@passioncode-ai/fabric-agent-adapter 0.59.0 → 0.61.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-link.mjs

@@ -6,6 +6,9 @@ import path from 'node:path';
 import { HubError, MCP_PROTOCOL_VERSION, postMcp, toolAnswer } from './fabric-hub.mjs';
 import { atomicWrite, ensurePrivateDir } from './fabric-service.mjs';
 import { BoardError, RESPOND_TOOLS, isObj, refusalProblems } from './fabric-board-shapes.mjs';
+import { UNREADABLE_PROJECT, mandateSpend } from './fabric-interop-rules.mjs'; // FAA-139
+import { isAgentId, mandateCovers } from './fabric-mandate.mjs';
+import { formatRfc3339 } from './fabric-time.mjs';
 
 /** MCP over HTTP with a board session's one-session bearer; calls are serialised; close() sends the session's DELETE. */
 export class BoardSession {
@@ -179,4 +182,118 @@ export class BoardRequest {
   toJSON() {
     return { requestId: this.requestId, capability: this.capability }; // never the body
   }
+  [Symbol.for('nodejs.util.inspect.custom')]() {
+    return this.toJSON(); // console.log(request) prints no body either
+  }
+}
+
+// -- the operator's mandate in a board request (FAA-135; contract project-comms.md, DEC-0125 MD-3) ---------------------
+
+/** `mandateFrom` naming every trusted sender of the board the service is installed on: the operator's personal board. */
+export const PERSONAL_BOARD = 'personal-board';
+const OPENER = /^```json[ \t]*$/;
+const CLOSER = /^```[ \t]*$/;
+
+/**
+ * The bodies of the ```json blocks, each fence on its own line: one pass over the lines, linear in the body. Lines end
+ * at "\\n" alone, one "\\r" before it dropped, as in the Python twin (never U+2028 or a lone "\\r"); an unclosed
+ * opener ends the scan.
+ */
+function jsonBlocks(body) {
+  const lines = body.split('\n').map((line) => (line.endsWith('\r') ? line.slice(0, -1) : line));
+  const blocks = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    if (!OPENER.test(lines[i])) continue;
+    let j = i + 1;
+    while (j < lines.length && !CLOSER.test(lines[j])) j += 1;
+    if (j === lines.length) break;
+    blocks.push(lines.slice(i + 1, j).join('\n'));
+    i = j;
+  }
+  return blocks;
+}
+const UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/** A Project id as Fabric's board compares it: a uuid lower-cased, any other id as written (normalProject). */
+const fold = (project) => (UUID.test(project) ? project.toLowerCase() : project);
+
+/**
+ * The mandate a request carries, read only when the service opted in (`agentId` and `mandateFrom` set), the board
+ * verified the sender (`provenance: trusted`) and its Project is one `mandateFrom` names (or `PERSONAL_BOARD`): a T1
+ * caller by project-comms. Answers `{ mandate, unread }`: `mandate` null when none is read, `unread` `mandate-blocks`
+ * (more than one) or `mandate-unreadable` (a block naming `mandate/1` that is not JSON). A `source` in the block is
+ * dropped: a board block carries none (OA-7).
+ */
+export function readMandate(request, mandateFrom, agentId) {
+  const none = { mandate: null, unread: null };
+  if (agentId == null || mandateFrom == null || typeof request.body !== 'string') return none;
+  const sender = isObj(request.sender) ? request.sender : {};
+  const principal = isObj(sender.principal) ? sender.principal : {};
+  if (principal.provenance !== 'trusted') return none;
+  if (typeof sender.project !== 'string' || !sender.project) return none; // comms-message requires it; the caller
+  if (mandateFrom !== PERSONAL_BOARD && !mandateFrom.has(fold(sender.project))) return none;
+  const found = [];
+  for (const block of jsonBlocks(request.body)) {
+    let value;
+    try {
+      value = JSON.parse(block);
+    } catch {
+      if (block.includes('mandate/1')) return { mandate: null, unread: 'mandate-unreadable' };
+      continue;
+    }
+    if (isObj(value) && value.kind === 'mandate/1') {
+      delete value.source; // a Project declares no protocols: a board block carries no source (OA-7)
+      found.push(value);
+    }
+  }
+  if (found.length > 1) return { mandate: null, unread: 'mandate-blocks' };
+  return found.length ? { mandate: found[0], unread: null } : none;
 }
+
+/**
+ * `mandateCovers` for a call under a board request's mandate, its sender placed as T1 and no caller agent id (the
+ * chain's end alone binds it, MD-3). A covered answer's `recordAs` names `caller`, the sender Project the board
+ * verified (MD-3 records the caller). `wall` answers milliseconds. Null when no mandate travelled. `spendUsd` and
+ * `project` are read failing closed, as the kit's other mandate readers read them (FAA-139): a spend that is not a
+ * finite number is none (a ceiling refuses it), a `project` that is not a string, null included (the contract's
+ * mandateCovers refuses a null project), unreadable; a call that names none leaves `project` out. Only the five
+ * members mandateCovers reads are read, each once: a spend as an own member (an inherited one is none, which a ceiling
+ * refuses), a capability, action, effect and project as the contract reads them, a plain [[Get]] whose undefined is
+ * absent (an inherited, non-enumerable, getter or Proxy member included); the rest of the call is never touched. A
+ * getter whose value changes is answered on its one read.
+ */
+export function covers(mandate, call, agentId, wall, caller = null) {
+  if (mandate == null || agentId == null) return null;
+  if (call !== null && typeof call === 'object' && !Array.isArray(call)) {
+    const read = {};
+    for (const key of ['capability', 'action', 'effect']) {
+      const value = call[key]; // the contract's read: whatever [[Get]] answers, undefined being absent
+      if (value !== undefined) read[key] = value;
+    }
+    const spend = mandateSpend(Object.hasOwn(call, 'spendUsd') ? call.spendUsd : undefined);
+    if (spend !== undefined) read.spendUsd = spend;
+    const project = call.project;
+    if (project !== undefined) read.project = typeof project === 'string' ? project : UNREADABLE_PROJECT;
+    call = read;
+  }
+  const clock = wall();
+  let now = '';
+  try {
+    if (typeof clock === 'number' && Number.isFinite(clock)) now = formatRfc3339(clock);
+  } catch { // finite but outside the dates a clock can name
+    now = '';
+  }
+  const answer = mandateCovers({ mandate, tier: 'T1', now, self: agentId, call });
+  return answer.recordAs ? { ok: true, recordAs: { ...answer.recordAs, caller } } : answer;
+}
+
+/** The responder's opt-in, checked: answers `mandateFrom` as the responder keeps it (a Set or the string). */
+export function mandateOptions(agentId, mandateFrom) {
+  if (agentId != null && !isAgentId(agentId)) throw new BoardError('invalid_arguments', 'agentId must be the service\'s registry agent id.');
+  if (mandateFrom == null || mandateFrom === PERSONAL_BOARD) return mandateFrom ?? null;
+  const projects = typeof mandateFrom === 'string' || mandateFrom instanceof String || typeof mandateFrom?.[Symbol.iterator] !== 'function' ? null : [...mandateFrom];
+  if (projects === null || !projects.every((p) => typeof p === 'string' && p)) {
+    throw new BoardError('invalid_arguments', `mandateFrom is '${PERSONAL_BOARD}' or a collection of Project ids.`);
+  }
+  return new Set(projects.map(fold));
+}
+

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-session.mjs

@@ -5,10 +5,10 @@ import crypto from 'node:crypto';
 import { Backoff, HubError, normalProject } from './fabric-hub.mjs';
 import { acceptedRevisions, feedDataProblems, negotiateRevision } from './fabric-service.mjs';
 import { BoardError, CAPABILITY, LEASE_SECONDS, REQUEST_STATES, SUMMARY_MAX, Stopped, isInt, isObj, outcomeProblems, receiptProblems } from './fabric-board-shapes.mjs';
-import { BoardRequest, BoardSession, Checkpoint } from './fabric-board-link.mjs';
+import { BoardRequest, BoardSession, Checkpoint, PERSONAL_BOARD, covers, mandateOptions, readMandate } from './fabric-board-link.mjs';
 import { HOLD_RETRY_MAX_SECONDS, LEASE_MARGIN_SECONDS, SESSION_CODES, SlotKeeper } from './fabric-board-slots.mjs';
 
-export { BoardRequest, BoardSession, Checkpoint }; // re-exported: callers import them from here since 0.40.0
+export { BoardRequest, BoardSession, Checkpoint, PERSONAL_BOARD }; // re-exported: callers import them from here since 0.40.0
 export { HOLD_RETRY_MAX_SECONDS, LEASE_MARGIN_SECONDS, SESSION_CODES }; // since 0.56.0 defined in fabric-board-slots.mjs
 
 export const RENEW_SECONDS = 20;
@@ -34,10 +34,23 @@ const NOT_OURS = new Set(['queued', 'claimed', 'answered']);
 export class WorkContext {
   #responder;
   #entry;
-  constructor(responder, entry) {
+  #caller;
+  constructor(responder, entry, mandate = null, caller = null) {
     this.#responder = responder;
     this.#entry = entry;
+    this.#caller = caller;
     this.stopped = false;
+    this.mandate = mandate; // the operator's mandate the request carried, when the responder reads one (FAA-135)
+  }
+  /** Whether the request's mandate covers `call` (`mandateCovers`' answer); null when none travelled. */
+  mandateCovers(call) {
+    return covers(this.mandate, call, this.#responder.agentId, this.#responder.wall, this.#caller);
+  }
+  toJSON() {
+    return { stopped: this.stopped }; // never the mandate: it holds the operator's words
+  }
+  [Symbol.for('nodejs.util.inspect.custom')]() {
+    return this.toJSON(); // console.log(ctx) prints no mandate either
   }
   async progress(note) {
     if (this.stopped) throw new Stopped();
@@ -69,13 +82,15 @@ function noticeSubject(value, project, episode) {
  */
 export class Responder extends SlotKeeper {
   constructor({ hub, projectId, capabilities, credentialFile, checkpointFile, handler, admit, observe, emit, service = 'service',
-    now = () => performance.now() / 1000, rand = Math.random, sessionFactory } = {}) {
+    now = () => performance.now() / 1000, rand = Math.random, sessionFactory, agentId = null, mandateFrom = null, wall = Date.now } = {}) {
     super();
     if (typeof admit !== 'function' || typeof handler !== 'function') throw new BoardError('invalid_arguments', 'A responder needs the service\'s own input gate (admit) and a handler.');
     const caps = [...(capabilities ?? [])];
     if (!caps.length || caps.some((c) => typeof c !== 'string' || !CAPABILITY.test(c)) || new Set(caps).size !== caps.length) throw new BoardError('invalid_arguments', 'Name each capability once, [a-z][a-z0-9._-]{1,127}.');
     Object.assign(this, { hub, capabilities: caps, credentialFile, handler, admit, observe, emitTo: emit, now, rand });
     this.project = normalProject(projectId);
+    // FAA-135: read the operator's mandate from a trusted request of his own Project (opt-in; null reads none)
+    Object.assign(this, { mandateFrom: mandateOptions(agentId, mandateFrom), agentId: agentId ?? null, wall });
     this.service = String(service).replace(/[^A-Za-z0-9._-]/g, '-').slice(0, 40) || 'service';
     this.checkpoint = new Checkpoint(checkpointFile);
     this.sessionFactory = sessionFactory ?? ((grant) => new BoardSession(grant));
@@ -88,6 +103,7 @@ export class Responder extends SlotKeeper {
     this.waitUntil = 0;
     this.stopping = false;
     this.claimKeys = {};
+    this.probing = new Set(); // moved slots whose move-back claim lost its answer: asked again under the same key
     this.said = {};
     this.rr = 0;
     this.reconcileAt = 0;
@@ -172,6 +188,7 @@ export class Responder extends SlotKeeper {
     this.state = 'connecting';
     this.slots = {}; // the previous session's slots are not this one's: a refusal now reconnects (FAA-163)
     this.confirmed = {}; // nor its confirmations: a slot may have moved between the two sessions
+    this.probing = new Set(); // nor its lost move-back claims
     const grant = await this.hub.joinBoard(this.project, this.credentialFile);
     const missing = this.capabilities.filter((c) => !grant.capabilities.includes(c));
     const session = this.sessionFactory(grant);
@@ -462,7 +479,9 @@ export class Responder extends SlotKeeper {
   /** Seconds this session's leases still run, by its own clock: the running attempt's, else the oldest held slot's. */
   leaseLeft() {
     const renewed = this.current ? [this.current.renewedAt ?? 0]
-      : Object.values(this.slots).filter((s) => s.state === 'held' && s.renewedAt !== -Infinity).map((s) => s.renewedAt ?? 0); // a lapsed slot holds no lease (FAA-163)
+      : [...Object.values(this.slots).filter((s) => s.state === 'held' && s.renewedAt !== -Infinity).map((s) => s.renewedAt ?? 0), // a lapsed slot holds no lease (FAA-163)
+        ...Object.entries(this.slots).filter(([c, s]) => this.probing.has(c) && 'probeAt' in s && this.now() - s.probeAt < LEASE_SECONDS - LEASE_MARGIN_SECONDS)
+          .map(([, s]) => s.probeAt)]; // a move-back claim whose answer was lost holds one from its send, while more than the 10 s margin of that lease is left (FAA-165)
     return renewed.length && this.session ? Math.min(...renewed) + LEASE_SECONDS - this.now() : 0;
   }
 
@@ -528,7 +547,10 @@ export class Responder extends SlotKeeper {
       this.suspect.delete(capability);
     }
     for (const [capability, slot] of Object.entries(this.slots)) {
-      if (slot.state === 'moved') continue; // never enrolled again on its own, even when the new holder's lease lapses (FAA-155)
+      if (slot.state === 'moved') { // never enrolled again on its own, even when the new holder lapses (FAA-155)
+        if (this.now() - (slot.renewedAt ?? 0) >= RENEW_SECONDS - 0.5) await this.movedBack(capability); // unless com.status shows a later generation it may hold (FAA-165)
+        continue;
+      }
       if (slot.state === 'paused') {
         // still held: a longer pause; lifted: the slot is ours again
         if (capability !== heldByWork && this.now() >= (slot.retryAt ?? 0) && !(await this.gone(capability))) await this.enroll(capability); // a move is read first
@@ -672,7 +694,11 @@ export class Responder extends SlotKeeper {
   }
 
   async runWork(entry, request) {
-    const ctx = new WorkContext(this, entry);
+    const { mandate, unread } = readMandate(request, this.mandateFrom, this.agentId);
+    if (unread) { // by its code alone: the block holds the operator's words
+      this.emit('board.request.mandate_unread', 'warning', `Request ${entry.request} carries a mandate the kit does not read (${unread}); it is worked without one.`, { request: entry.request, reason: unread });
+    }
+    const ctx = new WorkContext(this, entry, mandate, isObj(request.sender) ? request.sender.project ?? null : null);
     const work = { entry, request, ctx, done: false, outcome: null, failure: null, renewedAt: this.now() };
     this.current = work;
     work.promise = Promise.resolve().then(() => this.handler(request, ctx)).then((outcome) => { work.outcome = outcome; }, (e) => { work.failure = e; }).finally(() => { work.done = true; });

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-slots.mjs

@@ -16,6 +16,8 @@ export const HOLD_RETRY_MAX_SECONDS = 900;
 export const SESSION_CODES = Object.freeze(new Set(['unreachable', 'session-ended', 'not_authorized', 'authority_changed', 'credential', 'no-epoch',
   'schema-unsupported', 'checkpoint', 'receipt-shape', 'idempotency_conflict', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol', 'not_available']));
 
+const sameRecord = (a, b) => JSON.stringify(a ?? {}) === JSON.stringify(b ?? {});
+
 /** The slot methods of Responder, which owns every field they read (checkpoint, slots, project, locked). */
 export class SlotKeeper {
   // -- a slot moved to another session (FAA-155, DEC-0140 PR-2) --
@@ -127,13 +129,88 @@ export class SlotKeeper {
     this.toResume = this.toResume.filter((r) => this.checkpoint.entries[r]?.capability !== capability);
     this.slots[capability] = { state: 'moved', generation: now, renewedAt: this.now() };
     delete this.confirmed[capability];
+    delete this.claimKeys[capability]; // the move returned that claim to the queue: its receipt is dead
     if (!('moved' in held)) { // once, even across restarts
-      this.emit('board.slot.moved', 'warning', `The ${capability} slot on this Project moved to another session. This service stopped answering it there and left its accepted work \`accepted\` (work begun is the new holder's to settle). Its take-back action brings the slot back once the other session lets it go, or at a later restart or reconnect while accepted work waits; a restart alone does not. Without it, ask its maintainer.`, { notify: true, episode: capability, capability, generation: now, held: held.generation });
+      this.emit('board.slot.moved', 'warning', `The ${capability} slot on this Project moved to another session. This service stopped answering it; accepted work stays \`accepted\` (work begun is the new holder's). The operator brings it back by take-back (once the other session lets it go, or at a restart with accepted work waiting; a restart alone does not) or, where Fabric offers it, a move back here. Else ask its maintainer.`, { notify: true, episode: capability, capability, generation: now, held: held.generation });
       this.note(capability, { ...held, moved: now }); // said again at the next start if it cannot be written
     }
     return true;
   }
 
+  /**
+   * A moved slot asked about once per later generation (FAA-165): the operator may move it back to this session
+   * (DEC-0140 PR-2), which this client cannot hear, so when com.status shows a generation past the recorded move, one
+   * com.claim asks whether the slot is its own. A claim that lands makes it held again and starts what it handed out; a
+   * lease_expired one (the move reached this session but its lease lapsed) enrolls again; a fenced one is another
+   * session's, recorded so the same generation is not asked about twice. Never an enroll or a replace on a slot another
+   * session holds: a slot moved off stays off unless it is handed back.
+   */
+  async movedBack(capability) {
+    if (this.current || this.stopping) return; // a claim now could hand out a second request, or start work while the responder stops
+    const held = this.checkpoint.slots[capability] ?? {};
+    if (held.project !== this.project || !isInt(held.moved, 1)) return;
+    if (this.slots[capability]) this.slots[capability].renewedAt = this.now();
+    const now = ((await this.status()).responders ?? []).find((r) => isObj(r) && r.capability === capability)?.generation;
+    if (!isInt(now, 1) || now <= held.moved) return;
+    if (!this.probing.has(capability) || !this.claimKeys[capability]) { // a fresh key: one from before the move may hold a dead receipt
+      this.claimKeys[capability] = this.key('claim');
+      if (this.slots[capability]) delete this.slots[capability].probeAt; // and a send time of its own
+    }
+    let answer;
+    const sent = this.now();
+    try {
+      answer = this.receipt('com.claim', await this.call('com.claim', { idempotency: this.idem(this.claimKeys[capability]), capability }));
+    } catch (e) {
+      if (!(e instanceof BoardError)) throw e; // not the board's answer
+      if (e.code === 'unreachable') { // the claim may have landed: asked again under this key, never left to the fault
+        this.probing.add(capability);
+        if (this.slots[capability] && !('probeAt' in this.slots[capability])) this.slots[capability].probeAt = sent; // its lease runs from the first send
+        return;
+      }
+      this.probing.delete(capability);
+      if (e.code === 'held') return; // the operator's hold: asked again at the next renewal
+      if (e.code === 'idempotency_window_expired' || e.code === 'capacity_exceeded') {
+        delete this.claimKeys[capability];
+        return;
+      }
+      if (e.code === 'lease_expired') {
+        delete this.claimKeys[capability]; // a dead attempt's receipt may sit under it
+        if (await this.back(capability, held, now)) {
+          this.slots[capability].renewedAt = -Infinity; // lapsed: the enroll below is recorded first
+          await this.enroll(capability);
+        }
+        return;
+      }
+      if (SESSION_CODES.has(e.code) && e.code !== 'not_authorized') throw e; // the board session's fault, not this slot's
+      // fenced, or another refusal of this claim: not this session's slot at this generation; a takeBack meanwhile wins (FAA-158)
+      await this.locked(() => { if (sameRecord(this.checkpoint.slots[capability], held)) this.note(capability, { ...held, moved: now }); });
+      return;
+    }
+    this.probing.delete(capability);
+    const generation = isObj(answer.attempt) && isInt(answer.attempt.generation, 1) ? answer.attempt.generation : now;
+    if (generation < now) { // a replay from before a later move: dead, asked again fresh
+      delete this.claimKeys[capability];
+      return;
+    }
+    if (!(await this.back(capability, held, generation))) return;
+    if ('request' in answer) {
+      delete this.claimKeys[capability];
+      this.slots[capability].renewedAt = this.now(); // the claim just landed: its lease runs (finding 38)
+      await this.start(capability, answer);
+    } else await this.enroll(capability); // renewed now: whether an empty com.claim renews the lease is not the contract's to say
+  }
+
+  /** The slot is this session's again at `generation`: held, its record rewritten without the move (FAA-165). */
+  back(capability, held, generation) {
+    return this.locked(() => {
+      if (!sameRecord(this.checkpoint.slots[capability], held)) return false; // a takeBack forgot it; its own next tick enrolls
+      this.slots[capability] = { state: 'held', generation, renewedAt: -Infinity }; // no lease yet
+      this.heldAt(capability, generation);
+      delete this.said['board.slot.moved']; // a later move is said again
+      return true;
+    });
+  }
+
   /**
    * The operator's act, never the kit's: forget that a capability's slot moved away. In the same board session the next
    * tick enrolls once the slot is free; a reconnect with held work takes it back at once by a transfer (FAA-155).
@@ -141,6 +218,8 @@ export class SlotKeeper {
   takeBack(capability) {
     if (!this.capabilities.includes(capability)) throw new BoardError('invalid_arguments', `This responder does not answer ${capability}.`);
     this.checkpoint.slot(capability, null);
+    delete this.claimKeys[capability]; // a receipt from before the take-back may be dead
+    this.probing.delete(capability);
     if (this.slots[capability]?.state === 'moved') this.slots[capability] = { state: 'contested', renewedAt: 0 };
     delete this.said['board.slot.moved'];
   }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board.mjs

@@ -37,6 +37,7 @@ export {
   BoardRequest,
   WorkContext,
   Responder,
+  PERSONAL_BOARD,
 } from './fabric-board-session.mjs';
 export {
   selfCheck,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-interop-rules.mjs

@@ -282,6 +282,16 @@ export function mandateSpend(value) {
   return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
 }
 
+/** A job's approval step {effect, spendUsd?, project?} as a job file keeps it: read as the gate reads it, so a job's
+ * start and its answer agree (0.61.0 seam reading 32, readings 33 and 34): a spend through mandateSpend (dropped when none), a project
+ * as a primitive string, else UNREADABLE_PROJECT (dropped when null or undefined). */
+export function keptStep(step) {
+  const { effect, spendUsd, project } = step; // each member read once (seam reading 34)
+  const spend = mandateSpend(spendUsd);
+  return { effect, ...(spend !== undefined ? { spendUsd: spend } : {}),
+    ...(project !== undefined && project !== null ? { project: typeof project === 'string' ? project : UNREADABLE_PROJECT } : {}) };
+}
+
 export function actionGate({ action, tier, caller, meta, target, elicited = false, approval, actionDigest, humanStepUrl, now, self, effect, callerAgent, spendUsd, project, mandateCapability } = {}) {
   const inputs = { action, tier, caller, elicited: elicited === true, now };
   if (isObject(meta) && Object.hasOwn(meta, 'decision')) inputs.decision = meta.decision;

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-interop.mjs

@@ -41,6 +41,7 @@ export {
   jobStep,
   actionGate,
   mandateSpend,
+  keptStep,
   UNREADABLE_PROJECT,
   actionRefusalToolResult,
   usageFindings,
@@ -49,7 +50,7 @@ export {
   pauseMessage,
   repeatedKeyDecision,
 } from './fabric-interop-rules.mjs';
-import { PROTOCOL, EXTENSION_KEY, MCP_REVISION, TERMINAL, CONTRACT_VERSION, JOB_HANDLE_SCHEMA, InteropError, UnknownJob, parseTraceparent, childTraceparent, traceIds, QUOTA_EXHAUSTED, QUEUE_FULL, OUTCOME_UNKNOWN, LIMIT_REACHED, INTEROP_NULL_USAGE, PROTOCOLS_READ, utcTime, quotaDataOk, readJobPause, jobCallerAction, intentIdempotencyKey, readsNullUsage, requestMeta, usageFindings, usageToward, jobLimitRules, pauseMessage, repeatedKeyDecision, OUTCOMES, ENVELOPE_REQUIRED, JOB_ID, KEY, SECRET_WORDS } from './fabric-interop-rules.mjs'; // the rule layer (FAA-92)
+import { PROTOCOL, EXTENSION_KEY, MCP_REVISION, TERMINAL, CONTRACT_VERSION, JOB_HANDLE_SCHEMA, InteropError, UnknownJob, parseTraceparent, childTraceparent, traceIds, QUOTA_EXHAUSTED, QUEUE_FULL, OUTCOME_UNKNOWN, LIMIT_REACHED, INTEROP_NULL_USAGE, PROTOCOLS_READ, utcTime, quotaDataOk, readJobPause, jobCallerAction, intentIdempotencyKey, readsNullUsage, requestMeta, usageFindings, usageToward, jobLimitRules, pauseMessage, repeatedKeyDecision, keptStep, OUTCOMES, ENVELOPE_REQUIRED, JOB_ID, KEY, SECRET_WORDS } from './fabric-interop-rules.mjs'; // the rule layer (FAA-92)
 
 // --- C3.1 capabilities as tools ----------------------------------------------------------
 export function expectedAnnotations(effect, idempotency) {
@@ -266,23 +267,28 @@ export class JobStore {
 
   // `steps` (DEC-0125) maps a request key to the approval step it asks for, {effect, spendUsd?, project?}, kept in the
   // job's private part (the format fabric_interop.py writes) so a service reads an answer's _meta.mandate for that step.
+  // A step is kept as the gate reads it (keptStep), so a job's start and its answer agree.
   requestInput(jobId, inputRequests, statusMessage, { steps } = {}) {
+    const entries = Object.entries(inputRequests ?? {});
+    if (!entries.length || Array.isArray(inputRequests) || typeof inputRequests !== 'object') throw new InteropError('input_required needs a JSON object of at least one input request.'); // a JSON object of requests, first (unit 38, 40)
+    const kept = Object.create(null); // the value checked is the value kept (seam 34); a key __proto__ stays a key (35)
     for (const [key, step] of Object.entries(steps ?? {})) {
-      if (!Object.hasOwn(inputRequests ?? {}, key) || !EFFECT_CLASSES.includes(step?.effect)) throw new InteropError(`Step ${key}: an input request's key with its effect class (DEC-0125).`);
+      kept[key] = Object.hasOwn(inputRequests, key) && step !== null && step !== undefined ? keptStep(step) : {};
+      if (!EFFECT_CLASSES.includes(kept[key].effect)) throw new InteropError(`Step ${key}: an input request's key with its effect class (DEC-0125).`);
     }
-    const entries = Object.entries(inputRequests ?? {});
-    if (!entries.length) throw new InteropError('input_required needs at least one input request.');
-    for (const [key, request] of entries) if (!KEY.test(key) || request?.method !== 'elicitation/create') throw new InteropError(`Input request ${key} must be a keyed elicitation/create request.`);
+    for (const [key, request] of entries) if (!KEY.test(key) || request === null || typeof request !== 'object' || Array.isArray(request) || request.method !== 'elicitation/create') throw new InteropError(`Input request ${key} must be a keyed elicitation/create request.`);
     const [finding] = inputRequestLinkFindings({ inputRequests }); // FAC-SEM-143 (D12)
     if (finding) throw new InteropError(`${finding.instancePath}: ${finding.message}`);
-    return this.transition(jobId, 'input_required', { inputRequests, statusMessage }, { steps: { ...(steps ?? {}) } });
+    return this.transition(jobId, 'input_required', { inputRequests, statusMessage }, { steps: kept });
   }
 
   answer(jobId, inputResponses) {
     const job = this.get(jobId);
     if (job.status !== 'input_required') return {};
-    const matched = Object.fromEntries(Object.entries(inputResponses ?? {}).filter(([key, value]) =>
-      key in (job.inputRequests ?? {}) && ['accept', 'decline', 'cancel'].includes(value?.action)));
+    const plain = (value) => value !== null && typeof value === 'object' && !Array.isArray(value); // as Python's dict (seam r37)
+    const asked = plain(job.inputRequests) ? job.inputRequests : {};
+    const matched = Object.fromEntries(Object.entries(plain(inputResponses) ? inputResponses : {}).filter(([key, value]) =>
+      Object.hasOwn(asked, key) && ['accept', 'decline', 'cancel'].includes(value?.action))); // an asked key, never an inherited name (seam 36)
     // The answered question's kept steps go in the same write: none outlives its answer.
     if (Object.keys(matched).length) this.transition(jobId, 'working', {}, { steps: {} });
     return matched;

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-lock.mjs

@@ -43,9 +43,19 @@ export class InstanceLock {
         if (error.code === 'EAGAIN' || error.code === 'EWOULDBLOCK') throw new AlreadyRunning(readPid(this.path), this.path);
         throw error;
       }
-      fs.ftruncateSync(this.fd, 0);
-      fs.writeSync(this.fd, String(process.pid));
-      fs.fsyncSync(this.fd);
+      try {
+        fs.ftruncateSync(this.fd, 0);
+        fs.writeSync(this.fd, String(process.pid));
+        fs.fsyncSync(this.fd);
+      } catch (error) { // a full disk or an I/O error: let the lock go, or nobody can (the caller drops this object)
+        const fd = this.fd;
+        this.fd = null;
+        try {
+          fs.closeSync(fd);
+        } catch { // a deferred write error (NFS) at the close: the lock still goes, the first error stands
+        }
+        throw error;
+      }
       return this;
     }
     // Linux: an abstract unix socket; Windows: a named pipe. Each is exclusive, has no file, and dies
@@ -66,7 +76,17 @@ export class InstanceLock {
       this.server.listen(name, resolve);
     });
     this.server.unref();
-    atomicWrite(this.path, String(process.pid));
+    try {
+      atomicWrite(this.path, String(process.pid));
+    } catch (error) { // as on macOS: the name is let go with the failed write, the first error standing
+      const server = this.server;
+      this.server = null;
+      try {
+        server.close();
+      } catch { // nothing to add to the first error
+      }
+      throw error;
+    }
     return this;
   }
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-mandate.mjs

@@ -45,6 +45,9 @@ export const OPERATOR_SOURCE_PROTOCOL = 'operator-source/1';
 const SCOPE_MEMBERS = new Set(['capabilities', 'actions', 'effects', 'perCallMaxUsd', 'projects']);
 const STEP_MEMBERS = new Set(['agent', 'at', 'scope']);
 const AGENT_ID = /^[a-z][a-z0-9-]{1,62}(\.[a-z][a-z0-9-]{0,31})?$/; // common.schema.json agentId
+
+/** A registry agent id (common.schema.json agentId): a provider or service id, optionally `.instance`. */
+export const isAgentId = (value) => typeof value === 'string' && AGENT_ID.test(value);
 const CAPABILITY = /^[a-z][a-z0-9._-]{1,127}$/; // common.schema.json capabilityName
 const REQUEST_KEY = /^[A-Za-z0-9_.-]{1,64}$/; // interop-common.schema.json requestKey
 const PROJECT = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-package.mjs

@@ -504,12 +504,17 @@ export function compose(draft, files) {
   return { pkg, notes };
 }
 
+/** What a folder problem means, where its code alone does not say what to change (FAA-193). */
+const FOLDER_MESSAGES = {
+  'provider-manifest': 'provider-manifest: the provider manifest must be a JSON object, and when it carries costPresets fabric.package.json must carry the same costPresets (copy them; pack does not)',
+};
+
 function allProblems(pkg, files) {
   return [
     ...schemaProblems(pkg).map((p) => ({ ...p, rule: 'schema' })),
     ...pathProblems(pkg).map((p) => ({ ...p, rule: 'path' })),
     ...packageFindings(pkg).map((p) => ({ ...p, rule: p.code })),
-    ...checkPackageFolder(pkg, files).map((p) => ({ rule: 'folder', problem: p.problem, instancePath: p.path, message: p.problem })),
+    ...checkPackageFolder(pkg, files).map((p) => ({ rule: 'folder', problem: p.problem, instancePath: p.path, message: FOLDER_MESSAGES[p.problem] ?? p.problem })),
   ];
 }
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_board.py

@@ -62,6 +62,7 @@ from fabric_board_session import (  # noqa: F401
     _Work,
     Handler,
     Responder,
+    PERSONAL_BOARD,
 )
 from fabric_board_fixture import (  # noqa: F401
     _FIXTURE_PROJECT,