@passioncode-ai/fabric-agent-adapter 0.43.0 → 0.44.1

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 0.44.1 (2026-10-22)
+
+### Changed
+
+- **Two kit modules split by responsibility** (FAA-92). `fabric_interop` and `fabric_package` stood at the 1000-line
+  ceiling `test_fabric_kit` enforces. The rules of `fabric-interop/0.1` that need no running service (constants,
+  `InteropError`, `UnknownJob`, trace context, the job limits of DEC-0087) moved to `fabric_interop_rules` /
+  `fabric-interop-rules.mjs` (L3), and the reading of `fabric-package.schema.json` to `fabric_package_schema` /
+  `fabric-package-schema.mjs` (L2), which now carries that schema as its data. `fabric_interop` and `fabric_package`
+  re-export every name they had, in both languages, so no caller changes; a service that copies the kit by hand
+  copies the two new files too (`fabric_kit.py install` and `status` name them). No behaviour changed.
+
+### Fixed
+
+- A board test (`test_a_revision_conflict_on_renew_reads_again_and_keeps_the_attempt`) read the call order before its
+  handler's thread had started its effect, and failed under load. It now waits for the effect to start.
+
+## 0.44.0 (2026-10-22)
+
+### Added
+
+- **What an agent uses, `fabric-connections/0.1`** (FAA-62, contract DEC-0096, FAC-SEM-127; asked by Fabric Dashboards
+  on board thread `131648c0`). A new kit module in both twins, `fabric_connections` / `fabric-connections.mjs`:
+  `connections_extension(declared, degraded, states)` / `connectionsExtension(declared, {degraded, states})` builds
+  the `extensions` entry, each connection's `state` from the service's own checks, else `degraded` when `degraded[]`
+  names it, else `unknown`, and refuses a declaration a host would hide (the schema, an id twice, a credential).
+  `connections_view` / `connectionsView` read a peer's list as the contract's reference does; both answer all 127
+  cases of the contract's `fixtures/vectors/connections.json`, vendored by `make_connections_vectors.mjs`.
+  `build_well_known` / `buildWellKnown` refuse an invalid declaration passed in by hand, `check_service.py` reports
+  `well-known.connections`, and the `fabric_service` facades re-export the four names. The Python twin reads
+  credentials with the reference's ECMAScript semantics (ASCII case folding and word boundary, ECMAScript's whitespace,
+  a URL WHATWG refuses read as text only, its query and fragment read as WHATWG serializes them, a name's leading
+  `?` dropped as `URLSearchParams` drops it, an unpaired surrogate read as U+FFFD); 1,073 more inputs, answered by the
+  contract's reader into `connections-extra-vectors.json`, hold both twins to it. Inputs whose answer changes with the
+  Node release (the reference parses URLs with the runtime's own `new URL`) are left out of that set. Where Python cannot tell whether WHATWG refuses a URL (a
+  non-ASCII host), it reads the URL's credentials anyway, so a doubt hides a declaration rather than publish one
+  (FAA-98 ports UTS46 to close that gap).
+
+### Changed
+
+- **`check_dashboard_layout.mjs` exits 3 when no rule was measured** (FAA-96): every rule `NOT_RUN` (no Playwright, a
+  browser that does not start, a service it cannot open) or no rule at all. It exited 0, and 2 for an empty report
+  since 0.42.1. 0 still needs at least one rule measured and none failing.
+
+### Fixed
+
+- **The session worker waits for an exit status to its deadline after a closed pipe** (FAA-97): a `fabric-mcp` that
+  closed its stdin and exited 3 more than a second later was logged as `outcome=unknown` and its spool kept.
+- **OpenClaw `--remove` drops our load path when its folder is gone** (FAA-90): the ownership check read a manifest
+  that no longer existed, so the dead path stayed.
+
 ## 0.43.0 (2026-10-22)
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.43.0",
+  "version": "0.44.1",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.43.0",
+  "version": "0.44.1",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.43.0"
+  version: "0.44.1"
   contract-version: "0.1.0"
   contract-commit: "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,7 +14,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.43.0"
+  version: "0.44.1"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0"
@@ -248,6 +248,11 @@ and declare it with `extensions=fs.dashboard_extension()`. Read
 declaration and how to upgrade a dashboard built before the kit: an upgrade you may make yourself,
 which the plugin's session-start notice offers in a repository that owns the service.
 
+**Say what the agent uses** (`fabric-connections/0.1`, DEC-0096) so Fabric Dashboards draws its chain: the other
+agents, models, connectors, stores and channels, each with its state, from
+`connections_extension()` / `connectionsExtension()` in `fabric_connections`. Never a credential in it, never a call
+count (that is the usage report); the details are in [the wire reference](references/protocol.md).
+
 The events feed is a **view over the log you already keep** (a jobs table, a JSONL
 journal), not a second store. Each event is one sentence a person reads; set
 `notify: true` only when the operator must decide, or something failed or degrades their
@@ -284,7 +289,7 @@ propagation, event trace pairs, and `board.responder` for a service that declare
 any `FAIL`. A `NOT_RUN` is not a pass;
 name it in the report. A service with a dashboard also runs the layout probe,
 `node <skill-dir>/scripts/check_dashboard_layout.mjs --service <id>` (WebKit at 360, 480, 768
-and 1280 px; needs Playwright, else `NOT_RUN`).
+and 1280 px; needs Playwright, else `NOT_RUN` and exit 3: nothing was measured).
 
 Then prove the lock: start a second copy by hand against the same data directory; it
 must exit 75 while the first keeps serving. Prove recovery: `kill -9` the launchd pid;

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-kit.md

@@ -137,7 +137,8 @@ the floor minus 40 and at 360, 480, 768 and 1280 px, and reports ED-1…ED-5 per
 Playwright where it runs (`npm i -D playwright && npx playwright install webkit`, or `--playwright
 <dir>`); without it every rule is `NOT_RUN`, and the probe asks for no login code. ED-3 also fails a link clipped
 vertically by the viewport or a clipping ancestor; ED-4 is `NOT_RUN` on a page past its 6000-element cap. It does not measure edge shades or that a refresh keeps
-the scroll position: say so in the report. A `NOT_RUN` is not a pass.
+the scroll position: say so in the report. A `NOT_RUN` is not a pass. Exit codes: 0 when no rule fails and at least
+one passed, 1 on a `FAIL`, 2 on a usage error, 3 when no rule was measured (every rule `NOT_RUN`, since 0.44.0).
 
 ## Upgrading an existing dashboard
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -58,11 +58,13 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L2 | `fabric_delegation` | the callee's side of `fabric-delegation/0.1` (DEC-0039) |
 | L2 | `fabric_share` | share grants and registrations (DEC-0086) |
 | L2 | `fabric_ceremonies` | the headless join token (DEC-0084) |
-| L2 | `fabric_package` | `fabric-package/1`: pack, sign, verify (DEC-0050, DEC-0051) |
+| L2 | `fabric_package_schema` | the reading of `fabric-package.schema.json` with JavaScript's pattern and format semantics (FAA-92) |
+| L2 | `fabric_package` | `fabric-package/1`: pack, sign, verify; re-exports `schema_problems` (DEC-0050, DEC-0051) |
 | L3 | `fabric_base` | the protocol name, `ServiceError`, small shared helpers |
 | L3 | `fabric_platform` | Windows: named pipes, owner-only files (DEC-0032) |
 | L3 | `fabric_paths` | the services directory, a service's folders, atomic and private writes |
 | L3 | `fabric_protocols` | protocol revisions (DEC-0067) and feed data (DEC-0070) |
+| L3 | `fabric_connections` | what an agent uses, `fabric-connections/0.1`: the reference reading and the declaration (DEC-0096, FAC-SEM-127) |
 | L3 | `fabric_lock` | the instance lock and the supervisor marker (LC-01, DEC-0057) |
 | L3 | `fabric_usage` | usage receipts, the ledger, the usage report, attribution, spending limits ([usage](usage.md)) |
 | L3 | `fabric_backups` | settings backups (DEC-0025) |
@@ -73,7 +75,8 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L3 | `fabric_supervisors` | launchd, systemd user units, Task Scheduler (DEC-0032, LC-14) |
 | L3 | `fabric_service` | the facade: every name 0.39.1 exported, re-exported from the modules above |
 | L3 | `fabric_profiles` | runner and model profiles ([profiles](profiles.md)) |
-| L3 | `fabric_interop` | `fabric-interop/0.1`: jobs, envelopes, MCP tools ([interop](interop.md)) |
+| L3 | `fabric_interop_rules` | `fabric-interop/0.1` rules without a service: constants, `InteropError`, trace context, job limits (DEC-0087; FAA-92) |
+| L3 | `fabric_interop` | `fabric-interop/0.1`: jobs, envelopes, MCP tools; re-exports the rule layer ([interop](interop.md)) |
 | L4 | `fabric_hub` | the Fabric hub's door (`fabric-hub/0.1`) |
 | L4 | `fabric_board_shapes` | the project board's wire: constants, refusal codes, shapes |
 | L4 | `fabric_board_link` | the board's link: the MCP session over the hub, the fsynced checkpoint, a claimed request as data |
@@ -93,7 +96,8 @@ the kit live in `../recipes/` ([the support agent](../recipes/support-agent/READ
 public name 0.39.1 had, in both languages (the snapshot is `test/fixtures/kit-api/kit-api-0.39.1.json`; a missing
 name fails `test_kit_api`), and the Python facade the private names other code reached through it (`_number`,
 `_DAY_MS`, `_utc_date_ms` from the core). `fabric_board` and `fabric-board.mjs` are
-facades the same way. What changed for a service that copies the kit: `fabric_service.py` alone is no longer enough;
+facades the same way, and since 0.44.1 so are `fabric_interop` (over `fabric_interop_rules`) and `fabric_package` (over
+`fabric_package_schema`), with their Node twins: patch the rule or schema module, not the facade. What changed for a service that copies the kit: `fabric_service.py` alone is no longer enough;
 install with `fabric_kit.py install` and `status` names what is missing. A test or service that replaced a function
 by assigning it on the facade (`fabric_service.X = ...`) no longer changes what the kit does: the code reads its own
 module's name, so patch the module that defines it (`fabric_lock.X`, `fabric_session_env.X`). A service that imported a module-private

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -93,6 +93,26 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   ED-9): `minWidth` 360…1280 (required), `appearance` ⊆ `scheme`, `theme`, `themes`, `kit`
   (`name@semver`), nothing else. The kits build it with `dashboard_extension()` /
   `dashboardExtension()`; see [the dashboard kit reference](dashboard-kit.md).
+- `extensions` MAY say what the service uses under
+  `https://fabric.passioncode.ai/agent-contract/extensions/connections/0.1` (`fabric-connections/0.1`, DEC-0096):
+  `{connections: [...]}`, at most 64, each `{id, kind, target, state}` with `kind` one of `service`, `model`,
+  `connector`, `store`, `channel`, `state` one of `ok`, `degraded`, `down`, `unknown`, and optionally `capability`
+  (a `service` only), `label`, `purpose`, `reason`, `lastAt`. No member carries a credential, and each `id` is named
+  once: a host hides a list that breaks either rule (FAC-SEM-127). A `degraded[].source` equal to an `id` is that
+  connection failing. The kits build it with `connections_extension(declared, degraded, states)` /
+  `connectionsExtension(declared, {degraded, states})`: `state` comes from the service's own checks (`states`, by
+  `id`), else `degraded` when `degraded[]` names it, else `unknown`; a declaration a host would hide is refused with
+  `ServiceError`, and `build_well_known` refuses one passed in by hand. `connections_view` / `connectionsView` read
+  a peer's list as Fabric Dashboards does, and `check_service.py` reports `well-known.connections`. Build it each
+  time the well-known document is built, from the same `degraded` list:
+
+  ```python
+  ext = fs.dashboard_extension()
+  ext.update(connections_extension(
+      [{"id": "router", "kind": "model", "target": "openai/gpt-5.1", "purpose": "drafts replies"},
+       {"id": "notify", "kind": "service", "target": "communicator.default", "capability": "communicator.notify"}],
+      degraded=degraded, states={"router": "ok" if model_answered else "down"}))
+  ```
 - `surfaces.mcp.auth`: `descriptor` (default), `own` (DEC-0024) or `delegation` (DEC-0039, DL-16):
   the MCP surface takes only the estate's delegation tokens, and the top-level
   `auth.delegation {issuer, jwks}` is then required. With `own` or `delegation` the descriptor's

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_dashboard_layout.mjs

@@ -13,7 +13,8 @@
 // scroll box) and ED-5 (sticky chrome within min(120 px, a quarter of the height), anchors landing
 // below it, no nested full-height scroller). What it cannot measure is NOT_RUN with the reason,
 // never a pass. WebKit is the default engine (Safari's). Exit 0 when nothing FAILs, 1 when
-// something does, 2 on a usage error or a report with no rule in it. It reads; it never clicks a control of the page.
+// something does, 2 on a usage error, 3 when no rule was measured (every rule NOT_RUN). It reads; it never clicks a
+// control of the page.
 import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { homedir, platform } from 'node:os';
@@ -261,11 +262,13 @@ export function report(rows, opts, target) {
     for (const r of rows) process.stdout.write(`${r.verdict.padEnd(8)} ${(r.rule + (r.width ? '@' + r.width : '')).padEnd(10)} ${r.evidence}\n`);
     process.stdout.write(`\n${rows.length} rule(s), ${failed} FAIL, ${rows.filter((r) => r.verdict === 'NOT_RUN').length} NOT_RUN\n`);
   }
-  if (!rows.length) {
-    process.stderr.write('no rule ran: nothing was measured, so nothing passed\n');
-    return 2;
+  if (failed) return 1;
+  // Nothing measured is never a pass (FAA-96): no rule, or every rule NOT_RUN, exits 3.
+  if (!rows.some((r) => r.verdict === 'PASS')) {
+    process.stderr.write('no rule was measured, so nothing passed\n');
+    return 3;
   }
-  return failed ? 1 : 0;
+  return 0;
 }
 
 async function main(argv) {

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -52,6 +52,7 @@ from typing import Any, Dict, List, Optional, Tuple
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import fabric_service as fs  # noqa: E402
+import fabric_connections as fcn  # noqa: E402
 import fabric_interop as fi  # noqa: E402
 
 Result = Dict[str, str]
@@ -238,6 +239,14 @@ class Probe:
             findings = fs.protocols_findings(wk["protocols"])
             self.add("well-known.protocols", "FAIL" if findings else "PASS",
                      "; ".join("%s %s" % (f["instancePath"], f["message"]) for f in findings) or ", ".join(wk["protocols"]))
+        extensions = wk.get("extensions") if isinstance(wk.get("extensions"), dict) else {}
+        if fcn.CONNECTIONS_EXTENSION_KEY in extensions:
+            # DEC-0096, FAC-SEM-127: what it uses, valid, each id once, no credential; a host hides an invalid list.
+            view = fcn.connections_view(wk)
+            failing = sum(1 for c in view["connections"] if c["failing"])
+            self.add("well-known.connections", "FAIL" if view["reported"] else "PASS",
+                     "; ".join(f["message"] for f in fcn.connections_rules(wk)[:5]) or
+                     "%d connection(s), %d named in degraded[]" % (len(view["connections"]), failing))
         self.configuration_rule()
         svc = wk.get("service") or {}
         answered = "%s.%s" % (svc.get("id"), svc.get("instance"))

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-connections.mjs

@@ -0,0 +1,186 @@
+// What an agent uses: fabric-connections/0.1, the extension keyed extensions/connections/0.1 (DEC-0096, FAC-SEM-127).
+// connectionsView reads a well-known document as the contract's connectionsView does (it never throws);
+// connectionsExtension builds the `extensions` entry a service declares, `state` from its own checks and its degraded[].
+// Part of the Node service kit (FAA-62, layer L3); the twin of fabric_connections.py. Node 20+, no dependency.
+import { ServiceError } from './fabric-base.mjs';
+import { BEARER_INSIDE, JWT_SHAPE, longSecret, secretUrl } from './fabric-secrets.mjs';
+import { isObject } from './fabric-jsvalue.mjs';
+
+export const CONNECTIONS_EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/connections/0.1';
+export const KINDS = Object.freeze(['service', 'model', 'connector', 'store', 'channel']);
+export const STATES = Object.freeze(['ok', 'degraded', 'down', 'unknown']);
+export const MAX_CONNECTIONS = 64;
+const MEMBERS = ['id', 'kind', 'target', 'capability', 'state', 'label', 'purpose', 'reason', 'lastAt'];
+const STRING_MEMBERS = ['id', 'target', 'capability', 'label', 'purpose', 'reason'];
+
+const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
+const TARGET = /^[^\s]+$/u;
+const SERVICE_TARGET = /^[a-z0-9][a-z0-9-]{0,63}(\.[a-z0-9][a-z0-9-]{0,63})?$/u;
+const CAPABILITY = /^[a-z][a-z0-9._-]{1,127}$/u;
+const LINE = /^[^\n\r]+$/u;
+
+// ajv-formats `date-time` in its full mode (the contract's validator): a date, `t` or a space, a time with a zone.
+const DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
+const TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
+const DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+function fullDate(value) {
+  const m = DATE.exec(value);
+  if (!m) return false;
+  const [year, month, day] = [+m[1], +m[2], +m[3]];
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  return month >= 1 && month <= 12 && day >= 1 && day <= (month === 2 && leap ? 29 : DAYS[month]);
+}
+function fullTime(value) {
+  const m = TIME.exec(value);
+  if (!m) return false;
+  const [hour, minute, second] = [+m[1], +m[2], +m[3]];
+  const sign = m[5] === '-' ? -1 : 1;
+  const [zoneH, zoneM] = [+(m[6] || 0), +(m[7] || 0)];
+  if (zoneH > 23 || zoneM > 59 || !m[4]) return false;
+  if (hour <= 23 && minute <= 59 && second < 60) return true;
+  const utcMin = minute - zoneM * sign; // a leap second, at 23:59 UTC only
+  const utcHour = hour - zoneH * sign - (utcMin < 0 ? 1 : 0);
+  return (utcHour === 23 || utcHour === -1) && (utcMin === 59 || utcMin === -1) && second < 61;
+}
+/** The `date-time` format as the contract's validator (ajv-formats, full mode) reads it. */
+export function dateTime(value) {
+  const parts = value.split(/t|\s/i);
+  return parts.length === 2 && fullDate(parts[0]) && fullTime(parts[1]);
+}
+
+const length = (value) => [...value].length; // code points, as ajv counts them
+
+/** service-connections-extension.schema.json, read as the contract's validator reads it. */
+function shapeProblems(value) {
+  if (!isObject(value)) return ['/ type: must be object'];
+  // A member's name is never echoed: a secret-shaped name would reach the error text and a probe's evidence.
+  const problems = Object.keys(value).filter((key) => key !== 'connections').map(() => '/ additionalProperties: a member other than connections');
+  if (!Object.hasOwn(value, 'connections')) return [...problems, '/ required: connections'];
+  const connections = value.connections;
+  if (!Array.isArray(connections)) return [...problems, '/connections type: must be array'];
+  if (connections.length > MAX_CONNECTIONS) problems.push(`/connections maxItems: at most ${MAX_CONNECTIONS}`);
+  connections.forEach((item, index) => {
+    const at = `/connections/${index}`;
+    if (!isObject(item)) { problems.push(`${at} type: must be object`); return; }
+    for (const key of ['id', 'kind', 'target', 'state']) if (!Object.hasOwn(item, key)) problems.push(`${at} required: ${key}`);
+    for (const key of Object.keys(item)) if (!MEMBERS.includes(key)) problems.push(`${at} additionalProperties: a member the schema does not name`);
+    for (const key of [...STRING_MEMBERS, 'lastAt']) if (Object.hasOwn(item, key) && typeof item[key] !== 'string') problems.push(`${at}/${key} type: must be string`);
+    const text = (key) => (Object.hasOwn(item, key) && typeof item[key] === 'string' ? item[key] : undefined);
+    if (text('id') !== undefined && !ID.test(text('id'))) problems.push(`${at}/id pattern`);
+    if (Object.hasOwn(item, 'kind') && !KINDS.includes(item.kind)) problems.push(`${at}/kind enum`);
+    if (Object.hasOwn(item, 'state') && !STATES.includes(item.state)) problems.push(`${at}/state enum`);
+    const target = text('target');
+    if (target !== undefined && !(length(target) >= 1 && length(target) <= 200 && TARGET.test(target))) problems.push(`${at}/target length or pattern`);
+    if (text('capability') !== undefined && !CAPABILITY.test(text('capability'))) problems.push(`${at}/capability pattern`);
+    for (const key of ['label', 'purpose', 'reason']) {
+      const line = text(key);
+      if (line !== undefined && !(length(line) >= 1 && length(line) <= 300 && LINE.test(line))) problems.push(`${at}/${key} length or pattern`);
+    }
+    if (text('lastAt') !== undefined && !dateTime(text('lastAt'))) problems.push(`${at}/lastAt format: date-time`);
+    if (Object.hasOwn(item, 'kind')) {
+      if (item.kind !== 'service' && Object.hasOwn(item, 'capability')) problems.push(`${at}/capability: only a service connection names a capability`);
+      if (item.kind === 'service' && target !== undefined && !SERVICE_TARGET.test(target)) problems.push(`${at}/target pattern: a service target is an id.instance key or a product id`);
+    }
+  });
+  return problems;
+}
+
+// The contract's KEY_SHAPE (src/connections.ts): a provider key where it starts a word, case-sensitive prefixes, the
+// `sk-` rules and a Telegram bot token.
+const KEY_SHAPE = /(?:^|[^A-Za-z0-9])(?:sk-(?=[A-Za-z0-9_-]*\d)(?:(?=[A-Za-z0-9_-]*[A-Z])[A-Za-z0-9_-]{16,}|[A-Za-z0-9_-]{32,})|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,}|(?:bot)?\d{6,12}:(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[a-z])[A-Za-z0-9_-]{34,35}(?![A-Za-z0-9_-]))/;
+const SCHEME = /[a-z][a-z0-9+.-]*:\/\//gi;
+const CLOSING = /[)\]}>"'.,;:!?]/;
+const TRIED_BACK = 1;
+/** The URLs a member may hold, from every scheme in each whitespace-delimited piece, without the closing brackets,
+ * quotes and punctuation that end a sentence, and with TRIED_BACK of them put back (`]` closes an IPv6 host). */
+function urlsIn(value) {
+  const urls = [];
+  for (const piece of value.split(/\s+/)) {
+    for (const match of piece.matchAll(SCHEME)) {
+      const url = piece.slice(match.index);
+      let end = url.length;
+      while (end > 0 && CLOSING.test(url[end - 1])) end -= 1;
+      for (let back = 0; back <= TRIED_BACK && end + back <= url.length; back += 1) urls.push(url.slice(0, end + back));
+    }
+  }
+  return urls;
+}
+/** A long secret-shaped run in a piece read whole; in a piece that holds a URL, the text before its first scheme's `://`. */
+const longRun = (value) =>
+  value.split(/\s+/).some((piece) => {
+    const at = piece.search(SCHEME);
+    const cut = at < 0 ? -1 : piece.indexOf('://', at);
+    return longSecret(cut < 0 ? piece : piece.slice(0, cut));
+  });
+const credential = (value, runs) =>
+  JWT_SHAPE.test(value) || KEY_SHAPE.test(value) || BEARER_INSIDE.test(value) || (runs && longRun(value)) || urlsIn(value).some(secretUrl);
+
+/** What the schema cannot state: an id named twice, a credential in any string member. */
+function beyondShape(list) {
+  const errors = [];
+  const seen = new Set();
+  list.forEach((connection, index) => {
+    if (seen.has(connection.id)) errors.push(`/connections/${index}/id duplicate: it is named twice`);
+    seen.add(connection.id);
+    for (const member of STRING_MEMBERS) {
+      const value = connection[member];
+      const runs = member !== 'id' && member !== 'capability' && !(member === 'target' && connection.kind === 'model');
+      if (typeof value === 'string' && credential(value, runs)) errors.push(`/connections/${index}/${member} credential: a connection never carries a credential`);
+    }
+  });
+  return errors;
+}
+
+const none = () => ({ declared: false, reported: false, connections: [], errors: [] });
+
+/** A host's reading of a well-known document's connections (the contract's connectionsView): never throws. */
+export function connectionsView(wellKnown) {
+  const extensions = isObject(wellKnown) && isObject(wellKnown.extensions) ? wellKnown.extensions : undefined;
+  if (extensions === undefined || !Object.hasOwn(extensions, CONNECTIONS_EXTENSION_KEY)) return none();
+  const value = extensions[CONNECTIONS_EXTENSION_KEY];
+  let errors = shapeProblems(value);
+  if (!errors.length) errors = beyondShape(value.connections);
+  if (errors.length) return { ...none(), reported: true, errors };
+  const degraded = Array.isArray(wellKnown.degraded) ? wellKnown.degraded : [];
+  const failing = new Set(degraded.filter(isObject).map((entry) => entry.source).filter((source) => typeof source === 'string'));
+  return { declared: true, reported: false, connections: value.connections.map((c) => ({ ...c, failing: failing.has(c.id) })), errors: [] };
+}
+
+const pointerToken = (token) => token.replace(/~/g, '~0').replace(/\//g, '~1');
+
+/** FAC-SEM-127: the connections a well-known document declares are valid, each id once, no credential. */
+export function connectionsRules(wellKnown) {
+  const view = connectionsView(wellKnown);
+  const at = `/extensions/${pointerToken(CONNECTIONS_EXTENSION_KEY)}`;
+  return view.errors.map((error) => ({ code: 'FAC-SEM-127', instancePath: at, message: `the connections declaration is invalid (${error}); a host treats it as not declared and reports it (DEC-0096)` }));
+}
+
+/**
+ * The `extensions` entry a service declares (DEC-0096): what it uses, each connection's `state` from the service's
+ * own checks (`states`, by id), else `degraded` when a degraded[].source names it, else `unknown`; a declared `state`
+ * is kept. Throws ServiceError on a declaration a host would hide: a service never publishes one that reads as
+ * "declared nothing".
+ */
+export function connectionsExtension(declared, options = {}) {
+  const { degraded: givenDegraded, states: givenStates } = options ?? {};
+  const degraded = givenDegraded ?? [];
+  const states = givenStates ?? {};
+  if (!Array.isArray(declared) || !Array.isArray(degraded) || !isObject(states)) {
+    throw new ServiceError('Connections declaration: declared and degraded are lists, states an object by id.');
+  }
+  const failing = new Set(degraded.filter(isObject).map((entry) => entry.source).filter((source) => typeof source === 'string'));
+  const connections = declared.map((item) => {
+    if (!isObject(item)) return item; // the shape check names it and the declaration is refused
+    const connection = { ...item };
+    if (!Object.hasOwn(connection, 'state')) {
+      const id = typeof connection.id === 'string' ? connection.id : undefined;
+      // An invalid check value is refused by the shape check, never read as a missing one.
+      connection.state = id !== undefined && Object.hasOwn(states, id) ? states[id] : (failing.has(id) ? 'degraded' : 'unknown');
+    }
+    return connection;
+  });
+  const value = { connections };
+  const view = connectionsView({ extensions: { [CONNECTIONS_EXTENSION_KEY]: value } });
+  if (view.reported) throw new ServiceError(`Connections declaration: ${view.errors.join('; ')}.`);
+  return { [CONNECTIONS_EXTENSION_KEY]: value };
+}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-descriptor.mjs

@@ -6,6 +6,7 @@ import { credentialName, secretArgument, secretUrl, secretValue } from './fabric
 import { ID, INSTANCE, LOCAL_PATH, PROTOCOL, ServiceError, TASK, UNIT, expand } from './fabric-base.mjs';
 import { atomicWrite, ensurePrivateDir, servicesDir } from './fabric-paths.mjs';
 import { protocolsFindings } from './fabric-protocols.mjs';
+import { CONNECTIONS_EXTENSION_KEY, connectionsView } from './fabric-connections.mjs';
 import { ROUTES } from './fabric-usage.mjs';
 
 // The embedded dashboard declaration (fabric-dashboard/0.1, DEC-0036 ED-9), under the well-known
@@ -369,6 +370,11 @@ export function buildWellKnown({ id, instance, name, version, build, startedAt,
       const problems = dashboardExtensionProblems(extensions[DASHBOARD_EXTENSION_KEY]);
       if (problems.length) throw new ServiceError(`Dashboard declaration: ${problems.join('; ')}.`);
     }
+    if (Object.hasOwn(extensions, CONNECTIONS_EXTENSION_KEY)) {
+      // DEC-0096: a host hides an invalid declaration (FAC-SEM-127); a service never publishes one.
+      const view = connectionsView({ extensions: { [CONNECTIONS_EXTENSION_KEY]: extensions[CONNECTIONS_EXTENSION_KEY] } });
+      if (view.reported) throw new ServiceError(`Connections declaration: ${view.errors.join('; ')}.`);
+    }
     doc.extensions = { ...extensions };
   }
   if (configuration !== undefined) {