@passioncode-ai/fabric-agent-adapter 0.56.0 → 0.58.0

package/CHANGELOG.md

@@ -1,5 +1,113 @@
 # Changelog
 
+## 0.58.0 (2026-11-03)
+
+Portable agents, part 1 (FAA-188, RM-36): an agent keeps its source apart from its instance from its first commit, and
+a local check finds instance data in a source tree without repeating it. The manifest of a source, its export and
+import wait for the contract's decision on CT-194 (part 2).
+
+### Added
+
+- **`fabric_source_check.py check`** (adapting-projects-to-fabric) reads the files a source would carry (what Git would
+  commit; every file but the dependency folders it names when Git lists none; or with `--every-file`, which reads
+  what `pack` carries) and reports, by path, line and kind: a path inside a person's home folder
+  (`home-path`: an ASCII home name in the macOS, Linux (`/home`, `/var/home`) and Windows forms (Git Bash's `/c/Users`
+  and WSL's `/mnt/c/Users` included), the dashed form of DEC-0105 (`C--Users-` on Windows; a name holding a space, a dash, a dot, an underscore or an apostrophe is declared with `home: <name>` to be read whole there) and the URL-encoded ones; a web route `/users/...`, a flag `--home-dir` or a CSS variable is not one), a
+  value shaped like a credential by the contract's detector read line by line, a long random value under a
+  credential's name (a whole Ed25519 signature under a JSON `"sig"`, `"signature"` or `"signatures"` member, as `sign` writes it, is public and not one; a storage URL's `sig=` is) or a private key: a PEM, OpenSSH or PGP block, or a JWK's `d` (JSON, escaped JSON or a Python dict), a URL carrying a password (8 or more characters with at least one letter and one digit) or a credential in its query (percent-encoded, JSON-escaped or nested), and a
+  file that is a credential by its name as `pack` refuses it, or a kit credential file (`*.token`,
+  `board.credential`) (`secret`), and a string from the owner's list of instance strings, kept
+  outside the tree in the user's configuration folder (`instance-string`, in a file, its path or a link's target). It
+  never prints a value it found, a line that holds one, an entry of the owner's list or the folder it checks: a file's
+  path is checked like its text and printed with an entry as `<line N>`, a home name as `<home>` and a segment holding a
+  credential-shaped value as `<secret>`. Every text file is read whole; a binary, unreadable or (in Git mode) nested-repository path is listed as not
+  read (check a nested repository in its own tree, then name it in the ignore file; before `pack`, check it with
+  `--every-file` too). It changes nothing: exit 0 with no finding and every file read, 1 with a finding, 2 when it cannot run or a file
+  was not read (a binary file counts unless the ignore file names it as source). `.fabric-source-ignore` and
+  `--exclude` leave out named files of synthetic test values (and a project `.npmrc` that holds no credential: `pack`
+  still refuses it, so the package is a copy without it), and the summary counts them. A line is a path from the
+  root, not as `.gitignore` reads one: a line with no `/` matches at the root only, a wildcard line takes only what
+  it matches (`*` stays in a folder, `**` crosses folders), and a line ending in `/`, or a path with no wildcard,
+  takes the folder; a nested repository or a submodule is left out only by a line naming its folder (`vendor/sub/`),
+  never by `vendor/*`, and a wildcard folder line (`vendor/*/`) takes every one it reaches, checked or not, so name
+  each by its path; an exception line (`!`), a line holding `\`, `//`, an unclosed `[` or a POSIX class, and a
+  glob it cannot read are refused. Git is run as `git ls-files` with its fsmonitor off and without the caller's `GIT_DIR` or index, taken only from PATH's
+  absolute folders (with PATH unset, `/bin` and `/usr/bin`; on Windows only a `git.exe`, and none with PATH unset). Under a locale whose file-system encoding is not UTF-8 it restarts itself in Python's UTF-8 mode, so names, arguments and text are read in one encoding; an owner's entry is compared composed (NFC), so it finds a name macOS stored decomposed. A neutral home (container, cloud and CI users, first names such as `alice` and accounts such as `admin`; an owner whose own home is a first name, an account or one or two letters writes `home: <name>` in the owner's list, the whole name, spaces included, which is then read in every form, while a container's, a cloud image's or a CI runner's user that only the image uses, such as `node` or `vscode`, is never declared; the owner's own machine's home is declared even when its name is an image user's (`ubuntu`, `admin`), and an image's paths under it then go through a build argument that names the user; a folder holding a typographic apostrophe is listed as a plain string with it kept and declared too with `home:` written with `'`) and
+  a value that says it is synthetic are not findings. Standard library only; the adapter's own tree passes it, with its
+  contract vectors, eight test files and its icon named in its `.fabric-source-ignore` (`test_source_check`).
+  `building-fabric-services/references/package.md` runs it with `--every-file` before `pack`, on a clean copy it
+  describes: what Git would commit and the nested trees checked on their own, each committed symbolic link replaced
+  by its committed target or removed and reviewed, shared source copied in and committed, dependency folders and
+  what `pack` refuses left out; SECURITY.md names what it reads.
+- **references/source-and-instance.md** (both skills): the layout (instance values in a configuration outside the
+  repository with a neutral default and a committed `*.example`, records and state documents in the kit's data folder,
+  keys by name, fixtures on neutral ids; the supervisor label and `createdBy` name the publisher until CT-194) and the
+  check. It is registered as a shared reference (`test_shared_references`).
+- creating-fabric-agents step 2 lays an agent out as source and instance and calls the skeleton done, once the owner has reviewed it (a floor, not a secret scanner), when the check
+  exits 0; step 5 runs it again. adapting-projects-to-fabric step 4c runs the check first, moves each finding out and
+  runs it again; a value already in Git history needs a fresh history, which stays the owner's act. Step 7's report
+  names a contract checkout by its commit, never a home path, and the check runs again after it. The check's ignore-line
+  reading is `fabric_source_ignore.py` and its reading of a declared home `fabric_source_homes.py`, both beside it, and the owner's list takes `home: <name>` for the owner's own home name.
+- Trigger and scenario evals for both (`source-apart-from-instance`, `move-instance-data-out-of-an-existing-agent`);
+  the Windows CI job runs `test_source_check`; the release smoke checks the script is installed. README, AGENTS.md and
+  SKILL-CARD name it.
+
+### Changed
+
+- `COMMERCIAL-LICENSE.md` is the knowledge base template as of fabric-workspace `875faae2` (line 5 now uses a comma
+  where it had a dash); the hash `test/validate.py` pins moved with it. The licence terms are unchanged.
+
+### Upgrading
+
+- Nothing to change: the check is new and opt-in. Handing a source over (a new remote, a push, a change of
+  visibility) stays the owner's act each time; the check reads the tree, never Git history.
+
+## 0.57.0 (2026-10-28)
+
+The contract pin moves to `3830a33` (`v0.1.0+2026-10-27.6`) from `00e050ba` (FAA-176).
+
+### Added
+
+- **`comparison` as a human step** (DEC-0142, contract CT-186). `humanStep` in an action declaration may be
+  `comparison`: the person compares two codes shown on two screens, or chooses to share without a comparison. Both
+  kits' action-declaration checks take it (`fabric_actions.py`, `fabric-actions.mjs`, `actions-vectors.json`
+  regenerated: 68 cases, 12 declarations), the probe passes a declaration that uses it, and interop.md, delegation.md
+  and working-with-fabric's human gates (OA-5), which its refusal table cites, name it. A reader pinned before (a 0.56.0
+  kit, Fabric Dashboards before 0.8.9) refuses such a declaration, which Project Observatory declares on its share
+  buttons from OBS-264.
+- **The protocol register** gains the six peer-share revisions (DEC-0142, `fabric-peer-share/1` and its parts) and
+  `org-adaptation/1` and `org-adaptation-receipt/1` (DEC-0138) in both twins (`feed-protocols-vectors.json`), so a
+  service's well-known that names one is read as a known revision.
+- **The provider entry's manifest path** (DEC-0145, CT-192): `fabric_provider.py` names the schema's
+  `MANIFEST_PATTERN`, read as a search that ends at the string's end; the reader accepts the manifest's name after a
+  backslash, the writer still writes it with `/` and refuses the other with a sentence naming CT-192, and the CLI's
+  stem is read after either separator (CT-193). The contract's ten `provider.schema.json` fixtures are vendored
+  (`provider-fixtures.json`) and tested in every run.
+
+### Changed
+
+- On Windows, `fabric_provider.py`'s `services_dir()` (its FAC-SEM-013 check that an id is not a service's) and
+  `providers_dir()` read `%LOCALAPPDATA%\passioncode-fabric` (provider.md), as the service kit's readers already did.
+- agents-that-answer-people.md (A5) names the contract's `support-quality-daily.schema.json`, says when a producer may
+  carry `calibration` (CT-188) and that a reader validates against its own pinned copy (DEC-0144).
+- The hosted contract job runs `test_provider`, and `test/validate.py` fails a workflow whose contract job leaves out a
+  module that holds a test gated on the contract.
+
+### Upgrading
+
+- A bundle pinned to `00e050ba` or an earlier supported commit keeps working; `adapt_project.py`
+  accepts it (`SUPPORTED_CONTRACT_COMMITS`). A new scaffold writes `3830a33`.
+- DEC-0139 (the machines' report) and DEC-0138's organization server route reach no kit code: the adapter registers
+  their protocol revisions and implements neither side. DEC-0143 (`secret.prompt`, the local channel) and DEC-0142's
+  peer-share profile beyond its register entries reach no kit code either; Project Observatory implements them
+  (CT-186).
+- On Windows, a provider entry written by `fabric_provider.py` now goes to the folder Fabric reads
+  (`%LOCALAPPDATA%\passioncode-fabric\providers`). Fabric v0.3.15 and earlier read a manifest path only under `~/` or
+  `/`; a drive letter (`C:/.../fabric-agent.json`) is read by the Fabric release after v0.3.15 (CO-479). Until then
+  write the manifest path under `~/`. An entry an older kit wrote on Windows sits in
+  `%USERPROFILE%\.local\share\passioncode-fabric\providers`, which Fabric never read and `remove` no longer finds:
+  write it again and delete the old file.
+
 ## 0.56.0 (2026-10-28)
 
 Stability and Windows: the debts of 0.53.0 to 0.55.0 that touch how the hooks, the board responder and the interop

package/COMMERCIAL-LICENSE.md

@@ -2,7 +2,7 @@
 
 This repository is open source under the [GNU Affero General Public License v3.0](LICENSE)
 (`AGPL-3.0-only`). PassionCode.ai also offers it under a commercial license, for use that does not
-meet the AGPL's terms — for example inside a closed-source product, or as a modified hosted
+meet the AGPL's terms, for example inside a closed-source product, or as a modified hosted
 service whose source is not published.
 
 To obtain a commercial license, tell us about your use at **https://passioncode.ai/business/**, or write to **commercial@passioncode.ai**.

package/README.md

@@ -124,7 +124,10 @@ For provider bundles the adapting skill helps an agent author:
 - scaffold a version-pinned provider manifest, schemas, safe fixture, probes, and
   conformance report;
 - distinguish structural validation from live protocol negotiation, semantic
-  admission, and project binding.
+  admission, and project binding;
+- keep the agent's source apart from its instance data, with `scripts/fabric_source_check.py check`, which reports a
+  home path, a credential-shaped value or a string from the owner's list by path, line and kind and never repeats it
+  (FAA-188).
 
 The skill never treats generated files as admission. Fabric contract `0.1.0` does not
 yet ship the host registry/runtime needed to connect and authorize a live provider.
@@ -266,13 +269,21 @@ python3 "$SKILL_DIR/scripts/adapt_project.py" check /path/to/project \
 ```
 
 Pack, sign and verify an agent as a `fabric-package/1` folder (contract DEC-0050, DEC-0051; nothing is written without
-`--apply`, and the key file is the person's, never made or kept here):
+`--apply`, and the key file is the person's, never made or kept here). First check the checkout, then make the clean
+copy [the package reference](plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md)
+describes and check that with `--every-file`, since it is what `pack` carries (a path named in `.fabric-source-ignore`
+or `--exclude` is carried unread; a nested repository is checked in its own tree with `--every-file`):
 
 ```bash
-npx @passioncode-ai/fabric-agent-adapter pack ./example-agent            # the digest, agentRef and every problem
-npx @passioncode-ai/fabric-agent-adapter pack ./example-agent --apply
-npx @passioncode-ai/fabric-agent-adapter sign ./example-agent --key ./publisher.jwk --apply
-npx @passioncode-ai/fabric-agent-adapter verify ./example-agent --trust ./trust.json
+python3 plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_source_check.py check ./example-agent
+python3 plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_source_check.py check ./example-agent-clean --every-file
+```
+
+```bash
+npx @passioncode-ai/fabric-agent-adapter pack ./example-agent-clean      # the clean copy: the digest, agentRef, every problem
+npx @passioncode-ai/fabric-agent-adapter pack ./example-agent-clean --apply
+npx @passioncode-ai/fabric-agent-adapter sign ./example-agent-clean --key ~/.config/example-publisher/publisher.jwk --apply   # a key outside any checkout
+npx @passioncode-ai/fabric-agent-adapter verify ./example-agent-clean --trust ./trust.json
 ```
 
 See [the package reference](plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md).
@@ -285,7 +296,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `00e050ba7429c0c60261cec871779e0fd6aeeb28`
+- commit: `3830a3353923e20f826d466610e1c479f120bec0`
 
 Every other mention of the default contract revision (this section, the skills' metadata, the
 skill card, `adapt_project.py`) must equal it; `python3 test/validate.py` fails a tree

package/SECURITY.md

@@ -57,4 +57,9 @@ bounded and non-publishing until explicit scoped grants exist in a project bindi
   executing it and writes only the seven documented bundle paths (`scaffold --dry-run`
   writes nothing); `check --contract` runs the contract checkout's own
   `node_modules/.bin/tsx` and installs nothing. `fabric_provider.py write` writes one
-  entry (0600) in the providers directory.
+  entry (0600) in the providers directory. `fabric_source_check.py check` reads the files of a
+  tree (credential values included, in memory only), the owner's list from the user's
+  configuration folder, and runs `git ls-files` (without the caller's `GIT_DIR` or other Git
+  location variables) and nothing else, except that under a locale whose
+  file-system encoding is not UTF-8 it restarts itself once with the same interpreter in Python's
+  UTF-8 mode; it writes nothing and prints no value it finds.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.56.0"
+  version: "0.58.0"
   contract-version: "0.1.0"
-  contract-commit: "00e050ba7429c0c60261cec871779e0fd6aeeb28"
+  contract-commit: "3830a3353923e20f826d466610e1c479f120bec0"
 ---
 
 # Adapting projects to Fabric
@@ -76,7 +76,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `00e050ba7429c0c60261cec871779e0fd6aeeb28`.
+- commit `3830a3353923e20f826d466610e1c479f120bec0`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or
@@ -159,6 +159,19 @@ A provider entry only describes an MCP server: a CLI that does not speak MCP get
 announced by its `local-runner` manifest (step 3). An agent that runs as a service uses a
 descriptor instead (`building-fabric-services`).
 
+### 4c. Keep the instance out of the source
+
+An agent's source (what its owner could hand over) and its instance (records, logs, keys, the owner's names and paths,
+its configuration) are kept apart; load [the source and the instance](references/source-and-instance.md). First run
+[`scripts/fabric_source_check.py`](scripts/fabric_source_check.py) `check <project-root>`, with the owner's list of
+their own strings or a note that none was given (when the owner's own home name is neutral, has one or two letters,
+or holds a space, `.`, `_`, `-` or `'`, the list gains `home: <name>` first, the reference's rule; a container's, a cloud image's or a CI runner's user that only the image uses, such as `node` or `vscode`, is never declared): it reports instance data by
+path, line and kind, never repeating a value, and changes nothing. Then move each finding out in the source: an
+instance value into the instance configuration outside the repository, read through a named variable with a neutral
+default and a committed `*.example`; a key into the secret store, named only. Run the check again until it exits 0; it is a floor under the owner's review, not a secret scanner.
+A value already committed stays in Git history: say so; a fresh history is the owner's act (no history rewrite, no
+force-push).
+
 ### 5. Make probes safe and meaningful
 
 For each capability, create at least one bounded fixture that:
@@ -208,7 +221,8 @@ Update `fabric/FABRIC-CONFORMANCE.md` with dated receipts for:
 3. bounded semantic probes;
 4. project-binding readiness.
 
-Include commands and exit codes, immutable endpoint or artifact identities, and explicit
+Include commands and exit codes (a contract checkout named by its commit or `<contract>`, never a home path; run the
+source check again after), immutable endpoint or artifact identities, and explicit
 unverified surfaces. If live Fabric admission/runtime does not yet exist, the last gates
 remain `NOT_VERIFIED`; the completed deliverable is an adaptation-ready provider bundle,
 not a connected provider.

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/provider-entry.md

@@ -11,6 +11,7 @@ directory:
 |---|---|
 | macOS | `~/Library/Application Support/ai.passioncode.fabric/providers/` |
 | Linux | `${XDG_DATA_HOME:-~/.local/share}/passioncode-fabric/providers/` |
+| Windows | `%LOCALAPPDATA%\passioncode-fabric\providers\` (the same root as the services folder, DEC-0032; `~\AppData\Local` when `LOCALAPPDATA` is unset) |
 | any | `FABRIC_PROVIDERS_DIR` when set |
 
 A service uses a descriptor instead (the `building-fabric-services` skill). One id is a
@@ -49,15 +50,25 @@ It refuses, with one sentence that never quotes a value:
   credential itself: a token prefix, a private key, a JWT (FAC-SEM-015: a value is
   checked by its form; name patterns apply to names);
 - what the pinned `provider.schema.json` refuses: a URL other than `http://127.0.0.1:<port>/mcp` with a port from 100
-  to 65535, a manifest path that is not an absolute or `~/` path to `fabric-agent.json` (or is a network share, or over
-  1024 characters), a shell-string command, more than 32 arguments or one over 1024 characters, more than 64 env
-  names, a `source.repository` that is not an absolute URI, an `installedAt` that is not an RFC 3339 date-time,
-  unknown fields. The patterns are the schema's, copied (`test_provider.SchemaParityTests` compares them with a
-  contract checkout at the pin when `FABRIC_CONTRACT_NEW` names one);
+  to 65535, a manifest path that is not an absolute, `~/` or `~\` path to a file named `fabric-agent.json` after
+  either separator (DEC-0145; or is a network share, or over 1024 characters), a shell-string command, more than 32
+  arguments or one over 1024 characters, more than 64 env names, a `source.repository` that is not an absolute URI, an
+  `installedAt` that is not an RFC 3339 date-time, unknown fields. The patterns are the schema's, copied
+  (`test_provider.SchemaParityTests` compares them with a contract checkout at the pin when `FABRIC_CONTRACT_NEW` names
+  one, as the contract job of the nightly CI does), and the reader is held to every `provider.schema.json` fixture of
+  the pin (`test/fixtures/contract/provider-fixtures.json`, `test_provider.ContractFixtureTests`);
 - a `source.repository` with a `user:password@` or a value shaped like a credential: it names the repository, never
-  reaches it (since 0.49.3, as the service kit's descriptor check).
+  reaches it (since 0.49.3, as the service kit's descriptor check);
+- a manifest whose name follows a backslash (`C:\Agents\example\fabric-agent.json`). The reader,
+  `validate_provider_entry`, accepts it since DEC-0145 (`MANIFEST_PATTERN`, the schema's), but a reader that has not
+  re-pinned to DEC-0145 refuses the entry, Fabric's registry among them (CT-192), so the writer does not emit it until
+  the oldest Fabric release in use reads it (the release after v0.3.15, CO-479). Write the path with `/` before the name. A manifest under the home folder
+  (`~/Agents/example/fabric-agent.json`) is read by every Fabric release; one with a drive letter
+  (`C:/Agents/example/fabric-agent.json`) only by Fabric after v0.3.15, whose registry took the repin (CO-479): v0.3.15
+  and earlier read only a manifest under `~/` or `/`, so not `~\` either.
 
-`validate` also checks that the file is named `<id>.json` (FAC-SEM-014, slug half).
+`validate` also checks that the file is named `<id>.json` (FAC-SEM-014, slug half): the stem is what follows the last
+`/` or `\`, on every platform (CT-193).
 From Python: `write_provider_entry(entry)`, `remove_provider_entry(id)`,
 `validate_provider_entry(entry)`, `manifest_problems(entry)`, `providers_dir()`.
 

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/source-and-instance.md

@@ -0,0 +1,154 @@
+# The source and the instance
+
+An agent is two things. Its **source** is what can be handed to someone else: code, skills, prompts, schemas,
+examples, the source documentation. Its **instance** is what belongs to one installation: records, logs, journals,
+keys, the owner's names and paths, accounts, hosts and its configuration. A new agent keeps the two apart from its
+first commit, so that its owner can hand the source over later without rewriting its history. Nothing is handed over
+by itself: handing over, a new remote, a push or a change of visibility stays the owner's act, each time (a personal
+agent stays private until its owner says so about that act).
+
+The format of a source manifest, export and import is the contract's to decide (CT-194). What follows does not depend
+on it.
+
+## Contents
+
+- [The layout](#the-layout)
+- [The check](#the-check)
+
+## The layout
+
+| Where | What | In Git |
+|---|---|---|
+| the repository | code, skills, prompts, schemas, the source documentation, fixtures on neutral ids (`example-agent`, `/Users/example`) | yes |
+| `config/<name>.example.json` (or `.env.example`, `*.example.yaml`) | every instance value the agent reads, with a neutral default: the repository address of the owner's account, folders, the owner, account ids, hosts | yes, the example only |
+| the instance folder, outside the repository | the real configuration, records (a database included), logs, journals, state documents | never in the source's repository (a separate private repository of the owner's data belongs to the instance) |
+| the secret store | key values; the source names each key by name only (`EXAMPLE_API_KEY`) | never |
+
+- **The instance folder is the agent's data folder.** An agent that is not a kit service reads it through one named
+  variable (`<AGENT>_DATA_DIR`) that overrides its default. A service built with `building-fabric-services` takes the
+  kit's folders unchanged (the Directories table in its `references/lifecycle.md`, `fabric_paths.service_dirs`): on macOS `~/Library/Application Support/<id>/`,
+  on Linux `${XDG_DATA_HOME:-~/.local/share}/<id>/`, on Windows `%LOCALAPPDATA%\<id>\`. An agent's second context
+  (an organization's) is a sibling instance, `<id>.<instance>`, never a folder inside the personal one
+  (`references/estate-record.md` of that skill).
+- **Ignore the instance in the source**: `.gitignore` names the real configuration (`config/*.json` with
+  `!config/*.example.json`), an instance folder that sits inside the checkout during development, and what running
+  the agent leaves (`__pycache__/`, `*.pyc`), which the check would otherwise report as binary in Git mode.
+- **State documents are instance data.** A handoff, a decision log or a backlog about this codebase is source
+  documentation; a record of what this installation did (runs, conversations, the owner's notes, a journal) lives in
+  the instance folder.
+- **Keys by name.** The README's Configure section lists key names, the agent reads each from its environment or the
+  secret store, and no value is ever written to a file, a fixture, an argument or a commit.
+- **Fixtures on neutral ids.** A test that needs a home folder, an owner or an account uses `example`, `example-agent`,
+  `owner@example.com` or a one-letter home, and a credential-shaped test value says it is synthetic
+  (`sk-test-not-a-key`) or is assembled at run time.
+- **Two names stay in the source until the contract decides (CT-194).** A service's supervisor label is the agent's
+  own name, reverse-DNS on the publisher's domain (`com.example.example-agent`), and `AGENTS.md` names it (LC-09):
+  never the owner's account or name. A provider's `createdBy` names the publisher; until one is chosen it
+  keeps the scaffold's sentinel, and a person's name or account is never written there. The adapter moves both when the
+  contract decides how an instance renames them (FAA-188 part 2).
+
+## The check
+
+`fabric_source_check.py check` reads the files the source would carry (what Git would commit: tracked files and
+untracked ones that are not ignored, as they are in the work tree; a staged copy that differs is not read) and reports each place where the instance shows through, by path, line and kind:
+
+| Kind | Finds |
+|---|---|
+| `home-path` | an absolute path inside a person's home folder (a web route under `/home/` is reported too; a route under `/users/` is not): `/Users/<name>/`, `/home/<name>/`, `C:\Users\<name>\`, Git Bash's `/c/Users/<name>/`, WSL's `/mnt/c/Users/<name>/`, and the dashed (`-Users-<name>-`, `C--Users-<name>-`) and URL-encoded forms a tool makes of one. The name is ASCII, and in the dashed form it ends at the next dash: an owner whose home name holds a space, a dash, a dot, an underscore or an apostrophe (each a dash in the dashed form; a slashed name also ends at a space) declares it with `home: <name>` in the owner's list, which reads it whole in every form, and one whose home name is not ASCII, or holds another character, lists it as a plain string (a typographic apostrophe a keyboard typed, which the folder's name does not hold, is written as `'` in `home:`; a folder whose name holds `’` is listed as a plain string with `’` kept and declared too with `home: <name>` written with `'`, which reads the dashed forms; its URL-encoded `’` is not read; a name outside ASCII of one or two characters cannot be checked) |
+| `secret` | a value shaped like a credential by the contract's detector (DEC-0044), read line by line: a provider key starting a word, a JWT, a bearer token, a long random value assigned to a credential's name (but a whole Ed25519 signature under a JSON `"sig"`, `"signature"` or `"signatures"` member, as `sign` writes it, which is public); or a private key: a PEM, OpenSSH or PGP block, or a JWK's `d` as a JSON member, escaped JSON or a Python dict; a URL with a password of 8 or more characters mixing letters and digits (a password without a digit or without a letter is not read) or a credential in its query, percent-encoded or not, JSON-escaped (`\u0026`, `\/`) or nested in another URL's parameter (two levels deep); a file that is a credential by its name, as `pack` refuses it (`.env`, `*.pem`, `*.key`, `.npmrc` and the rest), or a kit credential file (`*.token`, `board.credential`) |
+| `instance-string` | a string from the owner's list, in a file, in a file's path or in a link's target |
+
+```bash
+python3 <plugin-dir>/skills/adapting-projects-to-fabric/scripts/fabric_source_check.py check <project-root>
+```
+
+- It **never repeats** a value it found: no value, no line holding one, no entry of the owner's list and not the
+  folder it checks reaches its output. A file's path is checked like its text (line `0` of a finding), and printed
+  with an entry of the list as `<line N>`, a home folder's name as `<home>` and each segment holding a
+  credential-shaped value as `<secret>` (two files can then print the same; the segments a found value runs across, an
+  assigned value, a bearer run or a URL, are masked too, while a key, a JWT or a JWK `d` is read up to the `/` that
+  cuts it, so the rest of a cut one can print in the next folder: find the file by the folder the finding names); an instance string is named by its line in the owner's list. The report can go in a commit
+  message, an issue or a chat. A declared home of one or two letters, once found anywhere in the tree, is masked wherever it stands in a printed
+  path, inside a word too (`qzone` prints `<home>one`); found nowhere, it is not masked.
+- It **changes nothing.** Exit `0`: no finding and every file read; `1`: at least one finding (the step is not done);
+  `2`: the check could not run, or a file was not read: an unreadable file, a nested repository, or a binary file the
+  ignore file does not name as source (the summary counts each, and how many files were left out by name). A finding
+  sets `1` even when a file was not read too; the files not read are still listed, so fixing the findings can leave `2`.
+- **What it reads.** A text file of any size is read whole, and the summary counts every text file read; a binary file (a NUL byte in its first 8 KiB) or one that
+  cannot be read is listed by its path as not read, and the summary counts it. A database or another binary of
+  records in the tree is instance data the check cannot read: move it to the instance folder. A binary that is source
+  (an icon, a font) is named in the ignore file. `--every-file` reads every file, those Git ignores included, but `.git`, `__pycache__`, `.DS_Store` and `*.pyc`
+  (litter `pack` refuses): run it
+  on a folder before `pack`, which carries them. A committed symbolic link is checked by the path it names, never followed. When the folder is
+  not in a Git checkout, Git lists nothing in it, or no `git` is found in PATH's absolute folders (with PATH unset, in `/bin` and `/usr/bin`; on Windows, nowhere), every file is read but `.git` and `__pycache__` (uncounted) and the dependency
+  folders (`node_modules`, virtual environments, caches), and the summary says Git was not used and how many dependency folders were not read.
+  Under a locale whose file-system encoding is not UTF-8 (ISO-8859-1, KOI8-R) the check restarts itself in Python's UTF-8
+  mode, so a file name, an argument and a file's text are read in one encoding; a name that is not UTF-8 is matched as its bytes.
+  A file's text is read as UTF-8, so an entry of the owner's list with a letter outside ASCII is found in a UTF-8 file
+  (composed or decomposed, as macOS may store a name), not in one saved as Latin-1 or CP1252.
+  In Git mode a nested repository (a submodule, a vendored checkout) is not read: check a nested repository in its own tree with
+  the same check (a submodule checked out first, `git submodule update --init`), then name its path in the ignore file,
+  with that reason on the line above. That line serves the check of the outer tree only: before `pack`, check the
+  nested repository with `--every-file` in its own tree too, because `pack` carries its files, ignored ones included.
+- **The owner's list** holds the strings only the owner knows are theirs (their name, company, accounts, hosts), one
+  per line, at least three characters; a line starting with `#` is a comment, so list a channel or a hashtag without its `#`, and a `#` after a string is
+  part of that string. An entry matches in any case and inside any word; an invisible format character (a direction mark, a
+  soft hyphen, a joiner) at either end of a string is dropped, spaces between such characters too, and does not count
+  toward the three; one inside it is kept and counts (an emoji's joiner), so a string copied with a soft hyphen in it
+  matches only text that holds one. A line `home: <name>` declares the owner's home
+  name instead (ASCII letters, digits, `.`, `_`, `-`, `'` and spaces, starting with a letter or a digit; a name holding a
+  space, as a Windows profile may, is written whole, `home: Jane Doe`, and everything after the colon is the name, so
+  a note goes on a line of its own (`# laptop`); spaces and tabs may stand around the colon; a line
+  that starts with `home` and a colon and holds anything else is refused, exit 2 (an invisible format character before
+  the name, after it or inside `home` is dropped, one inside the name refuses the line; a NUL anywhere in the list
+  refuses it too); such a line is never a string
+  entry, so list a string like `home: page` by a part of it, `ome: page`): the check then finds that home in every form the table names (it is never neutral, even with one or two
+  letters), and the bare name is not looked for anywhere else, though a declared name of three or more letters and digits is
+  masked wherever a printed path holds it as a word, its parts joined by none or any run of a space, `.`, `_`, `-`, `+`, `'`, their
+  percent-encodings or an escaped apostrophe (`\'`, `\x27`, `\u0027`, `&#39;`, `&#x27;`, `&apos;`), the same separators it is found with in every form; a home that is also your name goes in the list
+  as a plain string too, to be found in text. It is `--instance-strings FILE`, else the file
+  `FABRIC_INSTANCE_STRINGS` names, else `passioncode-fabric/instance-strings.txt` in the user's configuration folder
+  (`$XDG_CONFIG_HOME` when it is absolute, else `~/.config`; `%APPDATA%` on Windows). A list inside the tree is refused, because it would
+  travel with the source. A person who already keeps private terms for org-index's `check_private.py`
+  (`~/.config/passioncode/private-terms.txt`) passes that file with `--instance-strings`; this check matches a term
+  anywhere in a word, and it does not look for e-mail addresses or account ids by their shape.
+- **Leaving paths out.** `.fabric-source-ignore` at the root (globs, one per line, `#` comments) or `--exclude GLOB`
+  leaves out files that hold synthetic values on purpose, such as test vectors. A line is a path from the root, not a
+  `.gitignore` line (a leading `/` changes nothing, a line with no `/` matches at the root only, and a line holding `\`, `//`, an unclosed `[` or a class such as `[[:digit:]]` is refused, as Git reads each
+  otherwise): `*`, `?` and `[...]` stay inside one folder (`?` and `[...]` match one byte, as Git's do, so a letter
+  outside ASCII takes two or more) and `**` as a whole segment crosses
+  folders, so `vectors/*` takes the files in `vectors` and none in its subfolders. A line ending in `/`, or a path
+  with no wildcard, takes that folder and all it holds; only such a line leaves out a nested repository or a
+  submodule (`vendor/sub/`), never a wildcard line without the `/` (`vendor/*`). A wildcard folder line (`vendor/*/`)
+  takes every nested repository it reaches, checked or not, so name each one by its path. In Git mode a nested
+  repository is not read; `--every-file` and a folder outside Git read its files, its `.git` left out. An exception line (`!`) is refused, since what it would
+  bring back would go unread. Name the files, or a folder that holds
+  only synthetic vectors, never a whole source folder (a nested repository checked in its own tree is the one
+  exception), and say why on the line above. A file `pack` refuses by its name cannot ship in a package: a public
+  certificate is renamed `*.crt`; a project `.npmrc` that holds no credential may be named in the ignore file, with
+  that reason, for the source check (the line then hides whatever is added to it later, so keep it credential-free),
+  and `pack` still refuses it, so a package is made from a copy without it (its
+  settings then apply only where the owner sets them: `~/.npmrc` reaches every project of the owner, and
+  `package.json`'s `publishConfig` carries publish-time settings such as `registry`, `tag` and `access`). A file
+  holding a credential moves to the instance, never into the ignore file.
+- A neutral home (`example`, `user`, `runner`, a container's, a cloud machine's or a dev container's user such as `node`, `ubuntu` or `vscode`, the fixture id
+  `example-agent`, a
+  one-letter name, a placeholder; the whole set is `NEUTRAL_HOMES` in the script. An owner whose home name is in it, a
+  first name such as `alice` or an `admin` account, or has one or two letters, writes `home: <name>` in the owner's
+  list; a container's, a cloud image's or a CI runner's user that only the image uses, such as `node` or `vscode`, is never declared, since
+  its paths are the image's and stay in the source; the home of the owner's own machine is declared even when its
+  name is an image's user, as `admin` or `ubuntu` on a cloud machine the owner works on; when that name is also the
+  user of an image in the tree, the image's paths are reported, and they are written through a build argument that
+  names the user, `ARG APP_USER=ubuntu`, `USER ${APP_USER}`, `WORKDIR /home/${APP_USER}/app`, so no home path stands
+  in the source; `$HOME` serves only where a shell in the image expands it, a `RUN` line or a script, since a
+  Dockerfile's `WORKDIR` and `COPY` see only `ENV` and `ARG` values) and a value that says it is synthetic (`EXAMPLE`, `not-a-key`, `fake`, `dummy`) are
+  not findings.
+
+The check finds the forms the table names, and only those: a credential in another shape (a bare token with no name
+before it, a provider's key the contract's names do not cover) passes it. It is a floor under the owner's review and a
+secret scanner, never a replacement for either.
+
+The check finds the repository from the folder it checks: a Git location the caller exports (`GIT_DIR`,
+`GIT_INDEX_FILE`, as a hook in a linked worktree has) is not passed to Git. The check reads the tree, not Git history. A value that was committed once is still in the history after the tree is
+clean: handing such a source over needs a fresh history, which is the owner's act, never the agent's (no history
+rewrite, no force-push).

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -22,10 +22,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "00e050ba7429c0c60261cec871779e0fd6aeeb28"
+CONTRACT_COMMIT = "3830a3353923e20f826d466610e1c479f120bec0"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "1197a90dc4b57152cabcc71ad17db7559f35a27f", "e6c4fc16b415eec3190dd34d924d269405359dc9", "a3a66eb0052043847f6556348e37d34ca873a629", "52c7d798b9f4eb784eb4e29e717038a8912c759d", "2f020a696453ae299b123517f14957f6a1354379", "87d384ffce2757081b7ab227e5dad3dddd08328f", "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e", "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "00e050ba7429c0c60261cec871779e0fd6aeeb28", "1197a90dc4b57152cabcc71ad17db7559f35a27f", "e6c4fc16b415eec3190dd34d924d269405359dc9", "a3a66eb0052043847f6556348e37d34ca873a629", "52c7d798b9f4eb784eb4e29e717038a8912c759d", "2f020a696453ae299b123517f14957f6a1354379", "87d384ffce2757081b7ab227e5dad3dddd08328f", "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e", "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_provider.py

@@ -41,6 +41,9 @@ PROTOCOL = "fabric-provider/0.1"
 URL_PATTERN = r"^http://127\.0\.0\.1:([1-9][0-9]{2,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])/mcp$"
 LOCAL_PATH_PATTERN = "^(~[\\\\/]|/(?![\\\\/])|[A-Za-z]:[\\\\/])[^\\u0000]*$"
 LOCAL_PATH_MAX = 1024
+# DEC-0145 (CT-192): the manifest is named fabric-agent.json after either separator, so a Windows path names it too. The
+# schema's pattern is a search, not a whole-value match; it is applied with its `$` read as \Z (R1, below).
+MANIFEST_PATTERN = r"(^|[\\/])fabric-agent\.json$"
 ARGV_MAX_ITEMS = 32
 ARGV_MAX_ITEM = 1024
 ENV_MAX = 64
@@ -55,6 +58,9 @@ _URI_PASSWORD = re.compile(r"^(?:(?:[Hh][Tt][Tt][Pp][Ss]?|[Ww][Ss][Ss]?|[Ff][Tt]
 _SECRET_REF = re.compile(r"^secret-ref:([A-Za-z0-9][A-Za-z0-9._/:@-]{0,255})\Z")
 _LOCAL_PATH = re.compile(LOCAL_PATH_PATTERN)
 _URL = re.compile(URL_PATTERN)
+_MANIFEST = re.compile(MANIFEST_PATTERN[:-1] + r"\Z")
+# The manifest's name after a backslash: valid since DEC-0145, but no writer emits it until every reader accepts it.
+_MANIFEST_AFTER_BACKSLASH = re.compile(r"\\fabric-agent\.json\Z")
 # format: uri (RFC 3986 absolute URI): a scheme, a colon, then no whitespace or control character.
 _URI = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:[^\s\x00-\x1f\x7f]+\Z")
 # format: date-time (RFC 3339).
@@ -89,6 +95,10 @@ def services_dir() -> Path:
     home = Path.home()
     if sys.platform == "darwin":
         return home / "Library/Application Support/ai.passioncode.fabric/services"
+    if sys.platform == "win32":
+        # provider.md "Where the directory is" (DEC-0032): LOCALAPPDATA, never the roaming APPDATA.
+        local = os.environ.get("LOCALAPPDATA")
+        return (Path(local) if local else home / "AppData" / "Local") / "passioncode-fabric" / "services"
     return Path(os.environ.get("XDG_DATA_HOME") or str(home / ".local/share")) / "passioncode-fabric/services"
 
 
@@ -128,8 +138,9 @@ def validate_provider_entry(entry: Any) -> List[str]:
         problems.append("summary is at most 200 characters")
     manifest = entry["manifest"]
     if (not isinstance(manifest, str) or len(manifest) > LOCAL_PATH_MAX or not _LOCAL_PATH.fullmatch(manifest)
-            or not re.search(r"(^|/)fabric-agent\.json\Z", manifest)):
-        problems.append("manifest is an absolute or ~/ path to fabric-agent.json, at most %d characters, never a network share" % LOCAL_PATH_MAX)
+            or not _MANIFEST.search(manifest)):
+        problems.append("manifest is an absolute, ~/ or ~\\ path to fabric-agent.json (the name after either separator), at most %d characters, "
+                        "never a network share" % LOCAL_PATH_MAX)
     if "source" in entry:
         source = entry["source"]
         if not isinstance(source, dict) or not set(source) <= {"repository"}:
@@ -237,8 +248,15 @@ def _service_ids(directory: Path) -> Dict[str, str]:
 def write_provider_entry(entry: Dict[str, Any], directory: Optional[Path] = None, services: Optional[Path] = None) -> Path:
     """Installer-only. Refuses an invalid entry and an id that is already a service (FAC-SEM-013)."""
     problems = validate_provider_entry(entry)
-    if not problems:
-        problems = manifest_problems(entry)
+    if problems:
+        raise ProviderError("Provider entry is invalid: %s." % "; ".join(problems))
+    if _MANIFEST_AFTER_BACKSLASH.search(entry["manifest"]):
+        # provider.md (DEC-0145): a reader before DEC-0145, Fabric's registry among them, refuses this entry until it
+        # re-pins (CT-192), so the writer does not emit it yet.
+        raise ProviderError("The manifest's name follows a backslash, which a reader that has not re-pinned to DEC-0145 refuses (CT-192). "
+                            "Write the path with / before the name: ~/.../fabric-agent.json, which every Fabric release reads, or "
+                            "C:/.../fabric-agent.json, which Fabric reads only after v0.3.15 (its repin, CO-479).")
+    problems = manifest_problems(entry)
     if problems:
         raise ProviderError("Provider entry is invalid: %s." % "; ".join(problems))
     clash = _service_ids(services or services_dir()).get(entry["id"])
@@ -301,7 +319,9 @@ def main(argv: Optional[List[str]] = None) -> int:
         if args.command == "validate":
             entry = json.loads(args.path.read_text(encoding="utf-8"))
             problems = validate_provider_entry(entry)
-            if isinstance(entry, dict) and entry.get("id") != args.path.stem:
+            # CT-193 (FAC-SEM-014): the stem is what follows the last / or \ and loses .json, on every platform.
+            stem = re.sub(r"\.json\Z", "", re.sub(r"^.*[\\/]", "", str(args.path), flags=re.S))
+            if isinstance(entry, dict) and entry.get("id") != stem:
                 problems.append("the file name %s is not <id>.json for %s (FAC-SEM-014)" % (args.path.name, entry.get("id")))
             if not problems:
                 problems = manifest_problems(entry)