@passioncode-ai/fabric-agent-adapter 0.40.0 → 0.41.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_board_shapes.py

@@ -54,7 +54,7 @@ EFFECT_STATES = ("not_started", "started", "succeeded_observed", "failed_observe
 
 
 #: DEC-0079: what an operator's hold may refuse, by the scopes that refuse it. A tool not named here is never refused
-#: `held` — it settles, reports on or keeps alive started work (com.renew, com.progress, com.complete, com.reconcile),
+#: `held`: it settles, reports on or keeps alive started work (com.renew, com.progress, com.complete, com.reconcile),
 #: cancels or reads. The contract's HOLD_SCOPES.
 HOLD_SCOPES = {"com.submit": ("thread",), "com.reply": ("thread",), "com.enroll": ("project", "slot"),
                "com.responder_replace": ("project", "slot"), "com.claim": ("thread", "project", "slot"),
@@ -87,7 +87,7 @@ _SAFE = 2 ** 53 - 1
 
 class BoardError(Exception):
     """A board refusal (`code` from the contract's refusal codes) or a kit fault: `unreachable` (the hub did not answer;
-    a write may have been stored — send it again with the same key), `session-ended`, `not-in-scope`, `receipt-shape`,
+    a write may have been stored, so send it again with the same key), `session-ended`, `not-in-scope`, `receipt-shape`,
     `schema-unsupported`, `no-epoch`, `checkpoint`, `digest-mismatch`, `not-addressed`, `directory-invalid`,
     `evidence`, `observation_required`. `str()` is one sentence and never carries a token or a body."""
 
@@ -264,7 +264,7 @@ def refusal_problems(value: Any) -> List[str]:
 
 def directory_findings(page: Any) -> List[Dict[str, str]]:
     """FAC-SEM-107 (DEC-0077), the contract's `commsDirectory`: a Project listed twice, or a capability listed twice
-    within a Project, compared exactly as written (Project ids are opaque and capability names are names, not URIs —
+    within a Project, compared exactly as written (Project ids are opaque and capability names are names, not URIs,
     so not by normal form). The finding names the second entry. Never raises."""
     findings: List[Dict[str, str]] = []
     projects = page.get("projects") if isinstance(page, dict) else None
@@ -366,7 +366,7 @@ def hold_refuses(tool: Any, target: Any, holds: Any) -> bool:
 
 
 def find_project(page: Any, project_id: str, capability: Optional[str] = None) -> Optional[Dict[str, Any]]:
-    """Look a Project up in one `com.directory` page (read by a Project session — a board session is not served the
+    """Look a Project up in one `com.directory` page (read by a Project session; a board session is not served the
     directory). The page is checked first: a page the contract would refuse, FAC-SEM-107 included, raises
     `BoardError("directory-invalid")` instead of answering from it. Ids and capability names compare exactly as
     written (DEC-0077). Answers the entry, or None when the page does not list it (or lists it without `capability`):

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_ceremonies.py

@@ -29,7 +29,6 @@ from pathlib import Path
 from typing import Any, Dict, List, Optional
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
-import fabric_delegation as _delegation  # noqa: E402 - beside this file: RFC 8785
 import fabric_estate as _estate  # noqa: E402 - beside this file: passkey assertions, times, show
 
 ENROLL_TOKEN_SCHEMA = "enroll-token/1"

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_crypto.py

@@ -2,19 +2,22 @@
 
 - ``ed25519_verify(public_key, message, signature)`` (RFC 8032) and ``is_small_order_key`` with
   ``SMALL_ORDER_ENCODINGS``: a key of small order verifies forged signatures and is refused (DEC-0045).
-- ``is_valid_p256_key`` and ``es256_verify`` (ECDSA P-256 over SHA-256, DER or raw signatures) for passkeys.
+- ``is_valid_p256_key`` and ``es256_verify`` (ECDSA P-256 over SHA-256, the signature in DER) for passkeys.
+- ``ed25519_sign`` and ``ed25519_seed_public_key`` (RFC 8032), which ``fabric_package`` signs with, over ``ed_mul_secret``.
 - base64url without padding (``b64url``, ``b64url_bytes``, ``node_base64``) and ``sha256``.
 
-Pure Python over integers: slow next to OpenSSL, constant inputs only, verification only. Nothing here signs.
-Standard library only; imports only ``fabric_jsvalue``.
+Pure Python over integers, slow next to OpenSSL. Verification multiplies public values only and takes the short path;
+a secret scalar goes through ``ed_mul_secret``, a ladder that runs the same 256 steps whatever its bits are (FAA-78,
+finding 45). Python's integers do not promise constant-time arithmetic, so that removes the branch on the secret, not
+every timing difference: the signer stays a local, one-shot command line, never a service that signs for others.
+Standard library only; imports no other kit module.
 """
 from __future__ import annotations
 
 import base64
 import hashlib
-import re
-from typing import Any, Optional, Tuple
 import secrets
+from typing import Optional, Tuple
 
 
 # The small-order points of edwards25519 and their non-canonical encodings, sign bit cleared (the contract's
@@ -67,6 +70,50 @@ def _ed_mul(scalar: int, point: Tuple[int, int, int, int]) -> Tuple[int, int, in
     return result
 
 
+def _ed_cswap(a: Tuple[int, int, int, int], b: Tuple[int, int, int, int], bit: int) -> Tuple[Tuple[int, int, int, int], Tuple[int, int, int, int]]:
+    """``(b, a)`` when ``bit`` is 1, ``(a, b)`` when it is 0, by arithmetic rather than a branch on ``bit``."""
+    deltas = [(x - y) * bit for x, y in zip(a, b)]
+    return (tuple(x - d for x, d in zip(a, deltas)), tuple(y + d for y, d in zip(b, deltas)))  # type: ignore[return-value]
+
+
+def ed_mul_secret(scalar: int, point: Tuple[int, int, int, int]) -> Tuple[int, int, int, int]:
+    """``[scalar]point`` for a secret scalar below 2**256: a Montgomery ladder over all 256 bits with a conditional
+    swap, so every scalar takes one addition and one doubling per bit and no step depends on a bit (finding 45). The
+    addition law is complete on edwards25519, so the ladder needs no special case for the identity or a doubling."""
+    r0, r1 = (0, 1, 1, 0), point
+    for i in range(255, -1, -1):
+        bit = (scalar >> i) & 1
+        r0, r1 = _ed_cswap(r0, r1, bit)
+        r1 = _ed_add(r0, r1)
+        r0 = _ed_add(r0, r0)
+        r0, r1 = _ed_cswap(r0, r1, bit)
+    return r0
+
+
+def _secret_scalar(seed: bytes) -> Tuple[int, bytes]:
+    h = hashlib.sha512(seed).digest()
+    a = int.from_bytes(h[:32], "little")
+    a &= (1 << 254) - 8
+    a |= 1 << 254
+    return a, h[32:]
+
+
+def ed25519_seed_public_key(seed: bytes) -> bytes:
+    """The 32-byte public key of a 32-byte Ed25519 seed (RFC 8032 §5.1.5)."""
+    return _ed_encode_point(ed_mul_secret(_secret_scalar(seed)[0], _ED_G))
+
+
+def ed25519_sign(seed: bytes, message: bytes) -> bytes:
+    """A deterministic Ed25519 signature (RFC 8032 §5.1.6); the same seed and message give the bytes Node's crypto.sign
+    gives. Both secret multiplications (the key's scalar, the nonce) go through ``ed_mul_secret``."""
+    a, prefix = _secret_scalar(seed)
+    public = _ed_encode_point(ed_mul_secret(a, _ED_G))
+    r = int.from_bytes(hashlib.sha512(prefix + message).digest(), "little") % _ED_L
+    big_r = _ed_encode_point(ed_mul_secret(r, _ED_G))
+    k = int.from_bytes(hashlib.sha512(big_r + public + message).digest(), "little") % _ED_L
+    return big_r + ((r + k * a) % _ED_L).to_bytes(32, "little")
+
+
 def _ed_decode_point(data: bytes) -> Optional[Tuple[int, int, int, int]]:
     if len(data) != 32:
         return None

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -16,8 +16,8 @@ R compared by its encoding).
 
 from __future__ import annotations
 
-import base64
 import hashlib
+import http.client
 import ipaddress
 import json
 import math
@@ -36,14 +36,14 @@ from pathlib import Path as _Path  # noqa: E402
 if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from any working directory (FAA-65)
     _sys.path.insert(0, str(_Path(__file__).resolve().parent))
 from fabric_crypto import (  # noqa: E402 - the core (FAA-65)
-    SMALL_ORDER_ENCODINGS,
-    _ED_P as _P,
-    _ed_decode_point as _decode_point,
+    SMALL_ORDER_ENCODINGS,  # noqa: F401 - public here since v0.39.1 (test/fixtures/kit-api)
+    b64url as _b64encode,
     b64url_decode as _b64decode,
     ed25519_verify,
     is_small_order_key,
 )
 from fabric_jsvalue import (  # noqa: E402 - the core (FAA-65)
+    MISSING as _MISSING,
     jcs,
 )
 
@@ -65,6 +65,8 @@ JWKS_MAX_AGE_SECONDS = 600
 JWKS_REREAD_SECONDS = 60
 # After a failed read, wait this long before trying again, so a down issuer does not cost every call a fetch.
 JWKS_RETRY_SECONDS = 10
+# One read of the key set, headers and body together, ends within this many seconds (Node's AbortSignal.timeout(5000)).
+JWKS_FETCH_SECONDS = 5.0
 # JavaScript's String.prototype.trim set, so a header is trimmed as the contract's verifier trims it.
 _JS_WHITESPACE = "\t\n\v\f\r \u00a0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u2028\u2029\u202f\u205f\u3000\ufeff"
 
@@ -91,16 +93,15 @@ REFUSAL_MESSAGES = {
     "unknown-state": "The state cannot be established, so the call is refused.",
 }
 
-_B64URL = re.compile(r"^[A-Za-z0-9_-]+$")
+_B64URL = re.compile(r"^[A-Za-z0-9_-]+\Z")
 # DL-2's grammar, as the contract's verifier types the claims (DEC-0045): an agent id, an opaque session or task id,
 # a URI, a jti and a scope.
-AGENT_ID = re.compile(r"^[a-z][a-z0-9-]{1,62}(\.[a-z][a-z0-9-]{0,31})?$")
-OPAQUE_ID = re.compile(r"^[A-Za-z0-9._:-]{1,128}$")
-_URI = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:\S+$")
-_JTI = re.compile(r"^[A-Za-z0-9._~-]{16,128}$")
-_SCOPE = re.compile(r"^[a-z][a-z0-9._-]{1,127}( [a-z][a-z0-9._-]{1,127})*$")
+AGENT_ID = re.compile(r"^[a-z][a-z0-9-]{1,62}(\.[a-z][a-z0-9-]{0,31})?\Z")
+OPAQUE_ID = re.compile(r"^[A-Za-z0-9._:-]{1,128}\Z")
+_URI = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:\S+\Z")
+_JTI = re.compile(r"^[A-Za-z0-9._~-]{16,128}\Z")
+_SCOPE = re.compile(r"^[a-z][a-z0-9._-]{1,127}( [a-z][a-z0-9._-]{1,127})*\Z")
 _SPEND_WINDOWS = ("total", "task", "project", "day", "week", "month")
-_MISSING = object()
 
 
 def _full(pattern: "re.Pattern[str]", value: Any) -> bool:
@@ -224,7 +225,8 @@ def _key_for(jwks: Dict[str, Any], kid: str) -> Dict[str, Any]:
         raw = _b64decode(jwk["x"])
     except ValueError:
         return {"problem": "unusable-key"}
-    if len(raw) != 32:
+    # D4: exactly the 43 characters that write 32 bytes, so the key compared with the estate record is one string.
+    if len(raw) != 32 or _b64encode(raw) != jwk["x"]:
         return {"problem": "unusable-key"}
     if is_small_order_key(raw):
         return {"problem": "small-order-key"}  # refused before any verification (DEC-0045, CT-29)
@@ -379,24 +381,27 @@ def _readable_clock(now: Any) -> bool:
         return False
 
 
-def _estate_problem(estate: Any, kid: str, x: str, now: float, applied: Any = None,
-                    revocations: Any = None) -> Optional[Tuple[str, str]]:
+def _estate_problem(estate: Any, kid: str, x: str, now: float, applied: Any = _MISSING,
+                    revocations: Any = _MISSING) -> Optional[Tuple[str, str]]:
     """DL-14 row 4a (DEC-0055, DEC-0060), right after the signature: when the callee reads the estate record, the
     token's kid and the published key must be certified by that revision. `estate` is a revision the caller verified
-    (fabric_estate.verify_estate_record) and its machine applied, or a callable returning it; None skips the rule (a
-    callable returning None is an unreadable source). `applied` is the highest revision the machine applied
-    (`{"revision", "digest"?}`); `revocations` the revocation delta's entries applied since (a list or a callable). A
-    source that raises is unreadable, never a pass. Returns ("token" | "issuer", detail) or None."""
-    if estate is None:
+    (fabric_estate.verify_estate_record) and its machine applied, or a callable returning it; only an omitted `estate`
+    skips the rule, and None (given, or returned by the callable) is an unreadable source, as Node's null is (D3).
+    `applied` is the highest revision the machine applied (`{"revision", "digest"?}`); `revocations` the revocation
+    delta's entries applied since (a list or a callable). An omitted one is absent; None is unreadable. A source that
+    raises is unreadable, never a pass. Returns ("token" | "issuer", detail) or None."""
+    if estate is _MISSING:
         return None
     try:
         record = estate() if callable(estate) else estate
         extra = revocations() if callable(revocations) else revocations
     except Exception:
         return ("issuer", "estate-unreadable")
+    if applied is None:  # the contract's hubKeyCertified refuses a null applied mark after its record checks: unreadable
+        return ("issuer", "estate-unreadable")
     import fabric_estate  # beside this file; imported here, since fabric_estate imports this module
-    verdict = fabric_estate.hub_key_certified(record, kid, x, now, applied,
-                                              fabric_estate._MISSING if extra is None else extra)
+    given = {} if applied is _MISSING else {"applied": applied}
+    verdict = fabric_estate.hub_key_certified(record, kid, x, now, extra_revocations=extra, **given)
     if verdict["certified"]:
         return None
     # The clock was refused before row 1, so a verdict here is the token's or the trust source's.
@@ -404,8 +409,8 @@ def _estate_problem(estate: Any, kid: str, x: str, now: float, applied: Any = No
 
 
 def verify_delegation(token: Any, *, audience: str, jwks: Any, now: float, capability: str, effect: str,
-                      issuer: Optional[str], read_only: bool = False, estate: Any = None,
-                      estate_applied: Any = None, estate_revocations: Any = None) -> Dict[str, Any]:
+                      issuer: Optional[str], read_only: bool = False, estate: Any = _MISSING,
+                      estate_applied: Any = _MISSING, estate_revocations: Any = _MISSING) -> Dict[str, Any]:
     """DL-13, in its fixed order: nothing about a token is believed before its signature is.
     `now` is seconds since the epoch. Returns {ok: True, claims, principal, caller, chain, kid} or a refusal
     {ok: False, code, detail[, data]} whose detail is a short machine word, never the token. `issuer` is required.
@@ -525,8 +530,8 @@ UNSAFE_NO_JTI_STORE = _NoReplayProtection()
 
 
 def verify_approval(approval: Optional[str], *, audience: str, jwks: Any, now: float, action_digest: str,
-                    jti_store: Any, issuer: Optional[str], estate: Any = None, estate_applied: Any = None,
-                    estate_revocations: Any = None) -> Dict[str, Any]:
+                    jti_store: Any, issuer: Optional[str], estate: Any = _MISSING, estate_applied: Any = _MISSING,
+                    estate_revocations: Any = _MISSING) -> Dict[str, Any]:
     """DL-18: a missing approval is approval-required carrying the action digest; any fault of the document is
     approval-invalid; a second use is approval-reused. The jti is consumed last."""
     if approval is None or approval == "":
@@ -624,18 +629,60 @@ class _NoRedirect(urllib.request.HTTPRedirectHandler):
         return None
 
 
-_OPENER = urllib.request.build_opener(_NoRedirect)
+def _opener(deadline: Dict[str, Any]) -> urllib.request.OpenerDirector:
+    """No redirect, and a timer that shuts the socket down at the deadline: a socket timeout bounds one read, so an
+    issuer trickling a byte a second would otherwise hold the caller for as long as it likes (finding 13)."""
+    def watched(base: type) -> type:
+        class Watched(base):  # type: ignore[misc, valid-type]
+            def connect(self) -> None:
+                super().connect()
+                sock = self.sock
+
+                def fire() -> None:
+                    deadline["fired"] = True
+                    try:
+                        sock.shutdown(2)  # socket.SHUT_RDWR
+                    except OSError:
+                        pass
+                timer = threading.Timer(max(0.0, deadline["end"] - time.monotonic()), fire)
+                timer.daemon = True
+                deadline["timer"] = timer
+                timer.start()
+        return Watched
+
+    class Http(urllib.request.HTTPHandler):
+        def http_open(self, req: Any) -> Any:
+            return self.do_open(watched(http.client.HTTPConnection), req)
+
+    class Https(urllib.request.HTTPSHandler):
+        def https_open(self, req: Any) -> Any:
+            return self.do_open(watched(http.client.HTTPSConnection), req, context=self._context)
+    return urllib.request.build_opener(_NoRedirect, Http, Https)
 
 
 def _fetch(source: str) -> Any:
     if source.startswith(("https://", "http://")):
         request = urllib.request.Request(source, headers={"Accept": "application/json"})
+        deadline: Dict[str, Any] = {"end": time.monotonic() + JWKS_FETCH_SECONDS, "fired": False, "timer": None}
         try:
-            with _OPENER.open(request, timeout=5) as response:  # https or loopback http only, no redirect
-                return json.loads(response.read(65537)[:65536])
+            with _opener(deadline).open(request, timeout=JWKS_FETCH_SECONDS) as response:  # https or loopback http only
+                body = b""
+                while len(body) <= 65536 and not deadline["fired"]:
+                    chunk = response.read1(65537 - len(body))
+                    if not chunk:
+                        break
+                    body += chunk
+            if deadline["fired"] or time.monotonic() > deadline["end"]:
+                raise TimeoutError("the key set did not arrive within %s s" % JWKS_FETCH_SECONDS)
+            return json.loads(body[:65536])
         except urllib.error.HTTPError as exc:
             exc.close()
             raise
+        except http.client.HTTPException as exc:  # a garbage status line or headers: the issuer cannot be read
+            raise ConnectionError(type(exc).__name__) from None
+        finally:
+            if deadline["timer"] is not None:
+                deadline["timer"].cancel()
     return json.loads(Path(source).expanduser().read_text())
 
 
@@ -663,28 +710,37 @@ class JwksCache:
         self._tried_at = -math.inf
         self._reread_at = -math.inf  # the last re-read for a kid the set did not hold
         self._lock = threading.Lock()
-
-    def _read(self, now: float) -> None:
-        self._tried_at = now
-        try:
-            value = self._fetch(self.source)
-        except (OSError, ValueError):
-            return
-        if _has_keys(value):
-            self._keys, self._read_at = value, now
+        self._pending: Optional[threading.Event] = None
 
     def get(self, kid: Optional[str] = None) -> Optional[Dict[str, Any]]:
+        """The key set, or None. The read runs outside the lock (finding 13): a caller whose kid the set holds never
+        waits on another caller's fetch, and one read at a time goes out, as Node's `pending` does."""
+        leader, waiting = False, None
         with self._lock:
             now = self._clock()
             fresh = now - self._read_at < JWKS_MAX_AGE_SECONDS
             known = self._keys is not None and (kid is None or any(isinstance(k, dict) and k.get("kid") == kid for k in self._keys["keys"]))
-            if not fresh:
-                if now - self._tried_at >= JWKS_RETRY_SECONDS:
-                    self._read(now)
-            elif not known and now - self._reread_at >= JWKS_REREAD_SECONDS:
+            due = (not fresh and now - self._tried_at >= JWKS_RETRY_SECONDS) or (fresh and not known and now - self._reread_at >= JWKS_REREAD_SECONDS)
+            if due and fresh:
                 self._reread_at = now
-                self._read(now)
-            return self._keys if now - self._read_at < JWKS_MAX_AGE_SECONDS else None
+            if due and self._pending is None:
+                self._pending, self._tried_at, leader = threading.Event(), now, True
+            elif due:
+                waiting = self._pending
+        if leader:
+            try:
+                value = self._fetch(self.source)
+            except Exception:  # noqa: BLE001 - whatever a source raises leaves the set unread; the age check decides
+                value = None
+            with self._lock:
+                if _has_keys(value):
+                    self._keys, self._read_at = value, now
+                done, self._pending = self._pending, None
+            done.set()
+        elif waiting is not None:
+            waiting.wait(JWKS_FETCH_SECONDS + 1)
+        with self._lock:
+            return self._keys if self._clock() - self._read_at < JWKS_MAX_AGE_SECONDS else None
 
 
 def _kid_of(token: str) -> Optional[str]:
@@ -699,8 +755,8 @@ TIERS = ("T0", "T1", "T2")
 
 
 def delegation_gate(*, audience: str, jwks: Any, effects: Mapping[str, str], issuer: str,
-                    read_only: bool = False, clock: Callable[[], float] = time.time, estate: Any = None,
-                    estate_applied: Any = None, estate_revocations: Any = None) -> Callable[..., Dict[str, Any]]:
+                    read_only: bool = False, clock: Callable[[], float] = time.time, estate: Any = _MISSING,
+                    estate_applied: Any = _MISSING, estate_revocations: Any = _MISSING) -> Callable[..., Dict[str, Any]]:
     """A check for one tools/call: `gate(tool, headers, tier="T2")` answers the accepted delegation or a DL-19
     refusal. `effects` maps each tool to its declared effect class (its manifest entry); a tool with none is
     refused rather than guessed. `jwks` is a JwksCache or a key set; `issuer` (auth.delegation.issuer) is required.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_descriptor.py

@@ -45,7 +45,7 @@ from fabric_usage import (
 DASHBOARD_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1"
 
 
-DASHBOARD_KIT = "fabric-dashboard-kit@1.1.1"
+DASHBOARD_KIT = "fabric-dashboard-kit@1.1.2"
 
 
 REFERENCE_THEMES = ("graphite", "fabric", "paper", "forest", "ocean", "ember", "contrast")
@@ -54,14 +54,14 @@ REFERENCE_THEMES = ("graphite", "fabric", "paper", "forest", "ocean", "ember", "
 STATUSES = ("starting", "ready", "degraded", "stopping")
 
 
-_ORIGIN = re.compile(r"^http://127\.0\.0\.1:([0-9]{3,5})$")
+_ORIGIN = re.compile(r"^http://127\.0\.0\.1:([0-9]{3,5})\Z")
 
 
 # DEC-0019: a remote placement — an online agent or dashboard — lives at an https DNS name.
-_REMOTE_ORIGIN = re.compile(r"^https://((?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(?::([0-9]{1,5}))?$")
+_REMOTE_ORIGIN = re.compile(r"^https://((?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(?::([0-9]{1,5}))?\Z")
 
 
-_RESERVED_HOST = re.compile(r"(^|\.)(localhost|local|internal|home\.arpa|lan|localdomain)$")
+_RESERVED_HOST = re.compile(r"(^|\.)(localhost|local|internal|home\.arpa|lan|localdomain)\Z")
 
 
 PLACEMENTS = ("local", "remote")
@@ -213,13 +213,13 @@ CREDENTIAL_KINDS = ("subscription", "key", "platform-metered", "none")
 SUBSCRIPTION_RUNNERS = {"claude-code": "claude", "kimi-code": "kimi", "codex": "chatgpt"}
 
 
-_PEER_ENDPOINT = re.compile(r"^https://(?P<host>([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?$", re.ASCII)
+_PEER_ENDPOINT = re.compile(r"^https://(?P<host>([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?\Z", re.ASCII)
 
 
-_RESIDENCY = re.compile(r"^(A[B-Z]|[B-PR-WY][A-Z]|Q[A-L]|Z[A-Y])$", re.ASCII)
+_RESIDENCY = re.compile(r"^(A[B-Z]|[B-PR-WY][A-Z]|Q[A-L]|Z[A-Y])\Z", re.ASCII)
 
 
-_RUNNER_KIND_NAME = re.compile(r"^[a-z][a-z0-9-]{1,62}$", re.ASCII)
+_RUNNER_KIND_NAME = re.compile(r"^[a-z][a-z0-9-]{1,62}\Z", re.ASCII)
 
 
 def _pointer(name: str) -> str:
@@ -451,10 +451,10 @@ def build_info(repo_root: Optional[Path] = None, package_file: Optional[Path] =
     return info
 
 
-_THEME_ID = re.compile(r"^[a-z][a-z0-9-]{0,31}$")
+_THEME_ID = re.compile(r"^[a-z][a-z0-9-]{0,31}\Z")
 
 
-_KIT_REF = re.compile(r"^[a-z][a-z0-9-]{0,63}@(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$")
+_KIT_REF = re.compile(r"^[a-z][a-z0-9-]{0,63}@(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?\Z", re.ASCII)
 
 
 def dashboard_extension_problems(value: Any) -> List[str]:
@@ -502,13 +502,13 @@ def dashboard_extension(min_width: int = 360, appearance: Sequence[str] = ("sche
     return {DASHBOARD_EXTENSION_KEY: value}
 
 
-_PROFILE_ID = re.compile(r"^[a-z][a-z0-9-]{0,62}$")
+_PROFILE_ID = re.compile(r"^[a-z][a-z0-9-]{0,62}\Z")
 
 
-_RUNNER_KIND = re.compile(r"^[a-z][a-z0-9-]{1,62}$")
+_RUNNER_KIND = re.compile(r"^[a-z][a-z0-9-]{1,62}\Z")
 
 
-_MODEL_ID = re.compile(r"^[a-z0-9][a-z0-9._-]{0,63}/[a-z0-9][a-z0-9._:-]{0,127}$")
+_MODEL_ID = re.compile(r"^[a-z0-9][a-z0-9._-]{0,63}/[a-z0-9][a-z0-9._:-]{0,127}\Z")
 
 
 def configuration_problems(doc: Any) -> List[str]:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_estate.py

@@ -20,7 +20,6 @@ in ``fabric_delegation``.
 from __future__ import annotations
 
 import base64
-import datetime as _dt
 import hashlib
 import json
 import math
@@ -397,12 +396,13 @@ def _revision_number(value: Any) -> bool:
     return _safe_integer(value) and value >= 1
 
 
-def hub_key_certified(record: Any, kid: Any, x: Any, at: Any, applied: Any = None,
+def hub_key_certified(record: Any, kid: Any, x: Any, at: Any, applied: Any = _MISSING,
                       extra_revocations: Any = _MISSING) -> Dict[str, Any]:
     """DL-14 (DEC-0055, DEC-0060): whether ``record`` certifies the delegation key ``kid`` with the published key's ``x``
     at ``at`` (an aware datetime or epoch seconds), for a verifier whose machine applied ``applied``
-    (``{"revision", "digest"?}``). ``extra_revocations`` are the revocation delta's entries applied since the revision
-    (DEC-0054). The contract's ``hubKeyCertified``, in its order; never raises. Answers ``{"certified": True, "machine",
+    (``{"revision", "digest"?}``; ``_MISSING``, the default, when none is known; an explicit None is no revision and
+    fails closed as ``estate-unreadable``, as Node's null does, decision D3). ``extra_revocations`` are the revocation
+    delta's entries applied since the revision (DEC-0054). The contract's ``hubKeyCertified``, in its order; never raises. Answers ``{"certified": True, "machine",
     "revision"}`` or ``{"certified": False, "fault": "token"|"estate"|"clock", "detail"}`` with detail
     ``kid-not-certified`` (the token's fault), ``estate-unreadable``, ``estate-outside-window``, ``estate-rolled-back``,
     ``estate-forked`` (the trust source's) or ``no-clock``."""
@@ -421,7 +421,7 @@ def hub_key_certified(record: Any, kid: Any, x: Any, at: Any, applied: Any = Non
     # A window that is not a time, not positive or longer than 30 days is no window: NaN fails every comparison below.
     if math.isnan(issued_at) or math.isnan(valid_until) or valid_until <= issued_at or valid_until - issued_at > _MAX_WINDOW_MS:
         return _refused("estate", "estate-unreadable")
-    if applied is not None:
+    if applied is not _MISSING:
         if (not isinstance(applied, dict) or not _revision_number(_get(applied, "revision"))
                 or (_get(applied, "digest") is not _MISSING and not isinstance(_get(applied, "digest"), str))):
             return _refused("estate", "estate-unreadable")

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_events.py

@@ -14,6 +14,7 @@ if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from
 from fabric_base import (
     ServiceError,
     now_iso,
+    store_lock,
 )
 from fabric_paths import (
     atomic_write,
@@ -32,13 +33,13 @@ EVENTS_MAX_LIMIT = 200
 LEVELS = ("info", "notice", "warning", "error")
 
 
-_KIND = re.compile(r"^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*){0,5}$")
+_KIND = re.compile(r"^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*){0,5}\Z")
 
 
-_TRACE_ID = re.compile(r"^(?!0{32}$)[0-9a-f]{32}$")
+_TRACE_ID = re.compile(r"^(?!0{32}\Z)[0-9a-f]{32}\Z")
 
 
-_SPAN_ID = re.compile(r"^(?!0{16}$)[0-9a-f]{16}$")
+_SPAN_ID = re.compile(r"^(?!0{16}\Z)[0-9a-f]{16}\Z")
 
 
 def make_event(event_id: Any, at: str, kind: str, level: str, text: str, *, subject: Optional[Dict[str, str]] = None,
@@ -105,6 +106,7 @@ class JsonlEventLog:
     def __init__(self, path: Path, keep: int = 5000):
         self.path = Path(path)
         self.keep = keep
+        self._lock = store_lock(self.path)  # R3: appends from a threaded server's handlers never lose one another
 
     def _all(self) -> List[Dict[str, Any]]:
         if not self.path.exists():
@@ -118,13 +120,14 @@ class JsonlEventLog:
         return out
 
     def append(self, kind: str, level: str, text: str, **extra: Any) -> Dict[str, Any]:
-        rows = self._all()
-        next_id = int(rows[-1]["id"]) + 1 if rows else 1
-        event = make_event(next_id, now_iso(), kind, level, text, **extra)
-        rows.append(event)
-        rows = rows[-self.keep:]
-        atomic_write(self.path, ("\n".join(json.dumps(r, ensure_ascii=False) for r in rows) + "\n").encode(), 0o600)
-        return event
+        with self._lock:
+            rows = self._all()
+            next_id = int(rows[-1]["id"]) + 1 if rows else 1
+            event = make_event(next_id, now_iso(), kind, level, text, **extra)
+            rows.append(event)
+            rows = rows[-self.keep:]
+            atomic_write(self.path, ("\n".join(json.dumps(r, ensure_ascii=False) for r in rows) + "\n").encode(), 0o600)
+            return event
 
     def fetch(self, after: Optional[str], limit: int) -> List[Dict[str, Any]]:
         rows = self._all()

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_http.py

@@ -372,7 +372,7 @@ def request(method: str, url: str, *, headers: Optional[Mapping[str, str]] = Non
             status, got_headers, got = send(method, url, dict(sent), data, left, max_bytes)
         except HttpError:
             raise
-        except TimeoutError:
+        except (TimeoutError, socket.timeout):  # socket.timeout is no TimeoutError before Python 3.10
             failure = HttpError("%s %s: timed out" % (method, where), url=where, attempts=attempt, kind="timeout")
         except Exception as exc:  # noqa: BLE001 - as the Node twin: whatever the transport throws is a connection error
             failure = HttpError("%s %s: connection error (%s)" % (method, where, type(exc).__name__), url=where,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py

@@ -44,7 +44,7 @@ import fabric_service as _fs  # noqa: E402 - beside this file: token files, atom
 HUB_PROTOCOL = "fabric-hub/0.1"
 MCP_PROTOCOL_VERSION = "2025-06-18"
 READ_CAP = 64 * 1024
-LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{4,5})")
+LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:([0-9]{4,5})")
 TOKEN = re.compile(r"[A-Za-z0-9_-]{43}")
 UUID = re.compile(r"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}")
 CAPABILITY = re.compile(r"[a-z][a-z0-9._-]{1,127}")
@@ -163,8 +163,12 @@ def locate_hub(root: Optional[Path] = None, alive: Callable[[int], bool] = pid_a
     if estate is not None and isinstance(doc.get("hubKey"), dict):
         import fabric_estate  # beside this file
         key = doc["hubKey"]
+        # A missing or null applied is "none known", as fabric-hub.mjs reads it (`estate.applied ?? undefined`); only a
+        # present one is checked, and hub_key_certified refuses an explicit null of its own (decision D3).
+        applied = estate.get("applied")
         verdict = fabric_estate.hub_key_certified(estate.get("record"), key.get("kid"), key.get("x"),
-                                                  time.time() if now is None else now, estate.get("applied"))
+                                                  time.time() if now is None else now,
+                                                  fabric_estate._MISSING if applied is None else applied)
         if not verdict.get("certified"):
             raise HubError("hub-key-refused", "The estate record does not certify the hub's key (%s)." % verdict.get("detail"),
                            data={"fault": verdict.get("fault"), "detail": verdict.get("detail")})