@passioncode-ai/fabric-agent-adapter 0.50.0 → 0.51.2

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # Changelog
 
+## 0.51.2 (2026-10-26)
+
+### Added
+
+- **Reminders Fabric gives on a turn reach the agent** (FAA-142, Fabric ask `dfb43ffb`). From Fabric 0.3.14, the
+  answer to a turn's `fabric_session_observe` may carry `nudges`: lapsed claims, unread board answers, requests nobody
+  moved. The Stop hook's worker keeps their text in the session's spool (`nudges.json`), and the UserPromptSubmit
+  hook prints each one once on the next prompt, after the unread line, as Fabric writes it (each starts `Fabric:`; any other line gets the tag `Fabric reminder: `): one line each, at most five lines of at most
+  400 characters. An empty or absent list prints nothing. A turn that `watch-mail` delivers has its nudges printed by
+  `watch-mail`, once. Not carried across `/clear`: nudges of turns spooled before it stay in the old id's folder and are
+  lost, since Fabric gives each nudge once and the turn's answer took it (carrying them would make the new id's folder before the launched-session check of FAA-68). Claude Code only: the Codex and Kimi
+  Code hooks run at session start and send no turns.
+
+### Fixed
+
+- The hooks now name this release to Fabric: 0.51.1 still said 0.51.0, and `test/validate.py` now checks it.
+  Copylot check `4028969a-aa35-48f9-9300-331da036fb1d`: no findings.
+
+## 0.51.1 (2026-10-26)
+
+The tag `v0.51.0` was never published: its release run stopped at the Node 18 floor, so 0.51.1 is the first npm
+release carrying everything listed under 0.51.0 below.
+
+### Fixed
+
+- The tests of one instance per context (`test/fabric-context.test.mjs`, FAA-125) skip on Linux under a Node that
+  cannot bind an abstract socket name exactly (Node 18 and 20), as every other lock test does since FAA-72. The kit
+  itself already refused there with a sentence; only the tests lacked the guard.
+- `references/package.md` no longer says the passkey countersignature waits for `org-authority/1`: DEC-0129 decided
+  that protocol only as the organization's member list for relay admission, and the countersignature waits for the
+  decision that defines the `org-countersign/1` verifier (contract finding on board thread `6c50c84f`).
+
+## 0.51.0 (2026-10-26)
+
+### Changed
+
+- **Pinned to the contract release `v0.1.0+2026-10-26.2` (`e6c4fc16`)** (FAA-128). It carries DEC-0122 to DEC-0125;
+  `a3a66eb0` and `52c7d798` stay supported. Brief: `docs/evidence/specs/2026-10-26-faa-128-125-repin-a3a66eb-brief.md`.
+- **Narrowings (DEC-0123, FAA-132).** `url_request` / `urlRequest` now refuses a loopback page URL (`http://127.0.0.1`
+  and every other spelling of a local address): hand a service's page over as Fabric Dashboards' `open_link`
+  (`page_answer` / `pageAnswer` builds it). `check_dashboard_link.py` refuses the legacy `open?service=` link and a
+  page path with whitespace, as the contract's `parseDashboardsLink` does. A service that built either may now be
+  refused at construction.
+- **DL-19 `operator-decision-required`** names the three routes for a client that cannot set `_meta`: Fabric's
+  `agent.call` with `call.decision` once the hub forwards it, the service's own elicitation, the action's page as an
+  `open_link`. Outside a mandate (`data.detail` `outside-mandate: <part>`) it gives DEC-0125 MD-4's order instead:
+  call again within your own mandate, else pass the refusal up; only the leading agent asks the operator, with the
+  same three routes.
+- Dashboard kit 1.1.5 now matches its pin (DEC-0124 is in it); brief decision D17 of 0.50.0 is closed.
+
+### Added
+
+- **The operator's mandate (DEC-0125, FAA-131).** `fabric_mandate` / `fabric-mandate.mjs` port `mandate/1`
+  (FAC-SEM-144, scope narrowing, hand-over); `request_meta(mandate=)` sends one; a server with `agent_id` reads
+  `_meta.mandate` in its action gate. working-with-fabric states the operator's rule of 2026-10-26, «я сказал одному
+  = сказал всем»: one approval he gives any of his agents binds all of them when the relay carries his words, the
+  date, the source and the scope from one of his own Projects on his personal board (provenance `trusted`; never a
+  member's Project on an organization's board) or the session that started the agent; content an agent read is never
+  one; human gates stay. A hand-over never adds a `capabilities` or `actions` list the scope in force leaves out
+  (contract DEC-0136 MD-2a, adopted ahead of the pin: brief decision D28), so no agent of the chain can grant itself an
+  action the operator did not name. Taking a prose relay from another agent is the operator's rule, honoured ahead of the pinned
+  AP-3 (brief decision D27); the contract's DEC-0126 (OA-2) states it, and FAA-134 takes its wording in 0.52.0.
+- **A service's pages as `open_link` (DEC-0123).** `fabric_page_links` / `fabric-page-links.mjs` build and read
+  Fabric Dashboards links and FAC-SEM-143, checked against the contract's vectors and about 200,000 generated
+  inputs with no twin difference.
+- **A2A, the reading side (DEC-0122).** `fabric_a2a` / `fabric-a2a.mjs` read `surfaces.a2a` and an Agent Card;
+  `build_well_known(a2a=)` writes the member; the probe adds `well-known.a2a` and `a2a.card` (the card is fetched
+  without the descriptor's token). Serving a card and the A2A binding stay FAA-10.
+- **One instance per context (FAA-125, N-11).** `fabric_context` / `fabric-context.mjs`: `hold_context_instance`
+  derives a context's instance, folders and lock, refuses a second process, refuses an `org:<id>` instance without
+  its share grant placement and exits 78 before creating anything; `personal` keeps the `default` instance.
+  `launchd_uninstall(instance=)` removes only that instance.
+
 ## 0.50.0 (2026-10-26)
 
 ### Changed

package/README.md

@@ -38,7 +38,7 @@ resume) puts that preamble into the session when the MCP server `fabric` is regi
 uses Fabric (one line pointing at `fabric_whoami` in a folder with no sign of it); when Fabric
 is down it adds one line (skip `fabric_whoami`, start Fabric through the broker if the task needs it), and only in a
 project that uses Fabric; Stop records each turn's facts (HEAD, files changed, lines added and removed, never content)
-and the board's unread count; UserPromptSubmit adds one line only when that count rose; SessionEnd releases what the
+and the board's unread count; UserPromptSubmit adds one line only when that count rose, and each reminder Fabric gave on a turn once (a turn `watch-mail` delivered prints there instead); SessionEnd releases what the
 session left claimed. Stop, UserPromptSubmit and SessionEnd spool and call Fabric only when the running Fabric
 advertises `session-hooks/1`; Stop and SessionEnd always prune their own stale spool folders. All are silent in a session Fabric launched, never block the session, read no token and always
 exit 0. `fabric_session.py watch-mail` waits for board mail under a background watcher, and `install-host-hooks
@@ -280,7 +280,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `52c7d798b9f4eb784eb4e29e717038a8912c759d`
+- commit: `e6c4fc16b415eec3190dd34d924d269405359dc9`
 
 Every other mention of the default contract revision (this section, the skills' metadata, the
 skill card, `adapt_project.py`) must equal it; `python3 test/validate.py` fails a tree

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.50.0",
+  "version": "0.51.2",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.50.0",
+  "version": "0.51.2",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "Two silent-unless-relevant hook sets. The dashboard-kit notice: one line at session start or /clear in a repository that owns a Fabric service whose dashboard has no kit or an older one (fabric-dashboard/0.1, DEC-0036), phrased as an upgrade the agent may make itself. The Fabric session hooks (working-with-fabric, COM-04, FAA-12a): at session start or /clear, the preamble when Claude Code has the MCP server `fabric` and Fabric runs (fabric_whoami, then the project board through com.status and com.list, claim and release); when Fabric is down, one line, only in a project that uses Fabric (a Fabric contract file, a project-bound registration or a service descriptor naming the repository); nothing on compact or resume; each turn's facts (HEAD, files changed, lines added and removed, never content), the board's unread count and the session's end through Fabric, only when the running Fabric advertises session-hooks/1; at each prompt one line only when the unread count rose. All silent in a session Fabric launched. Every hook reads no token, prints at most one block, always exits 0, and hands any Fabric call to a detached worker with a 10 s deadline.",
+  "description": "Two silent-unless-relevant hook sets. The dashboard-kit notice: one line at session start or /clear in a repository that owns a Fabric service whose dashboard has no kit or an older one (fabric-dashboard/0.1, DEC-0036), phrased as an upgrade the agent may make itself. The Fabric session hooks (working-with-fabric, COM-04, FAA-12a): at session start or /clear, the preamble when Claude Code has the MCP server `fabric` and Fabric runs (fabric_whoami, then the project board through com.status and com.list, claim and release); when Fabric is down, one line, only in a project that uses Fabric (a Fabric contract file, a project-bound registration or a service descriptor naming the repository); nothing on compact or resume; each turn's facts (HEAD, files changed, lines added and removed, never content), the board's unread count and the session's end through Fabric, only when the running Fabric advertises session-hooks/1; at each prompt one line only when the unread count rose, then each nudge a turn's answer carried, once (watch-mail prints those of turns it delivered). All silent in a session Fabric launched. Every hook reads no token, prints at most one block, always exits 0, and hands any Fabric call to a detached worker with a 10 s deadline.",
   "hooks": {
     "SessionStart": [
       {

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.50.0"
+  version: "0.51.2"
   contract-version: "0.1.0"
-  contract-commit: "52c7d798b9f4eb784eb4e29e717038a8912c759d"
+  contract-commit: "e6c4fc16b415eec3190dd34d924d269405359dc9"
 ---
 
 # Adapting projects to Fabric
@@ -76,7 +76,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `52c7d798b9f4eb784eb4e29e717038a8912c759d`.
+- commit `e6c4fc16b415eec3190dd34d924d269405359dc9`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/dashboard-links.md

@@ -140,5 +140,8 @@ or instructions alone do not prove all final answers from every agent are filter
 
 Syntax is owned by Fabric Dashboards and `@passioncode-ai/fabric-service-host`:
 [ADR-0005](https://github.com/passioncode-ai/fabric-dashboards/blob/51a7a80acf42781d7bec304cc87c655d48cc309b/docs/adr/0005-service-links.md).
-The gate accepts canonical links and the legacy `open?service=` form returned by
-older hosts; it does not generate either dialect or redefine the Fabric wire contract.
+The gate accepts only the service form, `fabric-dashboards://service/SERVICE_ID.INSTANCE`
+with at most one `path`; since 0.51.0 it refuses the legacy `open?service=` form, as contract
+DEC-0123 (PL-1, checker rule `FAC-SEM-143`) and its vectors do. A host that still returns the
+legacy form fails the gate: report it as an installed host that did not open the page. The gate
+does not generate links or redefine the Fabric wire contract.

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -22,10 +22,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "52c7d798b9f4eb784eb4e29e717038a8912c759d"
+CONTRACT_COMMIT = "e6c4fc16b415eec3190dd34d924d269405359dc9"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "2f020a696453ae299b123517f14957f6a1354379", "87d384ffce2757081b7ab227e5dad3dddd08328f", "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e", "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "a3a66eb0052043847f6556348e37d34ca873a629", "52c7d798b9f4eb784eb4e29e717038a8912c759d", "2f020a696453ae299b123517f14957f6a1354379", "87d384ffce2757081b7ab227e5dad3dddd08328f", "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e", "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/check_dashboard_link.py

@@ -74,7 +74,9 @@ def login_path(path):
 
 def safe_path(path):
     return (isinstance(path, str) and path.startswith('/') and not path.startswith('//')
-            and len(path) <= 2048 and not re.search(r'[\\\x00-\x1f\x7f]', path))
+            and len(path) <= 2048 and not re.search(r'[\\\x00-\x1f\x7f]', path)
+            # JavaScript's whitespace (\s), which the contract's parseDashboardsLink refuses in a page (DEC-0123)
+            and not re.search('[ \u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]', path))
 
 
 def check(data):
@@ -87,11 +89,11 @@ def check(data):
     require(not re.search(r'[\\\x00-\x20\x7f]', native + http), 'unsafe_url')
     deep, plain = urlsplit(native), urlsplit(http)
     require(deep.scheme == 'fabric-dashboards' and not deep.username and not deep.password and not deep.port and not deep.fragment, 'invalid_deep_link')
-    query = parse_qs(deep.query, keep_blank_values=True, strict_parsing=True)
-    if deep.netloc == 'service':
-        require(deep.path in ('/' + service, '/' + service + '/') and set(query) <= {'path'}, 'wrong_service_or_parameter')
-    else:
-        require(deep.netloc == 'open' and deep.path in ('', '/') and query.get('service') == [service] and set(query) <= {'service', 'path'}, 'invalid_legacy_link')
+    # An empty query is no fields: Python 3.9's strict parse_qs raises on '' where 3.11 and later answer {}.
+    query = parse_qs(deep.query, keep_blank_values=True, strict_parsing=True) if deep.query else {}
+    # DEC-0123 PL-1: only the service form; the legacy open?service= link is refused (FAC-SEM-143, since 0.51.0).
+    require(deep.netloc == 'service', 'not_service_link')
+    require(deep.path in ('/' + service, '/' + service + '/') and set(query) <= {'path'}, 'wrong_service_or_parameter')
     require('path' not in query or len(query['path']) == 1, 'duplicate_path')
     page = query.get('path', [None])[0]
     require(page is None or safe_path(page), 'unsafe_path')

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,10 +14,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.50.0"
+  version: "0.51.2"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "52c7d798b9f4eb784eb4e29e717038a8912c759d"
+  extension-commit: "e6c4fc16b415eec3190dd34d924d269405359dc9"
 ---
 
 # Building Fabric services
@@ -72,6 +72,7 @@ Answer before writing code, and record the answers in the project README:
 | Another agent on this machine | MCP `2026-07-28`, `streamable-http`, at `/mcp` on the service origin, token in a header | one process serves every session; stdio-per-session once left twenty stray servers on this machine |
 | The operator or a script | a CLI: `<tool> service status\|start\|stop\|restart`, `<tool> dashboard` (opens only in Fabric Dashboards, below), `<tool> doctor --json` | every verb delegates to launchd and the well-known document, never to its own process table |
 | A remote agent | A2A `1.0` over HTTPS, or MCP behind an authenticated gateway | loopback reachability is not authorization |
+| An A2A peer on this computer | `surfaces.a2a` names a public Agent Card, served without the token; its interface URLs are loopback (DEC-0122); the kits read it, serving one is FAA-10 | the card carries no credential, process member or required Fabric extension |
 | The dashboard page | same-origin REST under `/api`, session cookie plus a custom request header; every button on it also a tool on the MCP surface (Step 5) | the CSRF defence all four existing dashboards use |
 
 Read [the surfaces and auth reference](references/surfaces-and-auth.md) when wiring
@@ -298,7 +299,9 @@ launchd pid equals answering pid, `dashboard.declared` (ED-9), `well-known.actio
 opener aimed at the service's pages in its checkout; `--repo PATH` names the checkout, and a service installed
 from a release folder needs it), and the `interop.*` rules:
 manifest link, capability list, tools equal to the manifest, job tools, unknown job, trace
-propagation, event trace pairs, `interop.action-tools` (every declared action's tool is served), and
+propagation, event trace pairs, `interop.action-tools` (every declared action's tool is served), `well-known.a2a` and
+`a2a.card` (DEC-0122: the card is fetched without the token and its interfaces are never called; the surfaces
+reference's *A2A for remote agents* section), and
 `board.responder` for a service that declares the project board) and exits 1 on any `FAIL`. A `NOT_RUN` is not a pass;
 name it in the report. A service with a dashboard also runs the layout probe,
 `node <skill-dir>/scripts/check_dashboard_layout.mjs --service <id>` (WebKit at 360, 480, 768

package/plugins/fabric-agent-adapter/skills/building-fabric-services/recipes/support-agent/README.md

@@ -101,7 +101,9 @@ version is still read and never written; delete it once its messages are past th
 - Replace the example knowledge with the product's own, and run real past questions through it ([practices](../../../creating-fabric-agents/references/practices.md#judges-and-evals), *Judges
   and evals*): count handoffs and read a sample of replies.
 - Show spend: `fabric_usage.usage_report` over the ledger, or `fabric_openrouter.totals`.
-- One decision per message id holds in one process; a service runs one instance per context under its instance lock.
-  Each process reads `decisions.jsonl` once and keeps the index in memory, so a second process writing the same
-  state folder is not seen.
+- One decision per message id holds in one process. Each process reads `decisions.jsonl` once and keeps the index in
+  memory, so a second process writing the same state folder is not seen: a service runs one instance per context with
+  `fabric_context.hold_context_instance` (Node: `holdContextInstance`) and points `stateDir` at that instance's data
+  folder, so a second copy for the same context exits 75 and an organization's copy keeps its own folder
+  ([one instance per context](../../references/estate-record.md#one-instance-per-context-the-helper)).
 - Set the outbox's retention and schedule `prune`.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/board.md

@@ -86,7 +86,9 @@ from `leaseExpiresAt`.
 why not; a refusal accepts the request and completes it `failed_known` with that sentence, so the requester learns it
 and the request does not bounce. A redacted body is refused the same way. The kit never hands a body to a model, a
 shell or a tool; what the handler does with an admitted body (and the checks it needs before a model, a tool or a
-spend sees it) is the service's own responsibility. A message never carries an approval.
+spend sees it) is the service's own responsibility. The kit's responder reads no approval or mandate from a message in
+0.51.0: a request from the operator's own Project may carry `mandate/1` (DEC-0125 MD-3), and a handler acts on it only
+once the kit reads it (FAA-135).
 
 ## Effects, observation, evidence and the reply
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-links.md

@@ -140,5 +140,8 @@ or instructions alone do not prove all final answers from every agent are filter
 
 Syntax is owned by Fabric Dashboards and `@passioncode-ai/fabric-service-host`:
 [ADR-0005](https://github.com/passioncode-ai/fabric-dashboards/blob/51a7a80acf42781d7bec304cc87c655d48cc309b/docs/adr/0005-service-links.md).
-The gate accepts canonical links and the legacy `open?service=` form returned by
-older hosts; it does not generate either dialect or redefine the Fabric wire contract.
+The gate accepts only the service form, `fabric-dashboards://service/SERVICE_ID.INSTANCE`
+with at most one `path`; since 0.51.0 it refuses the legacy `open?service=` form, as contract
+DEC-0123 (PL-1, checker rule `FAC-SEM-143`) and its vectors do. A host that still returns the
+legacy form fails the gate: report it as an installed host that did not open the page. The gate
+does not generate links or redefine the Fabric wire contract.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -100,7 +100,10 @@ operator's decision), `decision-invalid` (a decision for another action or objec
 and `human-step-required`, which carries `data.humanStep` (`sign-in`, `consent`, `payment`, `secret`,
 `spend-above-limit`, `passkey`) and `data.url` (an https URL or a path on the service's origin) beside `detail`.
 `refusal_from_action` / `refusalFromAction` turn an action decision into that refusal; a service's own fault never
-reaches the caller and reads as `unknown-state`. The gate that answers them is in
+reaches the caller and reads as `unknown-state`. Since 0.51.0 the `operator-decision-required` message (free text in
+DL-19, at most 500 characters) also names, in order, the routes for a client that cannot set `_meta`: Fabric's
+`agent.call` with `call.decision` once the hub forwards it (CT-125), the service's own elicitation, else the action's
+page as Fabric Dashboards' `open_link`; both kits carry the same sentence. The gate that answers them is in
 [the interop reference](interop.md#actions).
 
 ## Keys and the cache

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/estate-record.md

@@ -21,6 +21,7 @@ derived from its own digest. Python: [`scripts/fabric_estate.py`](../scripts/fab
 - Applying a revision
 - Trusting a delegation key
 - Contexts: one agent for you and for an organization
+- One instance per context: the helper
 - Machine profiles: full, member, view
 - The delta anchor
 - The estate ceremonies
@@ -133,6 +134,65 @@ Every rule is total on hostile JSON, as the contract's are: an `instancePath` na
 non-object before it does not shift it), and a value whose own `toString` member is data is shown as its JSON. Both kits
 answer the contract's contexts fixtures and variants of them (`test/fixtures/contract/estate-vectors.json`).
 
+## One instance per context: the helper
+
+A service that runs for the person and for an organization runs once per context on a machine (contract
+`contexts.md`, *One instance per context on a machine*; FAA-125). `fabric_context` / `fabric-context.mjs` turns the
+context it is started for into that context's one instance. It is not in the facade: install it with
+`fabric_kit.py install <dir> --module fabric_context` (Node: `--lang node --module fabric-context`), so a service that
+does not run per context keeps the estate reader out of its closure.
+
+```python
+import fabric_context as fc
+info, lock = fc.hold_context_instance("example-agent", "org:acme-rehearsal", record=applied_revision,
+                                      machine_id="machine-a", agent_ref="urn:agent:example-agent")
+serve(data=info["dirs"]["data"], instance=info["instance"])        # org-acme-rehearsal; lock held until exit
+```
+
+```js
+import { holdContextInstance } from './fabric-context.mjs';
+const { dirs, instance, lock } = await holdContextInstance('example-agent', 'org:acme-rehearsal', { record, machineId, agentRef });
+```
+
+- **The instance name.** `personal` is `default` (`personal_instance` / `personalInstance`), so an existing install
+  keeps its descriptor `<id>.default.json`, its folders and its lock. `org:<orgId>` is `org-<orgId>` when the id is
+  lower-case words joined by single hyphens, at most 28 characters, and does not end in a hyphen and 10 hex digits
+  (`org:acme-rehearsal` is `org-acme-rehearsal`); any other id is `org-<slug>-<first 10 hex digits of sha256(orgId)>`
+  (`org:Acme` is `org-acme-37036cd8f9`). `context_instance_name` / `contextInstanceName` answer it alone.
+- **Its folders.** `instance_dirs(id, instance)` / `instanceDirs(id, instance, platform)`: `default` is
+  `service_dirs`; any other is a sibling named as its descriptor, `<id>.<instance>` (on macOS
+  `~/Library/Application Support/<id>.<instance>`, `~/Library/Logs/<id>.<instance>`, `~/Library/Caches/<id>.<instance>`),
+  never inside the personal tree. `launchd_uninstall(..., purge=True, service_id=..., instance=...)` /
+  `launchdUninstall(..., {purge, serviceId, instance})` purge only that instance's folders.
+- **What it checks, before anything is created.** `context_instance` / `contextInstance` is pure and answers
+  `{context, kind, org?, instance, key, dirs, descriptorPath, grant?}`, never the record. An organization's instance
+  needs the estate record revision this machine applied (verified with `verify_estate_record`; the helper verifies no
+  signature), the machine id and the agentRef, all passed by whoever installed the instance. It finds this machine's
+  placement of that agent in that context, as written (FAC-SEM-074), runs FAC-SEM-111 on it
+  (`placement_grant_findings` / `placementGrantFindings`), and refuses outside the grant's window (`startsAt` <= now <
+  `expiresAt`); `instance_share_grant` / `instanceShareGrant` answers the three alone. A personal instance needs no
+  record; given one, a personal placement that names a grant is refused.
+- **What it holds.** `hold_context_instance` / `holdContextInstance` then takes the instance lock on the instance's
+  data folder (`hold_single_instance`: a second copy for the same context exits 75, a supervised one waits first),
+  then the marker `<data>/fabric-context.json` (`{service, instance, context}`, 0600): absent, it is written; equal,
+  kept; another context or instance, or unreadable, releases the lock and refuses. The folder never changes context.
+
+A refusal is one sentence on stderr naming the code and the context, never a record or grant value, and exit 78
+(`EXIT_CONTEXT_REFUSED`, EX_CONFIG; 75 stays "already running"). `ContextRefused` carries the code:
+
+| Code | When |
+|---|---|
+| `context-invalid` | the context is neither `personal` nor `org:<orgId>` as written (`Personal`, `ORG:x`) |
+| `record-required` | an organization's context with no record, machine id or agentRef (fail closed) |
+| `placement-missing` | the record places no such agent on this machine in that context |
+| `grant-refused` | the placement names no share grant of the record for that context, or a revoked one (FAC-SEM-111); a personal placement names one |
+| `grant-window` | now is before the grant's `startsAt`, at or after its `expiresAt`, or an instant cannot be read |
+| `context-mismatch` | the data folder's `fabric-context.json` names another context or instance, or cannot be read |
+
+Under launchd's `KeepAlive` a refused instance is started again every 10 s until the node's next revision removes it;
+a revoked grant stops calls at once at the hub and the meter (DL-24), not here: the helper reads revisions only.
+Tests: `test/test_fabric_context.py`, `test/fabric-context.test.mjs` over `test/fixtures/kit-context-cases.json`.
+
 ## Machine profiles: full, member, view
 
 DEC-0106 gives a machine an optional `profile`. It says what the machine may be when other machines of the estate call

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md

@@ -12,7 +12,7 @@ A service that other agents (and Fabric) call does five things. Each has one hel
 | C3.1 capability = tool | serves each `mcp` capability of its manifest as the MCP tool of the same name, with the manifest's input schema unchanged, its output schema unchanged (or, for a job, wrapped as `oneOf[result envelope, job handle]`) and annotations from the effect | `tool_for_capability` / `toolForCapability`, `job_tool_output_schema`, `expected_annotations` |
 | C3.2 long work = job | a capability whose work can outlive one request declares `"job": true` in its interop block, returns `{"job": {"id", "status": "working"}}`, and serves `fabric.job.get` and `fabric.job.cancel` | `JobStore`, `McpToolServer` (Python), `unknown_job_result` |
 | C3.2 result | a completed job carries the full result envelope, the shape a synchronous call returns: `id`, `contractVersion`, `outcome`, `done`, `proof`, `scope`, `notVerified`, `artifacts`, `createdAt`, `producer`, `output`, `usage`, and its `trace` | `result_envelope` / `resultEnvelope` |
-| C3.3 a person decides | the job goes `input_required` with an elicitation: a titled single-select in form mode, and URL mode for anything secret | `choice_request`, `form_request`, `url_request` |
+| C3.3 a person decides | the job goes `input_required` with an elicitation: a titled single-select in form mode, and URL mode for anything secret. A URL-mode request is an `https` URL or, for a page of this service, its Fabric Dashboards open_link (DEC-0123 PL-4): `url_request` refuses a raw loopback address (`http://127.0.0.1:4100/x`, `http://127.1/`, `http://[::1]/`, `http://localhost/` in any spelling) and a `fabric-dashboards:` link outside the grammar when the request is built, and `request_input` refuses a hand-built request either way (FAC-SEM-143). A tool answer that hands a person a page is `page_answer`'s `{open_link, http_url?}`; `http_url` is a diagnostic | `choice_request`, `form_request`, `url_request`, `page_answer` / `pageAnswer`; the rules in `fabric_page_links` / `fabric-page-links.mjs` |
 | C3.4 trace | every call runs as a child span of the caller's `_meta.traceparent`; outgoing calls carry the same trace; the result envelope records it; events about traced work carry `traceId` and `spanId`, events about untraced work none | `child_traceparent`, `trace_ids`, `make_event(..., trace_id=, span_id=)` |
 
 The interop block sits in the manifest under the capability's `extensions`:
@@ -28,6 +28,7 @@ That key has one spelling (the contract's `src/extensions.ts`); copy it, never r
 - [The kit](#the-kit)
 - [Limits and uncertain effects](#limits-and-uncertain-effects)
 - [Actions: every button has a tool](#actions)
+- [The operator's mandate](#the-operators-mandate)
 - [What the probe checks](#what-the-probe-checks)
 
 ## The kit
@@ -228,6 +229,64 @@ The probe reads the declaration (`well-known.actions`), checks that `tools/list`
 (`interop.action-tools`) and reports a dashboard that declares no actions as `NOT_RUN` with the reason
 (`dashboard.actions-declared`): absence does not prove a page-only button.
 
+<a id="the-operators-mandate"></a>
+
+## The operator's mandate
+
+Contract DEC-0125 (`mandate/1`, rule `FAC-SEM-144`, `docs/specification/delegation.md#the-operators-mandate`, MD-1 to
+MD-6): the operator's instruction for one task travels with the task, narrowed at each hand-over, so a service the
+task reaches takes a call the mandate covers as his decision without asking him again. It is the machine form of his
+rule of 2026-10-26: one approval he gives in the chat of any of his agents binds all his agents (working-with-fabric,
+Step 5). Both kits carry the reference in `fabric_mandate` / `fabric-mandate.mjs` and answer the contract's
+`mandate.json` vectors case for case.
+
+**As a service.** Name your own agent id and each relayed action's effect class; the gate then reads the call's
+`_meta.mandate` when it carries no decision:
+
+```python
+server = fi.McpToolServer("example-agent", "1.0.0", jobs=jobs, authorize=gate, agent_id="example-agent")
+server.add_tool(approve_tool, approve_reply, action=reply_action, target="reply_id", effect="reply",
+                spend=lambda arguments: estimate_usd(arguments), project="example-site")
+```
+
+- `McpToolServer(agent_id=)` is this service's agent id (a lower-case id, optionally `.instance`). Without it a mandate
+  is not read and every call is answered as before DEC-0125.
+- A `spend` or `project` function that raises, or a spend that is not a finite number, fails closed: the call is
+  answered, and a mandate with a `perCallMaxUsd` ceiling or a `projects` list refuses it (`outside-mandate: spend` or
+  `outside-mandate: project`); the estimate is read as a double, so an integer past the float range is infinite and
+  refused under a ceiling, and a project function that answers anything but a string or `None` names no project a
+  mandate can list. A refusal outside a mandate
+  tells the caller the MD-4 order: call again within its own mandate, else pass the refusal up; only the leading agent
+  asks the operator.
+- `add_tool(tool, handler, action=, effect=, spend=, project=)`: on a server with `agent_id`, a `relayed` action names
+  its `effect` (governance's class: `none`, `draft`, `publish`, `send`, `reply`, `charge`, `delete`, `merge`, `deploy`,
+  `change-policy`) or `add_tool` refuses it; `spend` is the service's own estimate of a call's USD (a number, or a
+  function of the arguments), read against the mandate's `perCallMaxUsd`; `project` the project a call acts in.
+- The mandate is read from `_meta.mandate` only, never from its arguments. Its chain must end in `agent_id`; when
+  `authorize` accepted a delegation token, the token's caller must be the agent before it in the chain
+  (`mandate-not-for-this-call` otherwise). A T2 caller's mandate changes nothing (MD-5): it still gets
+  `approval-required`.
+- A covered call is the operator's act: `ctx.record` is `{by: "operator", via: "mandate", task, chain, caller}` and
+  `ctx.mandate` the mandate it took (its `instruction` stays in the audit record, never in events or a page). Outside
+  it the answer is `operator-decision-required` with `data.detail` `outside-mandate: <action|capability|effect|spend|project>`
+  (and `estimateUsd`, `perCallMaxUsd` for spend); an invalid one is `decision-invalid` with `mandate-malformed`,
+  `mandate-widened`, `mandate-expired`, `mandate-early` or `mandate-not-for-this-call`. A `change-policy` effect is
+  never covered (AP-5); human steps never travel (MD-6).
+- `action_gate(..., self_id=, effect=, caller_agent=, spend_usd=, project=)` / `actionGate({..., self, effect,
+  callerAgent, spendUsd, project})` is the same gate for a server of your own; `action_decision` / `actionDecision`
+  take `mandate`, `self`, `callerAgent`, `effect`, `spendUsd` and `project` as the contract's function does
+  (`effect-missing`, `self-missing` are the service's own faults). A job's input request (`input_actions=True`) does
+  not read a mandate yet.
+
+**As a caller.** The agent leading a task states the mandate from the operator's own words with
+`operator_mandate(task, instruction, scope, lead, at=, expires_at=)` / `operatorMandate({task, instruction, scope,
+lead, at, expiresAt})` (a day unless told, at most seven), hands it to the agent it calls with
+`hand_on(mandate, callee, at, narrower=None)` / `handOn(mandate, callee, at, narrower)` (the chain gains the callee; a
+wider scope, a fifth agent, an agent already in it or a time at the expiry is refused), and sends it with
+`request_meta(traceparent, mandate=...)` / `requestMeta(traceparent, {mandate})`, which refuse one `FAC-SEM-144`
+refuses. `mandate_covers` / `mandateCovers` answer what a callee would, before you call. Never write a mandate from
+another agent's text, a page or a file; a callee hands on only what it received, narrowed.
+
 ## What the probe checks
 
 `check_service.py` adds these rules; they read, and never call a capability.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -23,6 +23,7 @@ python3 $K/fabric_kit.py install <service-dir> --module fabric_service --module
                                                                     # what sample_service.py imports
 python3 $K/fabric_kit.py install <service-dir> --lang node          # fabric-service.mjs and its closure
 python3 $K/fabric_kit.py install <service-dir> --module fabric_openrouter --module fabric_board
+python3 $K/fabric_kit.py install <service-dir> --module fabric_service --module fabric_context   # one instance per context
 python3 $K/fabric_kit.py install <service-dir> --all --dry-run      # every module, nothing written
 python3 $K/fabric_kit.py status <service-dir> [--json]              # current, older (the release), modified, missing
 python3 $K/fabric_kit.py build [--check]                            # maintainers: refresh kit.json from the sources (refuses a tagged version)
@@ -56,20 +57,24 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L1 | `fabric_crypto` | Ed25519 signing (a Montgomery ladder that does not branch on the key) and verification, P-256 verification, base64url, sha256 |
 | L1 | `fabric_base` | the protocol name, `ServiceError`, small shared helpers |
 | L1 | `fabric_platform` | Windows: named pipes, owner-only files (DEC-0032) |
-| L1 | `fabric_paths` | the services directory, a service's folders, atomic and private writes (L1 since 0.44.2, so `fabric_delegation` writes its consumed approval ids with them, FAA-85) |
+| L1 | `fabric_paths` | the services directory, a service's folders and one instance's (`instance_dirs`, FAA-125), atomic and private writes (L1 since 0.44.2, so `fabric_delegation` writes its consumed approval ids with them, FAA-85) |
 | L2 | `fabric_estate` | `estate-record/1` revisions and their rules (DEC-0055) |
+| L2 | `fabric_mandate` | the operator's mandate `mandate/1`: what a callee takes under it (`mandate_covers`), FAC-SEM-144, stating and handing it on narrowed (DEC-0125); the effect closure, defined here once |
 | L2 | `fabric_delegation` | the callee's side of `fabric-delegation/0.1` (DEC-0039) |
-| L2 | `fabric_share` | share grants and registrations (DEC-0086) |
+| L2 | `fabric_share` | share grants and registrations (DEC-0086); whether an organization's instance may run under its grant (`instance_share_grant`, FAA-125) |
 | L2 | `fabric_ceremonies` | the headless join token (DEC-0084) |
 | L2 | `fabric_package_schema` | the reading of `fabric-package.schema.json` with JavaScript's pattern and format semantics (FAA-92) |
 | L2 | `fabric_package` | `fabric-package/1`: pack, sign, verify; re-exports `schema_problems` (DEC-0050, DEC-0051) |
 | L3 | `fabric_protocols` | protocol revisions (DEC-0067) and feed data (DEC-0070) |
 | L3 | `fabric_actions` | every action a person has and its agent tool, `fabric-actions/0.1`: the gate a tool runs (`action_decision`), the reader and FAC-SEM-142, the declaration (DEC-0121) |
 | L3 | `fabric_connections` | what an agent uses, `fabric-connections/0.1`: the reference reading and the declaration (DEC-0096, FAC-SEM-127) |
+| L3 | `fabric_a2a` | the reading side of an A2A Agent Card: `surfaces.a2a` as the schema reads it, and what a public card must not carry (DEC-0122) |
+| L3 | `fabric_page_links` | a service's pages as Fabric Dashboards' open_link: build and read it, a raw local address, FAC-SEM-143 on a link and on a URL-mode input request (DEC-0123); the Python twin reads URLs as WHATWG does by hand |
 | L3 | `fabric_lock` | the instance lock and the supervisor marker (LC-01, DEC-0057) |
 | L3 | `fabric_usage` | usage receipts, the ledger, the usage report, attribution, spending limits ([usage](usage.md)) |
 | L3 | `fabric_backups` | settings backups (DEC-0025) |
 | L3 | `fabric_descriptor` | the descriptor, peers, app descriptors, the well-known document |
+| L3 | `fabric_context` | one instance per context (FAA-125, N-11): a context's instance, folders, descriptor, lock and marker; not in the facade, installed with `--module fabric_context` ([contexts](estate-record.md#one-instance-per-context-the-helper)) |
 | L3 | `fabric_auth` | the token, the network guard, login codes |
 | L3 | `fabric_events` | events, paging, the JSONL event log (DEC-0029) |
 | L3 | `fabric_logs` | rotating logs, the stop signal and the drain (LC-12) |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md

@@ -121,8 +121,10 @@ PA-03).
 
 - **ES256.** It waits for Fabric's decision D2; until then a verifier refuses it as `unknown-algorithm` (FAA-29).
 - **Hub signing for the person's own machines, and the passkey.** Stage 3 of target architecture v4.
-- **The organization's countersignature as a passkey assertion.** It waits for `org-countersign/1` and
-  `org-authority/1`; this version's countersignature is a detached Ed25519 signature.
+- **The organization's countersignature as a passkey assertion.** It waits for the decision that defines the
+  `org-countersign/1` verifier (contract `docs/specification/package.md`, "Signatures" and "Not decided here"; its
+  challenge type is registered with DEC-0063). DEC-0129 decided `org-authority/1` only as the organization's member
+  list for relay admission. This version's countersignature is a detached Ed25519 signature.
 - **Fabric recording packages by `agentRef`.** It waits for the ADR-0138 D2b amendment.
 - **`publish --to org`** (FAA-28; an organization cloud's import API is FAA-63, under FAA-28's rule that publishing to
   an organization is the person's own act).

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1: wire reference
 
-Pinned to `fabric-agent-contract` commit `52c7d798b9f4eb784eb4e29e717038a8912c759d`
+Pinned to `fabric-agent-contract` commit `e6c4fc16b415eec3190dd34d924d269405359dc9`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
@@ -17,7 +17,9 @@ no-token `401` DEC-0109; money apart from a subscription's estimate DEC-0110; th
 protocols of DEC-0111 in the register; a check-in's credential members DEC-0112, a revocation that names its request
 DEC-0113, a node summary against the certificate DEC-0114, key windows read strictly DEC-0115 and DEC-0119, which list
 gates each credential member DEC-0116 to DEC-0118, a pin of four members and `profile` DEC-0120; every action a person
-has as an agent tool, `fabric-actions/0.1` and the operator's relayed decision DEC-0121). The contract's schemas are normative;
+has as an agent tool, `fabric-actions/0.1` and the operator's relayed decision DEC-0121; `surfaces.a2a` and the public A2A
+Agent Card DEC-0122, a service's pages as Fabric Dashboards' `open_link` DEC-0123, Fabric's button in the page's language
+DEC-0124; the operator's mandate `mandate/1`, handed on narrowed with a task DEC-0125). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
@@ -96,6 +98,13 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   `operatorChannel.path` (DEC-0034) when the service has an operator channel; its status
   document follows the contract's `operator-channel-status.schema.json` and is token-protected
   like the events feed. The kits do not serve it yet.
+- `surfaces.a2a` (DEC-0122) SHOULD name the public A2A Agent Card of a service that serves one: `{path,
+  protocolVersion}`, `path` a path on the service origin (normally `/.well-known/agent-card.json`), `protocolVersion`
+  `"1.0"`, nothing else; the card itself names its interfaces, bindings and security schemes. A reader pinned before
+  DEC-0122 refuses the member. The kits build it with `a2a_surface()` / `a2aSurface()` (`fabric_a2a`), read it with
+  `a2a_view` / `a2aView`, and `build_well_known(a2a=...)` / `buildWellKnown({a2a})` refuse one that is not the
+  schema's, passed either way; `agent_card_findings` / `agentCardFindings` say what a public card must not carry
+  ([surfaces and auth](surfaces-and-auth.md#a2a-for-remote-agents)). The kits do not serve a card yet (FAA-10).
 - `extensions` MAY carry the embedded dashboard declaration under
   `https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1` (`fabric-dashboard/0.1`,
   ED-9): `minWidth` 360…1280 (required), `appearance` ⊆ `scheme`, `theme`, `themes`, `kit`

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/surfaces-and-auth.md

@@ -1,5 +1,14 @@
 # Surfaces and auth
 
+## Contents
+
+- [MCP for agents](#mcp-for-agents)
+- [CLI for people and scripts](#cli-for-people-and-scripts)
+- [A2A for remote agents](#a2a-for-remote-agents)
+- [Token](#token)
+- [Dashboard session](#dashboard-session)
+- [Headers every response carries](#headers-every-response-carries)
+
 ## MCP for agents
 
 - One server inside the service process, `streamable-http`, at `/mcp` on the service
@@ -45,6 +54,32 @@ MCP, never by binding a LAN address. A tunnel (Tailscale Serve and the like) is
 outward surface with its own token lifetime; watch it like a service, because nothing
 else will notice it expire.
 
+A service that answers A2A peers names its public Agent Card in the well-known document's `surfaces.a2a`
+(DEC-0122; [the wire reference](protocol.md)). What that card may say:
+
+- On a local placement the public card answers without the token (Host and Origin checks still apply) and its
+  interface URLs are on the service's loopback origin, for peers on this computer; on a remote placement they are
+  `https`, and a card that is not open is gated by the service's own credentials or an identity proxy.
+- An A2A peer is never given the descriptor's token: no interface accepts it and no `securitySchemes` entry names
+  it. A2A callers bring the service's own credentials or the estate's delegation tokens; the extended card needs
+  one of them.
+- The public card carries no secret and none of the well-known document's process members (`build`, `process`,
+  `pid`, `status`, `summary`, `degraded`). An extension it declares for a Fabric fact (`uri` under
+  `https://fabric.passioncode.ai/`) carries `required: false`; the probe also accepts it absent, which A2A reads as
+  false (a protobuf-written card drops a false default), and flags `required: true` or a non-boolean.
+
+`agent_card_findings(card, origin=, remote=, descriptor_header=)` / `agentCardFindings(card, {origin, remote,
+descriptorHeader})` report each of these by `code` and place, never the value. The probe runs two rules:
+
+| Rule | PASS when | NOT_RUN when |
+|---|---|---|
+| `well-known.a2a` | `surfaces.a2a` is the schema's (`FAIL` names each schema error's place and keyword) | no `surfaces.a2a` |
+| `a2a.card` | the card at `surfaces.a2a.path`, asked with no `Authorization` header and never the descriptor's token, answers 200 with JSON that has no finding; on a local placement any other answer is a `FAIL` | no member, an unreadable one, or a remote card that answers 401 or 403 (a card that is not open; a refusal is not nonconformance) |
+
+A probe cannot see whether an interface would take the descriptor's token without sending it, which DEC-0122
+forbids, so it reads the card only and never calls an interface: an API-key scheme in the descriptor's own
+`auth.header` is a finding, and with `Authorization` (the default) the card cannot show it.
+
 ## Token
 
 - Created once with `ensure_token` at first start, after the instance lock.