@passioncode-ai/fabric-agent-adapter 0.46.1 → 0.47.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.47.0 (2026-10-23)
+
+### Changed
+
+- **Pinned to contract `87d384f`** (FAA-105; `0a4ce77` stays supported): DEC-0105 (the home-path detector and a node
+  summary's silence) and DEC-0106 (calls between machines of one estate). Every vendored vector is regenerated from
+  the contract's own functions at the pin.
+- **The estate reader reads a machine's `profile`** (DEC-0106), both twins. `FAC-SEM-134` joins the record's rules:
+  a profile is `full`, `member` or `view`; only a `full` machine carries a `hubKey`; a `view` machine places no agent,
+  holds no secret and fills none. `verify_estate_record` / `verifyEstateRecord` refuses a revision that breaks it
+  (`rule-violation`). New: `machine_profile(record, machine_id)` / `machineProfile(record, machineId)` and
+  `MACHINE_PROFILES`, held to the contract's profile vectors and hostile inputs.
+- **`profile-forbids` is a DL-19 refusal code** in both delegation kits (403), with its message.
+- **The protocol register gains `fabric-agent-call/1`**, both twins.
+- `references/estate-record.md` gains *Machine profiles*; `references/delegation.md` and `references/protocol.md` name
+  DEC-0106. Placing a relay caller, judging a call by profile and sealing it stay a relay node's duties, not the kit's
+  yet (FAA-106). DEC-0105 changes no kit: the kits do not port the activity rules' home-path detector.
+
 ## 0.46.1 (2026-10-23)
 
 ### Fixed

package/README.md

@@ -274,7 +274,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `0a4ce773c4b9e6bec40c6387eb3f988af7152c0e`
+- commit: `87d384ffce2757081b7ab227e5dad3dddd08328f`
 
 Every other mention of the default contract revision (this section, the skills' metadata, the
 skill card, `adapt_project.py`) must equal it; `python3 test/validate.py` fails a tree

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.46.1",
+  "version": "0.47.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.46.1",
+  "version": "0.47.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.46.1"
+  version: "0.47.0"
   contract-version: "0.1.0"
-  contract-commit: "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e"
+  contract-commit: "87d384ffce2757081b7ab227e5dad3dddd08328f"
 ---
 
 # Adapting projects to Fabric
@@ -76,7 +76,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `0a4ce773c4b9e6bec40c6387eb3f988af7152c0e`.
+- commit `87d384ffce2757081b7ab227e5dad3dddd08328f`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -22,10 +22,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e"
+CONTRACT_COMMIT = "87d384ffce2757081b7ab227e5dad3dddd08328f"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e", "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,10 +14,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.46.1"
+  version: "0.47.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e"
+  extension-commit: "87d384ffce2757081b7ab227e5dad3dddd08328f"
 ---
 
 # Building Fabric services

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -90,7 +90,8 @@ DL-19: an MCP tool answers `refusal_tool_result(r)` / `refusalToolResult(r)`: `i
 `structuredContent: {error: {code, message, data: {detail}}}`; an HTTP route answers `refusal_http(r)` /
 `refusalHttp(r)` with the code's status (401 for `unauthenticated`, `token-expired`, `principal-unproven`, with
 `WWW-Authenticate: Bearer error="invalid_token"`; 503 for `issuer-unavailable` and `unknown-state`; 403 for the
-rest). A published key the service cannot use (of small order, for another use, or published twice) is the
+rest, `profile-forbids` included: DEC-0106's refusal of a call between two machines of one estate that a machine's
+profile does not allow). A published key the service cannot use (of small order, for another use, or published twice) is the
 issuer's fault, `issuer-unavailable` (DEC-0045); a gate without a trusted issuer refuses everything as
 `no-trusted-issuer`. `detail` is a short machine word; the token, the approval and the keys never appear in a result or a log.
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/estate-record.md

@@ -2,10 +2,11 @@
 
 Fabric Agent Contract DEC-0055, `docs/specification/estate-record.md`, schema `schemas/estate-record.schema.json`,
 rules `FAC-SEM-072…076`, with contexts (DEC-0082, `docs/specification/contexts.md`, `FAC-SEM-110`, `FAC-SEM-111`) and a
-partner's scoped publisher key (DEC-0090, `docs/specification/partner-channel.md`, `FAC-SEM-122`).
+partner's scoped publisher key (DEC-0090, `docs/specification/partner-channel.md`, `FAC-SEM-122`) and each machine's
+profile (DEC-0106, `docs/specification/machine-calls.md`, `FAC-SEM-134`).
 One revision of one person's estate lists:
 - the passkeys that sign it;
-- the machines, with their device keys and a certificate of each machine's hub key;
+- the machines, with their device keys, a certificate of each machine's hub key and, optionally, a profile;
 - the packages placed on each machine, each in a context: the person's own, or an organization's;
 - where each secret slot is filled from (by reference only);
 - share grants and revocations.
@@ -19,6 +20,7 @@ derived from its own digest. Python: [`scripts/fabric_estate.py`](../scripts/fab
 - Applying a revision
 - Trusting a delegation key
 - Contexts: one agent for you and for an organization
+- Machine profiles: full, member, view
 - The estate ceremonies
 - Share grants into an organization
 - Checking a record you produce
@@ -57,7 +59,7 @@ It checks, in the order of the ER table:
 7. **The window.** At most 30 days. A revision may be issued up to 60 s ahead of the verifier's clock (DEC-0066,
    `CLOCK_SKEW_SECONDS`); earlier than that it is `not-yet-valid`.
 8. **The record's own rules.** A violation is `rule-violation` with its `codes`, `FAC-SEM-072…076`, `FAC-SEM-110`,
-   `FAC-SEM-111`, `FAC-SEM-122` and `FAC-SEM-092`
+   `FAC-SEM-111`, `FAC-SEM-122`, `FAC-SEM-134` and `FAC-SEM-092`
    (each passkey the record lists is a signing credential, its origins within its RP ID).
 
 Dates are strict RFC 3339: a `T`, an offset, and a day that exists. `:60` and a space are refused. Passkey JWK `x`
@@ -128,6 +130,36 @@ Every rule is total on hostile JSON, as the contract's are: an `instancePath` na
 non-object before it does not shift it), and a value whose own `toString` member is data is shown as its JSON. Both kits
 answer the contract's contexts fixtures and variants of them (`test/fixtures/contract/estate-vectors.json`).
 
+## Machine profiles: full, member, view
+
+DEC-0106 gives a machine an optional `profile`. It says what the machine may be when other machines of the estate call
+it over the relay.
+
+- **`full`**, the default. A record omits it: a machine with no `profile` is `full`. Only a `full` machine carries a
+  `hubKey`.
+- **`member`** takes calls from the estate's machines and holds only the secret slots the record places on it. It has
+  no `hubKey`.
+- **`view`** only reads. It has no `hubKey`, no placement and no secret placement, and no secret placement names it as
+  `from`.
+
+`FAC-SEM-134` checks all of it: an unknown value, a hub key on a `member` or `view` machine, and a `view` machine that
+places, holds or fills a secret. A revision that breaks it is `rule-violation`. A profile changes only by a revision
+the passkey signs.
+
+`machine_profile(record, machine_id)` / `machineProfile(record, machineId)` answers a machine's profile: `full` for a
+machine listed once with no `profile`, its value when it is one of the three, and `None` / `undefined` otherwise (not
+listed, listed twice, an unreadable record or id, an unknown value). It never raises. Both kits answer the contract's
+own profile vectors (`fixtures/vectors/machine-call.json`) and hostile inputs (`test/fixtures/contract/estate-vectors.json`).
+
+- **Update a copied kit before a record carries `profile`.** A copy older than 0.47.0 refuses a record with `profile`
+  only when it checks the schema; its rules find nothing broken on a `view` machine that places agents. Fabric writes
+  `profile` only once every reader of its records is pinned at or after DEC-0106, the kits included:
+  `fabric_kit.py install <dir> --module fabric_estate` (or `--lang node --module fabric-estate`).
+- **The kit does not take calls between machines.** Placing a relay caller (`relayCallerTier`), judging a call by
+  profile (`machineCallVerdict`) and sealing it (`fabric-agent-call/1`, HPKE) are a relay node's duties; no kit-built
+  service is one yet (FAA-106). A delegation verifier still names the refusal: `profile-forbids` is a DL-19 code
+  ([delegation](delegation.md)).
+
 ## The estate ceremonies
 
 Contract DEC-0084: create a network, add a machine nearby (a six-digit comparison code) or headless (an enroll token),

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1: wire reference
 
-Pinned to `fabric-agent-contract` commit `0a4ce773c4b9e6bec40c6387eb3f988af7152c0e`
+Pinned to `fabric-agent-contract` commit `87d384ffce2757081b7ab227e5dad3dddd08328f`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
@@ -11,7 +11,8 @@ estate record's 60 s skew DEC-0066; an app's own descriptor DEC-0069; the descri
 by normal form DEC-0076; the project board's directory page DEC-0077 and a replacement's transferred attempts DEC-0078; an operator's hold DEC-0079, a structured finding DEC-0080 and the owner's settlement DEC-0081; `fabric-connections/0.1` in the protocol register
 DEC-0096; a schema pattern never uses a bare dot DEC-0097; the board as Fabric 0.3.9 serves it DEC-0098 and DEC-0102, a
 `processor-hosted` peer DEC-0099, three device protocols in the register DEC-0101; a call queue's `queue-full` and
-the `agent-directory`, `fabric-load` and `service-load` protocols DEC-0104). The contract's schemas are normative;
+the `agent-directory`, `fabric-load` and `service-load` protocols DEC-0104; a machine's `profile` in the estate record,
+`profile-forbids` and the `fabric-agent-call` protocol DEC-0106). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-delegation.mjs

@@ -19,7 +19,7 @@ import { atomicWrite } from './fabric-paths.mjs'; // the kit's private writer (F
 export const REFUSAL_CODES = Object.freeze([
   'unauthenticated', 'token-expired', 'wrong-audience', 'scope-not-granted', 'effect-above-ceiling', 'no-grant',
   'grant-expired', 'grant-revoked', 'limit-reached', 'approval-required', 'approval-invalid', 'approval-reused',
-  'principal-unproven', 'credential-source-refused', 'chain-too-deep', 'issuer-unavailable', 'unknown-state',
+  'principal-unproven', 'credential-source-refused', 'chain-too-deep', 'profile-forbids', 'issuer-unavailable', 'unknown-state',
 ]);
 export const EFFECT_CLASSES = Object.freeze(['none', 'draft', 'publish', 'send', 'reply', 'charge', 'delete', 'merge', 'deploy', 'change-policy']);
 export const DELEGATION_HEADER = 'Fabric-Delegation';
@@ -52,6 +52,7 @@ export const REFUSAL_MESSAGES = Object.freeze({
   'principal-unproven': "The caller's proof is missing or stale.",
   'credential-source-refused': 'The grant names a credential source that is not allowed.',
   'chain-too-deep': 'The actor chain is deeper than four.',
+  'profile-forbids': "The caller's or the target's machine profile does not allow this call.",
   'issuer-unavailable': "The estate's published keys cannot be read.",
   'unknown-state': 'The state cannot be established, so the call is refused.',
 });

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-estate.mjs

@@ -4,7 +4,8 @@
 //
 // - verifyEstateRecord(record, { at, parent } | { at, authorities }) — the verdict a machine applies a revision on, after
 //   it has checked the revision against estate-record.schema.json (the verifier does not check the schema);
-// - estateRecordRules(kind, value) — FAC-SEM-072…076;
+// - estateRecordRules(kind, value) — FAC-SEM-072…076, with FAC-SEM-134 on each machine's profile (DEC-0106);
+// - machineProfile(record, machineId) — a machine's profile (DEC-0106): `full`, `member`, `view`, or undefined;
 // - hubKeyCertified(record, kid, x, at) — DL-14: a delegation verifier that reads the estate record trusts a token's
 //   `kid` only while a current revision certifies it for a machine (fabric-delegation.mjs calls it).
 //
@@ -540,6 +541,50 @@ function placementGrants(value, flag) {
   });
 }
 
+/** DEC-0106: what a machine of the estate may be. Absent is `full`, and a writer omits `full`. */
+export const MACHINE_PROFILES = Object.freeze(['full', 'member', 'view']);
+const isProfile = (value) => typeof value === 'string' && MACHINE_PROFILES.includes(value);
+
+/**
+ * A machine's profile in a record (DEC-0106): `full` when the machine is listed once with no `profile`, its value when
+ * that is one of the three, undefined otherwise (not listed, listed twice, an unreadable record or id, an unknown
+ * value). The contract's machineProfile; it never throws.
+ */
+export function machineProfile(record, machineId) {
+  if (!isObject(record) || !isString(machineId)) return undefined;
+  const found = list(record.machines).filter((machine) => machine.id === machineId);
+  if (found.length !== 1) return undefined;
+  const { profile } = found[0];
+  if (profile === undefined) return 'full';
+  return isProfile(profile) ? profile : undefined;
+}
+
+/**
+ * FAC-SEM-134 (DEC-0106): a profile, when present, is `full`, `member` or `view`; only a `full` machine carries a
+ * `hubKey`; a `view` machine has no placement and no secret placement, and no secret placement names it as `from`.
+ */
+function machineProfiles(value, flag) {
+  const views = new Set();
+  indexed(value.machines).forEach(([machine, m]) => {
+    if (machine.profile === undefined) return;
+    if (!isProfile(machine.profile)) {
+      flag(`/machines/${m}/profile`, `profile ${show(machine.profile)} is none of full, member, view`);
+      return;
+    }
+    if (machine.profile !== 'full' && machine.hubKey !== undefined) flag(`/machines/${m}/hubKey`, `a ${machine.profile} machine is never the hub's: only a full machine carries a hub key`);
+    if (machine.profile === 'view') {
+      views.add(machine.id);
+      if (list(machine.packages).length > 0) flag(`/machines/${m}/packages`, 'a view machine runs no agent: it has no placement');
+      if (list(machine.secrets).length > 0) flag(`/machines/${m}/secrets`, "a view machine holds none of the estate's secrets");
+    }
+  });
+  indexed(value.machines).forEach(([machine, m]) => {
+    indexed(machine.secrets).forEach(([secret, s]) => {
+      if (views.has(secret.from)) flag(`/machines/${m}/secrets/${s}/from`, `machine ${show(secret.from)} is a view machine: it is the source of no secret`);
+    });
+  });
+}
+
 function recordFindings(value) {
   const findings = [];
   revisionWhole(value, flagger(findings, 'FAC-SEM-072'));
@@ -550,6 +595,7 @@ function recordFindings(value) {
   grantsAndRevocations(value, flagger(findings, 'FAC-SEM-076'));
   indexed(value.shareGrants).forEach(([grant, index]) => findings.push(...grantContextFindings(grant, `/shareGrants/${index}`)));
   placementGrants(value, flagger(findings, 'FAC-SEM-111'));
+  machineProfiles(value, flagger(findings, 'FAC-SEM-134'));
   // FAC-SEM-092 (DEC-0063) on each passkey the record lists.
   indexed(value.authorities).forEach(([authority, index]) => signingCredential(authority, `/authorities/${index}`, flagger(findings, 'FAC-SEM-092')));
   return findings;

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-protocols.mjs

@@ -8,7 +8,7 @@ import { credentialName, secretArgument, secretUrl, secretValue } from './fabric
 /** Each contract protocol's published revisions, oldest first (the contract's `PROTOCOL_REVISIONS`); a test holds it equal to the contract's. */
 export const PROTOCOL_REVISIONS = new Map(Object.entries({
   'access-log': ['1'], approval: ['1'], 'activity-summary': ['1'], 'agent-directory': ['1'], 'coding-agents': ['1'], 'enroll-token': ['1'], entitlement: ['1'], 'entitlement-key-set': ['1'], 'estate-record': ['1'], 'execution-packet': ['1'],
-  'fabric-activity': ['0.1'], 'fabric-connections': ['0.1'], 'fabric-load': ['0.1'], 'fabric-dashboard': ['0.1'], 'fabric-delegation': ['0.1'], 'fabric-device': ['0.1'],
+  'fabric-activity': ['0.1'], 'fabric-agent-call': ['1'], 'fabric-connections': ['0.1'], 'fabric-load': ['0.1'], 'fabric-dashboard': ['0.1'], 'fabric-delegation': ['0.1'], 'fabric-device': ['0.1'],
   'fabric-interop': ['0.1', '0.2'], 'fabric-local-channel': ['0.1'], 'fabric-local-runner': ['0.1'], 'fabric-operator-channel': ['0.1'],
   'fabric-package': ['1'], 'fabric-project-comms': ['0.1'], 'fabric-proposal': ['1'], 'fabric-provider': ['0.1'], 'fabric-relay': ['0.1'],
   'fabric-secret-envelope': ['1'], 'fabric-service': ['0.1'], 'fabric-settings-backup': ['1'], heartbeat: ['1'], 'learning-note': ['1'],

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -49,7 +49,8 @@ from fabric_paths import atomic_write as _atomic_write  # noqa: E402 - the kit's
 REFUSAL_CODES = (
     "unauthenticated", "token-expired", "wrong-audience", "scope-not-granted", "effect-above-ceiling", "no-grant",
     "grant-expired", "grant-revoked", "limit-reached", "approval-required", "approval-invalid", "approval-reused",
-    "principal-unproven", "credential-source-refused", "chain-too-deep", "issuer-unavailable", "unknown-state",
+    "principal-unproven", "credential-source-refused", "chain-too-deep", "profile-forbids", "issuer-unavailable",
+    "unknown-state",
 )
 EFFECT_CLASSES = ("none", "draft", "publish", "send", "reply", "charge", "delete", "merge", "deploy", "change-policy")
 DELEGATION_HEADER = "Fabric-Delegation"
@@ -88,6 +89,7 @@ REFUSAL_MESSAGES = {
     "principal-unproven": "The caller's proof is missing or stale.",
     "credential-source-refused": "The grant names a credential source that is not allowed.",
     "chain-too-deep": "The actor chain is deeper than four.",
+    "profile-forbids": "The caller's or the target's machine profile does not allow this call.",
     "issuer-unavailable": "The estate's published keys cannot be read.",
     "unknown-state": "The state cannot be established, so the call is refused.",
 }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_estate.py

@@ -10,7 +10,8 @@ at the pin, ported answer for answer and held to the contract's own vectors (`te
 - ``verify_estate_record(record, at=..., parent=... | authorities=...)`` — the verdict a machine applies a revision on,
   after it has checked the revision against `estate-record.schema.json` (the verifier does not check the schema);
 - ``estate_record_rules(kind, value)`` — FAC-SEM-072…076 for `estate-record`, `estate-record-revision` and
-  `estate-placement`;
+  `estate-placement`, with FAC-SEM-134 on each machine's profile (DEC-0106);
+- ``machine_profile(record, machine_id)`` — a machine's profile (DEC-0106): `full`, `member`, `view`, or None;
 - ``hub_key_certified(record, kid, x, at)`` — DL-14: a delegation verifier that reads the estate record trusts a token's
   `kid` only while a current revision certifies it for a machine (``fabric_delegation`` calls it).
 
@@ -645,6 +646,54 @@ def _secret_references(value: Dict[str, Any], flag) -> None:
             slots.append(key)
 
 
+#: DEC-0106: what a machine of the estate may be. Absent is `full`, and a writer omits `full`.
+MACHINE_PROFILES = ("full", "member", "view")
+
+
+def _is_profile(value: Any) -> bool:
+    return isinstance(value, str) and value in MACHINE_PROFILES
+
+
+def machine_profile(record: Any, machine_id: Any) -> Optional[str]:
+    """A machine's profile in a record (DEC-0106): ``full`` when the machine is listed once with no ``profile``, its value
+    when that is one of the three, None otherwise (not listed, listed twice, an unreadable record or id, an unknown
+    value). The contract's ``machineProfile``; never raises."""
+    if not isinstance(record, dict) or not isinstance(machine_id, str):
+        return None
+    found = [m for m in _list(_get(record, "machines")) if _same(_get(m, "id"), machine_id)]
+    if len(found) != 1:
+        return None
+    profile = _get(found[0], "profile")
+    if profile is _MISSING:
+        return "full"
+    return profile if _is_profile(profile) else None
+
+
+def _machine_profiles(value: Dict[str, Any], flag) -> None:
+    """FAC-SEM-134 (DEC-0106): a profile, when present, is `full`, `member` or `view`; only a `full` machine carries a
+    `hubKey`; a `view` machine has no placement and no secret placement, and no secret placement names it as `from`."""
+    views: List[Any] = []
+    for machine, m in _indexed(_get(value, "machines")):
+        profile = _get(machine, "profile")
+        if profile is _MISSING:
+            continue
+        if not _is_profile(profile):
+            flag("/machines/%d/profile" % m, "profile %s is none of full, member, view" % _show(profile))
+            continue
+        if profile != "full" and _get(machine, "hubKey") is not _MISSING:
+            flag("/machines/%d/hubKey" % m, "a %s machine is never the hub's: only a full machine carries a hub key" % profile)
+        if profile == "view":
+            views.append(_get(machine, "id"))
+            if _list(_get(machine, "packages")):
+                flag("/machines/%d/packages" % m, "a view machine runs no agent: it has no placement")
+            if _list(_get(machine, "secrets")):
+                flag("/machines/%d/secrets" % m, "a view machine holds none of the estate's secrets")
+    for machine, m in _indexed(_get(value, "machines")):
+        for secret, s in _indexed(_get(machine, "secrets")):
+            if _contains(views, _get(secret, "from")):
+                flag("/machines/%d/secrets/%d/from" % (m, s), "machine %s is a view machine: it is the source of no secret" % _show(_get(secret, "from")))
+
+
 def _grant_key(ident: Any) -> Any:
     """A grant's id is a URI, so grants and their revocations are keyed by its normal form (DEC-0076)."""
     import fabric_identifiers  # noqa: E402 - beside this file
@@ -783,6 +832,7 @@ def _record_findings(value: Dict[str, Any]) -> List[Dict[str, str]]:
     for grant, index in _indexed(_get(value, "shareGrants")):  # FAC-SEM-110 (DEC-0082)
         findings.extend(grant_context_findings(grant, "/shareGrants/%d" % index))
     _placement_grants(value, _finding(findings, "FAC-SEM-111"))
+    _machine_profiles(value, _finding(findings, "FAC-SEM-134"))
     for authority, index in _indexed(_get(value, "authorities")):  # FAC-SEM-092 (DEC-0063)
         _signing_credential(authority, "/authorities/%d" % index, _finding(findings, "FAC-SEM-092"))
     return findings

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_protocols.py

@@ -15,7 +15,7 @@ if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from
 PROTOCOL_REVISIONS: Dict[str, Tuple[str, ...]] = {
     "access-log": ("1",), "approval": ("1",), "activity-summary": ("1",), "agent-directory": ("1",), "coding-agents": ("1",), "enroll-token": ("1",), "entitlement": ("1",),
     "entitlement-key-set": ("1",), "estate-record": ("1",), "execution-packet": ("1",),
-    "fabric-activity": ("0.1",), "fabric-connections": ("0.1",), "fabric-load": ("0.1",), "fabric-dashboard": ("0.1",), "fabric-delegation": ("0.1",), "fabric-device": ("0.1",),
+    "fabric-activity": ("0.1",), "fabric-agent-call": ("1",), "fabric-connections": ("0.1",), "fabric-load": ("0.1",), "fabric-dashboard": ("0.1",), "fabric-delegation": ("0.1",), "fabric-device": ("0.1",),
     "fabric-interop": ("0.1", "0.2"), "fabric-local-channel": ("0.1",), "fabric-local-runner": ("0.1",),
     "fabric-operator-channel": ("0.1",), "fabric-package": ("1",), "fabric-project-comms": ("0.1",), "fabric-proposal": ("1",),
     "fabric-provider": ("0.1",), "fabric-relay": ("0.1",), "fabric-secret-envelope": ("1",), "fabric-service": ("0.1",),

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/kit.json

@@ -1,6 +1,6 @@
 {
  "name": "fabric-service-kit",
- "version": "0.46.1",
+ "version": "0.47.0",
  "about": "The service kit's modules in dependency order: a module imports only modules listed before it. Written by fabric_kit.py build; edit the order and layers by hand, never the digests.",
  "python": [
   {
@@ -77,7 +77,7 @@
     "fabric_secrets",
     "fabric_time"
    ],
-   "sha256": "50cc12166a00b680ba5b2e458200912d7bcfbef70bd73ec4edf57c7fcfa9b687"
+   "sha256": "a7400a3b2498ea2b6e3a845ed438580f2bf3c4ce58854ba4ad22d7cdf6f846bc"
   },
   {
    "module": "fabric_delegation",
@@ -89,7 +89,7 @@
     "fabric_jsvalue",
     "fabric_paths"
    ],
-   "sha256": "4eb5004188fdc6f5c0fd21fb0f9f1f538899a0383bcde0365dea080ef8347182"
+   "sha256": "6638a6039befe3b43f59018bab292e050931af21b544df1044cd5059572ded36"
   },
   {
    "module": "fabric_share",
@@ -150,7 +150,7 @@
    "imports": [
     "fabric_secrets"
    ],
-   "sha256": "420e83dedeccfc93306870b2776908336c81cb349abb188d4cd7be9c8cef9802"
+   "sha256": "89babdb43468a90e4aa9df388a82dd498ae1e0ac5445ac4a1b9c225d8bc61f67"
   },
   {
    "module": "fabric_connections",
@@ -473,7 +473,7 @@
     "fabric-secrets",
     "fabric-time"
    ],
-   "sha256": "912b1ceab57ed20f946986bf14ae2faf41fb8ea539e818164496874f3749ef65"
+   "sha256": "c4784b0f73d06baaa5f8d104eb33ec21bf5433abfbaed046f24f1d07cf78c782"
   },
   {
    "module": "fabric-delegation",
@@ -485,7 +485,7 @@
     "fabric-jsvalue",
     "fabric-paths"
    ],
-   "sha256": "85a7e00e606244e7e02f9cbecc3e421bfcb9c1e12cd2a91daadf8a9c2403104d"
+   "sha256": "dafde9ea327c88d92dc73d1400282b43dc6f84dd345a2d2b9b154304f65fc9d7"
   },
   {
    "module": "fabric-share",
@@ -544,7 +544,7 @@
    "imports": [
     "fabric-secrets"
    ],
-   "sha256": "91a98de17b29e1d100b2e8b965f3310f57b24b65ad6b4596e7a90b26b9069d4d"
+   "sha256": "b1fcf14ef1e4f2215111d9fdc89ff5bda3ce2a49aefcd2788feb5a1c12463cbf"
   },
   {
    "module": "fabric-connections",
@@ -2419,6 +2419,82 @@
    "fabric-openrouter.mjs": "f8f0168691f968b7cd85f36aa98e2167e88cc44f1104ff514fd0c7699b339253",
    "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
    "share-registration.schema.json": "34b3997eeaf936ebc861342a23045634a7c18c19f01d7ed4198310d81989f5b0"
+  },
+  "0.47.0": {
+   "fabric_jsvalue.py": "0cd4eab0a5d6ae35d097f7c59a08dc29173cb61c561c49e5291a8dad15d36779",
+   "fabric_time.py": "588f383da4ac6a243ea95b6ffc3a0aa99ca94245732dc4937734f190b7af4ae9",
+   "fabric_identifiers.py": "0fd814d521ac3aa39907458265870753046a73f48af3d8581ab864b93b211607",
+   "fabric_secrets.py": "68a0b5e9e90c468ec9ac67b2f0fd1848e08813d6ec1ec14a2a47337eb1a98911",
+   "fabric_crypto.py": "9c34aee20dbe4d6742e4fdbaab68ceb934bbe7dbd3a904c0010824ace16cdeaa",
+   "fabric_base.py": "f62bcc2ed9912660fa875d27a09f60867260cc4925f79873501fd9620be59611",
+   "fabric_platform.py": "a9350dff55ef0fb3a23cdb4d0320a15868b15a8deb10d2eb74d72c58740c284b",
+   "fabric_paths.py": "6c92af34292baddf7e10d3134d0a5b0bb23387741812a9f79c409cf1628bad23",
+   "fabric_estate.py": "a7400a3b2498ea2b6e3a845ed438580f2bf3c4ce58854ba4ad22d7cdf6f846bc",
+   "fabric_delegation.py": "6638a6039befe3b43f59018bab292e050931af21b544df1044cd5059572ded36",
+   "fabric_share.py": "78506fe1a60829c525dbf6266a0aa0749a2164290ed94da8249a20b4e9be5605",
+   "fabric_ceremonies.py": "a59e83cf4adb2669a9b98008e3d3a0cba991a35cbff97bc604fc82fe81cfd49f",
+   "fabric_package_schema.py": "e623f0408d38e3343ed66222fb812907c6c52e1a286eb1c1176ab2e64640c9ad",
+   "fabric_package.py": "ff533f1b3f92b4ea0f532fcec50b68c610d47549930eef8ad5247692a64dfb3c",
+   "fabric_protocols.py": "89babdb43468a90e4aa9df388a82dd498ae1e0ac5445ac4a1b9c225d8bc61f67",
+   "fabric_connections.py": "77d3ccf863c70e9209d21ef45c46a6db9c06237019bc20d54f8d3946873f3f11",
+   "fabric_lock.py": "ba2399d2137c7a7791b7133b9db9cca36693f4eb7e30955b25a75ade814e95ba",
+   "fabric_usage.py": "ce685cb9fdfd62ea75fff8b1b2be12a2ba758da783e4bfb4dcebe47bcbeb832b",
+   "fabric_backups.py": "02dc5eb66ec956723d3ddba07b6dd15f6a9726d901f4d60edfd02eee57880ceb",
+   "fabric_descriptor.py": "daf16f95b1810283b1386488e006e940a0cdfa5c3c8d09386ac33d29d58df78d",
+   "fabric_auth.py": "55794587750f6c9f40935b74295d83d7096cb4b26a0b36ac292334cd87d8f853",
+   "fabric_events.py": "0086886c2c29dbd5c9d152be9d375c5bdf4a29f89b8095baff8490c2bcd64e47",
+   "fabric_logs.py": "86dc55bfafa2a57264722e2403510a249b95de0e4a722b2e4bc3948e3bd93da9",
+   "fabric_supervisors.py": "a2dbf15aa1c4eb9de42996b413103fa4814afd2e4e66d1ab7315f30e06ab6841",
+   "fabric_service.py": "d411433ce6ff3e81189b10b2c1a8462335a97cd99574ab0ee7d1c28cf48e1694",
+   "fabric_profiles.py": "26e21ec29c016000f8ca8053b7b489184854a73be1b7fdc0a18d12990203db9b",
+   "fabric_interop_rules.py": "b5f0ecb1791b4c50c5ac151f987f692ed7001bc74841a8a161125ec775145e09",
+   "fabric_interop.py": "f92fa111328fe3811438f733d8f0eb5295e6941c774123a78e26318bdcb35fc3",
+   "fabric_hub.py": "b9ac852e601b1d54cf61351677a628afc69faeed7d1fc74ebe541c1cf38e0c2a",
+   "fabric_board_shapes.py": "0a0e8d3d40e33dfd8c457aedb85330b2ff25f8c49a33eb6cbd5a5cc8a5007f7e",
+   "fabric_board_link.py": "b5bff994cb615c6a4bb0d88d020e3a59504166180e1fa1aea3be93224f2aeccb",
+   "fabric_board_session.py": "2271834c36c23f6bfa50395cd147e6af99f294ef09325fd15f0759ca8e18d941",
+   "fabric_board_fixture.py": "69761ce205ec640762ec9b591c6903e5a87f844e8d423b041681924027e39d1e",
+   "fabric_board.py": "0f075894b3e352194fcaf3fc7d08dee4e9f1c215e859769ed85fa5010e4a1599",
+   "fabric_http.py": "5d7f72af3a73fdbe8c1f487ecf60cef23a7c46289eba542b03aff4706b8218d4",
+   "fabric_openrouter.py": "2017d898c17001d7275f58267de653be7ecf6acd17ad8d9b24ecb7a43e5617d4",
+   "fabric-jsvalue.mjs": "dfbdb8c41584972c9389750a41719374a1cfc5652ed438dd1623025190b0106e",
+   "fabric-time.mjs": "3ff932069038a720df1c68c6492976906737b2e67e5c12d9c81c418597f661de",
+   "fabric-identifiers.mjs": "a18c2a501a4aa170bfd3d99e571ad6b7662649b4d3b9d2a540c002ea42811bbf",
+   "fabric-secrets.mjs": "6ad8ab18ac899ecc2384e8ec6a3fb689b92be3b9a5ce3a59b92a37d52da5d766",
+   "fabric-crypto.mjs": "038e03689701e3c9721a1e7f8e0a4d02a52d6a5d1661b0dc84035edc3ebbfcf6",
+   "fabric-base.mjs": "7804b2df7715dbbf9702a9b61b6b8cef2110f9a52b04cabd8fb0a66458d87512",
+   "fabric-platform.mjs": "a8119d95ebba4d589a9e401f5d6fc8dda62d59d44e4c1ff811d97fac3771ac0c",
+   "fabric-paths.mjs": "2201b4ed7126f260931b63e8386377b4317d8dcad419d109bf22c683e44b7f29",
+   "fabric-estate.mjs": "c4784b0f73d06baaa5f8d104eb33ec21bf5433abfbaed046f24f1d07cf78c782",
+   "fabric-delegation.mjs": "dafde9ea327c88d92dc73d1400282b43dc6f84dd345a2d2b9b154304f65fc9d7",
+   "fabric-share.mjs": "d40a7405d7bd4c3213ed691330b7549afe8e023db0753b582e249714e672010d",
+   "fabric-ceremonies.mjs": "117d4374c9e95c930a38de7adbd4323774798f4fe6ec6f24afcd6f2c7298ca44",
+   "fabric-package-schema.mjs": "cd28092375db0fc21ffab1f0bb7794f7f8979ee08c64d3b9faf4b3845357caa6",
+   "fabric-package.mjs": "49b757eefcc50e4c91585d5a5694bf3c83d0b03d112c1837f1c9f01466797ab5",
+   "fabric-protocols.mjs": "b1fcf14ef1e4f2215111d9fdc89ff5bda3ce2a49aefcd2788feb5a1c12463cbf",
+   "fabric-connections.mjs": "303432e547ce563e90ca9ffcd827f5612f51d3582929834e1add0fdaf6485dcc",
+   "fabric-lock.mjs": "ac219ab0a326d5c43c7c4c255e0c3843d4794de795a60e3af661e7d5350ea052",
+   "fabric-usage.mjs": "e413569620bbc8221bc59e24b27e22d1483825ed18457801ed58d54a57de8114",
+   "fabric-backups.mjs": "849acdc6eba0fff648c8158e61f6b68cccd7bedf0880f7d5ec03a6a20f1e7005",
+   "fabric-descriptor.mjs": "95c0b7ff36c29d7c748f1fa6fb1767d6fe8c97fca7f1ee404559930abbd3cc84",
+   "fabric-auth.mjs": "3ea6796470fcd829bc72a772fb7e4c37532a09d1e37ff41592dcf1a1a3074ca2",
+   "fabric-events.mjs": "c463d6ffcae24229a5c608d8fcea4268d2ccc5024b19fa10e5a452284068fa71",
+   "fabric-logs.mjs": "58467e5719c16e099d05bbedec47a95712506ab03c33f3cd4be1252e8498a946",
+   "fabric-supervisors.mjs": "9d61c1a17538a5e2453e33e5ae347337336748041bc054478a96dd51f3d4fc51",
+   "fabric-service.mjs": "bc67550e52aa6aa9c6d2ed6cbae52418a3e836623e17164166699f953d8aafa8",
+   "fabric-profiles.mjs": "314376cf2deb87f235fb18b11d3b532e211f585b9af0a9302b5f4cc39971b532",
+   "fabric-interop-rules.mjs": "57a8081307956e8c381119b361fa5232a7bf791815be8e3541eb5492820e2ea5",
+   "fabric-interop.mjs": "581983ec3e197e5c2340ad25e8468320c69a2459c90097c7fcf2699766b4fb26",
+   "fabric-hub.mjs": "c005115a864cfd67daa4862097bb14acfe5a60bf653897e5bf8a570dd80f1070",
+   "fabric-board-shapes.mjs": "c1db7b7bd0d58d82bb6d8dfbc3cd1547a256a333052d367e82ff1b3edf2804d7",
+   "fabric-board-link.mjs": "4cd6d4e21713a38c8e56f7d59db3148638b8c27c08e774d96a0f6283c6049e0a",
+   "fabric-board-session.mjs": "e9eefb5d34dc66f6d6b528a9c9e85960fd884e6ea5e179c26cbfe3c054ccf7bc",
+   "fabric-board-fixture.mjs": "83c4b7e33ee47b68385faf2569d38d5c8a0c5cb0f8656090f41e1b0eed2f436e",
+   "fabric-board.mjs": "9e7bfe4d412521982224ef12bebfc2ff255eeeaf8d96cf40234ac18de68e7a59",
+   "fabric-http.mjs": "f886bcb49c4353d039387ac9568738dda26697a94dd07fc6a6204500f0bc27bf",
+   "fabric-openrouter.mjs": "f8f0168691f968b7cd85f36aa98e2167e88cc44f1104ff514fd0c7699b339253",
+   "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
+   "share-registration.schema.json": "34b3997eeaf936ebc861342a23045634a7c18c19f01d7ed4198310d81989f5b0"
   }
  },
  "data": {

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.46.1"
+  version: "0.47.0"
   contract-version: "0.1.0"
-  contract-commit: "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e"
+  contract-commit: "87d384ffce2757081b7ab227e5dad3dddd08328f"
 ---
 
 # Creating Fabric-compatible agents
@@ -136,7 +136,7 @@ python3 <plugin-dir>/skills/adapting-projects-to-fabric/scripts/adapt_project.py
 The effect class is declared, never defaulted: ask the author what the agent does outside itself when the request
 does not say. Cost presets are only for a run whose cost varies; their amounts come from the author or measured runs.
 
-Pin exactly contract `0.1.0` at commit `0a4ce773c4b9e6bec40c6387eb3f988af7152c0e` and
+Pin exactly contract `0.1.0` at commit `87d384ffce2757081b7ab227e5dad3dddd08328f` and
 read the pinned guide before implementing protocol details. If this skill is installed
 without its sibling, the scaffolder is absent: create the bundle by hand from the pinned
 contract's `docs/guides/connecting-compatible-agents.md` and mark the structural check

package/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -19,7 +19,7 @@ compatibility: >-
   this plugin; Codex/Kimi use command hooks; Hermes/OpenCode/OpenClaw/Pi use native context plugins after opt-in.
 metadata:
   author: PassionCode.ai
-  version: "0.46.1"
+  version: "0.47.0"
 ---
 
 # Working with Fabric

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session_env.py

@@ -57,7 +57,7 @@ SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 
 
-VERSION = "0.46.1"
+VERSION = "0.47.0"
 
 
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",