@passioncode-ai/fabric-agent-adapter 0.56.0 → 0.58.0

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_source_homes.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""How fabric_source_check.py reads a home the owner's list declares (`home: <name>`, FAA-188 part 1): the name in
+every form the table names, its parts joined by any separator a tool or a language writes, and its spellings for the
+masks of printed paths. Beside fabric_source_check.py, which imports it. Standard library only.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Dict, Iterable, List, Set, Tuple
+
+_SEP = r"(?:\\|/)+"  # one way to read a run: two alternatives that both take a `\\` backtrack exponentially
+
+#: How a `home: <name>` line of the owner's list is kept among the entries: a character no line can hold.
+HOME_ENTRY = "\0"
+
+
+def _owner_homes(entries: List[str]) -> Set[str]:
+    """The home names the owner's list declares (`home: <name>`), which are never neutral."""
+    return {e[1:] for e in entries if e.startswith(HOME_ENTRY)}
+
+
+_DASHED: Dict[str, Tuple["re.Pattern[str]", ...]] = {}
+
+
+#: Where a declared home name stands in each form the table names: the slashed, drive, URL-encoded and dashed homes.
+_DECLARED_SLASHED = (r"(?<![A-Za-z0-9_.-])(?:/var)?/home/", r"(?<![A-Za-z0-9_.-])/Users/",
+                     r"(?<![A-Za-z0-9_.-])(?:/mnt)?/[A-Za-z]/Users/",
+                     r"(?<![A-Za-z0-9_.-])(?i:[A-Za-z]:%sUsers%s)" % (_SEP, _SEP),
+                     r"%2[Ff](?:Users|home)%2[Ff]", r"(?i:%5CUsers%5C)")
+_DECLARED_DASHED = (r"(?:^|[^A-Za-z0-9-])(?:-Users|-home|-var-home|(?:-mnt)?-[A-Za-z]-Users)-",
+                    r"(?<![A-Za-z0-9])(?i:[A-Za-z]--Users-)")
+
+
+#: One separator between the parts of a declared home name, in any spelling a tool or a language writes: a space, `.`,
+#: `_`, `-`, `+`, `'`, an escaped `\'` or `\u0027`, an HTML `&#39;` or `&#x27;`, or a percent-encoding of one of them.
+_NAME_JOIN = r"(?:[ ._+'-]|\\'|\\x27|\\u0027|&#0?39;|&#[xX]27;|&apos;|%2[07BbDdEe]|%5[Ff])"
+
+
+#: Where an unfound declared name starts a word: no letter or digit before it, or one of `_NAME_JOIN`'s escapes that ends
+#: in a letter or digit (a percent-encoding, `\x27`, `\u0027`); the escapes ending in `;` or `'` already leave no letter
+#: or digit before the name. Kept beside `_NAME_JOIN`, so a separator added to one is added to the other.
+_NAME_START = r"(?:(?<![A-Za-z0-9])|(?<=%[0-9A-Fa-f]{2})|(?<=\\x27)|(?<=\\u0027))"
+
+
+def _name_parts(name: str) -> List[str]:
+    return [part for part in re.split(r"[ ._'-]+", name) if part]
+
+
+def _spellings(found: Iterable[str], owner: Iterable[str]) -> Set[str]:
+    """The names found, and every spelling of a declared home one of them spells (its parts joined by each separator
+    a tool writes), so a printed path masks the other spellings of that home too."""
+    names = set(found)
+    for name in owner:
+        parts = _name_parts(name)
+        body = re.compile(r"(?i:%s)" % (_NAME_JOIN + "+").join(re.escape(part) for part in parts), re.ASCII)
+        if parts and any(body.fullmatch(n) for n in names):
+            names |= {name} | {sep.join(parts) for sep in (" ", ".", "_", "-", "+", "'", "%20", "%27")}
+    return names
+
+
+def _dashed_home(name: str) -> Tuple["re.Pattern[str]", ...]:
+    """A declared home name in every form, read whole, its parts joined by any run of the separators a tool or a
+    language writes (`_NAME_JOIN`: a space, `.`, `_`, `-`, `+`, `'` and their escapes and percent-encodings), since
+    the generic forms end a name at a dash or a space, so `-Users-j-doe-proj` would read `j`. It ends only where a
+    letter or digit would continue it: a `.` or `_` after it (an extension, a sentence's end) is read as the declared
+    home, failing closed."""
+    if name not in _DASHED:
+        body = (_NAME_JOIN + "+").join(re.escape(part) for part in _name_parts(name)) or re.escape(name)
+        whole = r"((?i:%s))(?![A-Za-z0-9])" % body
+        _DASHED[name] = tuple(re.compile(prefix + whole, re.ASCII) for prefix in _DECLARED_SLASHED + _DECLARED_DASHED)
+    return _DASHED[name]

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_source_ignore.py

@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+"""How fabric_source_check.py reads `.fabric-source-ignore` and `--exclude` (FAA-188 part 1): a line is a path from the
+tree's root, matched byte by byte as Git matches (`*`, `?` and `[...]` inside one folder, `**` as a whole segment
+across folders), and a line Git would read otherwise is refused. Beside fabric_source_check.py, which imports it.
+Standard library only.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import re
+import warnings
+from typing import Dict, Iterable, List, Optional
+
+IGNORE_FILE = ".fabric-source-ignore"
+
+
+class CheckError(Exception):
+    pass
+
+
+_GLOBS: Dict[str, "re.Pattern[str]"] = {}
+
+
+def _as_bytes(text: str) -> str:
+    """A path or a line as Git compares it: its UTF-8 bytes, one character each. An unpaired surrogate (a Windows file
+    name may hold one) is written as Git for Windows writes it (WTF-8), never a crash."""
+    if os.name == "nt":  # Windows names are UTF-16: every surrogate in one is a character of the name, as WTF-8
+        return text.encode("utf-8", "surrogatepass").decode("latin-1")
+    try:  # POSIX names are bytes: a surrogate here is one Python escaped, and surrogateescape gives that byte back
+        return text.encode("utf-8", "surrogateescape").decode("latin-1")
+    except UnicodeEncodeError:
+        return text.encode("utf-8", "surrogatepass").decode("latin-1")
+
+
+def _name_bytes(name: str) -> str:
+    """A file name as Git compares it, one byte each: on POSIX the bytes on disk, encoded back with the file system's
+    own codec (os.walk and `_git_files` decoded it with that codec, so a name in any locale comes back exact); on
+    Windows its UTF-8 (WTF-8) bytes, as `_as_bytes` writes them. The ignore file is read as UTF-8 and stays `_as_bytes`."""
+    if os.name == "nt":
+        return _as_bytes(name)
+    try:
+        return os.fsencode(name).decode("latin-1")
+    except UnicodeEncodeError:  # not a name os.walk or Git gave (a surrogate outside the escapes): read as `_as_bytes`
+        return _as_bytes(name)
+
+
+def _glob(glob: str) -> "re.Pattern[str]":
+    """A line of the ignore file read from the tree's root: `*`, `?` and `[...]` stay inside one folder, and `**` as a
+    whole segment crosses folders (`**/` also matches none); any other run of stars is one `*`. Not a `.gitignore`
+    line: a line with no `/` matches at the root only, and `\\` or `//` is refused (`_line`).
+    fnmatch's `*` would cross `/`, so `vectors/*.json` would leave out `vectors/private/live.json`. Raises re.error
+    for a class Python cannot read (`[9-0]`)."""
+    key = glob
+    if key not in _GLOBS:
+        glob = _as_bytes(glob)  # Git matches bytes: `?` and a class read one byte of a UTF-8 name, never a letter
+        out, i = [], 0
+        while i < len(glob):
+            c = glob[i]
+            if c == "*":
+                end = i
+                while end < len(glob) and glob[end] == "*":
+                    end += 1
+                whole = end - i >= 2 and (i == 0 or glob[i - 1] == "/") and (end == len(glob) or glob[end] == "/")
+                if whole and end < len(glob):
+                    out.append("(?:.*/)?")
+                    end += 1
+                else:
+                    out.append(".*" if whole else "[^/]*")
+                i = end
+                continue
+            elif c == "?":
+                out.append("[^/]")
+            elif c == "[":
+                j = i + 1 + (glob[i + 1:i + 2] in ("!", "^"))
+                j += glob[j:j + 1] == "]"
+                end = glob.find("]", j)
+                if end < 0 or "[:" in glob[i + 1:end + 1]:
+                    # Git matches nothing for an unclosed `[` and reads `[:digit:]` as a POSIX class: refused
+                    raise re.error("a class Git reads otherwise")
+                else:
+                    inner = glob[i + 1:end].replace("\\", "\\\\")
+                    negated = inner[:1] in ("!", "^")  # Git reads both as a negated class
+                    body = inner[negated:]
+                    if body[:1] in ("^", "["):  # a literal right after the negation
+                        body = "\\" + body
+                    for mark in "&~|":  # literals, never the set operations a later Python may read there
+                        body = body.replace(mark, "\\" + mark)
+                    out.append("(?!/)[%s%s]" % ("^" if negated else "", body))
+                    i = end
+            else:
+                out.append(re.escape(c))
+            i += 1
+        with warnings.catch_warnings():  # a FutureWarning (`--` in a class) would print the script's own path
+            warnings.simplefilter("error")
+            try:
+                _GLOBS[key] = re.compile("(?s:%s)\\Z" % "".join(out))
+            except Warning:
+                raise re.error("a class Python may read as a set operation")
+    return _GLOBS[key]
+
+
+def _readable_glob(glob: str) -> bool:
+    """Whether every form `_ignored` tries can be read: a reversed range (`[9-0]`) is refused on every Python."""
+    try:
+        for form in (glob, glob.rstrip("/")):
+            _glob(form)  # every form, whether `_ignored` tries it for this line or not
+    except re.error:
+        return False
+    return True
+
+
+def _line(glob: str, where: str) -> str:
+    """An ignore line as it is matched: a leading `/` is the root (it changes nothing); a `!` exception is refused, since a
+    file it would bring back is left out here (it fails open), and so is a glob that cannot be read."""
+    if glob.startswith("!"):
+        raise CheckError("%s is an exception (`!`), which the check does not read: name the files to leave out" % where)
+    # `//` and `\` mean something else to Git (no match, an escape): refused, never read as a wider line
+    if "//" in glob or "\\" in glob:
+        raise CheckError("%s holds `\\` or `//`: write the path from the root with single `/`" % where)
+    glob = glob[1:] if glob.startswith("/") else glob
+    if not glob or not _readable_glob(glob):
+        raise CheckError("%s is not a glob it can read" % where)
+    return glob
+
+
+def ignore_globs(root: Path, extra: Iterable[str]) -> List[str]:
+    globs = [_line(g.rstrip(" "), "an --exclude glob") for g in extra]
+    ignore = root / IGNORE_FILE
+    try:
+        present = ignore.is_file()
+    except OSError:
+        raise CheckError("the folder cannot be read")
+    if present:
+        try:
+            data = ignore.read_bytes().decode("utf-8-sig")
+        except (OSError, UnicodeDecodeError):
+            raise CheckError("%s cannot be read as UTF-8" % IGNORE_FILE)
+        # as Git splits it: at LF, a trailing CR dropped, trailing spaces trimmed; a tab or a leading space is the line's
+        for number, line in enumerate(data.split("\n"), 1):
+            glob = (line[:-1] if line.endswith("\r") else line).rstrip(" ")
+            if glob and not glob.startswith("#"):
+                globs.append(_line(glob, "line %d of %s" % (number, IGNORE_FILE)))
+    return globs
+
+
+def _takes_folder(glob: str) -> bool:
+    """A line that names a folder takes all it holds: one ending in `/`, or a path with no wildcard (`vendor/lib`). A
+    wildcard line takes only what it matches: `vectors/*` the files in `vectors`, never `vectors/live/config.json`."""
+    return glob.endswith("/") or not any(c in glob for c in "*?[")
+
+
+def _under(path: str, glob: str) -> bool:
+    """Whether a folder above the path matches the line, read as a folder: `src/**/` takes `src/pkg/x`, never
+    `src/main.py` (joining the line with `/**` would read `**/` as no folder at all)."""
+    folder = _glob(glob.rstrip("/"))
+    return any(folder.match(path[:i]) for i, c in enumerate(path) if c == "/")
+
+
+def _ignored(path: str, globs: List[str], root: Optional[Path] = None) -> bool:
+    """Whether a line leaves the path out. A folder (a nested repository, which Git lists as `vendor/sub/`, or a
+    submodule, listed as `vendor/sub`) is left out only by a line that names it as a folder (`vendor/sub/`,
+    `vendor/sub`, or a wildcard folder line such as `vendor/*/`, which takes every one it reaches): a wildcard line
+    without the `/` takes files, so `vendor/*` reports a nested repository until it is checked in its own tree and
+    named. A line ending in `/` never takes a file of that name."""
+    on_disk = path.rstrip("/")
+    name = _name_bytes(on_disk)  # matched as Git matches: byte by byte, the bytes on disk
+    known: List[bool] = []
+
+    def folder() -> bool:
+        if not known:
+            known.append(path.endswith("/") or (root is not None and os.path.isdir(str(root / on_disk))
+                                                and not os.path.islink(str(root / on_disk))))
+        return known[0]
+
+    for g in globs:
+        if _takes_folder(g):
+            if _under(name, g):
+                return True
+            if _glob(g.rstrip("/")).match(name) and (not g.endswith("/") or folder()):
+                return True
+        elif _glob(g).match(name) and not folder():
+            return True
+    return False

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,10 +14,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.56.0"
+  version: "0.58.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "00e050ba7429c0c60261cec871779e0fd6aeeb28"
+  extension-commit: "3830a3353923e20f826d466610e1c479f120bec0"
 ---
 
 # Building Fabric services
@@ -321,7 +321,8 @@ the well-known document must answer again with a new pid within about 15 seconds
 
 To hand an agent to another machine or an organization, pack it as one folder (contract DEC-0050, DEC-0051). Write the
 author's `fabric.package.json` (the descriptive fields; for an agent `resultSignal` and `evals` with the receipt of the
-suite as packed), then:
+suite as packed), run `fabric_source_check.py check <folder> --every-file` (adapting-projects-to-fabric, Python) on the clean copy
+the package reference describes, then:
 
 ```bash
 python3 <skill-dir>/scripts/fabric_package.py pack <folder>            # or: node fabric-package.mjs, npx @passioncode-ai/fabric-agent-adapter pack

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -110,7 +110,9 @@ issuer's fault, `issuer-unavailable` (DEC-0045); a gate without a trusted issuer
 DEC-0121 adds three codes to the one set, each 403: `operator-decision-required` (a `relayed` action called without the
 operator's decision), `decision-invalid` (a decision for another action or object, outside its 24 hours, or malformed)
 and `human-step-required`, which carries `data.humanStep` (`sign-in`, `consent`, `payment`, `secret`,
-`spend-above-limit`, `passkey`) and `data.url` (an https URL or a path on the service's origin) beside `detail`.
+`spend-above-limit`, `passkey`, and since DEC-0142 `comparison`: a comparison of codes between two people or the choice
+to share without one; a reader pinned before DEC-0142 refuses a whole declaration that names it, and a caller that validates the refusal
+against a `delegation-refusal.schema.json` pinned before DEC-0142 refuses that refusal) and `data.url` (an https URL or a path on the service's origin) beside `detail`.
 `refusal_from_action` / `refusalFromAction` turn an action decision into that refusal; a service's own fault never
 reaches the caller and reads as `unknown-state`, but for `mandate-capability-missing` (DEC-0141 MJ-1): the caller
 reads `operator-decision-required` with that `data.detail`, since no mandate covers the step and only a decision does. Since 0.51.0 the `operator-decision-required` message (free text in

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md

@@ -161,7 +161,11 @@ dialog is one of those checks; an instruction that names the action satisfies it
 |---|---|---|
 | `none` | an act on the caller's own account: refresh, read, retry or cancel its own job | the caller's own act |
 | `relayed` | a decision on another party's proposal or draft, a send, a publish, a deletion, a spend within a limit, a restore, a policy change | the operator's act when a T0 or T1 caller carries a valid decision; else a refusal below |
-| `human` with `humanStep` | `sign-in`, `consent`, `payment`, `secret`, `spend-above-limit`, `passkey` (AP-4): they stay the person's | `human-step-required` with `data.humanStep` and `data.url`, the direct link to that step |
+| `human` with `humanStep` | `sign-in`, `consent`, `payment`, `secret`, `spend-above-limit`, `passkey`, `comparison` (a comparison of codes between two people or the choice to share without one, DEC-0142) (AP-4): they stay the person's | `human-step-required` with `data.humanStep` and `data.url`, the direct link to that step |
+
+Declare `comparison` only to readers at or after DEC-0142: a reader pinned before it (a 0.56.0 or older kit, Fabric
+Dashboards before 0.8.9) refuses the whole declaration, every action in it, and FAC-SEM-142 then reads it as not declared. Fabric's hub reads no declaration and forwards the step unchanged
+(CT-186).
 
 ```python
 server = fi.McpToolServer("example-agent", "1.0.0", jobs=jobs, authorize=gate,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md

@@ -42,6 +42,28 @@ python3 scripts/fabric_package.py pack <folder>           # a dry run: the packa
 python3 scripts/fabric_package.py pack <folder> --apply   # writes fabric.package.json when nothing is wrong
 ```
 
+Run `adapting-projects-to-fabric/scripts/fabric_source_check.py check <folder> --every-file` on the folder you pack first (a floor under your own
+review, not a secret scanner): a package carries
+the source, and the instance (the owner's paths, keys, strings) stays out of it (`references/source-and-instance.md` of
+that skill). `--every-file` reads what `pack` reads, files Git ignores included; without it the check reads only what Git
+would commit. A path named in `.fabric-source-ignore` or `--exclude` is still carried by `pack`, unread, so name only synthetic files
+there, and check a nested repository named there with `--every-file` in its own tree. Keep the signing key file
+outside the folder. Pack a clean copy: what Git would commit (`git ls-files --cached --others --exclude-standard`) plus the nested
+trees checked on their own, copied without their `.git` and with each committed symbolic link replaced or removed by where its resolved
+target is (`pack` refuses a link): a file or folder Git would commit in the tree being packed, or in a nested tree checked
+on its own, is copied in its place (a folder's committed files, each link inside it by the same rule; a file the ignore
+file names needs an ignore line of its own at the new path); a link whose target is a folder already being copied on
+the way to it (an ancestor, or a folder a link above it led into) is removed, so the copy ends; a target that leaves
+that tree or lies in what `.gitignore` keeps out, such as an instance folder in the checkout, is removed, since it is
+the instance or another project. Source the agent shares from outside the tree (a monorepo's common code, linked or
+imported by a relative path) is copied into the agent's tree at the path it is reached by and committed before
+packing. List each link removed and review it: a missing file is not seen by `pack` or `verify`. Leave out dependency
+folders (`node_modules`, virtual environments, which hold install paths and binaries), what `.gitignore` keeps out as
+instance (the real configuration, an instance folder in the checkout) and the files `pack` refuses by name (a
+credential-free `.npmrc` that `.fabric-source-ignore` names for the check included). `pack` does not read
+`.gitignore`, and an account id or a host is found only through the owner's list. The check is Python only (3.9+); a Node-only machine packs without it, and `pack` itself carries the kit's token files
+and a private `*.jwk` by their names: keep them in the instance.
+
 It refuses to list what must not ship, and names each: a symlink, a special file, `.git`, `__pycache__`, `.DS_Store`,
 `*.pyc`, and files that are credentials by name (`.env` and `.env.*` but `.env.example|sample|template`, `*.pem`, `*.key`,
 `*.p12`, `*.pfx`, `*.jks`, `*.keystore`, `id_rsa`-style keys, `.npmrc`, `.netrc`, `.pypirc`). Remove them or pack a clean

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1: wire reference
 
-Pinned to `fabric-agent-contract` commit `00e050ba7429c0c60261cec871779e0fd6aeeb28`
+Pinned to `fabric-agent-contract` commit `3830a3353923e20f826d466610e1c479f120bec0`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
@@ -23,8 +23,10 @@ DEC-0124; the operator's mandate `mandate/1`, handed on narrowed with a task DEC
 operator's agents, its `source` on a mandate and a decision DEC-0126; context hub keys and the organizations an estate
 record pins DEC-0127 and DEC-0128; the family and the agent network named DEC-0130 and DEC-0137; a reply delivered to
 the sender it answers, or to whom it names DEC-0135; a hand-over adds no naming list the scope in force leaves out
-DEC-0136; a job's step under the mandate read under the job's own capability DEC-0141. The organization's member list, draft exchange, relay and the machines' report, DEC-0129, DEC-0131 to DEC-0134,
-reach the kit only as protocol register entries). The contract's schemas are normative;
+DEC-0136; a job's step under the mandate read under the job's own capability DEC-0141; a person's comparison of codes as a human
+step DEC-0142. The organization's member list, draft exchange, relay and the machines' report, DEC-0129, DEC-0131 to
+DEC-0134 and DEC-0139, an organization's adaptation DEC-0138 and the peer share DEC-0142, reach the kit only as
+protocol register entries). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-actions.mjs

@@ -37,7 +37,8 @@ export const DECISION_INVALID = 'decision-invalid';
 export const HUMAN_STEP_REQUIRED = 'human-step-required';
 export const APPROVAL_REQUIRED = 'approval-required';
 export const GATES = Object.freeze(['none', 'relayed', 'human']);
-export const HUMAN_STEPS = Object.freeze(['sign-in', 'consent', 'payment', 'secret', 'spend-above-limit', 'passkey']);
+/** AP-4's steps a person takes; `comparison` (DEC-0142) is a comparison of codes between two people. */
+export const HUMAN_STEPS = Object.freeze(['sign-in', 'consent', 'payment', 'secret', 'spend-above-limit', 'passkey', 'comparison']);
 export const MAX_ACTIONS = 128;
 /** How far ahead of the service's clock a decision's `at` may be (the contract's CLOCK_SKEW_SECONDS). */
 export const CLOCK_SKEW_SECONDS = 60;

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-protocols.mjs

@@ -10,10 +10,12 @@ export const PROTOCOL_REVISIONS = new Map(Object.entries({
   'access-log': ['1'], approval: ['1'], 'activity-summary': ['1'], 'agent-directory': ['1'], 'call-record': ['1'], 'coding-agents': ['1'], 'credential-decision': ['1'], 'credential-request': ['1'], 'credential-revocation': ['1'], 'enroll-token': ['1'], entitlement: ['1'], 'entitlement-key-set': ['1'], 'estate-record': ['1'], 'execution-packet': ['1'],
   'fabric-actions': ['0.1'], 'fabric-activity': ['0.1'], 'fabric-agent-call': ['1'], 'fabric-connections': ['0.1'], 'fabric-credential-envelope': ['1'], 'fabric-load': ['0.1'], 'fabric-dashboard': ['0.1'], 'fabric-delegation': ['0.1'], 'fabric-device': ['0.1'],
   'fabric-interop': ['0.1', '0.2'], 'fabric-local-channel': ['0.1'], 'fabric-local-runner': ['0.1'], 'fabric-machine-report': ['1'], 'fabric-operator-channel': ['0.1'],
-  'fabric-package': ['1'], 'fabric-project-comms': ['0.1'], 'fabric-proposal': ['1'], 'fabric-provider': ['0.1'], 'fabric-relay': ['0.1'],
+  'fabric-package': ['1'],
+  'fabric-peer-share': ['1'], 'fabric-peer-share-envelope': ['1'], 'fabric-peer-share-report': ['1'], 'fabric-project-comms': ['0.1'], 'fabric-proposal': ['1'], 'fabric-provider': ['0.1'], 'fabric-relay': ['0.1'],
   'fabric-secret-envelope': ['1'], 'fabric-service': ['0.1'], 'fabric-settings-backup': ['1'], heartbeat: ['1'], 'learning-note': ['1'], 'machine-report': ['1'], mandate: ['1'],
-  memory: ['0.1'], 'node-summary': ['1'], 'operator-source': ['1'], 'org-authority': ['1'], 'org-authority-draft': ['1'],
-  'org-key-set': ['1'], 'org-key-set-draft': ['1'], 'org-membership': ['1'], 'org-root-registration': ['1'], 'pairing-message': ['1'], pipeline: ['0.1'], 'repair-request': ['1'], 'repair-result': ['1'],
+  memory: ['0.1'], 'node-summary': ['1'], 'operator-source': ['1'], 'org-adaptation': ['1'], 'org-adaptation-receipt': ['1'], 'org-authority': ['1'], 'org-authority-draft': ['1'],
+  'org-key-set': ['1'], 'org-key-set-draft': ['1'], 'org-membership': ['1'], 'org-root-registration': ['1'], 'pairing-message': ['1'],
+  'peer-share-deletion': ['1'], 'peer-share-frame': ['1'], 'peer-share-revocation': ['1'], pipeline: ['0.1'], 'repair-request': ['1'], 'repair-result': ['1'],
   'revocation-delta': ['1'], 'session-handoff': ['1'], 'service-load': ['1'],
   'share-registration': ['1'], 'share-registration-receipt': ['1'], 'support-quality-daily': ['1'], 'window-lease': ['1'],
 }));

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_actions.py

@@ -51,7 +51,8 @@ DECISION_INVALID = "decision-invalid"
 HUMAN_STEP_REQUIRED = "human-step-required"
 APPROVAL_REQUIRED = "approval-required"
 GATES = ("none", "relayed", "human")
-HUMAN_STEPS = ("sign-in", "consent", "payment", "secret", "spend-above-limit", "passkey")
+#: AP-4's steps a person takes; `comparison` (DEC-0142) is a comparison of codes between two people.
+HUMAN_STEPS = ("sign-in", "consent", "payment", "secret", "spend-above-limit", "passkey", "comparison")
 MAX_ACTIONS = 128
 #: How far ahead of the service's clock a decision's `at` may be (the contract's CLOCK_SKEW_SECONDS).
 CLOCK_SKEW_SECONDS = 60

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_protocols.py

@@ -17,11 +17,13 @@ PROTOCOL_REVISIONS: Dict[str, Tuple[str, ...]] = {
     "entitlement-key-set": ("1",), "estate-record": ("1",), "execution-packet": ("1",),
     "fabric-actions": ("0.1",), "fabric-activity": ("0.1",), "fabric-agent-call": ("1",), "fabric-connections": ("0.1",), "fabric-credential-envelope": ("1",), "fabric-load": ("0.1",), "fabric-dashboard": ("0.1",), "fabric-delegation": ("0.1",), "fabric-device": ("0.1",),
     "fabric-interop": ("0.1", "0.2"), "fabric-local-channel": ("0.1",), "fabric-local-runner": ("0.1",), "fabric-machine-report": ("1",),
-    "fabric-operator-channel": ("0.1",), "fabric-package": ("1",), "fabric-project-comms": ("0.1",), "fabric-proposal": ("1",),
+    "fabric-operator-channel": ("0.1",), "fabric-package": ("1",),
+    "fabric-peer-share": ("1",), "fabric-peer-share-envelope": ("1",), "fabric-peer-share-report": ("1",), "fabric-project-comms": ("0.1",), "fabric-proposal": ("1",),
     "fabric-provider": ("0.1",), "fabric-relay": ("0.1",), "fabric-secret-envelope": ("1",), "fabric-service": ("0.1",),
     "fabric-settings-backup": ("1",), "heartbeat": ("1",), "learning-note": ("1",), "machine-report": ("1",), "mandate": ("1",), "memory": ("0.1",), "node-summary": ("1",),
-    "operator-source": ("1",), "org-authority": ("1",), "org-authority-draft": ("1",), "org-key-set": ("1",), "org-key-set-draft": ("1",),
+    "operator-source": ("1",), "org-adaptation": ("1",), "org-adaptation-receipt": ("1",), "org-authority": ("1",), "org-authority-draft": ("1",), "org-key-set": ("1",), "org-key-set-draft": ("1",),
     "org-membership": ("1",), "org-root-registration": ("1",), "pairing-message": ("1",),
+    "peer-share-deletion": ("1",), "peer-share-frame": ("1",), "peer-share-revocation": ("1",),
     "pipeline": ("0.1",), "repair-request": ("1",), "repair-result": ("1",), "revocation-delta": ("1",), "session-handoff": ("1",), "service-load": ("1",), "share-registration": ("1",),
     "share-registration-receipt": ("1",), "support-quality-daily": ("1",), "window-lease": ("1",),
 }