@passioncode-ai/fabric-agent-adapter 0.39.0 → 0.40.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/surfaces-and-auth.md

@@ -16,13 +16,13 @@
   the estate's delegation tokens; declare `auth.delegation {issuer, jwks}` in the well-known
   document. The probe treats it like `own` and checks the declaration
   (`auth.delegation-declared`). The kits verify the tokens: put `delegation_gate` /
-  `delegationGate` in front of the tools — see [the delegation reference](delegation.md).
+  `delegationGate` in front of the tools (see [the delegation reference](delegation.md)).
 - Register it into a client config with the service's own command
   (`<tool> mcp-register`), which writes `{"type":"http","url":"http://127.0.0.1:<port>/mcp","headers":{...}}`
   atomically, aborts if the file changed meanwhile, and keeps one 0600 backup. The token
-  goes in `headers`, never in the URL — every log that records a URL prints its query
+  goes in `headers`, never in the URL: every log that records a URL prints its query
   string. An HTTP registration starts nothing per session: every client session talks to the
-  one resident service (LC-19). A stdio server, by contrast, is a process per session — keep
+  one resident service (LC-19). A stdio server, by contrast, is a process per session; keep
   one only at project scope.
 - Ship server `instructions` that tell a caller where to start and that every answer
   carries `degraded`.
@@ -39,7 +39,7 @@ a sign-in link only when stdout is a terminal.
 ## A2A for remote agents
 
 Remote reach goes through A2A `1.0` over HTTPS or an authenticated gateway in front of
-MCP — never by binding a LAN address. A tunnel (Tailscale Serve and the like) is an
+MCP, never by binding a LAN address. A tunnel (Tailscale Serve and the like) is an
 outward surface with its own token lifetime; watch it like a service, because nothing
 else will notice it expire.
 
@@ -50,7 +50,7 @@ else will notice it expire.
 - Compared in constant time (`token_matches`).
 - Rotation is an operator act: write a new file, restart, re-run `mcp-register`.
 - Same-user processes can read it. The protocol defends against web pages and
-  mistakes, not against hostile code running as the operator — say so in SECURITY.md.
+  mistakes, not against hostile code running as the operator; say so in SECURITY.md.
 
 ## Dashboard session
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/usage.md

@@ -1,4 +1,4 @@
-# Usage report — what the agent spent (DEC-0021)
+# Usage report: what the agent spent (DEC-0021)
 
 Fabric Agent Contract DEC-0021, `docs/specification/service.md` → *Usage report*, schema
 `schemas/service-usage.schema.json`. Optional. A service that calls paid models or tools should
@@ -29,6 +29,8 @@ ledger.record(receipt)                     # fs.JsonlUsageLedger(data / "usage.j
 ledger.record(k.makeUsageReceipt('openrouter', model, { inputTokens, outputTokens, costUsd: usage.cost ?? null }));
 ```
 
+- **OpenRouter through the kit.** `fabric_openrouter.Client` records these receipts itself, one per answered call,
+  and checks a spend ceiling before every attempt ([connectors](connectors.md)).
 - **The provider's own numbers.** Take tokens from the response's usage block, not from a local
   estimate. The cost is `provider` when the provider reported the charge (OpenRouter `usage.cost`,
   a billing API) and `price-list` when you computed it from a published price list.
@@ -39,7 +41,8 @@ ledger.record(k.makeUsageReceipt('openrouter', model, { inputTokens, outputToken
 - **Unknown tokens are named too** (DEC-0091). When the provider gave no token count (a stream cut off, a local
   model without a counter), pass `tokens_measured=False` / `tokensMeasured: false` with the tokens you have (often 0).
   The receipt carries `tokensMeasured: false`, and the report counts the call in `unmeasuredCalls` on its day and model
-  row, never more than `calls`; a host then shows the token totals as a lower bound.
+  row, never more than `calls`; a host then shows the token totals as a lower bound. A job whose usage you send as
+  `null` or `partial` ([interop](interop.md)) is such a call.
 - **No content.** A receipt carries no prompt, output, caller or user id. The kits accept only the
   fields above.
 - If the service already keeps a ledger (a jobs table with token counts), build the receipts from
@@ -63,7 +66,7 @@ left out.
 it, and the host only shows it.
 
 **Every limit (DEC-0027).** Pass `budgets` to list every spending limit the service applies,
-enforced or not, so the spend view shows all of them — the operator asked for that on 2026-10-07:
+enforced or not, so the spend view shows all of them; the operator asked for that on 2026-10-07:
 
 ```python
 ledger.report(service_id=ID, budget={"period": "month", "limitUsd": 100}, budgets=[
@@ -78,7 +81,7 @@ ledger.report(service_id=ID, budget={"period": "month", "limitUsd": 100}, budget
   way `budget` is, so `budget` and its twin in `budgets` never disagree. A per-order limit
   (`per_job`, `approval`) gets `spentUsd: null`. Every other limit states its own spend.
 - `scope` is `machine`, `project`, `pool` or `job`; a `project` or `pool` limit names its
-  `subject`. A limit has at most one window — `period`, `windowSeconds` or `since` — and it agrees
+  `subject`. A limit has at most one window (`period`, `windowSeconds` or `since`), and it agrees
   with the kind (`daily`: the day or 86400 s; `monthly`: the month or 28–31 days; `velocity`: a
   rolling window). `tripped: true` (work stopped by it now) needs `enforced: true`. An unknown
   kind is shown generically, never refused.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -57,74 +57,16 @@ import fabric_interop as fi  # noqa: E402
 Result = Dict[str, str]
 
 
-
-def plist_problems(plist: dict, label: object, token: object = None) -> list:
-    """What makes a service's launchd job unfit to stay up: identity, restart, secrets."""
-    problems = []
-    if plist.get("Label") != label:
-        problems.append("Label %r" % plist.get("Label"))
-    if plist.get("RunAtLoad") is not True:
-        problems.append("RunAtLoad is not true")
-    if plist.get("KeepAlive") is not True:
-        problems.append("KeepAlive is %r, not true" % plist.get("KeepAlive"))
-    for key, value in (plist.get("EnvironmentVariables") or {}).items():
-        if re.search(r"(TOKEN|SECRET|PASSWORD|KEY)$", key) and not key.endswith("_FILE"):
-            problems.append("secret-like variable %s in the plist" % key)
-        if token and token in str(value):
-            problems.append("the service token itself is in the plist")
-    return problems
-
-
-def marker_problem(plist: dict) -> Optional[str]:
-    """What is wrong with the job's supervisor marker (DEC-0057; FAA-05), read the way the copy it starts reads it.
-
-    Without ``FABRIC_SERVICE_SUPERVISOR=launchd`` (or ``--fabric-supervisor launchd``) a copy that finds the
-    lock held exits 75 at once, and KeepAlive starts it again every ThrottleInterval."""
-    env = plist.get("EnvironmentVariables")
-    env = {str(k): str(v) for k, v in env.items()} if isinstance(env, dict) else {}
-    argv = plist.get("ProgramArguments")
-    argv = [str(a) for a in argv] if isinstance(argv, list) else []
-    marker = fs.supervisor_marker(env, argv)
-    if marker["kind"] == "supervised" and marker["manager"] == "launchd":
-        return None
-    fix = ("a copy that finds the lock held exits 75 at once and KeepAlive respawns it every ThrottleInterval; "
-           "regenerate the plist with launchd_plist / launchdPlist and reinstall")
-    if marker["kind"] == "conflict":
-        return "%s — %s" % (fs.marker_conflict_message(marker), fix)
-    if marker["kind"] == "supervised":
-        return "the marker names %s, not launchd — %s" % (marker["manager"], fix)
-    if marker.get("unreadable") is not None:
-        return "the marker %r names no supervisor — %s" % (marker["unreadable"], fix)
-    return "no %s=launchd — %s" % (fs.SUPERVISOR_ENV, fix)
-
-
-def priority_problems(plist: dict) -> list:
-    """A service that answers hosts and agents must not be scheduled as background work."""
-    out = []
-    if plist.get("ProcessType", "Standard") in ("Background", "Adaptive"):
-        out.append("ProcessType is %s" % plist.get("ProcessType"))
-    if isinstance(plist.get("Nice"), int) and plist["Nice"] > 0:
-        out.append("Nice is %d" % plist["Nice"])
-    if plist.get("LowPriorityIO") is True or plist.get("LowPriorityBackgroundIO") is True:
-        out.append("low-priority I/O")
-    return out
-
-
-# A platform router (Heroku, Fly, Render, a CDN) routes by Host, so a request naming a foreign
-# Host never reaches an online service: the router itself answers, typically 404 or 421. That is
-# still a refusal — the service disclosed nothing — so for a remote placement the host check
-# accepts it, as long as the body is not the well-known document. Every other guard request names
-# the right Host, reaches the service, and must be the service's own 403.
-PLATFORM_HOST_REFUSALS = (400, 404, 421)
-
-
-def guard_verdict(rule: str, remote: bool, status: int, body: bytes) -> Tuple[str, str]:
-    if status == 403:
-        return "PASS", "HTTP 403"
-    disclosed = b"fabric-service/" in (body or b"")
-    if rule == "network.host-check" and remote and status in PLATFORM_HOST_REFUSALS and not disclosed:
-        return "PASS", "HTTP %d from the platform router: a foreign Host never reaches the service" % status
-    return "FAIL", "HTTP %d%s" % (status, ", and the body is the well-known document" if disclosed else "")
+from check_service_rules import PLATFORM_HOST_REFUSALS  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import plist_problems  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import marker_problem  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import priority_problems  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import guard_verdict  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import board_responder_verdict  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import session_lifetime_problem  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import _semver  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import usage_problems  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import same_repository  # noqa: E402,F401 - moved (FAA-65)
 
 
 class _PinnedHTTPS(http.client.HTTPSConnection):
@@ -729,7 +671,7 @@ class Probe:
                  marker or "%s: %s=launchd, so a copy that finds the lock held backs off" % (plist_path.name, fs.SUPERVISOR_ENV))
         slow = priority_problems(plist)
         self.add("lifecycle.priority", "FAIL" if slow else "PASS",
-                 "; ".join(slow) + " — macOS may starve the service under load and hosts then see an outage; use ProcessType Standard"
+                 "; ".join(slow) + ". macOS may starve the service under load and hosts then see an outage; use ProcessType Standard"
                  if slow else "%s: scheduled as a standard process" % plist_path.name)
         if sys.platform != "darwin" or not shutil.which("launchctl"):
             self.add("lifecycle.one-copy", "NOT_RUN", "launchctl is not available")
@@ -839,146 +781,6 @@ class Probe:
         return self.results
 
 
-def board_responder_verdict(wk: Any, kit: Optional[str] = None) -> Tuple[str, str]:
-    """board.responder: NOT_RUN when the well-known document declares no fabric-project-comms revision; FAIL when it
-    declares one this kit does not read or the kit's fixture conversation finds a problem; PASS otherwise. `kit` is the
-    service's own copy (a .py or .mjs path); by default the kit beside this probe."""
-    protocols = wk.get("protocols") if isinstance(wk, dict) else None
-    declared = [p for p in protocols if isinstance(p, str) and p.startswith("fabric-project-comms/")] if isinstance(protocols, list) else []
-    if not declared:
-        return "NOT_RUN", "the service declares no board participation (no fabric-project-comms revision in protocols)"
-    accepted = fs.accepted_revisions("fabric-project-comms")
-    unread = [p for p in declared if "error" in fs.negotiate_revision(p, accepted)]
-    if unread:
-        return "FAIL", "declares %s, which this kit does not read (it reads %s)" % (", ".join(unread), ", ".join(accepted))
-    try:
-        if kit and kit.endswith(".mjs"):
-            if not shutil.which("node"):
-                return "NOT_RUN", "node is not installed to run %s's fixture conversation" % kit
-            url = Path(kit).resolve().as_uri()
-            out = subprocess.run(["node", "--input-type=module", "-e",
-                                  "import(process.env.FABRIC_BOARD_KIT).then(async (m) => console.log(JSON.stringify(await m.selfCheck())))"],
-                                 env=dict(os.environ, FABRIC_BOARD_KIT=url), capture_output=True, text=True, timeout=60)
-            problems = json.loads(out.stdout.strip().splitlines()[-1]) if out.returncode == 0 and out.stdout.strip() else ["the Node kit did not run: %s" % out.stderr.strip()[:200]]
-        else:
-            import importlib.util
-            path = Path(kit) if kit else Path(__file__).resolve().parent / "fabric_board.py"
-            spec = importlib.util.spec_from_file_location("fabric_board_under_test", str(path))
-            module = importlib.util.module_from_spec(spec)
-            sys.path.insert(0, str(path.resolve().parent))
-            spec.loader.exec_module(module)  # type: ignore[union-attr]
-            problems = module.self_check()
-    except Exception as exc:  # noqa: BLE001 - a kit that cannot run its conversation fails the rule
-        return "FAIL", "the kit's fixture conversation did not run: %s" % exc.__class__.__name__
-    if problems:
-        return "FAIL", "; ".join(problems)
-    return "PASS", "declares %s; the kit%s answers the fixture conversation (whole, fenced, no epoch)" % (
-        ", ".join(declared), " at %s" % kit if kit else " beside this probe")
-
-
-def session_lifetime_problem(set_cookie: str, now: Optional[float] = None) -> Optional[str]:
-    """DEC-0039: a session cookie set at sign-in lives at most 7 days. Max-Age wins over Expires (RFC 6265
-    §5.3); a cookie with neither ends with the browser session. None when it is within the bound."""
-    attrs = {}
-    for part in set_cookie.split(";")[1:]:
-        name, _, value = part.strip().partition("=")
-        attrs[name.strip().lower()] = value.strip()
-    bound = fs.OPERATOR_SESSION_MAX_SECONDS
-    if "max-age" in attrs:
-        if not re.fullmatch(r"-?\d+", attrs["max-age"]):
-            return "the session cookie's Max-Age %r is not a number" % attrs["max-age"]
-        if int(attrs["max-age"]) > bound:
-            return "the session cookie's Max-Age %s outlives 7 days (%d s, DEC-0039)" % (attrs["max-age"], bound)
-        return None
-    if "expires" in attrs:
-        try:
-            at = email.utils.parsedate_to_datetime(attrs["expires"]).timestamp()
-        except (TypeError, ValueError, IndexError, OverflowError):
-            return "the session cookie's Expires %r is not a date" % attrs["expires"]
-        if at - (time.time() if now is None else now) > bound:
-            return "the session cookie's Expires %s outlives 7 days (DEC-0039)" % attrs["expires"]
-    return None
-
-
-def _semver(text: str) -> Tuple[int, int, int]:
-    m = re.match(r"^(\d+)\.(\d+)\.(\d+)", text or "")
-    return (int(m.group(1)), int(m.group(2)), int(m.group(3))) if m else (0, 0, 0)
-
-
-def usage_problems(report: Any, service_id: str, instance: str) -> List[str]:
-    """What makes this not a DEC-0021 usage report of the service: shape, identity and the sums of
-    FAC-SEM-025. An unknown cost must be null; a day's totals are the sums of its models."""
-    if not isinstance(report, dict):
-        return ["not an object"]
-    out: List[str] = []
-    if report.get("protocol") != fs.PROTOCOL:
-        out.append("protocol is %r" % report.get("protocol"))
-    if report.get("service") != {"id": service_id, "instance": instance}:
-        out.append("reports for %r, not %s.%s" % (report.get("service"), service_id, instance))
-    if report.get("currency") != "USD":
-        out.append("currency is not USD")
-    days = report.get("days")
-    if not isinstance(days, list) or len(days) > fs.USAGE_DAYS:
-        return out + ["days is not a list of at most 31"]
-    fields = ("calls", "unpricedCalls", "unmeasuredCalls", "inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens")
-
-    def priced(row: Dict[str, Any], at: str) -> None:
-        calls, unpriced, cost = row.get("calls", 0), row.get("unpricedCalls", 0), row.get("costUsd")
-        if unpriced > calls:
-            out.append("%s: more unpriced calls than calls" % at)
-        if row.get("unmeasuredCalls", 0) > calls:
-            out.append("%s: more calls with unknown tokens than calls (DEC-0091)" % at)
-        if calls and unpriced == calls and cost is not None:
-            out.append("%s: every call is unpriced, so the cost must be null, not %r" % (at, cost))
-        if unpriced < calls and cost is None:
-            out.append("%s: priced calls carry a cost" % at)
-        if cost is not None and (not isinstance(cost, (int, float)) or cost < 0):
-            out.append("%s: costUsd is not a non-negative number" % at)
-
-    previous = ""
-    for i, day in enumerate(days):
-        at = "days[%d]" % i
-        date = str(day.get("date", "")) if isinstance(day, dict) else ""
-        if not re.match(r"^\d{4}-\d{2}-\d{2}$", date) or date <= previous:
-            out.append("%s: dates must run forward" % at)
-        previous = date
-        priced(day, at)
-        models = day.get("byModel") if isinstance(day, dict) else None
-        if not isinstance(models, list):
-            out.append("%s: byModel missing" % at)
-            continue
-        for j, m in enumerate(models):
-            priced(m, "%s.byModel[%d]" % (at, j))
-        for f in fields:
-            if day.get(f, 0) != sum(m.get(f, 0) for m in models):
-                out.append("%s: %s is not the sum of its models" % (at, f))
-        known = sum(m["costUsd"] for m in models if isinstance(m.get("costUsd"), (int, float)))
-        if isinstance(day.get("costUsd"), (int, float)) and abs(day["costUsd"] - known) > 1e-6:
-            out.append("%s: costUsd is not the sum of its models' known costs" % at)
-        for j, m in enumerate(models):
-            # DEC-0046, DEC-0061: a row's route is a login in its vendor's runner, an issued key, or the platform's
-            # own metered models (a listing in the cloud).
-            if "route" in m and m["route"] not in fs.USAGE_ROUTES:
-                out.append("%s.byModel[%d]: route %r is not subscription, key or platform-metered" % (at, j, m["route"]))
-    # DEC-0065: the window and the project attribution, as the contract's usageRules reads them (FAC-SEM-025).
-    for finding in fs.usage_findings(report):
-        path, message = finding["instancePath"], finding["message"]
-        if path.startswith(("/byProject", "/generatedAt")) or "generatedAt" in message or "exists in its month" in message:
-            out.append("%s: %s" % (path or "/", message))
-    return out
-
-
-def same_repository(a: str, b: str) -> bool:
-    """git@github.com:o/r.git, https://github.com/o/r and github.com/o/r are one repository."""
-    def norm(u: str) -> str:
-        u = u.strip().lower()
-        u = re.sub(r"^git@([^:]+):", r"\1/", u)
-        u = re.sub(r"^[a-z+]+://", "", u)
-        u = re.sub(r"^[^@/]+@", "", u)
-        return re.sub(r"\.git$", "", u).rstrip("/")
-    return bool(a and b) and norm(a) == norm(b)
-
-
 def locate(target: Optional[str], descriptor: Optional[str], services_dir: Path) -> Path:
     if descriptor:
         return Path(descriptor).expanduser()

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service_rules.py

@@ -0,0 +1,204 @@
+"""The probe's rules that read one thing and need no running service (FAA-65): a plist's marker and priority, the
+network guard's verdict, the board responder's fixture conversation, a session cookie's lifetime, a usage report, and
+whether two repository URLs name one repository. ``check_service.py`` runs them against a live service.
+Standard library only, Python 3.9+."""
+from __future__ import annotations
+
+import email.utils
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import fabric_service as fs  # noqa: E402 - beside this file
+
+
+def plist_problems(plist: dict, label: object, token: object = None) -> list:
+    """What makes a service's launchd job unfit to stay up: identity, restart, secrets."""
+    problems = []
+    if plist.get("Label") != label:
+        problems.append("Label %r" % plist.get("Label"))
+    if plist.get("RunAtLoad") is not True:
+        problems.append("RunAtLoad is not true")
+    if plist.get("KeepAlive") is not True:
+        problems.append("KeepAlive is %r, not true" % plist.get("KeepAlive"))
+    for key, value in (plist.get("EnvironmentVariables") or {}).items():
+        if re.search(r"(TOKEN|SECRET|PASSWORD|KEY)$", key) and not key.endswith("_FILE"):
+            problems.append("secret-like variable %s in the plist" % key)
+        if token and token in str(value):
+            problems.append("the service token itself is in the plist")
+    return problems
+
+
+def marker_problem(plist: dict) -> Optional[str]:
+    """What is wrong with the job's supervisor marker (DEC-0057; FAA-05), read the way the copy it starts reads it.
+
+    Without ``FABRIC_SERVICE_SUPERVISOR=launchd`` (or ``--fabric-supervisor launchd``) a copy that finds the
+    lock held exits 75 at once, and KeepAlive starts it again every ThrottleInterval."""
+    env = plist.get("EnvironmentVariables")
+    env = {str(k): str(v) for k, v in env.items()} if isinstance(env, dict) else {}
+    argv = plist.get("ProgramArguments")
+    argv = [str(a) for a in argv] if isinstance(argv, list) else []
+    marker = fs.supervisor_marker(env, argv)
+    if marker["kind"] == "supervised" and marker["manager"] == "launchd":
+        return None
+    fix = ("a copy that finds the lock held exits 75 at once and KeepAlive respawns it every ThrottleInterval; "
+           "regenerate the plist with launchd_plist / launchdPlist and reinstall")
+    if marker["kind"] == "conflict":
+        return "%s: %s" % (fs.marker_conflict_message(marker), fix)
+    if marker["kind"] == "supervised":
+        return "the marker names %s, not launchd: %s" % (marker["manager"], fix)
+    if marker.get("unreadable") is not None:
+        return "the marker %r names no supervisor: %s" % (marker["unreadable"], fix)
+    return "no %s=launchd: %s" % (fs.SUPERVISOR_ENV, fix)
+
+
+def priority_problems(plist: dict) -> list:
+    """A service that answers hosts and agents must not be scheduled as background work."""
+    out = []
+    if plist.get("ProcessType", "Standard") in ("Background", "Adaptive"):
+        out.append("ProcessType is %s" % plist.get("ProcessType"))
+    if isinstance(plist.get("Nice"), int) and plist["Nice"] > 0:
+        out.append("Nice is %d" % plist["Nice"])
+    if plist.get("LowPriorityIO") is True or plist.get("LowPriorityBackgroundIO") is True:
+        out.append("low-priority I/O")
+    return out
+
+
+# A platform router (Heroku, Fly, Render, a CDN) routes by Host, so a request naming a foreign
+# Host never reaches an online service: the router itself answers, typically 404 or 421. That is
+# still a refusal — the service disclosed nothing — so for a remote placement the host check
+# accepts it, as long as the body is not the well-known document. Every other guard request names
+# the right Host, reaches the service, and must be the service's own 403.
+PLATFORM_HOST_REFUSALS = (400, 404, 421)
+
+
+def guard_verdict(rule: str, remote: bool, status: int, body: bytes) -> Tuple[str, str]:
+    if status == 403:
+        return "PASS", "HTTP 403"
+    disclosed = b"fabric-service/" in (body or b"")
+    if rule == "network.host-check" and remote and status in PLATFORM_HOST_REFUSALS and not disclosed:
+        return "PASS", "HTTP %d from the platform router: a foreign Host never reaches the service" % status
+    return "FAIL", "HTTP %d%s" % (status, ", and the body is the well-known document" if disclosed else "")
+
+
+def board_responder_verdict(wk: Any, kit: Optional[str] = None) -> Tuple[str, str]:
+    """board.responder: NOT_RUN when the well-known document declares no fabric-project-comms revision; FAIL when it
+    declares one this kit does not read or the kit's fixture conversation finds a problem; PASS otherwise. `kit` is the
+    service's own copy (a .py or .mjs path); by default the kit beside this probe."""
+    protocols = wk.get("protocols") if isinstance(wk, dict) else None
+    declared = [p for p in protocols if isinstance(p, str) and p.startswith("fabric-project-comms/")] if isinstance(protocols, list) else []
+    if not declared:
+        return "NOT_RUN", "the service declares no board participation (no fabric-project-comms revision in protocols)"
+    accepted = fs.accepted_revisions("fabric-project-comms")
+    unread = [p for p in declared if "error" in fs.negotiate_revision(p, accepted)]
+    if unread:
+        return "FAIL", "declares %s, which this kit does not read (it reads %s)" % (", ".join(unread), ", ".join(accepted))
+    try:
+        if kit and kit.endswith(".mjs"):
+            if not shutil.which("node"):
+                return "NOT_RUN", "node is not installed to run %s's fixture conversation" % kit
+            url = Path(kit).resolve().as_uri()
+            out = subprocess.run(["node", "--input-type=module", "-e",
+                                  "import(process.env.FABRIC_BOARD_KIT).then(async (m) => console.log(JSON.stringify(await m.selfCheck())))"],
+                                 env=dict(os.environ, FABRIC_BOARD_KIT=url), capture_output=True, text=True, timeout=60)
+            problems = json.loads(out.stdout.strip().splitlines()[-1]) if out.returncode == 0 and out.stdout.strip() else ["the Node kit did not run: %s" % out.stderr.strip()[:200]]
+        else:
+            # A clean interpreter: the kit is several modules (FAA-65), and modules this probe already imported from
+            # beside it would stand in for the copy under test.
+            path = Path(kit) if kit else Path(__file__).resolve().parent / "fabric_board.py"
+            code = ("import json, sys; sys.path.insert(0, sys.argv[1]); import %s as board; "
+                    "print(json.dumps(board.self_check()))" % path.stem)
+            out = subprocess.run([sys.executable, "-E", "-s", "-c", code, str(path.resolve().parent)], capture_output=True,
+                                 text=True, timeout=60, cwd=str(path.resolve().parent))
+            problems = json.loads(out.stdout.strip().splitlines()[-1]) if out.returncode == 0 and out.stdout.strip() else ["the kit did not run: %s" % out.stderr.strip()[-200:]]
+    except Exception as exc:  # noqa: BLE001 - a kit that cannot run its conversation fails the rule
+        return "FAIL", "the kit's fixture conversation did not run: %s" % exc.__class__.__name__
+    if problems:
+        return "FAIL", "; ".join(problems)
+    return "PASS", "declares %s; the kit%s answers the fixture conversation (whole, fenced, no epoch)" % (
+        ", ".join(declared), " at %s" % kit if kit else " beside this probe")
+
+
+def session_lifetime_problem(set_cookie: str, now: Optional[float] = None) -> Optional[str]:
+    """DEC-0039: a session cookie set at sign-in lives at most 7 days. Max-Age wins over Expires (RFC 6265
+    §5.3); a cookie with neither ends with the browser session. None when it is within the bound."""
+    attrs = {}
+    for part in set_cookie.split(";")[1:]:
+        name, _, value = part.strip().partition("=")
+        attrs[name.strip().lower()] = value.strip()
+    bound = fs.OPERATOR_SESSION_MAX_SECONDS
+    if "max-age" in attrs:
+        if not re.fullmatch(r"-?\d+", attrs["max-age"]):
+            return "the session cookie's Max-Age %r is not a number" % attrs["max-age"]
+        if int(attrs["max-age"]) > bound:
+            return "the session cookie's Max-Age %s outlives 7 days (%d s, DEC-0039)" % (attrs["max-age"], bound)
+        return None
+    if "expires" in attrs:
+        try:
+            at = email.utils.parsedate_to_datetime(attrs["expires"]).timestamp()
+        except (TypeError, ValueError, IndexError, OverflowError):
+            return "the session cookie's Expires %r is not a date" % attrs["expires"]
+        if at - (time.time() if now is None else now) > bound:
+            return "the session cookie's Expires %s outlives 7 days (DEC-0039)" % attrs["expires"]
+    return None
+
+
+def _semver(text: str) -> Tuple[int, int, int]:
+    m = re.match(r"^(\d+)\.(\d+)\.(\d+)", text or "")
+    return (int(m.group(1)), int(m.group(2)), int(m.group(3))) if m else (0, 0, 0)
+
+
+def usage_problems(report: Any, service_id: str, instance: str) -> List[str]:
+    """What makes this not a DEC-0021 usage report of the service: shape, identity and the sums of
+    FAC-SEM-025. An unknown cost must be null; a day's totals are the sums of its models."""
+    if not isinstance(report, dict):
+        return ["not an object"]
+    out: List[str] = []
+    if report.get("protocol") != fs.PROTOCOL:
+        out.append("protocol is %r" % report.get("protocol"))
+    if report.get("service") != {"id": service_id, "instance": instance}:
+        out.append("reports for %r, not %s.%s" % (report.get("service"), service_id, instance))
+    if report.get("currency") != "USD":
+        out.append("currency is not USD")
+    days = report.get("days")
+    if not isinstance(days, list) or len(days) > fs.USAGE_DAYS:
+        return out + ["days is not a list of at most 31"]
+    # The arithmetic of FAC-SEM-025 is the kit's `usage_findings`, the contract's `usageRules` held to its vectors: one
+    # implementation, so the probe never disagrees with the kit and never throws on a count that is not a number.
+    for i, day in enumerate(days):
+        if not isinstance(day, dict):
+            out.append("days[%d]: not an object" % i)
+            continue
+        if not isinstance(day.get("byModel"), list):
+            out.append("days[%d]: byModel missing" % i)
+            continue
+        for row, at in [(day, "days[%d]" % i)] + [(m, "days[%d].byModel[%d]" % (i, j)) for j, m in enumerate(day["byModel"]) if isinstance(m, dict)]:
+            cost = row.get("costUsd")
+            if cost is not None and (isinstance(cost, bool) or not isinstance(cost, (int, float)) or cost < 0):
+                out.append("%s: costUsd is not a non-negative number" % at)
+        for j, m in enumerate(day["byModel"]):
+            # DEC-0046, DEC-0061: a row's route is a login in its vendor's runner, an issued key, or the platform's
+            # own metered models (a listing in the cloud).
+            if isinstance(m, dict) and "route" in m and m["route"] not in fs.USAGE_ROUTES:
+                out.append("days[%d].byModel[%d]: route %r is not subscription, key or platform-metered" % (i, j, m["route"]))
+    for finding in fs.usage_findings(report):
+        out.append("%s: %s" % (finding["instancePath"] or "/", finding["message"]))
+    return out
+
+
+def same_repository(a: str, b: str) -> bool:
+    """git@github.com:o/r.git, https://github.com/o/r and github.com/o/r are one repository."""
+    def norm(u: str) -> str:
+        u = u.strip().lower()
+        u = re.sub(r"^git@([^:]+):", r"\1/", u)
+        u = re.sub(r"^[a-z+]+://", "", u)
+        u = re.sub(r"^[^@/]+@", "", u)
+        return re.sub(r"\.git$", "", u).rstrip("/")
+    return bool(a and b) and norm(a) == norm(b)

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/dashboard_kit.py

@@ -408,7 +408,7 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
             for c in report["copies"]:
                 print("  %-8s %s (%s)" % (c["state"], c["path"], c["version"] or "no version marker"))
             if not report["copies"]:
-                print("  no kit copy" + (" — services %s declare a dashboard" % ", ".join(report["services"])
+                print("  no kit copy" + (" (services %s declare a dashboard)" % ", ".join(report["services"])
                                          if report["dashboard"] and report["services"] else ""))
             if report["services"]:
                 print("  services from this repository: %s" % ", ".join(report["services"]))