@passioncode-ai/fabric-agent-adapter 0.42.1 → 0.44.0

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # Changelog
 
+## 0.44.0 (2026-10-22)
+
+### Added
+
+- **What an agent uses, `fabric-connections/0.1`** (FAA-62, contract DEC-0096, FAC-SEM-127; asked by Fabric Dashboards
+  on board thread `131648c0`). A new kit module in both twins, `fabric_connections` / `fabric-connections.mjs`:
+  `connections_extension(declared, degraded, states)` / `connectionsExtension(declared, {degraded, states})` builds
+  the `extensions` entry, each connection's `state` from the service's own checks, else `degraded` when `degraded[]`
+  names it, else `unknown`, and refuses a declaration a host would hide (the schema, an id twice, a credential).
+  `connections_view` / `connectionsView` read a peer's list as the contract's reference does; both answer all 127
+  cases of the contract's `fixtures/vectors/connections.json`, vendored by `make_connections_vectors.mjs`.
+  `build_well_known` / `buildWellKnown` refuse an invalid declaration passed in by hand, `check_service.py` reports
+  `well-known.connections`, and the `fabric_service` facades re-export the four names. The Python twin reads
+  credentials with the reference's ECMAScript semantics (ASCII case folding and word boundary, ECMAScript's whitespace,
+  a URL WHATWG refuses read as text only, its query and fragment read as WHATWG serializes them, a name's leading
+  `?` dropped as `URLSearchParams` drops it, an unpaired surrogate read as U+FFFD); 1,073 more inputs, answered by the
+  contract's reader into `connections-extra-vectors.json`, hold both twins to it. Inputs whose answer changes with the
+  Node release (the reference parses URLs with the runtime's own `new URL`) are left out of that set. Where Python cannot tell whether WHATWG refuses a URL (a
+  non-ASCII host), it reads the URL's credentials anyway, so a doubt hides a declaration rather than publish one
+  (FAA-98 ports UTS46 to close that gap).
+
+### Changed
+
+- **`check_dashboard_layout.mjs` exits 3 when no rule was measured** (FAA-96): every rule `NOT_RUN` (no Playwright, a
+  browser that does not start, a service it cannot open) or no rule at all. It exited 0, and 2 for an empty report
+  since 0.42.1. 0 still needs at least one rule measured and none failing.
+
+### Fixed
+
+- **The session worker waits for an exit status to its deadline after a closed pipe** (FAA-97): a `fabric-mcp` that
+  closed its stdin and exited 3 more than a second later was logged as `outcome=unknown` and its spool kept.
+- **OpenClaw `--remove` drops our load path when its folder is gone** (FAA-90): the ownership check read a manifest
+  that no longer existed, so the dead path stayed.
+
+## 0.43.0 (2026-10-22)
+
+### Changed
+
+- **Pinned to contract `bfa9a67`** (FAA-95; the contract review, PR #137 and #138, DEC-0096 and DEC-0097). `c55f2d5`
+  (0.39.0 to 0.42.1) joins the supported revisions. Every vendored vector was regenerated from the contract's own
+  functions at the pin: new negative package fixtures, a `comms-complete` case and `fabric-connections` in the register.
+- **A delegation chain names a partner only for a partner actor** (contract `src/delegation.ts` at `bfa9a67`): an actor
+  that carries `partner` beside `sub` is named by its `sub` in the verified `chain`, in both kits.
+- **`fabric-connections/0.1` is in both protocol registers** (DEC-0096), so a `protocols` list naming it is read as
+  the contract reads it. The kits do not emit the extension yet (FAA-62).
+- **The provider schema's MCP branches are read as `if`/`then`/`else`** (the contract review): the schema parity test
+  takes the URL pattern from `else` (a `oneOf` before); the pattern itself is unchanged. No kit code walked that `oneOf`.
+
+### Fixed
+
+- **The kit's copy of `fabric-package.schema.json` carries DEC-0097's path pattern.** ECMAScript's `.` stops at U+2028
+  and U+2029, so the old pattern accepted `skills<U+2028>/../../etc/passwd`; any character is now `[\s\S]`. Both kits'
+  own package checks already refused these paths (0.41.0). `share-registration.schema.json` is regenerated at the pin.
+- **The settings backup's secret-name patterns follow DEC-0097** in both kits (`[\s\S]+_` for `.+_`); no input reached
+  the difference, since table and column names refuse a line break first. A contract-gated test holds each twin's
+  regex to the pinned schema's pattern.
+- **A guard holds the kit's vendored schemas to the pin:** `test_the_kit_schemas_carry_the_patterns_of_the_pinned_contract`
+  fails when a pattern in either copy is not a pattern of that schema's `$ref` closure at the pinned contract.
+
 ## 0.42.1 (2026-10-22)
 
 The first published release of the 0.42 line: everything in 0.42.0 below, plus one test fix.

package/README.md

@@ -274,7 +274,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `c55f2d5a11c9a0197e958e87212fca7ae1154769`
+- commit: `bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0`
 
 Every other mention of the default contract revision (this section, the skills' metadata, the
 skill card, `adapt_project.py`) must equal it; `python3 test/validate.py` fails a tree

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.42.1",
+  "version": "0.44.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.42.1",
+  "version": "0.44.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.42.1"
+  version: "0.44.0"
   contract-version: "0.1.0"
-  contract-commit: "c55f2d5a11c9a0197e958e87212fca7ae1154769"
+  contract-commit: "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0"
 ---
 
 # Adapting projects to Fabric
@@ -76,7 +76,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `c55f2d5a11c9a0197e958e87212fca7ae1154769`.
+- commit `bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -22,10 +22,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "c55f2d5a11c9a0197e958e87212fca7ae1154769"
+CONTRACT_COMMIT = "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,10 +14,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.42.1"
+  version: "0.44.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "c55f2d5a11c9a0197e958e87212fca7ae1154769"
+  extension-commit: "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0"
 ---
 
 # Building Fabric services
@@ -248,6 +248,11 @@ and declare it with `extensions=fs.dashboard_extension()`. Read
 declaration and how to upgrade a dashboard built before the kit: an upgrade you may make yourself,
 which the plugin's session-start notice offers in a repository that owns the service.
 
+**Say what the agent uses** (`fabric-connections/0.1`, DEC-0096) so Fabric Dashboards draws its chain: the other
+agents, models, connectors, stores and channels, each with its state, from
+`connections_extension()` / `connectionsExtension()` in `fabric_connections`. Never a credential in it, never a call
+count (that is the usage report); the details are in [the wire reference](references/protocol.md).
+
 The events feed is a **view over the log you already keep** (a jobs table, a JSONL
 journal), not a second store. Each event is one sentence a person reads; set
 `notify: true` only when the operator must decide, or something failed or degrades their
@@ -284,7 +289,7 @@ propagation, event trace pairs, and `board.responder` for a service that declare
 any `FAIL`. A `NOT_RUN` is not a pass;
 name it in the report. A service with a dashboard also runs the layout probe,
 `node <skill-dir>/scripts/check_dashboard_layout.mjs --service <id>` (WebKit at 360, 480, 768
-and 1280 px; needs Playwright, else `NOT_RUN`).
+and 1280 px; needs Playwright, else `NOT_RUN` and exit 3: nothing was measured).
 
 Then prove the lock: start a second copy by hand against the same data directory; it
 must exit 75 while the first keeps serving. Prove recovery: `kill -9` the launchd pid;

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-kit.md

@@ -137,7 +137,8 @@ the floor minus 40 and at 360, 480, 768 and 1280 px, and reports ED-1…ED-5 per
 Playwright where it runs (`npm i -D playwright && npx playwright install webkit`, or `--playwright
 <dir>`); without it every rule is `NOT_RUN`, and the probe asks for no login code. ED-3 also fails a link clipped
 vertically by the viewport or a clipping ancestor; ED-4 is `NOT_RUN` on a page past its 6000-element cap. It does not measure edge shades or that a refresh keeps
-the scroll position: say so in the report. A `NOT_RUN` is not a pass.
+the scroll position: say so in the report. A `NOT_RUN` is not a pass. Exit codes: 0 when no rule fails and at least
+one passed, 1 on a `FAIL`, 2 on a usage error, 3 when no rule was measured (every rule `NOT_RUN`, since 0.44.0).
 
 ## Upgrading an existing dashboard
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -63,6 +63,7 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L3 | `fabric_platform` | Windows: named pipes, owner-only files (DEC-0032) |
 | L3 | `fabric_paths` | the services directory, a service's folders, atomic and private writes |
 | L3 | `fabric_protocols` | protocol revisions (DEC-0067) and feed data (DEC-0070) |
+| L3 | `fabric_connections` | what an agent uses, `fabric-connections/0.1`: the reference reading and the declaration (DEC-0096, FAC-SEM-127) |
 | L3 | `fabric_lock` | the instance lock and the supervisor marker (LC-01, DEC-0057) |
 | L3 | `fabric_usage` | usage receipts, the ledger, the usage report, attribution, spending limits ([usage](usage.md)) |
 | L3 | `fabric_backups` | settings backups (DEC-0025) |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1: wire reference
 
-Pinned to `fabric-agent-contract` commit `c55f2d5a11c9a0197e958e87212fca7ae1154769`
+Pinned to `fabric-agent-contract` commit `bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
@@ -8,7 +8,8 @@ canonical forms DEC-0043; `degraded[].setup` and `run.mcp.stdio.scope` DEC-0044;
 DEC-0045; runner and model profiles DEC-0046; the estate record DEC-0055; one copy under any supervisor and its marker,
 the Windows token-file reader DEC-0057; the hub key the estate certifies DEC-0060; signing credentials DEC-0063; the
 estate record's 60 s skew DEC-0066; an app's own descriptor DEC-0069; the descriptor for listings DEC-0061; identifier equality
-by normal form DEC-0076; the project board's directory page DEC-0077 and a replacement's transferred attempts DEC-0078; an operator's hold DEC-0079, a structured finding DEC-0080 and the owner's settlement DEC-0081). The contract's schemas are normative;
+by normal form DEC-0076; the project board's directory page DEC-0077 and a replacement's transferred attempts DEC-0078; an operator's hold DEC-0079, a structured finding DEC-0080 and the owner's settlement DEC-0081; `fabric-connections/0.1` in the protocol register
+DEC-0096; a schema pattern never uses a bare dot DEC-0097). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
@@ -92,6 +93,26 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   ED-9): `minWidth` 360…1280 (required), `appearance` ⊆ `scheme`, `theme`, `themes`, `kit`
   (`name@semver`), nothing else. The kits build it with `dashboard_extension()` /
   `dashboardExtension()`; see [the dashboard kit reference](dashboard-kit.md).
+- `extensions` MAY say what the service uses under
+  `https://fabric.passioncode.ai/agent-contract/extensions/connections/0.1` (`fabric-connections/0.1`, DEC-0096):
+  `{connections: [...]}`, at most 64, each `{id, kind, target, state}` with `kind` one of `service`, `model`,
+  `connector`, `store`, `channel`, `state` one of `ok`, `degraded`, `down`, `unknown`, and optionally `capability`
+  (a `service` only), `label`, `purpose`, `reason`, `lastAt`. No member carries a credential, and each `id` is named
+  once: a host hides a list that breaks either rule (FAC-SEM-127). A `degraded[].source` equal to an `id` is that
+  connection failing. The kits build it with `connections_extension(declared, degraded, states)` /
+  `connectionsExtension(declared, {degraded, states})`: `state` comes from the service's own checks (`states`, by
+  `id`), else `degraded` when `degraded[]` names it, else `unknown`; a declaration a host would hide is refused with
+  `ServiceError`, and `build_well_known` refuses one passed in by hand. `connections_view` / `connectionsView` read
+  a peer's list as Fabric Dashboards does, and `check_service.py` reports `well-known.connections`. Build it each
+  time the well-known document is built, from the same `degraded` list:
+
+  ```python
+  ext = fs.dashboard_extension()
+  ext.update(connections_extension(
+      [{"id": "router", "kind": "model", "target": "openai/gpt-5.1", "purpose": "drafts replies"},
+       {"id": "notify", "kind": "service", "target": "communicator.default", "capability": "communicator.notify"}],
+      degraded=degraded, states={"router": "ok" if model_answered else "down"}))
+  ```
 - `surfaces.mcp.auth`: `descriptor` (default), `own` (DEC-0024) or `delegation` (DEC-0039, DL-16):
   the MCP surface takes only the estate's delegation tokens, and the top-level
   `auth.delegation {issuer, jwks}` is then required. With `own` or `delegation` the descriptor's

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_dashboard_layout.mjs

@@ -13,7 +13,8 @@
 // scroll box) and ED-5 (sticky chrome within min(120 px, a quarter of the height), anchors landing
 // below it, no nested full-height scroller). What it cannot measure is NOT_RUN with the reason,
 // never a pass. WebKit is the default engine (Safari's). Exit 0 when nothing FAILs, 1 when
-// something does, 2 on a usage error or a report with no rule in it. It reads; it never clicks a control of the page.
+// something does, 2 on a usage error, 3 when no rule was measured (every rule NOT_RUN). It reads; it never clicks a
+// control of the page.
 import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { homedir, platform } from 'node:os';
@@ -261,11 +262,13 @@ export function report(rows, opts, target) {
     for (const r of rows) process.stdout.write(`${r.verdict.padEnd(8)} ${(r.rule + (r.width ? '@' + r.width : '')).padEnd(10)} ${r.evidence}\n`);
     process.stdout.write(`\n${rows.length} rule(s), ${failed} FAIL, ${rows.filter((r) => r.verdict === 'NOT_RUN').length} NOT_RUN\n`);
   }
-  if (!rows.length) {
-    process.stderr.write('no rule ran: nothing was measured, so nothing passed\n');
-    return 2;
+  if (failed) return 1;
+  // Nothing measured is never a pass (FAA-96): no rule, or every rule NOT_RUN, exits 3.
+  if (!rows.some((r) => r.verdict === 'PASS')) {
+    process.stderr.write('no rule was measured, so nothing passed\n');
+    return 3;
   }
-  return failed ? 1 : 0;
+  return 0;
 }
 
 async function main(argv) {

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -52,6 +52,7 @@ from typing import Any, Dict, List, Optional, Tuple
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import fabric_service as fs  # noqa: E402
+import fabric_connections as fcn  # noqa: E402
 import fabric_interop as fi  # noqa: E402
 
 Result = Dict[str, str]
@@ -238,6 +239,14 @@ class Probe:
             findings = fs.protocols_findings(wk["protocols"])
             self.add("well-known.protocols", "FAIL" if findings else "PASS",
                      "; ".join("%s %s" % (f["instancePath"], f["message"]) for f in findings) or ", ".join(wk["protocols"]))
+        extensions = wk.get("extensions") if isinstance(wk.get("extensions"), dict) else {}
+        if fcn.CONNECTIONS_EXTENSION_KEY in extensions:
+            # DEC-0096, FAC-SEM-127: what it uses, valid, each id once, no credential; a host hides an invalid list.
+            view = fcn.connections_view(wk)
+            failing = sum(1 for c in view["connections"] if c["failing"])
+            self.add("well-known.connections", "FAIL" if view["reported"] else "PASS",
+                     "; ".join(f["message"] for f in fcn.connections_rules(wk)[:5]) or
+                     "%d connection(s), %d named in degraded[]" % (len(view["connections"]), failing))
         self.configuration_rule()
         svc = wk.get("service") or {}
         answered = "%s.%s" % (svc.get("id"), svc.get("instance"))

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-backups.mjs

@@ -18,11 +18,11 @@ export const SETTINGS_BACKUP_MAX_AGE_SECONDS = 24 * 60 * 60;
 
 const TABLE = /^[a-z][a-z0-9_]{0,62}$/;
 
-const SECRET_TABLE = /^((.+_)?(account_connections?|account_connection_drafts?|tokens?|secrets?|credentials?|passwords?|login_codes?)|(operator_)?sessions?)$/;
+const SECRET_TABLE = /^(([\s\S]+_)?(account_connections?|account_connection_drafts?|tokens?|secrets?|credentials?|passwords?|login_codes?)|(operator_)?sessions?)$/;
 
 const COLUMN = /^[A-Za-z_][A-Za-z0-9_]{0,62}$/;
 
-const SECRET_COLUMN = /^(?:.+_)?(?:[Tt]oken|[Ss]ecret|[Pp]assword|[Pp]assphrase|[Aa]pi_?[Kk]ey|[Pp]rivate_[Kk]ey|[Cc]ookie|[Ll]ogin_[Cc]ode|[Oo]tp|[Cc]redential)s?$/;
+const SECRET_COLUMN = /^(?:[\s\S]+_)?(?:[Tt]oken|[Ss]ecret|[Pp]assword|[Pp]assphrase|[Aa]pi_?[Kk]ey|[Pp]rivate_[Kk]ey|[Cc]ookie|[Ll]ogin_[Cc]ode|[Oo]tp|[Cc]redential)s?$/;
 
 const REASON = /^[a-z][a-z0-9_.-]{0,63}$/;
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-connections.mjs

@@ -0,0 +1,186 @@
+// What an agent uses: fabric-connections/0.1, the extension keyed extensions/connections/0.1 (DEC-0096, FAC-SEM-127).
+// connectionsView reads a well-known document as the contract's connectionsView does (it never throws);
+// connectionsExtension builds the `extensions` entry a service declares, `state` from its own checks and its degraded[].
+// Part of the Node service kit (FAA-62, layer L3); the twin of fabric_connections.py. Node 20+, no dependency.
+import { ServiceError } from './fabric-base.mjs';
+import { BEARER_INSIDE, JWT_SHAPE, longSecret, secretUrl } from './fabric-secrets.mjs';
+import { isObject } from './fabric-jsvalue.mjs';
+
+export const CONNECTIONS_EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/connections/0.1';
+export const KINDS = Object.freeze(['service', 'model', 'connector', 'store', 'channel']);
+export const STATES = Object.freeze(['ok', 'degraded', 'down', 'unknown']);
+export const MAX_CONNECTIONS = 64;
+const MEMBERS = ['id', 'kind', 'target', 'capability', 'state', 'label', 'purpose', 'reason', 'lastAt'];
+const STRING_MEMBERS = ['id', 'target', 'capability', 'label', 'purpose', 'reason'];
+
+const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
+const TARGET = /^[^\s]+$/u;
+const SERVICE_TARGET = /^[a-z0-9][a-z0-9-]{0,63}(\.[a-z0-9][a-z0-9-]{0,63})?$/u;
+const CAPABILITY = /^[a-z][a-z0-9._-]{1,127}$/u;
+const LINE = /^[^\n\r]+$/u;
+
+// ajv-formats `date-time` in its full mode (the contract's validator): a date, `t` or a space, a time with a zone.
+const DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
+const TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
+const DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+function fullDate(value) {
+  const m = DATE.exec(value);
+  if (!m) return false;
+  const [year, month, day] = [+m[1], +m[2], +m[3]];
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  return month >= 1 && month <= 12 && day >= 1 && day <= (month === 2 && leap ? 29 : DAYS[month]);
+}
+function fullTime(value) {
+  const m = TIME.exec(value);
+  if (!m) return false;
+  const [hour, minute, second] = [+m[1], +m[2], +m[3]];
+  const sign = m[5] === '-' ? -1 : 1;
+  const [zoneH, zoneM] = [+(m[6] || 0), +(m[7] || 0)];
+  if (zoneH > 23 || zoneM > 59 || !m[4]) return false;
+  if (hour <= 23 && minute <= 59 && second < 60) return true;
+  const utcMin = minute - zoneM * sign; // a leap second, at 23:59 UTC only
+  const utcHour = hour - zoneH * sign - (utcMin < 0 ? 1 : 0);
+  return (utcHour === 23 || utcHour === -1) && (utcMin === 59 || utcMin === -1) && second < 61;
+}
+/** The `date-time` format as the contract's validator (ajv-formats, full mode) reads it. */
+export function dateTime(value) {
+  const parts = value.split(/t|\s/i);
+  return parts.length === 2 && fullDate(parts[0]) && fullTime(parts[1]);
+}
+
+const length = (value) => [...value].length; // code points, as ajv counts them
+
+/** service-connections-extension.schema.json, read as the contract's validator reads it. */
+function shapeProblems(value) {
+  if (!isObject(value)) return ['/ type: must be object'];
+  // A member's name is never echoed: a secret-shaped name would reach the error text and a probe's evidence.
+  const problems = Object.keys(value).filter((key) => key !== 'connections').map(() => '/ additionalProperties: a member other than connections');
+  if (!Object.hasOwn(value, 'connections')) return [...problems, '/ required: connections'];
+  const connections = value.connections;
+  if (!Array.isArray(connections)) return [...problems, '/connections type: must be array'];
+  if (connections.length > MAX_CONNECTIONS) problems.push(`/connections maxItems: at most ${MAX_CONNECTIONS}`);
+  connections.forEach((item, index) => {
+    const at = `/connections/${index}`;
+    if (!isObject(item)) { problems.push(`${at} type: must be object`); return; }
+    for (const key of ['id', 'kind', 'target', 'state']) if (!Object.hasOwn(item, key)) problems.push(`${at} required: ${key}`);
+    for (const key of Object.keys(item)) if (!MEMBERS.includes(key)) problems.push(`${at} additionalProperties: a member the schema does not name`);
+    for (const key of [...STRING_MEMBERS, 'lastAt']) if (Object.hasOwn(item, key) && typeof item[key] !== 'string') problems.push(`${at}/${key} type: must be string`);
+    const text = (key) => (Object.hasOwn(item, key) && typeof item[key] === 'string' ? item[key] : undefined);
+    if (text('id') !== undefined && !ID.test(text('id'))) problems.push(`${at}/id pattern`);
+    if (Object.hasOwn(item, 'kind') && !KINDS.includes(item.kind)) problems.push(`${at}/kind enum`);
+    if (Object.hasOwn(item, 'state') && !STATES.includes(item.state)) problems.push(`${at}/state enum`);
+    const target = text('target');
+    if (target !== undefined && !(length(target) >= 1 && length(target) <= 200 && TARGET.test(target))) problems.push(`${at}/target length or pattern`);
+    if (text('capability') !== undefined && !CAPABILITY.test(text('capability'))) problems.push(`${at}/capability pattern`);
+    for (const key of ['label', 'purpose', 'reason']) {
+      const line = text(key);
+      if (line !== undefined && !(length(line) >= 1 && length(line) <= 300 && LINE.test(line))) problems.push(`${at}/${key} length or pattern`);
+    }
+    if (text('lastAt') !== undefined && !dateTime(text('lastAt'))) problems.push(`${at}/lastAt format: date-time`);
+    if (Object.hasOwn(item, 'kind')) {
+      if (item.kind !== 'service' && Object.hasOwn(item, 'capability')) problems.push(`${at}/capability: only a service connection names a capability`);
+      if (item.kind === 'service' && target !== undefined && !SERVICE_TARGET.test(target)) problems.push(`${at}/target pattern: a service target is an id.instance key or a product id`);
+    }
+  });
+  return problems;
+}
+
+// The contract's KEY_SHAPE (src/connections.ts): a provider key where it starts a word, case-sensitive prefixes, the
+// `sk-` rules and a Telegram bot token.
+const KEY_SHAPE = /(?:^|[^A-Za-z0-9])(?:sk-(?=[A-Za-z0-9_-]*\d)(?:(?=[A-Za-z0-9_-]*[A-Z])[A-Za-z0-9_-]{16,}|[A-Za-z0-9_-]{32,})|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,}|(?:bot)?\d{6,12}:(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[a-z])[A-Za-z0-9_-]{34,35}(?![A-Za-z0-9_-]))/;
+const SCHEME = /[a-z][a-z0-9+.-]*:\/\//gi;
+const CLOSING = /[)\]}>"'.,;:!?]/;
+const TRIED_BACK = 1;
+/** The URLs a member may hold, from every scheme in each whitespace-delimited piece, without the closing brackets,
+ * quotes and punctuation that end a sentence, and with TRIED_BACK of them put back (`]` closes an IPv6 host). */
+function urlsIn(value) {
+  const urls = [];
+  for (const piece of value.split(/\s+/)) {
+    for (const match of piece.matchAll(SCHEME)) {
+      const url = piece.slice(match.index);
+      let end = url.length;
+      while (end > 0 && CLOSING.test(url[end - 1])) end -= 1;
+      for (let back = 0; back <= TRIED_BACK && end + back <= url.length; back += 1) urls.push(url.slice(0, end + back));
+    }
+  }
+  return urls;
+}
+/** A long secret-shaped run in a piece read whole; in a piece that holds a URL, the text before its first scheme's `://`. */
+const longRun = (value) =>
+  value.split(/\s+/).some((piece) => {
+    const at = piece.search(SCHEME);
+    const cut = at < 0 ? -1 : piece.indexOf('://', at);
+    return longSecret(cut < 0 ? piece : piece.slice(0, cut));
+  });
+const credential = (value, runs) =>
+  JWT_SHAPE.test(value) || KEY_SHAPE.test(value) || BEARER_INSIDE.test(value) || (runs && longRun(value)) || urlsIn(value).some(secretUrl);
+
+/** What the schema cannot state: an id named twice, a credential in any string member. */
+function beyondShape(list) {
+  const errors = [];
+  const seen = new Set();
+  list.forEach((connection, index) => {
+    if (seen.has(connection.id)) errors.push(`/connections/${index}/id duplicate: it is named twice`);
+    seen.add(connection.id);
+    for (const member of STRING_MEMBERS) {
+      const value = connection[member];
+      const runs = member !== 'id' && member !== 'capability' && !(member === 'target' && connection.kind === 'model');
+      if (typeof value === 'string' && credential(value, runs)) errors.push(`/connections/${index}/${member} credential: a connection never carries a credential`);
+    }
+  });
+  return errors;
+}
+
+const none = () => ({ declared: false, reported: false, connections: [], errors: [] });
+
+/** A host's reading of a well-known document's connections (the contract's connectionsView): never throws. */
+export function connectionsView(wellKnown) {
+  const extensions = isObject(wellKnown) && isObject(wellKnown.extensions) ? wellKnown.extensions : undefined;
+  if (extensions === undefined || !Object.hasOwn(extensions, CONNECTIONS_EXTENSION_KEY)) return none();
+  const value = extensions[CONNECTIONS_EXTENSION_KEY];
+  let errors = shapeProblems(value);
+  if (!errors.length) errors = beyondShape(value.connections);
+  if (errors.length) return { ...none(), reported: true, errors };
+  const degraded = Array.isArray(wellKnown.degraded) ? wellKnown.degraded : [];
+  const failing = new Set(degraded.filter(isObject).map((entry) => entry.source).filter((source) => typeof source === 'string'));
+  return { declared: true, reported: false, connections: value.connections.map((c) => ({ ...c, failing: failing.has(c.id) })), errors: [] };
+}
+
+const pointerToken = (token) => token.replace(/~/g, '~0').replace(/\//g, '~1');
+
+/** FAC-SEM-127: the connections a well-known document declares are valid, each id once, no credential. */
+export function connectionsRules(wellKnown) {
+  const view = connectionsView(wellKnown);
+  const at = `/extensions/${pointerToken(CONNECTIONS_EXTENSION_KEY)}`;
+  return view.errors.map((error) => ({ code: 'FAC-SEM-127', instancePath: at, message: `the connections declaration is invalid (${error}); a host treats it as not declared and reports it (DEC-0096)` }));
+}
+
+/**
+ * The `extensions` entry a service declares (DEC-0096): what it uses, each connection's `state` from the service's
+ * own checks (`states`, by id), else `degraded` when a degraded[].source names it, else `unknown`; a declared `state`
+ * is kept. Throws ServiceError on a declaration a host would hide: a service never publishes one that reads as
+ * "declared nothing".
+ */
+export function connectionsExtension(declared, options = {}) {
+  const { degraded: givenDegraded, states: givenStates } = options ?? {};
+  const degraded = givenDegraded ?? [];
+  const states = givenStates ?? {};
+  if (!Array.isArray(declared) || !Array.isArray(degraded) || !isObject(states)) {
+    throw new ServiceError('Connections declaration: declared and degraded are lists, states an object by id.');
+  }
+  const failing = new Set(degraded.filter(isObject).map((entry) => entry.source).filter((source) => typeof source === 'string'));
+  const connections = declared.map((item) => {
+    if (!isObject(item)) return item; // the shape check names it and the declaration is refused
+    const connection = { ...item };
+    if (!Object.hasOwn(connection, 'state')) {
+      const id = typeof connection.id === 'string' ? connection.id : undefined;
+      // An invalid check value is refused by the shape check, never read as a missing one.
+      connection.state = id !== undefined && Object.hasOwn(states, id) ? states[id] : (failing.has(id) ? 'degraded' : 'unknown');
+    }
+    return connection;
+  });
+  const value = { connections };
+  const view = connectionsView({ extensions: { [CONNECTIONS_EXTENSION_KEY]: value } });
+  if (view.reported) throw new ServiceError(`Connections declaration: ${view.errors.join('; ')}.`);
+  return { [CONNECTIONS_EXTENSION_KEY]: value };
+}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-delegation.mjs

@@ -188,7 +188,8 @@ export function chainDepth(act) {
 
 function chainOf(act) {
   const chain = [];
-  for (let node = act; node; node = 'act' in node ? node.act : undefined) chain.push('partner' in node ? node.partner : node.sub);
+  // The contract's chainOf at bfa9a67: a node names its partner only when it is a partner actor (the partner member alone).
+  for (let node = act; node; node = 'act' in node ? node.act : undefined) chain.push(isPartnerActor(node) ? node.partner : node.sub);
   return chain;
 }
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-descriptor.mjs

@@ -6,6 +6,7 @@ import { credentialName, secretArgument, secretUrl, secretValue } from './fabric
 import { ID, INSTANCE, LOCAL_PATH, PROTOCOL, ServiceError, TASK, UNIT, expand } from './fabric-base.mjs';
 import { atomicWrite, ensurePrivateDir, servicesDir } from './fabric-paths.mjs';
 import { protocolsFindings } from './fabric-protocols.mjs';
+import { CONNECTIONS_EXTENSION_KEY, connectionsView } from './fabric-connections.mjs';
 import { ROUTES } from './fabric-usage.mjs';
 
 // The embedded dashboard declaration (fabric-dashboard/0.1, DEC-0036 ED-9), under the well-known
@@ -369,6 +370,11 @@ export function buildWellKnown({ id, instance, name, version, build, startedAt,
       const problems = dashboardExtensionProblems(extensions[DASHBOARD_EXTENSION_KEY]);
       if (problems.length) throw new ServiceError(`Dashboard declaration: ${problems.join('; ')}.`);
     }
+    if (Object.hasOwn(extensions, CONNECTIONS_EXTENSION_KEY)) {
+      // DEC-0096: a host hides an invalid declaration (FAC-SEM-127); a service never publishes one.
+      const view = connectionsView({ extensions: { [CONNECTIONS_EXTENSION_KEY]: extensions[CONNECTIONS_EXTENSION_KEY] } });
+      if (view.reported) throw new ServiceError(`Connections declaration: ${view.errors.join('; ')}.`);
+    }
     doc.extensions = { ...extensions };
   }
   if (configuration !== undefined) {

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-package.schema.json

@@ -557,7 +557,7 @@
     },
     "path": {
       "type": "string",
-      "pattern": "^(?![/~])(?!.*\\\\)(?!.*//)(?!(?:.*/)?\\.{1,2}(?:/|$))[^\\u0000-\\u001f:]{1,256}(?<!/)$"
+      "pattern": "^(?![/~])(?![\\s\\S]*\\\\)(?![\\s\\S]*//)(?!(?:[\\s\\S]*/)?\\.{1,2}(?:/|$))[^\\u0000-\\u001f:]{1,256}(?<!/)$"
     },
     "common.$defs.semver": {
       "type": "string",

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-protocols.mjs

@@ -8,7 +8,7 @@ import { credentialName, secretArgument, secretUrl, secretValue } from './fabric
 /** Each contract protocol's published revisions, oldest first (the contract's `PROTOCOL_REVISIONS`); a test holds it equal to the contract's. */
 export const PROTOCOL_REVISIONS = new Map(Object.entries({
   'access-log': ['1'], approval: ['1'], 'activity-summary': ['1'], 'coding-agents': ['1'], 'enroll-token': ['1'], entitlement: ['1'], 'entitlement-key-set': ['1'], 'estate-record': ['1'], 'execution-packet': ['1'],
-  'fabric-activity': ['0.1'], 'fabric-dashboard': ['0.1'], 'fabric-delegation': ['0.1'], 'fabric-device': ['0.1'],
+  'fabric-activity': ['0.1'], 'fabric-connections': ['0.1'], 'fabric-dashboard': ['0.1'], 'fabric-delegation': ['0.1'], 'fabric-device': ['0.1'],
   'fabric-interop': ['0.1', '0.2'], 'fabric-local-channel': ['0.1'], 'fabric-local-runner': ['0.1'], 'fabric-operator-channel': ['0.1'],
   'fabric-package': ['1'], 'fabric-project-comms': ['0.1'], 'fabric-proposal': ['1'], 'fabric-provider': ['0.1'], 'fabric-relay': ['0.1'],
   'fabric-secret-envelope': ['1'], 'fabric-service': ['0.1'], 'fabric-settings-backup': ['1'], heartbeat: ['1'], 'learning-note': ['1'],

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-secrets.mjs

@@ -41,12 +41,12 @@ export const JWT_SHAPE = /eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]
 /** A value that says it is a credential, or a provider key's shape. */
 export const SECRET_VALUE = /(^bearer\s.+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})/i;
 const LONG_RUN = /[A-Za-z0-9+/=_-]{40,}/g;
-const longSecret = (value) => (value.match(LONG_RUN) ?? []).some((run) => /[a-z]/.test(run) && /[A-Z]/.test(run) && /[0-9]/.test(run));
+export const longSecret = (value) => (value.match(LONG_RUN) ?? []).some((run) => /[a-z]/.test(run) && /[A-Z]/.test(run) && /[0-9]/.test(run));
 
 /** Whether a value could be a credential: a JWT anywhere, a provider key or `Bearer …`, or a long secret-shaped run. */
 export const secretValue = (value) => JWT_SHAPE.test(value) || SECRET_VALUE.test(value) || longSecret(value);
 
-const BEARER_INSIDE = /\bbearer\s+(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{12,}=*/i;
+export const BEARER_INSIDE = /\bbearer\s+(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{12,}=*/i;
 const PATH_LIKE = /^(?:[/~.]|[A-Za-z]:[\\/]|[a-z][a-z0-9+.-]*:\/\/)/i;
 const pathLike = (piece) =>
   PATH_LIKE.test(piece) ||

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -40,6 +40,7 @@ export {
   feedDataFindings,
   feedDataProblems,
 } from './fabric-protocols.mjs';
+export { CONNECTIONS_EXTENSION_KEY, connectionsExtension, connectionsRules, connectionsView } from './fabric-connections.mjs';
 export {
   EXIT_ALREADY_RUNNING,
   LOCK_WAIT_SUPERVISED_SECONDS,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_backups.py

@@ -49,13 +49,13 @@ _SAFE_INTEGER = 2 ** 53 - 1
 _TABLE = re.compile(r"^[a-z][a-z0-9_]{0,62}\Z")
 
 
-_SECRET_TABLE = re.compile(r"^((.+_)?(account_connections?|account_connection_drafts?|tokens?|secrets?|credentials?|passwords?|login_codes?)|(operator_)?sessions?)\Z")
+_SECRET_TABLE = re.compile(r"^(([\s\S]+_)?(account_connections?|account_connection_drafts?|tokens?|secrets?|credentials?|passwords?|login_codes?)|(operator_)?sessions?)\Z")
 
 
 _COLUMN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]{0,62}\Z")
 
 
-_SECRET_COLUMN = re.compile(r"^(?:.+_)?(?:[Tt]oken|[Ss]ecret|[Pp]assword|[Pp]assphrase|[Aa]pi_?[Kk]ey|[Pp]rivate_[Kk]ey|[Cc]ookie|[Ll]ogin_[Cc]ode|[Oo]tp|[Cc]redential)s?\Z")
+_SECRET_COLUMN = re.compile(r"^(?:[\s\S]+_)?(?:[Tt]oken|[Ss]ecret|[Pp]assword|[Pp]assphrase|[Aa]pi_?[Kk]ey|[Pp]rivate_[Kk]ey|[Cc]ookie|[Ll]ogin_[Cc]ode|[Oo]tp|[Cc]redential)s?\Z")
 
 
 _REASON = re.compile(r"^[a-z][a-z0-9_.-]{0,63}\Z")