, a `kid` on two machines, a revoked hub
+  key or machine) is `unauthenticated` (for an approval, `approval-invalid`) with detail `kid-not-certified`.
 - **The trust source's fault** is `issuer-unavailable`: `estate-unreadable` (a source that throws or answers nothing
   readable, a revision without a number or digest, a window of zero or over 30 days, dates read strictly, `machines` or
   `revocations` not arrays), `estate-outside-window`, `estate-rolled-back` (lower than the applied revision) and
   `estate-forked` (the applied number with another digest). A caller cannot cure these by minting again.
-- An unreadable clock — not a finite number of seconds a `Date` can hold — is refused `unknown-state` `no-clock`
+- An unreadable clock (not a finite number of seconds a `Date` can hold) is refused `unknown-state` `no-clock`
   before row 1, in every verifier.
 - Only an absent `estate` skips the check. In the Node kit `null` is an unreadable source; in Python, where `None` is
   the absent value, pass a function returning `None` for a source that has nothing.
@@ -113,6 +114,14 @@ of `[A-Za-z0-9][A-Za-z0-9_-]{0,127}`. Absent is `personal`; `null` is not absent
 - **A share grant is never personal** (FAC-SEM-110). A grant to a principal outside the estate (`principalKind:
   external`) is used in that principal's organization; `context: "personal"` on it is a finding, and an absent one
   means not stated. `grant_context_findings(grant, at)` / `grantContextFindings(grant, at)` check one grant on its own.
+- **A partner's publisher key is trusted only where its scope says** (DEC-0090, FAC-SEM-122). `publisherScopes[]`
+  names the keys that are a partner's (`kid`, `partner: org:<id>`, `contexts`); a placement under such a key is in one
+  of the organization contexts listed, never `personal` or another organization. A key is scoped once, and only a key
+  `publisherKeys` pins. A key no scope names keeps DEC-0051's meaning, trusted in any context.
+- **Update a copied kit before a revision carries `publisherScopes`.** A service runs the copy of the kit it was built
+  with; a copy older than 0.39.0 does not read `publisherScopes`, so it trusts a partner's key in every context and
+  finds no rule broken. A service that applies the estate record updates its copy of `fabric_estate.py` /
+  `fabric-estate.mjs` to 0.39.0 or later first.
 
 Every rule is total on hostile JSON, as the contract's are: an `instancePath` names an item by its index as written (a
 non-object before it does not shift it), and a value whose own `toString` member is data is shown as its JSON. Both kits
@@ -174,14 +183,15 @@ sharer's node's and the organization server's, not this kit's.
 ## Checking a record you produce
 
 `estate_record_rules(kind, value)` / `estateRecordRules(kind, value)` are the contract's rules, finding for finding:
-- `estate-record` (FAC-SEM-072…076, 110, 111);
+- `estate-record` (FAC-SEM-072…076, 110, 111, 122);
 - `estate-record-revision` `{parent, next}` (072);
-- `estate-placement` `{record, machine, package, context?}` (074, 075, 111): the package placed on that machine in that
+- `estate-placement` `{record, machine, package, context?}` (074, 075, 111, 122): the package placed on that machine in that
   context, `personal` when `context` is absent.
 
 `placement_trust(record, machine, agentRef, context="personal")` / `placementTrust(record, machine, agentRef, context)`
 names the publisher keys a package verifier trusts for the package placed in that context. A caller that passes no
-context gets the personal placement, as before contexts.
+context gets the personal placement, as before contexts. A partner's key placed outside the contexts its scope names
+answers `{publisher: []}`: the placement exists, and no key may verify it (DEC-0090).
 
 ## What the kit does not do
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/events-and-notifications.md

@@ -13,7 +13,7 @@ The feed is a view: never copy rows into a second store that can drift from the
 
 ## Reading a feed (FAC-SEM-036)
 
-A client of `GET /fabric/v1/events` — or of any token-protected route — sends the token in the
+A client of `GET /fabric/v1/events` (or of any token-protected route) sends the token in the
 header the descriptor's `auth.header` names, in the form `auth.scheme` names: the raw token for
 `none`, `Bearer <token>` for `Bearer`. Never assume `Authorization: Bearer`: a client that did
 was refused on every poll and silently dropped every notify event. `token_header(auth, token)` /
@@ -27,7 +27,7 @@ in the URL.
 - `level`: `info` (routine), `notice` (the operator may want to look), `warning`
   (something is degrading), `error` (something failed and needs action).
 - `text`: one sentence, in the operator's language, with the object named and the
-  number stated — "The Q3 report draft is ready for your approval (12 sections, 3
+  number stated: "The Q3 report draft is ready for your approval (12 sections, 3
   languages)." Never a machine id, never a stack trace.
 - `subject`: what it is about (`{type: "report", id: "q3", label: "Q3 report"}`), so a host
   can group.
@@ -42,11 +42,11 @@ lands on what matters:
 
 | The operator… | Event | `notify` |
 |---|---|---|
-| must decide or act — a choice, an approval, a key to enter | kind says it: `job.awaiting_choice`, `plan.awaiting_approval`, `human_step.opened`; level `notice` | `true` |
-| lost work — a job failed after its retries, a key expired | level `error`; kind `*.failed`, `*.expired` | `true` |
-| will lose work soon — a degraded source that blocks orders | level `warning`, `service.degraded`, **once when it starts** | `true` |
+| must decide or act: a choice, an approval, a key to enter | kind says it: `job.awaiting_choice`, `plan.awaiting_approval`, `human_step.opened`; level `notice` | `true` |
+| lost work: a job failed after its retries, a key expired | level `error`; kind `*.failed`, `*.expired` | `true` |
+| will lose work soon: a degraded source that blocks orders | level `warning`, `service.degraded`, **once when it starts** | `true` |
 | asked to be told when a long job finishes | `job.delivered`, level `notice` | `true` only if that person asked; a host may still keep it in Activity |
-| only needs the record — progress, retries, recoveries, syncs | `job.started`, `service.recovered`, `*.cleared`, level `info` or `notice` | `false` |
+| only needs the record: progress, retries, recoveries, syncs | `job.started`, `service.recovered`, `*.cleared`, level `info` or `notice` | `false` |
 
 - **One episode, one request.** Notify on the transition, never on each poll: a source that
   flaps between degraded and healthy sends `service.degraded` with `notify: true` once, and later

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md

@@ -4,14 +4,14 @@ Normative source: the Fabric Agent Contract's `docs/specification/interop.md` (D
 at the commit this plugin pins. This page says how the kit implements it; where the two
 differ, the contract is right.
 
-A service that other agents — and Fabric — call does five things. Each has one helper in
+A service that other agents (and Fabric) call does five things. Each has one helper in
 `scripts/fabric_interop.py` (Python) and `scripts/fabric-interop.mjs` (Node).
 
 | Rule | What the service does | Helper |
 |---|---|---|
-| C3.1 capability = tool | serves each `mcp` capability of its manifest as the MCP tool of the same name, with the manifest's input schema unchanged, its output schema unchanged — or, for a job, wrapped as `oneOf[result envelope, job handle]` — and annotations from the effect | `tool_for_capability` / `toolForCapability`, `job_tool_output_schema`, `expected_annotations` |
+| C3.1 capability = tool | serves each `mcp` capability of its manifest as the MCP tool of the same name, with the manifest's input schema unchanged, its output schema unchanged (or, for a job, wrapped as `oneOf[result envelope, job handle]`) and annotations from the effect | `tool_for_capability` / `toolForCapability`, `job_tool_output_schema`, `expected_annotations` |
 | C3.2 long work = job | a capability whose work can outlive one request declares `"job": true` in its interop block, returns `{"job": {"id", "status": "working"}}`, and serves `fabric.job.get` and `fabric.job.cancel` | `JobStore`, `McpToolServer` (Python), `unknown_job_result` |
-| C3.2 result | a completed job carries the full result envelope — the shape a synchronous call returns: `id`, `contractVersion`, `outcome`, `done`, `proof`, `scope`, `notVerified`, `artifacts`, `createdAt`, `producer`, `output`, `usage`, and its `trace` | `result_envelope` / `resultEnvelope` |
+| C3.2 result | a completed job carries the full result envelope, the shape a synchronous call returns: `id`, `contractVersion`, `outcome`, `done`, `proof`, `scope`, `notVerified`, `artifacts`, `createdAt`, `producer`, `output`, `usage`, and its `trace` | `result_envelope` / `resultEnvelope` |
 | C3.3 a person decides | the job goes `input_required` with an elicitation: a titled single-select in form mode, and URL mode for anything secret | `choice_request`, `form_request`, `url_request` |
 | C3.4 trace | every call runs as a child span of the caller's `_meta.traceparent`; outgoing calls carry the same trace; the result envelope records it; events about traced work carry `traceId` and `spanId`, events about untraced work none | `child_traceparent`, `trace_ids`, `make_event(..., trace_id=, span_id=)` |
 
@@ -61,7 +61,7 @@ response = server.handle(json_rpc_message)          # POST /mcp body in, JSON re
 open with a handshake, and a server that refuses it is marked failed), `server/discover`,
 `tools/list` and `tools/call` with JSON responses. Every tool's `outputSchema` must be
 rooted at `type: object` (DEC-0018): `add_tool` refuses any other root, because a client may
-drop the whole tool list over one bad schema — an SDK-level test will not show it, so check
+drop the whole tool list over one bad schema; an SDK-level test will not show it, so check
 with the real client (below). A service already on an MCP SDK keeps
 the SDK and uses only the helpers. The Node kit has the helpers and the same job file
 format, without the dispatcher. `scripts/sample_service.py` is the worked example:
@@ -73,7 +73,7 @@ DEC-0017 amended by DEC-0018), so its `structuredContent` always conforms; an ev
 untraced work carries no trace pair.
 
 **Check with a real client**, never only an SDK: `FABRIC_REAL_CLIENT=1 python3 -m unittest
-test.test_real_client` in the adapter repository, or by hand — a throwaway directory, a
+test.test_real_client` in the adapter repository, or by hand: a throwaway directory, a
 temporary `--mcp-config` (mode 600, the token in a header) and `--strict-mcp-config`, so
 the operator's own configuration is not touched:
 
@@ -105,7 +105,9 @@ As a provider:
   `limit_holds=False`, a `limit-reached` job once `approval_granted=True`, and an `outcome-unknown` job never.
 - **Usage you did not measure is `null`, never 0,** but only toward a caller whose request `_meta.protocols` names
   `fabric-interop/0.2`: pass `request_meta` to `result_envelope` (`usage_toward`). Toward any other caller the kit
-  writes the measured lower bound, as before.
+  writes the measured lower bound, as before. Either way, record that call's usage receipt with
+  `tokens_measured=False` / `tokensMeasured: false` and the tokens you have, so your own usage report counts it in
+  `unmeasuredCalls` and does not show the lower bound as complete (DEC-0091, [usage](usage.md)).
 
 As a caller: send `request_meta(traceparent)` as your `_meta` (it names `fabric-interop/0.1` and `0.2`), act on every
 `fabric.job.get` answer as `job_caller_action(answer, now)` says, and resend only under

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -1,4 +1,4 @@
-# Lifecycle — supervisor, install, release layout, state
+# Lifecycle: supervisor, install, release layout, state
 
 **This page is the rule** for anyone who builds, installs or runs a `fabric-service/0.1` service with this
 skill. Everything you must follow is stated here or in the public Fabric Agent Contract's
@@ -56,17 +56,17 @@ that document until `service.id` matches (at most 40 s) before it calls the serv
 | Id | Rule | Here | Kit (Python / Node) |
 |---|---|---|---|
 | LC-01 | **Quit reaches exit within a deadline.** Every trigger (`SIGTERM`, `SIGINT`, logout, the app's own quit) ends the process: within 5 s idle, within 10 s with work in flight, then a hard exit. Nothing starts after quit begins | [Shutdown](#shutdown) | `Drain` / `Drain` |
-| LC-02 | **Every child has an owner, a deadline and a process group.** No subprocess without a timeout; on timeout or the parent's exit the whole group goes; no orphan survives. Locks and shared resources are released in `finally` | your own code | — |
+| LC-02 | **Every child has an owner, a deadline and a process group.** No subprocess without a timeout; on timeout or the parent's exit the whole group goes; no orphan survives. Locks and shared resources are released in `finally` | your own code | none |
 | LC-03 | **A job is bounded and exclusive.** One copy holds `service.lock`; a scheduled job has a watchdog shorter than its interval, shares its lock with every manual entry point, bounds every network call and records each run's outcome. Long work is journalled before it starts | [One copy under a supervisor](#one-copy-under-a-supervisor) | `hold_single_instance` / `holdSingleInstance` |
-| LC-04 | **Credentials are silent after setup.** No background prompt; a credential read that is denied or absent is cached and backs off until a person acts | [Directories](#directories) (secret files 0600) | — |
-| LC-05 | **Identity is stable across updates.** The supervisor runs a stable executable inside a release directory, never an interpreter by a versioned package-manager path; signed builds are pinned by team and identifier | [launchd plist](#launchd-plist-generate-it-with-launchd_plist-or-launchdplist-both-kits-write-the-same-bytes) | — |
+| LC-04 | **Credentials are silent after setup.** No background prompt; a credential read that is denied or absent is cached and backs off until a person acts | [Directories](#directories) (secret files 0600) | none |
+| LC-05 | **Identity is stable across updates.** The supervisor runs a stable executable inside a release directory, never an interpreter by a versioned package-manager path; signed builds are pinned by team and identifier | [launchd plist](#launchd-plist-generate-it-with-launchd_plist-or-launchdplist-both-kits-write-the-same-bytes) | none |
 | LC-09 | **The footprint is declared.** The service's `AGENTS.md` names every resident process, its supervisor label, unit or task and its port, who starts each and who stops it | the descriptor and the supervisor file | `write_descriptor`, `launchd_plist`, `systemd_unit` / `systemdUnit`, `task_xml` / `taskXml` |
 | LC-11 | **An update is a lifecycle event.** An upgrade writes a new immutable release and restarts through the supervisor; the previous release is kept for rollback, older ones are pruned | [Install, upgrade, uninstall](#install-upgrade-uninstall) | `prune_releases` / `pruneReleases` |
 | LC-12 | **Every file is bounded.** Logs rotate by size (5 × 5 MB), mode 0600, never in `/tmp`; temporary leftovers are swept at start | [Logs](#logs) | `RotatingLog`, `cap_stdout_log` / `RotatingLog`, `capStdoutLog` |
 | LC-14 | **The operator's intent wins; uninstall is symmetric.** No install or upgrade re-enables what the operator turned off; uninstall removes what install added (supervisor file, override, descriptor), and data goes only on an explicit purge | [Install, upgrade, uninstall](#install-upgrade-uninstall), [Linux and Windows](#linux-and-windows) | `launchd_install` / `launchdInstall`, `launchd_uninstall` / `launchdUninstall`; `systemd_install` / `systemdInstall`, `task_install` / `taskInstall` and their uninstalls |
 | LC-15 | **Builds clean up after themselves.** At most the current release and the one before it remain; the prune runs inside the installer, not later | [Install, upgrade, uninstall](#install-upgrade-uninstall) | `prune_releases` / `pruneReleases` |
 | LC-21 | **A secret never travels in a command line.** Keys reach the process through its environment, a 0600 file or a vault, never argv; a supervisor file carries no secret | [launchd plist](#launchd-plist-generate-it-with-launchd_plist-or-launchdplist-both-kits-write-the-same-bytes), [Linux and Windows](#linux-and-windows) | the supervisor-file writers refuse a secret-shaped value |
-| LC-22 | **Work survives a restart.** Work started but not finished is journalled on disk, without secrets, before it starts; the restarted service takes it back or cleans it up | [Shutdown](#shutdown) | — (the service's own journal) |
+| LC-22 | **Work survives a restart.** Work started but not finished is journalled on disk, without secrets, before it starts; the restarted service takes it back or cleans it up | [Shutdown](#shutdown) | none (the service's own journal) |
 
 ## launchd plist (generate it with `launchd_plist` or `launchdPlist`; both kits write the same bytes)
 
@@ -78,8 +78,8 @@ that document until `service.id` matches (at most 40 s) before it calls the serv
 | `KeepAlive` | `true` | `{SuccessfulExit:false}` leaves a cleanly exited service down |
 | `ThrottleInterval` | `10` | bounds a crash loop |
 | `ExitTimeOut` | above the drain and its hard exit (15 s default; `Drain` ends by 10 s) | SIGKILL arrives after it, so it must never come first |
-| `ProcessType` | `Standard` — never `Background`, and no `Nice` > 0 or `LowPriorityIO` | a host probes the service and agents call it while the Mac is busy; a background job is starved for tens of seconds under load and every host reports an outage that never happened (the probe's `lifecycle.priority` rule fails it) |
-| `EnvironmentVariables` | `PATH` set explicitly; `*_FILE` paths to secrets; `FABRIC_SERVICE_SUPERVISOR=launchd` | never a secret value — the plist is world-readable in backups; the supervisor marker is how the lock knows to back off (the probe's `lifecycle.supervisor-marker` rule fails a plist without it: a copy that finds the lock held would exit 75 at once into a respawn every `ThrottleInterval`) |
+| `ProcessType` | `Standard`, never `Background`, and no `Nice` > 0 or `LowPriorityIO` | a host probes the service and agents call it while the Mac is busy; a background job is starved for tens of seconds under load and every host reports an outage that never happened (the probe's `lifecycle.priority` rule fails it) |
+| `EnvironmentVariables` | `PATH` set explicitly; `*_FILE` paths to secrets; `FABRIC_SERVICE_SUPERVISOR=launchd` | never a secret value: the plist is world-readable in backups; the supervisor marker is how the lock knows to back off (the probe's `lifecycle.supervisor-marker` rule fails a plist without it: a copy that finds the lock held would exit 75 at once into a respawn every `ThrottleInterval`) |
 | `StandardOutPath`/`StandardErrorPath` | `~/Library/Logs/<id>/service.log` | one place the host tails |
 
 ## Install, upgrade, uninstall
@@ -103,13 +103,13 @@ that document until `service.id` matches (at most 40 s) before it calls the serv
 rewrites the plist, so the new release is what starts once they turn it back on, and
 answers `{"disabled": true, ...}` instead of the well-known document. `force_enable=True`
 is for an operator who asked for the service to be switched on. The service never
-implements these verbs itself — its CLI calls launchctl the same way.
+implements these verbs itself; its CLI calls launchctl the same way.
 
 **Uninstall is symmetric.** `launchd_uninstall` boots the job out and **waits** until
 launchd reports it gone (it raises, removing nothing, if the job is still loaded at the
 timeout), removes the plist, and resets the override to `enabled`. launchctl has no verb
 that deletes an override, and a leftover `disabled` would make a later fresh install stay
-off. Tests use a throwaway label or a fake `launchctl` first on `PATH` — never the
+off. Tests use a throwaway label or a fake `launchctl` first on `PATH`, never the
 operator's real jobs.
 
 ## One copy under a supervisor
@@ -118,7 +118,7 @@ Started by hand, a copy that finds `service.lock` held prints one sentence namin
 holder (or saying the holder is unknown, when its pid cannot be read) and exits 75 at once.
 Under launchd that exit is a respawn every `ThrottleInterval` (10 s), forever, and under
 systemd one every `RestartSec`. So a copy its supervisor started, and that says so with the
-**supervisor marker**, backs off in-process — 0.5 s doubling to 30 s, 300 s in all — takes over
+**supervisor marker**, backs off in-process (0.5 s doubling to 30 s, 300 s in all), takes over
 if the holder leaves, and exits 75 only when the wait runs out: a few starts an hour instead of
 360. It touches nothing while it waits. Two installs sharing one data directory are still the
 defect to remove; the back-off only stops the loop from costing the machine.
@@ -136,8 +136,8 @@ never infers supervision from its parent process.
   `supervised` (with the manager), `manual` or `conflict`. Only an empty variable counts as no
   marker; a bare `--fabric-supervisor` (followed by nothing, by `--` or by another `--…` flag,
   none of which it consumes) names no manager.
-- Markers that disagree — the variable and the argument with different values, the argument
-  twice, or a bare or empty argument beside the variable — exit 75 at once, before the lock and
+- Markers that disagree (the variable and the argument with different values, the argument
+  twice, or a bare or empty argument beside the variable) exit 75 at once, before the lock and
   whether or not it is held, naming both markers.
 - A service's own argument parser accepts the flag in both spellings and ignores it: in Python,
   `add_supervisor_argument(parser)` (argparse otherwise exits 2 on an unknown flag); the sample
@@ -152,8 +152,8 @@ never infers supervision from its parent process.
 `"lifecycle": {"manager": "person", "app": "<the installed bundle or executable>"}`, `installedBy {by: "person", role,
 tool}` and no `origin`: it says the app is installed, never that it runs. The installer writes it; where there is none
 (a macOS app dragged into Applications), the app writes it on a start when `app_descriptor_action` /
-`appDescriptorAction` answers `write` — no descriptor yet, another version in `installedBy.tool`, or another path than
-`lifecycle.app` — and never from an App Translocation path. Its live origin and process id go in its own liveness file,
+`appDescriptorAction` answers `write` (no descriptor yet, another version in `installedBy.tool`, or another path than
+`lifecycle.app`), and never from an App Translocation path. Its live origin and process id go in its own liveness file,
 rewritten on every start and removed on quit; a caller that sends anything reads that file and checks the process.
 `write_descriptor` claims no port for it, and a reader that finds `lifecycle.app` gone treats the descriptor as stale.
 
@@ -179,8 +179,8 @@ anything the operator would miss belongs in data.
 
 ## Logs
 
-One structured log (JSON lines) rotated by size — `RotatingLog(dirs["logs"] / "service.jsonl")`,
-5 × 5 MB by default, files 0600 in a 0700 directory — plus the launchd stdout file, which
+One structured log (JSON lines) rotated by size (`RotatingLog(dirs["logs"] / "service.jsonl")`,
+5 × 5 MB by default, files 0600 in a 0700 directory), plus the launchd stdout file, which
 `cap_stdout_log` copies to `.1` and truncates at start once it passes 5 MB (launchd holds it
 open for append, so it is truncated in place, never renamed). Configure logging once, in the
 entry point. Never log a token, a cookie, a login code or a request body that may carry one.
@@ -189,7 +189,7 @@ entry point. Never log a token, a cookie, a login code or a request body that ma
 
 On `SIGTERM`: stop accepting new work, append a `service.stopping` event, drain
 in-flight work, persist what was interrupted so the next start resumes it, release the
-lock, exit 0 — within 10 s with work in flight (LC-01). `Drain` does the timing:
+lock, exit 0, within 10 s with work in flight (LC-01). `Drain` does the timing:
 
 ```python
 drain = fs.Drain()                       # drain 8 s, hard exit 2 s later (EXIT_HARD_STOP, 70)
@@ -208,8 +208,8 @@ A host may run a lifecycle broker: one always-on per-user service that agents as
 stop and restart products, instead of launching or killing them themselves. A product it manages
 has to survive being driven from outside:
 
-- **Quit reaches exit through both doors.** A broker asks the platform's own quit first — on
-  macOS `NSRunningApplication.terminate()`, the path Cmd+Q and the Dock take — and `SIGTERM` a few
+- **Quit reaches exit through both doors.** A broker asks the platform's own quit first (on
+  macOS `NSRunningApplication.terminate()`, the path Cmd+Q and the Dock take) and `SIGTERM` a few
   seconds later. Handle both and exit inside the deadline (LC-01). A desktop app
   that answers `SIGTERM` by closing its window and staying alive is stopped late or not at all.
 - **A background launch stays in the background.** A broker opens the app non-activating
@@ -219,8 +219,8 @@ has to survive being driven from outside:
 - **Identity is the designated requirement.** A broker pins the app by team + bundle id, so an
   update signed by the same team keeps working and anything else is refused (LC-05). Never ship an
   ad-hoc or differently signed build to a machine that pins you.
-- **Starting is not ready.** Expose readiness the broker can probe without a person — the
-  well-known document for a service, a process-level answer for a plain app — and keep it honest
+- **Starting is not ready.** Expose readiness the broker can probe without a person (the
+  well-known document for a service, a process-level answer for a plain app) and keep it honest
   while the app is still starting.
 
 ## Linux and Windows
@@ -230,7 +230,7 @@ Both kits write and install the supervisor file the contract names (DEC-0032, se
 secret: the writers refuse a credential-shaped argument, environment name or value, and any
 control character (a line break would end a unit line early).
 
-**Linux — a systemd user unit.** `systemd_unit(unit, argv, working_directory=…)` /
+**Linux: a systemd user unit.** `systemd_unit(unit, argv, working_directory=…)` /
 `systemdUnit(unit, argv, {workingDirectory})` writes `Restart=always`, `RestartSec=10`,
 `TimeoutStopSec` above the drain (15 s default), `KillMode=mixed`, `WantedBy=default.target`
 and `FABRIC_SERVICE_SUPERVISOR=systemd` (always, whatever the caller passed), quoting every argument (`%` → `%%`, `$` → `$$`).
@@ -247,7 +247,7 @@ descriptor says `"lifecycle": {"manager": "systemd", "unit": "<id>.<instance>.se
 A user unit runs while the person is logged in; one that must run without a session needs
 `loginctl enable-linger <user>`, which is the operator's decision, not the installer's.
 
-**Windows — a per-user Scheduled Task.** `task_xml(task, argv, working_directory=…)` /
+**Windows: a per-user Scheduled Task.** `task_xml(task, argv, working_directory=…)` /
 `taskXml(task, argv, {workingDirectory})` writes a task with a logon trigger for the current
 user, `InteractiveToken` and `LeastPrivilege` (no administrator rights), restart on failure
 every minute, no execution time limit and `MultipleInstancesPolicy` `IgnoreNew`, its settings in the
@@ -269,16 +269,16 @@ starting a second copy. Measured (FAA-38, [report](https://github.com/passioncod
 that still exits 75 stays down until the next logon.
 
 **One copy on each system.** The Python kit takes `flock` (Linux) or a locked byte
-(Windows); the Node kit cannot, so it holds a name instead — an abstract unix socket on Linux,
+(Windows); the Node kit cannot, so it holds a name instead: an abstract unix socket on Linux,
 a named pipe on Windows (`lock_name` / `lockName`), each gone with the process. The Python kit
 holds the same name beside its file lock, so the two kits exclude each other everywhere, and
 `check_service.py` reports the lock held when either is. The probe only looks (`/proc/net/unix`,
 `WaitNamedPipeW`); it never takes the name, so it cannot make a service that is starting fail.
 
 **Token files on Windows.** The privacy of `service.token` is its ACL (service.md *Windows
-token files*): the kits write a protected list — the user, SYSTEM and Administrators, set before the
+token files*): the kits write a protected list: the user, SYSTEM and Administrators, set before the
 token's bytes go in, any entry already there dropped. On read, `windows_token_acl_problem` /
-`windowsTokenAclProblem` decide over what was read — the file's flags, its owner SID and each ACE
+`windowsTokenAclProblem` decide over what was read: the file's flags, its owner SID and each ACE
 as `{type, sid, mask}` (DEC-0057, `FAC-SEM-079`, held to the contract's
 `fixtures/vectors/windows-token.json`): a reparse point, a directory, a real path outside the
 profile, another owner, an allow ACE with a non-zero mask for any other SID, an ACE of another type

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/migrating-a-service.md

@@ -8,7 +8,7 @@ Order matters: each step leaves the service answering.
 2. **Add the well-known route and the build identity.** Read-only, no risk.
 3. **Add the events view** over the existing log, then the login-code routes. Keep the
    service's old login path until the operator has switched.
-4. **Move the lock to the top of startup** — before the startup hook that resumes jobs.
+4. **Move the lock to the top of startup**, before the startup hook that resumes jobs.
    Test: a second copy exits 75 and the first copy's running jobs are untouched.
 5. **Move state out of the code tree** if it lives there: copy to the OS data
    directory, switch the paths, keep the old tree read-only for one release, then

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md

@@ -1,4 +1,4 @@
-# Packing, signing and verifying — `fabric-package/1`
+# Packing, signing and verifying: `fabric-package/1`
 
 Contract DEC-0050 (format and digest), DEC-0051 (signatures), DEC-0071 and DEC-0074 (a consumer agent), rules
 `FAC-SEM-064`…`066` and `FAC-SEM-102`, all at this plugin's pin. The kit: `scripts/fabric_package.py` and
@@ -102,8 +102,13 @@ version `range`. The partner packs and signs every package with its own publishe
 machine pins that key and `verify` refuses a package signed by any other. One signed package serves every company: what
 differs per company (a display name, a brand, an address) is placement configuration, never a second package.
 
-Still to come, each waiting on its owner: trusting a partner's key for one organization only (contract CT-58), a
-partner's own space in a catalog and publishing to it (FAA-44, Vesta PA-03).
+The company's estate record trusts the partner's key for that company only (DEC-0090): `publisherScopes[]` names the
+key, the partner and the organization contexts, and `placement_trust` / `placementTrust` hand the key to a placement in
+one of those contexts and to no other (FAC-SEM-122, [the estate record reference](estate-record.md)). The partner's own
+agents call the company's agents with the partner innermost in the delegation chain ([delegation](delegation.md)).
+
+Still to come, each waiting on its owner: a partner's own space in a catalog and publishing to it (FAA-44, Vesta
+PA-03).
 
 ## What this version does not do
 
@@ -112,4 +117,5 @@ partner's own space in a catalog and publishing to it (FAA-44, Vesta PA-03).
 - **The organization's countersignature as a passkey assertion.** It waits for `org-countersign/1` and
   `org-authority/1`; this version's countersignature is a detached Ed25519 signature.
 - **Fabric recording packages by `agentRef`.** It waits for the ADR-0138 D2b amendment.
-- **`publish --to org`** (FAA-28).
+- **`publish --to org`** (FAA-28; an organization cloud's import API is FAA-63, under FAA-28's rule that publishing to
+  an organization is the person's own act).

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/profiles.md

@@ -27,7 +27,7 @@ resolution = fp.resolve_model_profile(catalogue=catalogue, profiles=estate_and_a
 ```
 
 The first level that names a profile wins: **request, agent, binding or project, estate default**. The project's
-`modelClasses` narrow the profile's models — a model stays only if every class the catalogue gives it is allowed — and
+`modelClasses` narrow the profile's models (a model stays only if every class the catalogue gives it is allowed) and
 never choose one. `open-vendor` is descriptive (DEC-0083): it is never checked against the policy, and a model whose
 only class is `open-vendor` does not stay. An empty result is `{"refused": "model-classes-empty", "policy": {id, revision}}`: refuse the launch
 and name the policy; never fall back to a model outside it. No level at all is `no-profile`; an id nobody offers is
@@ -37,17 +37,17 @@ and name the policy; never fall back to a model outside it. No level at all is `
 
 `profile_problems(kind, doc)` / `profileProblems(kind, doc)` returns the contract's findings for a `model-catalogue`
 (a model catalogued once; a provider never both ordered and ignored, a base slug covering its variants), a
-`model-profiles` set (an id once), a `runner-profile` (a subscription only in its vendor's runner — Claude in Claude
+`model-profiles` set (an id once), a `runner-profile` (a subscription only in its vendor's runner: Claude in Claude
 Code, Kimi in Kimi Code, ChatGPT in Codex; a key route's allow-list is its own model profile; a key named by reference,
 never by value) and a recorded `profile-resolution` (it equals the order's answer). Every rule compares as the contract
-does — `===` (`1` and `true` differ, `null` is not absent) and its `jsonEqual` for a recorded resolution, where NaN
-equals nothing — and never raises on hostile JSON: a value whose own `toString` member is data is shown as its JSON.
+does: `===` (`1` and `true` differ, `null` is not absent) and its `jsonEqual` for a recorded resolution, where NaN
+equals nothing. It never raises on hostile JSON: a value whose own `toString` member is data is shown as its JSON.
 
 ## A lane that reads user content
 
-A model profile names what the lane it serves reads (DEC-0083, `reads`): `user-content` — what a member, a client or
-the public sends (messages, questions, images, reviews, screenshots, voice); `operator` — only what the estate's own
-operator or its agents write; `web` — pages fetched from the open web. Absent is "not declared", which stays valid.
+A model profile names what the lane it serves reads (DEC-0083, `reads`): `user-content`: what a member, a client or
+the public sends (messages, questions, images, reviews, screenshots, voice); `operator`: only what the estate's own
+operator or its agents write; `web`: pages fetched from the open web. Absent is "not declared", which stays valid.
 
 A profile that reads `user-content` has an **open-vendor route** (FAC-SEM-112): with `fallback: none` (or any value the
 contract does not name) its first model is `open-vendor` in the catalogue; with `between-turns` at least one of its
@@ -83,7 +83,7 @@ and answers whether the runner is installed, which version answers and whether i
 catalogued binary found on `PATH`, only with the catalogued version argv (and `auth` argv), without a shell, within
 the entry's timeout (at most 5 s); an entry outside these rules is refused and nothing runs. `model_usable(model,
 catalogue, policy)` names why a model cannot be used here: not catalogued, a class the project does not allow, or
-only `open-vendor`, which admits nothing — the same admission the resolution applies.
+only `open-vendor`, which admits nothing: the same admission the resolution applies.
 
 `probe` is the contract's closed probe result for that runner, the one Fabric's walk records (DEC-0026):
 `not-installed` (no catalogued binary on `PATH`), `not-responding` (the version probe did not answer in its bound,
@@ -102,12 +102,12 @@ contract's `routeRules` finding for finding:
 | `kind` | value | rules |
 |---|---|---|
 | `runner-route` | the route | one candidate per runner kind (FAC-SEM-028); a candidate can attach or spawn (029) |
-| `route-bundle` | `{route, admissions, binding?, catalogue?}` | every candidate's provider revision admitted for the capability by id, revision and hash (030); the binding agrees — project, capability, local-runner, a candidate as provider, this route as `runnerRoute` (032); every kind and named drive is in the runner catalogue (033) |
+| `route-bundle` | `{route, admissions, binding?, catalogue?}` | every candidate's provider revision admitted for the capability by id, revision and hash (030); the binding agrees (project, capability, local-runner, a candidate as provider, this route as `runnerRoute`) (032); every kind and named drive is in the runner catalogue (033) |
 | `route-event` | `{route, event}` | the event names this route, project and capability; candidates by position; the probes cover every candidate above the selection in order (all for an exhausted walk, none for a sticky relaunch); attach, spawn, `no-held-session` and `spawn-failed` obey the session policy; `held` only under `exhausted: hold`; `preferred-available` only under `recovery: reprobe`, moving up (034) |
 
 A probe result in an event is one of `PROBE_RESULTS`; a host never appends a runner the route does not name.
 
 ## Usage by route
 
-`make_usage_receipt(..., route="subscription"|"key")` records how the call was paid — the operator's own login in its
+`make_usage_receipt(..., route="subscription"|"key")` records how the call was paid: the operator's own login in its
 vendor's runner, or an issued key. The usage report keeps the rows of one model on two routes apart.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
-# fabric-service/0.1 — wire reference
+# fabric-service/0.1: wire reference
 
-Pinned to `fabric-agent-contract` commit `07042181bfae2a481aa0da1a5651f24c76669c48`
+Pinned to `fabric-agent-contract` commit `c55f2d5a11c9a0197e958e87212fca7ae1154769`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
@@ -14,13 +14,13 @@ this page is the working summary. Extension key:
 
 ## Contents
 
-- Descriptor — written by the installer
+- Descriptor: written by the installer
 - Well-known document
 - Events page
 - Login code and the operator session
 - Semantic rules a host applies
 
-## Descriptor — written by the installer
+## Descriptor: written by the installer
 
 Directory: macOS `~/Library/Application Support/ai.passioncode.fabric/services/`,
 Linux `${XDG_DATA_HOME:-~/.local/share}/passioncode-fabric/services/`, Windows
@@ -33,13 +33,13 @@ File `<id>.<instance>.json`, mode 0600 (on Windows a protected ACL), atomic.
 | `id`, `instance` | `^[a-z][a-z0-9-]{1,62}$`, `^[a-z][a-z0-9-]{0,31}$` (default `default`); the pair is unique per machine |
 | `name`, `summary` | ≤ 80 and ≤ 200 characters |
 | `origin` | `http://127.0.0.1:<port>`; the port is a machine-wide claim. Optional for an app's descriptor only (`manager: "person"`, DEC-0069): its live origin and process id are in the app's own liveness file, and a descriptor without an origin claims no port (`FAC-SEM-010`) |
-| `auth` | `tokenFile` (0600; on Windows a protected ACL — owner and every granting entry the current user, SYSTEM or Administrators: service.md *Windows token files*, DEC-0032, DEC-0033); `header` default `Authorization` with `scheme` `Bearer`; any other header carries the raw token with `scheme: "none"` |
+| `auth` | `tokenFile` (0600; on Windows a protected ACL: owner and every granting entry the current user, SYSTEM or Administrators: service.md *Windows token files*, DEC-0032, DEC-0033); `header` default `Authorization` with `scheme` `Bearer`; any other header carries the raw token with `scheme: "none"` |
 | `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task), `node` (Project Observatory's node supervises it as its child, with no supervisor file, DEC-0061), `person` (an app a person installs and starts, then `app`, the installed app, DEC-0069) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032), `label` and `plist` beside any but `launchd` (DEC-0057), `app` beside any but `person`. Both kits and the probe accept all six; both kits write the unit and the task (`systemd_unit`, `task_xml` / `systemdUnit`, `taskXml`). An app's descriptor says it is installed, never that it runs: the probe checks `app` is still there (`descriptor.app-installed`) and reads no well-known document; a reader that finds the app gone treats the descriptor as stale (`app_descriptor_stale` / `appDescriptorStale`), and an app that writes its own descriptor rewrites it only when `app_descriptor_action` / `appDescriptorAction` says `write` |
 | `paths` | `data` (required), `logs[]`, optional `config`, `cache` |
-| `commands` | only `doctor` and `update`, argument arrays whose first item is an absolute or `~/` path (Windows: also `C:\…`, `C:/…` or `~\…`, never a network share — DEC-0032) |
+| `commands` | only `doctor` and `update`, argument arrays whose first item is an absolute or `~/` path (Windows: also `C:\…`, `C:/…` or `~\…`, never a network share; DEC-0032) |
 | `source.repository`, `fabricManifest` | optional |
-| `installedAt`, `installedBy` | when, and who installed it: the installer and its version as a string, or `{by, role?, tool}` (DEC-0061) — `by` `person` (with `role` `operator` or `administrator`), `node` or `organization`; `role` for a person only; `tool` the installer and its version. It names a role, never a person. An app's descriptor uses the object form with `by: "person"`. `register_remote` / `registerRemote` and the sample write the object form |
-| `runner` | optional `{kind?, credentialKind}` (DEC-0061): `credentialKind` `subscription`, `key`, `platform-metered` or `none` — a kind, never a credential (`FAC-SEM-086` refuses a credential-shaped value here or in `installedBy`); a subscription names its vendor's runner (`claude-code`, `kimi-code`, `codex`) |
+| `installedAt`, `installedBy` | when, and who installed it: the installer and its version as a string, or `{by, role?, tool}` (DEC-0061): `by` `person` (with `role` `operator` or `administrator`), `node` or `organization`; `role` for a person only; `tool` the installer and its version. It names a role, never a person. An app's descriptor uses the object form with `by: "person"`. `register_remote` / `registerRemote` and the sample write the object form |
+| `runner` | optional `{kind?, credentialKind}` (DEC-0061): `credentialKind` `subscription`, `key`, `platform-metered` or `none`: a kind, never a credential (`FAC-SEM-086` refuses a credential-shaped value here or in `installedBy`); a subscription names its vendor's runner (`claude-code`, `kimi-code`, `codex`) |
 | `peer` | optional `{endpoint, custody, residency, maxDataClass}` (DEC-0061): the service is offered to others. `endpoint` `https://<dns-name>[:<port>][/<path>]`, never a reserved name (`FAC-SEM-085`); `custody` `organization-managed` or `personal`; `residency` 1–32 ISO 3166-1 alpha-2 codes, `EU` admitted, user-assigned codes refused; `maxDataClass` `public` < `internal` < `confidential` < `restricted`. An offer needs `runner` and never runs on a subscription. A host sends a request from anyone but the operator only when `peer_refusal` / `peerRefusal` answers null (`FAC-SEM-088`); usage rows may take `route: "platform-metered"` |
 
 ## Identifier equality (DEC-0076)
@@ -53,7 +53,7 @@ and a value that is not a string is compared as it is. The kits compare by it in
 events), FAC-SEM-076 (estate grants and their revocations) and FAC-SEM-014 (a provider entry's `providerId`), and they
 write the identifiers they scaffold in normal form.
 
-## Well-known document — `GET /.well-known/fabric-service`
+## Well-known document: `GET /.well-known/fabric-service`
 
 No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
 
@@ -83,8 +83,8 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
 - `build` needs `commit` or `digest` (`sha256:<64 hex>`).
 - `summary`: at most six tiles; `attention: true` counts toward the host's badge.
 - `surfaces.events` is required; `dashboard` and `mcp` when the service has them; `usage`
-  (DEC-0021) when the service reports its spend — see [the usage reference](usage.md);
-  `operatorChannel.path` (DEC-0034) when the service has an operator channel — its status
+  (DEC-0021) when the service reports its spend (see [the usage reference](usage.md));
+  `operatorChannel.path` (DEC-0034) when the service has an operator channel; its status
   document follows the contract's `operator-channel-status.schema.json` and is token-protected
   like the events feed. The kits do not serve it yet.
 - `extensions` MAY carry the embedded dashboard declaration under
@@ -98,7 +98,7 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   token is not an MCP credential: a host and the probe never call `/mcp` with it as a caller.
   The kits verify them with `fabric_delegation` / `fabric-delegation.mjs` ([delegation](delegation.md)).
 
-## Events page — `GET /fabric/v1/events?after=<cursor>&limit=<n>`
+## Events page: `GET /fabric/v1/events?after=<cursor>&limit=<n>`
 
 Token required. `limit` default 50, maximum 200. Without `after`: the newest `limit`,
 ascending. `cursor` is the last id returned, or the `after` you sent when the page is
@@ -134,7 +134,7 @@ reading it further (HTTP 400, or an MCP `isError` result's `structuredContent`);
 own fault `no-accepted-revisions`. `PROTOCOL_REVISIONS` is the contract's register; `check_service.py` reads
 `well-known.protocols`.
 
-## Login code and the operator session — `POST /fabric/v1/login-code`
+## Login code and the operator session: `POST /fabric/v1/login-code`
 
 Token required → `{ "url": "/fabric/v1/login?code=<16–256 url-safe chars>", "expiresAt": "…" }`,
 single use, at most 120 s, recorded as used before it is honoured. `GET` that URL →
@@ -151,4 +151,4 @@ ended session answers `401` on the dashboard page.
 | `FAC-SEM-010` | no two descriptors claim one port or one `id.instance` |
 | `FAC-SEM-011` | `ready` carries no degraded source |
 | `FAC-SEM-012` | commands start with an absolute or `~/` executable |
-| `FAC-SEM-025` | a usage report adds up; an all-unpriced row costs `null`, not `0` (DEC-0021) |
+| `FAC-SEM-025` | a usage report adds up; an all-unpriced row costs `null`, not `0` (DEC-0021); unmeasured calls are within calls and a day's are its models' sum (DEC-0091) |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/remote-placement.md

@@ -1,4 +1,4 @@
-# The remote placement — online agents and dashboards
+# The remote placement: online agents and dashboards
 
 Normative source: `fabric-agent-contract` `docs/specification/service.md` → *Remote placement*,
 DEC-0019, at the commit this skill pins. This page is the how-to.
@@ -7,7 +7,7 @@ DEC-0019, at the commit this skill pins. This page is the how-to.
 
 It is, when it runs outside the operator's computer and the operator wants it in Fabric beside
 the local services: a hosted dashboard, an agent on a server, a bot's web console. It keeps the
-same objects — well-known document, events feed, login code — at the same paths.
+same objects (well-known document, events feed, login code) at the same paths.
 
 ## The descriptor
 
@@ -47,7 +47,7 @@ watch the gate fail.
   the same value is written on the operator's computer by `registerRemote`. Compare in constant
   time (`tokenMatches`).
 - **Session key**: 32 random bytes, a separate secret; rotating it signs every operator out.
-- **Codes and sessions**: `MemoryCodeStore` — a restart forgets every outstanding code, so none
+- **Codes and sessions**: `MemoryCodeStore`: a restart forgets every outstanding code, so none
   can be replayed, and every session record, so a deploy signs the operator out (DEC-0039: the
   server keeps each session's last use and logout). The host signs in again on the page's `401`.
   To keep sessions across a deploy, pass a durable store (any object with `load()` and `save()`).
@@ -68,7 +68,7 @@ reach the service, and still need its own `403`.
 
 | Situation | Host |
 |---|---|
-| `401` on the well-known document | `down` — the service refused the token; never `foreign` |
+| `401` on the well-known document | `down`: the service refused the token; never `foreign` |
 | answer names another `id.instance` | `foreign`; the token is not sent again until the descriptor changes |
 | certificate invalid or for another name | `down`, the reason names TLS |
 | redirect | not followed; `down` |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/settings-backups.md

@@ -1,8 +1,8 @@
-# Settings backups — what the operator decided survives the data directory (DEC-0025)
+# Settings backups: what the operator decided survives the data directory (DEC-0025)
 
 Fabric Agent Contract DEC-0025, `docs/specification/service.md` → *Settings backup*, schema
 `schemas/settings-backup.schema.json`, rule `FAC-SEM-035`. A service whose store holds what the operator
-decided — which projects it serves, how each is bound, which secret slot each binding uses, their overrides —
+decided (which projects it serves, how each is bound, which secret slot each binding uses, their overrides)
 SHOULD keep settings backups, so a lost, purged or wrongly migrated data directory costs the operator nothing.
 
 ## Where
@@ -61,7 +61,7 @@ plan = fs.restore_plan(doc, {"projects": {"columns": [...], "key": ["id"], "requ
 # plan["tables"]["projects"]: insert, present, droppedColumns, defaultedColumns, missingRequired, refused
 ```
 
-- **Automatic restore** only on a *fresh* database — no domain records **and** the service has never started —
+- **Automatic restore** only on a *fresh* database (no domain records **and** the service has never started),
   so a restart never undoes a deletion. Insert `plan[...]["insert"]` and add every row the database refuses to
   `refused` with its key and reason.
 - **Manual restore** shows the plan first; applying it is the operator's act, never an agent's.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/surfaces-and-auth.md

@@ -16,13 +16,13 @@
   the estate's delegation tokens; declare `auth.delegation {issuer, jwks}` in the well-known
   document. The probe treats it like `own` and checks the declaration
   (`auth.delegation-declared`). The kits verify the tokens: put `delegation_gate` /
-  `delegationGate` in front of the tools — see [the delegation reference](delegation.md).
+  `delegationGate` in front of the tools (see [the delegation reference](delegation.md)).
 - Register it into a client config with the service's own command
   (`<tool> mcp-register`), which writes `{"type":"http","url":"http://127.0.0.1:<port>/mcp","headers":{...}}`
   atomically, aborts if the file changed meanwhile, and keeps one 0600 backup. The token
-  goes in `headers`, never in the URL — every log that records a URL prints its query
+  goes in `headers`, never in the URL: every log that records a URL prints its query
   string. An HTTP registration starts nothing per session: every client session talks to the
-  one resident service (LC-19). A stdio server, by contrast, is a process per session — keep
+  one resident service (LC-19). A stdio server, by contrast, is a process per session; keep
   one only at project scope.
 - Ship server `instructions` that tell a caller where to start and that every answer
   carries `degraded`.
@@ -39,7 +39,7 @@ a sign-in link only when stdout is a terminal.
 ## A2A for remote agents
 
 Remote reach goes through A2A `1.0` over HTTPS or an authenticated gateway in front of
-MCP — never by binding a LAN address. A tunnel (Tailscale Serve and the like) is an
+MCP, never by binding a LAN address. A tunnel (Tailscale Serve and the like) is an
 outward surface with its own token lifetime; watch it like a service, because nothing
 else will notice it expire.
 
@@ -50,7 +50,7 @@ else will notice it expire.
 - Compared in constant time (`token_matches`).
 - Rotation is an operator act: write a new file, restart, re-run `mcp-register`.
 - Same-user processes can read it. The protocol defends against web pages and
-  mistakes, not against hostile code running as the operator — say so in SECURITY.md.
+  mistakes, not against hostile code running as the operator; say so in SECURITY.md.
 
 ## Dashboard session