@passioncode-ai/fabric-agent-adapter 0.60.0 → 0.62.0

package/CHANGELOG.md

@@ -1,5 +1,251 @@
 # Changelog
 
+## 0.62.0 (2026-11-04)
+
+A new install names the repository of its code, and a service says what it uses, so a map of the installed agents can
+link each to its project and draw its chain (FAA-198, FAA-199).
+
+### Added
+
+- The reference service declares its connections (`extensions/connections/0.1`): the template it drafts from and the
+  demo source `serve --degraded` marks failing; the online example (`sample-remote-service.mjs`) declares an empty list,
+  since it calls nothing outside itself. The support-agent recipe's `SupportAgent.connections()` names its two models
+  for the service that runs it, keeping only an id the connections rule accepts, and imports `fabric_connections` only
+  when called (the recipe's install line names the module). `check_service.py` reports `well-known.connections` as `NOT_RUN` when the
+  well-known document has no connections declaration (it reported nothing before); an empty list is one and reads
+  `PASS`, and adapting-projects-to-fabric names the declaration in its
+  adapter step (FAA-199).
+
+### Changed
+
+- `write_descriptor` / `writeDescriptor` refuse a new descriptor that names no `source.repository` (no descriptor of its
+  `id.instance` is installed yet: an installed one is a regular file, whatever it holds, so a folder, a broken link or
+  a path that cannot be examined is none), with `ServiceError` naming the descriptor; `register_remote` / `registerRemote` refuse it before they
+  write the token file, so a refused registration leaves nothing, and a rotation that names no `source` keeps the
+  installed one when the kit accepts it (a hand-edited one it refuses is dropped, as before). Rewriting a descriptor already installed without it still writes it and warns
+  (`NoSourceRepositoryWarning`, a `UserWarning` attributed to the installer's call; Node `process.emitWarning`, code
+  `FABRIC_NO_SOURCE_REPOSITORY`), so an installed agent's update keeps working. `source_refusal` / `sourceRefusal` say
+  why an install would be refused, for an installer that checks before it validates or writes anything else (a `source`
+  that is no object names nothing), and `names_repository` / `namesRepository` whether a descriptor names one.
+  `check_service.py` names a descriptor without it, or with one the descriptor's rules refuse, and why
+  (`descriptor.source-repository`, `NOT_RUN`, never a pass), and prints a repository without its userinfo, query or
+  fragment (a URL through `redact_url`; a local path, one that starts with `/`, `~`, `.`, `\\` or a drive, by its name;
+  a value of a URL scheme such as `https:` also without `//`, through `redact_url`; an scp form or any other value from
+  after its user and password, whatever they hold; one with a piece shaped like a credential that is no name not at
+  all), as
+  `state.outside-code` and `dashboard.opens-in-host` now do too for the source and for the data checkout's origin (they
+  printed them as found).
+  `sample_service.py register` writes this repository, whose code its descriptor runs whatever `--id` names, takes
+  `--repository`, and writes its manifest only after the descriptor, so a refusal of any kind leaves none naming it, and
+  a manifest it cannot write takes a new descriptor back with it, or puts an installed one's bytes back; an installed
+  descriptor it cannot read is never replaced (it refuses before writing anything). No owner field is added: the
+  organization follows from the repository (FAA-198). `source.repository` is read for a credential by one rule in both kits and
+  in the provider entry's check (`repository_credential` / `repositoryCredential` in `fabric_secrets`): its user, its query
+  and fragment as `secret_url` reads them (a parameter named for a credential, such as `access_token`, now counts), and
+  a path segment shaped like a key; a path segment in lower case, or of letters with no digit, is the repository's
+  name unless a key's shape (such as `sk-`, `ghp_`, `xoxb-`, `glpat-`, `AKIA`, `eyJ`) starts it or follows a `.`,
+  `_` or `-` in it, so `task-pipeline-dashboard` and `Task-Pipeline-Dashboard`, which read as an `sk-` key, are accepted (a source with it was refused before). A user is accepted only in a URL's
+  authority (`https://user@host/path`): an scp form or an opaque URI holding an `@` (`bot:...@host:path`,
+  `https:user@host/path`) is refused, and so is a password in the user information read any way a reader takes it:
+  as written (`https://h\u:pw@x/r`, as git reads it) or as the URL standard does (`https:///u:pw@h/r`). Node reads
+  the user information and parameters by hand, as Python does, so a special scheme written without `//`
+  (`https:host/r?access_token=...`) or a host `new URL` refuses is read alike.
+
+### Fixed
+
+- `redact_url` / `redactUrl` (the URL an `HttpError` carries and `check_url` / `checkUrl` print) dropped a user
+  information only as the URL standard reads it, so `https://h\u:pw@x/r`, which git and Python's `urllib` read as a
+  password, printed `pw` in its path in both kits (0.61.0 too); they now drop the user information as
+  written first, after any run of slashes or backslashes that follows the scheme (`https:/h\u:pw@x/r`,
+  `https:\\h\u:pw@x/r`; 0.62.0 seam readings 11 and 13).
+- Node's `checkUrl` sent `ht<tab>tps://h\u:pw@x/r` and `https:\/h\u:pw@x/r`, which Python's `check_url` refuses
+  (since 0.60.0): it now reads the written user information on the text `new URL` reads, after any run of slashes.
+- Node's `redactUrl` printed `<unparseable url>` for a URL of a scheme other than http, https, ws, wss or ftp (`file:`
+  included) that `new URL` cannot parse (`ssh://[zz]/r`, `ssh://h:99999/r`, `file://h:1/r`), where Python keeps the
+  scheme: both now print `<scheme>:<redacted>`.
+- A subscription `runner.kind` that is no string (a list or an object) raised `TypeError` in Python's
+  `validate_descriptor`, `write_descriptor` and `check_service.py` (0.61.0 too), and Node, for a list whose text is a
+  subscription runner's name (`["claude-code"]`, which `Object.hasOwn` reads as that key), named only one of its two
+  problems: both kits now name both as descriptor problems.
+- Node's key set cache (`JwksCache`) accepted `https://h\u:pw@x/j` and `https://@x/j`, which the Python twin refuses:
+  it now reads the authority as written too.
+
+### Upgrading
+
+- An installer that writes a descriptor for a new install (`register_remote` / `registerRemote` included) and a desktop
+  app that writes its own (DEC-0069) pass `source: {"repository": "https://github.com/owner/name"}` (the repository
+  their code is built from) in the call that writes it: a source set by a later write is too late, since the first call
+  is refused before anything is written. An installer that loads the kit from the installed plugin meets this as
+  soon as the plugin updates; an installed agent's next update warns until it names one. Only a rewrite in
+  place keeps working: an update that removes the descriptor before it writes it again, a new instance (a preview) and a
+  moved services directory are new installs. In Python the warning is `NoSourceRepositoryWarning` (a `UserWarning`), so
+  a suite that runs with warnings as errors (`-W error`) sees the rewrite raise; filter that class there.
+- Once a descriptor names its repository, two probe rules that read `NOT_RUN` without it start judging:
+  `state.outside-code` fails data kept inside that checkout, and `dashboard.opens-in-host` reads the checkout for pages
+  opened in a browser. A service that passed may fail them until its data moves out of the checkout or its pages open
+  through Fabric Dashboards.
+- Declare what the service uses with `connections_extension` / `connectionsExtension` (an empty list when it uses
+  nothing): until it does, `well-known.connections` reads `NOT_RUN` and the connection map has no row for it.
+- A `source.repository` (a service's or a provider entry's) that names a user outside a URL's authority (an scp form,
+  `https:user@host/path`) or carries a query parameter named for a credential is refused: write it as
+  `https://github.com/owner/name`, with no user, query or fragment. A path segment that mixes upper case with a digit
+  is read for a key's shape (`sk-` and 16 more characters, a `ghp_` run, 40 characters of mixed case and digits), so
+  `Task-Pipeline-Dashboard2` is refused while `Agent-V2` is not: write the repository's name in lower case (hosts such
+  as GitHub take either). A segment that a key's shape starts, or follows a `.`, `_` or `-` in, is refused whatever
+  its case and also percent-encoded (`%73k-` reads as `sk-`). The shapes are those of `fabric_secrets.SECRET_VALUE`,
+  such as `sk-` and 16 more characters, `gh` and one of p, o, u, s, r then `_` and 20, `xox` and one of a, b, o, p, r,
+  s then `-` and 10 (so the word `xoxo-` counts), `glpat-` and 20, `AKIA` and 16, and a JWT as written (`eyJ` in
+  that case, `JWT_SHAPE`); `bearer` and a space counts at a segment's start once decoded (`Bearer%20Tracking` is
+  refused, `team-Bearer%20Tracking` stays a name), and anywhere in a segment or a host when 12 or more token
+  characters with a digit follow it and no letter, digit or `_` comes before it (`x-Bearer%20<a token>` is refused).
+  A host is read for a key's shape anywhere in it, inside a word too, so `task-pipeline-dashboard.example.com` is
+  refused although the same path segment is a name (FAA-200 (32)). Such a host, like a repository such
+  as `sk-learn-` followed by a longer name, has no spelling the kit accepts, so an agent built from it is not installed
+  new, and
+  an installed one keeps working by a rewrite in place that leaves the source out (FAA-200 (24)).
+
+## 0.61.0 (2026-11-04)
+
+The board responder reads the operator's mandate from a request of his own Project (FAA-135), and working-with-fabric
+says that his approval holds for the whole task, at every link (FAA-195).
+
+### Added
+
+- `Responder(..., agent_id=, mandate_from=)`: with both set, a request whose sender the board verified
+  (`provenance: trusted`) and whose Project `mandate_from` names (a uuid in any case; or every such sender,
+  `mandate_from="personal-board"`, only on the personal board's responder) is read for one `mandate/1` block fenced
+  ` ```json `, each fence at the start of its own line with no indent, in its body (contract project-comms.md, DEC-0125 MD-3). The handler gets it as `ctx.mandate`, and
+  `ctx.mandate_covers(call)` answers `mandate_covers` with the sender placed as T1, the responder's wall clock (`wall=`,
+  `time.time` by default; Node `Date.now`, milliseconds) and the sender Project as the `caller` of a covered answer's
+  `recordAs`; None when no mandate travelled, and `{"fault": "now-unreadable"}` when the clock returns a value that is not a finite instant (one that raises passes its
+  error to the handler). A `source` in the block is dropped (OA-7). Two `mandate/1` blocks, or one whose text holds
+  `mandate/1` and is not JSON (an integer longer than 4300 digits included, on every Python), read as none, with a `board.request.mandate_unread` warning carrying the request id and its `reason`, never the block.
+  Off by default: a responder that names neither reads nothing, as before. Node's `WorkContext` serialises without the
+  mandate. Both kits (FAA-135). `ctx.mandate_covers` reads the call's `spendUsd` and `project` failing closed, as the
+  kit's MCP and job mandate readers do (FAA-139): a spend that is not a finite number is none, which a `perCallMaxUsd`
+  refuses, and a `project` that is not a string (in Python an exact `str`, so a subclass too: the core compares a
+  project by exact type, so every Python reader refuses one there; the board path marks it unreadable first), None (Node null) included, is refused by a mandate limited to
+  projects, as the contract's `mandateCovers` refuses a null project (the MCP and job readers read None as naming
+  none; leave `project` out on the board) (a draft of this release passed them as given; 0.61.0 seam reading 14). Only
+  the five members `mandate_covers` reads are read, each once, as the contract reads them (`call[name]` in Python; a
+  plain property read in Node, inherited, getter and Proxy members included), but for a Node spend, read as the call's
+  own member; the rest of a call is never touched (0.61.0 seam readings 16 and 17).
+
+### Fixed
+
+- The Python mandate readers (McpToolServer and `action_gate`, the job step, and the core `mandate_covers` and
+  `action_decision` beneath them; a draft of this release's board path too) read a spend estimate that is an `int` or
+  `float` subclass through its own `float()` and comparisons, so a subclass whose `float()` answered 0.0 for 100, or
+  whose `>` lied about an integer past the double range, passed a `perCallMaxUsd` of 5. A number is now an `int` or
+  `float` by its real type (`fabric_jsvalue.is_number`, never `__class__`) and is read by the number it stores
+  (`real_number`: `float.__float__`, `int.__int__`), in `mandate_spend`, `js_to_number`, `double` and McpToolServer's
+  estimate: an honest subclass such as `numpy.float64` keeps its number, a lying one is read as what it holds. A value
+  that only claims a number through `__class__` (a mock with `spec=float`, a lazy proxy), a `Decimal` or a
+  `numpy.int64` is no estimate: the call is answered and a `perCallMaxUsd` refuses it, in every reader. The core
+  `mandate_covers` reads a spend only when it is a number or JSON data as `json.loads` gives it, by exact type all the
+  way down, so for its direct callers a tuple, bytes, a `str`, `list` or `dict` subclass, or a list holding a number
+  subclass is no estimate either, a stricter reading than 0.60.0's (checked only under a ceiling, without recursion in one
+  pass, then read as `Number()` reads it, in time linear in the structure (a list is never joined: two or more items are
+  NaN, one is read for itself); a shared or cyclic list or dict, which `json.loads` never gives, is no estimate, and a spend whose lists nest in
+  lists more than 100 deep (`MAX_SPEND_DEPTH`, a dict between them ends the count) is no estimate, so the spend a
+  refusal carries as `estimateUsd` is one a serialiser writes: that nesting is what `String()` of a list recurses
+  through, so 0.60.0 raised RecursionError a few hundred deep (about 500 on Python 3.14, 330 on 3.9) and Node's
+  `mandateCovers` and the contract throw RangeError a few thousand deep, and between 100 and those depths the core is
+  stricter than all three, a fail-closed twin split that no board, MCP or job reader reaches, since they take no list
+  or dict spend; under a dict there is no bound, since `Number()` never descends a dict, NaN at any depth in all of
+  them; a dict with an own `toString`, at the top or reached through lists alone, is no estimate too, where 0.60.0
+  read it as NaN and Node and the contract throw TypeError). A bool is none in `mandate_spend`, `action_decision` and McpToolServer as before, while
+  the core `mandate_covers` reads it as JavaScript's `Number()` does, as the contract's `mandateCovers` does (0.61.0
+  seam readings 17 to 22, 24 and 26 to 29, product readings 18 to 20 and 22 to 27, unit readings 19, 21, 24, 26 and 28 to 30). `js_to_number` tested a bool with `isinstance`, which asks
+  a number subclass's own `__class__`: one claiming `bool` was read as 1 under a ceiling, and one whose `__class__`
+  raised made the core raise (older than 0.61.0); it tests a bool by identity now (0.61.0 unit reading 30). A job's approval step kept a `str`-subclass project (a `(str, Enum)` member included) as given, which
+  the start refused by the core's exact-type compare but the job file then wrote as its plain string, so the answer
+  covered it, and the same held for a step a service keeps itself through `request_input(steps=)` or Node's
+  `requestInput({steps})` (a `String` object project, a `Number` object spend); both stores now keep a step as the gate
+  reads it (`kept_step` / `keptStep`: a spend through `mandate_spend`, a project as an exact `str` or a primitive
+  string, else `UNREADABLE_PROJECT`), and `job_step`, `action_gate` and McpToolServer read a project as an exact `str`
+  too, as the board path does, so the start and the answer agree, and a value that only claims `str` never reaches the
+  job file (older than 0.61.0; 0.61.0 seam reading 32, readings 33). Node's `JobStore.answer` matched an answer
+  keyed by an inherited name (`constructor`, `toString`) as an asked question and cleared the real one; it matches an
+  own key only, as Python does (older than 0.61.0; 0.61.0 seam reading 36). Both stores' `answer` match nothing when
+  the answer's `inputResponses` or the job's `inputRequests` is not a plain object (a hand-edited file, an array), and
+  McpToolServer answers a `fabric.job.get` whose `inputResponses` is present, not `null` (read as a poll, as before)
+  and not a JSON object with `-32602`:
+  0.60.0 raised out of `handle()` for a non-empty one on a job waiting `input_required` (the transport sent no reply)
+  and read an empty list or string, `0`, `false`, or any non-object on another job or an unknown id, as no answer or
+  `unknown-job` (a client that writes an empty map as `[]` now gets `-32602`; for an unknown id on a server without
+  `authorize`, `-32602` comes before `unknown-job`, where a server with `authorize` answers `unknown-job` first). Both stores' `request_input` /
+  `requestInput` refuse requests that are not a JSON object (before they read a step), and a request that is
+  not a keyed object (under a string key, a dict in Python, in Node an object that is not null, an array or a function), with `InteropError` (0.60.0 Python raised `AttributeError` or `TypeError`, by the shape and whether
+  `steps=` was passed; Node kept an array, which an answer keyed by an index or `length` then matched), and McpToolServer's answer gate reads only an object of requests (older
+  than 0.61.0; 0.61.0 seam and unit readings 37 and 38). The same split held for an
+  effect: Python admitted a `str`-subclass effect (`isinstance`) that the core then refused at the start and the job
+  file wrote as a plain string the answer covered; `job_step` (when a mandate travelled), `request_input(steps=)` and
+  `add_tool` (with an action) now admit an effect as an exact `str` (an `InteropError` otherwise, as Node's `requestInput` already refused a `String` object),
+  and both stores read each member of a step once and keep the value they checked (0.61.0 seam and unit readings 34). `js_to_number`'s decimal
+  pattern backtracked over a long digit string that fails to match, quadratic in its length; it now costs the length
+  (0.61.0 seam reading 22).
+- `InstanceLock.acquire` (Python, `fabric_lock.py`): when writing the pid failed after the lock was taken (a full disk, an
+  I/O error, an interrupt), the descriptor stayed held, and the lock name too, since the caller drops the object
+  (`release()` would have freed only the name, on Linux and Windows), so the same process could not start the service
+  again. The lock now lets both go and re-raises the first error, even when the
+  close itself fails; the Node twin
+  (`fabric-lock.mjs`), whose caller drops a lock that failed to start, does the same for its descriptor or its name,
+  the first error standing in both.
+  Found by a service that vendors the kit, on the board.
+
+### Changed
+
+- working-with-fabric's mandate section: every hand-over within a task carries the four parts of the operator's
+  approval (`source` only where OA-7 lets it), and each receiver acts on them without asking him again, narrowing only
+  (human gates stay, MD-6); a relayed receiver's chain starts with it (OA-2), so the four-agent bound limits one
+  mandate, never the task; a mandate lapses within seven days of his words, and a task still open asks him once for a
+  new one, his same words with `at` when he confirms (MD-1), then weekly until the contract's CT-205 (its answer
+  `7f372925` on board thread `118f95f9`; CT-205 is a row the contract proposes after this kit's pin, on its branch
+  `agent/template-parity-20261103`); a link whose chain already holds four agents hands on no mandate and never restates its own: the four
+  parts go as a relay through OA-3 (his own Project on the board or his local session), whose receiver states its own (OA-2),
+  as the contract confirmed on board thread `118f95f9` (message `adf0c61a`); references/project-board.md and building-fabric-services
+  references/interop.md say the relay names the scope in force and the held `expiresAt`, which the receiver's mandate
+  does not pass (the kit's bound); and, as the contract proposes until CT-205,
+  no agent takes a relay for a task it already leads; references/interop.md says a service has no route past four agents until CT-205. `expiresAt` is counted from `at` and
+  covers the task's length (the kit's `operator_mandate` defaults to a day; references/interop.md says to pass it); the
+  source and spend sentences are reworded with no change in rule, and Step 5's lane-restart paragraph drops its reason
+  sentence ("The stop is usually stale by then.") for room, its rule unchanged; the paragraph for a client without `_meta`
+  leaves the mandate section for Step 5's routes (CT-125), and two sentences that restated rules kept elsewhere in the
+  section are dropped (FAA-196 (6)). A scenario eval `an-approval-holds-for-the-whole-task` (FAA-195).
+- working-with-fabric references/project-board.md says what a kit service reads from a board request: one `mandate/1`
+  block fenced ` ```json ` at the start of its own lines, its chain ending in the service's registry agent id, never a
+  decision block; and what comes back: `mandate-not-for-this-call` is handed on again to the right id without asking
+  him, `mandate-expired` asks him once for a new one.
+
+### Upgrading
+
+- `fabric_board_link` (and `fabric-board-link.mjs`) now imports `fabric_interop_rules`, so a board responder's install
+  brings it and its `fabric_delegation` too (`fabric_kit.py install --module fabric_board` copies 33 modules, 31 in
+  0.60.0): reinstall with `fabric_kit.py install` and check with `status`, never by copying `fabric_board_link` alone.
+- A Python service that passes a job or tool project as a `(str, Enum)` member or another `str` subclass, under a
+  mandate limited to projects, is now asked at a job's answer as at its start: pass the plain string (`member.value`).
+  An effect passed that way to `approval_step`, `job_step` (when the start call carried a mandate), `request_input(steps=)` or `add_tool` with an action now raises
+  `InteropError`: pass `member.value` there too. A Node service that keeps a step through `requestInput({steps})` with
+  a `String` object project (under a mandate limited to projects) or a `Number` object spend (under a `perCallMaxUsd`)
+  is likewise asked at the answer: pass the primitive value.
+- A kept step holds only `effect`, `spendUsd` and `project`, read as the step's accessors answer them (Node property
+  access, Python `.get`), where 0.60.0 kept the step's JSON form (Node `JSON.stringify`, Python `json.dumps`, which reads a
+  `dict` subclass through its `items()`): a
+  service that put its own keys in `steps=` keeps them elsewhere. The two differ for a Node step that is a function
+  (0.60.0 kept no step), an array, an object whose members are inherited (a class's getters included) or not
+  enumerable, or one with its own `toJSON`, and for a Python `dict` subclass whose `.get` or `items()` answers otherwise
+  than its storage: such a step is now kept as its accessors answer, and an accessor that throws for the spend or the project,
+  which 0.60.0 never called, now throws from `requestInput` / `request_input` (the job stays `working`).
+- A job waiting `input_required` whose approval step 0.60.0 kept keeps it as 0.60.0 wrote it: a `str`-subclass
+  project or effect, or a Node `String` or `Number` object, as its plain value, and the step kinds above in their JSON
+  form. A step so kept with its effect but no project is covered at a 0.61.0 answer by a mandate limited to projects;
+  one kept with no effect waits for the operator (`effect-missing` where a step is kept, `no-decision` where none is),
+  and a Node job whose requests 0.60.0 kept as an array can no longer be answered. Answer or cancel such jobs before
+  upgrading.
+- Python McpToolServer answers a `fabric.job.get` whose `inputResponses` is not a JSON object (`[]` and `""`
+  included), on any job the caller may read, `-32602` (Node has no tool server): send an object, or leave it out (or `null`) to poll.
+
 ## 0.60.0 (2026-11-03)
 
 The board responder is ready to find a slot the operator moves back to it, once Fabric offers the move (FAA-165), and four smaller fixes: working-with-fabric

package/README.md

@@ -72,7 +72,8 @@ requests other Projects post to its Project on Fabric's project board uses the b
 (`scripts/fabric_hub.py` and `scripts/fabric_board.py`, Node `fabric-hub.mjs` and `fabric-board.mjs`): the
 `board.respond` grant, enroll, claim, accept the exact digest, complete, a checkpoint before every step, and restarts
 that reconcile or take accepted work back by a transfer, unless the slot was moved to another session (until the
-operator's take-back, or a move back once Fabric offers one) (the [board reference](plugins/fabric-agent-adapter/skills/building-fabric-services/references/board.md)):
+operator's take-back, or a move back once Fabric offers one), and, when the service opts in, the operator's
+`mandate/1` from a trusted request of his own Project (the [board reference](plugins/fabric-agent-adapter/skills/building-fabric-services/references/board.md)):
 
 ```bash
 python3 plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py example-agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.60.0",
+  "version": "0.62.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.60.0",
+  "version": "0.62.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.60.0"
+  version: "0.62.0"
   contract-version: "0.1.0"
   contract-commit: "3830a3353923e20f826d466610e1c479f120bec0"
 ---
@@ -143,6 +143,9 @@ Preserve the chosen ownership boundary:
   `building-fabric-services`'s `scripts/fabric_interop.py`.
 - Local runner maps typed input, executable identity, result location, cancellation,
   heartbeat, and partial results without relying on ambient accounts.
+- A service declares what it uses (`extensions/connections/0.1`: models, other agents, connectors, stores,
+  channels) with `connections_extension` / `connectionsExtension`, and its descriptor names `source.repository`;
+  the probe names either one missing (FAA-198, FAA-199).
 
 Keep model selection and provider-internal reasoning outside the Fabric contract. Expose
 typed outcomes, evidence, artifacts, and protocol-visible state, not chain-of-thought.

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/provider-entry.md

@@ -57,8 +57,10 @@ It refuses, with one sentence that never quotes a value:
   (`test_provider.SchemaParityTests` compares them with a contract checkout at the pin when `FABRIC_CONTRACT_NEW` names
   one, as the contract job of the nightly CI does), and the reader is held to every `provider.schema.json` fixture of
   the pin (`test/fixtures/contract/provider-fixtures.json`, `test_provider.ContractFixtureTests`);
-- a `source.repository` with a `user:password@` or a value shaped like a credential: it names the repository, never
-  reaches it (since 0.49.3, as the service kit's descriptor check);
+- a `source.repository` with a `user:password@`, a user outside a URL's authority, or a value shaped like a credential
+  in its user, query or fragment or as a path segment (one in lower case, or of letters with no digit, is the name unless a key's shape starts it or follows a `.`, `_` or `-`, read as written and percent-decoded; a host is read for a key's shape anywhere in it,
+  inside a word too, so `task-pipeline-dashboard.example.com` is refused, FAA-200 (32)): it names the
+  repository, never reaches it (since 0.49.3; one rule with the service kit's descriptor check since 0.62.0);
 - a manifest whose name follows a backslash (`C:\Agents\example\fabric-agent.json`). The reader,
   `validate_provider_entry`, accepts it since DEC-0145 (`MANIFEST_PATTERN`, the schema's), but a reader that has not
   re-pinned to DEC-0145 refuses the entry, Fabric's registry among them (CT-192), so the writer does not emit it until

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_provider.py

@@ -147,7 +147,7 @@ def validate_provider_entry(entry: Any) -> List[str]:
             problems.append("source is {repository?}")
         elif "repository" in source and not _is_uri(source["repository"]):
             problems.append("source.repository is an absolute URI")
-        elif "repository" in source and (_URI_PASSWORD.match(source["repository"]) or _secrets.secret_argument(source["repository"])):
+        elif "repository" in source and (_URI_PASSWORD.match(source["repository"]) or _secrets.repository_credential(source["repository"])):
             # FAA-120, as the service kit: a repository is named, never reached with a credential in its URI.
             problems.append("source.repository carries no password or credential: it names the repository")
     if not isinstance(entry["installedAt"], str) or not _TIMESTAMP.fullmatch(entry["installedAt"]):

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_secrets.py

@@ -185,3 +185,60 @@ def secret_url(value: str) -> bool:
             if any((raw != "" and credential_name(name)) or secret_value(raw) for raw in raws):
                 return True
     return False
+
+
+_REPOSITORY_URI = re.compile(r"\A([A-Za-z][A-Za-z0-9+.-]*:(?://[^/?#]*)?)([^?#]*)(.*)\Z", re.S)
+_REPOSITORY_NAME = re.compile(r"(?:[a-z0-9._-]+|[A-Za-z._-]+)\Z")  # lower case, or letters with no digit (readings 8)
+_REPOSITORY_AUTHORITY = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://")
+_KEY_AT_A_WORD = re.compile(r"(?:\A|(?<=[._-]))(?:%s)" % SECRET_VALUE.pattern, re.IGNORECASE | re.ASCII)
+_JWT_AT_A_WORD = re.compile(r"(?:\A|(?<=[._-]))%s" % JWT_SHAPE.pattern)
+
+
+def repository_name(piece: str) -> bool:
+    """Whether a path segment reads as a repository's name: lower case, or letters with no digit, with no provider
+    key's or JWT's shape (`sk-`, `ghp_`, `xoxb-`, `AKIA`, `eyJ`) at its start or after a `.`, `_` or `-` (0.62.0
+    readings 9 and 10), so a letters-only key is still a key while `task-pipeline-dashboard`, which holds an `sk-` shape
+    inside a word, is a name."""
+    return bool(_REPOSITORY_NAME.match(piece)) and not _KEY_AT_A_WORD.search(piece) and not _JWT_AT_A_WORD.search(piece)
+
+
+def ascii_decoded(text: str) -> str:
+    """Every `%XX` escape of an ASCII character decoded, the rest left as written: how a repository's path and user
+    information are read as well as written, since git and hosts decode them (`%73k-` is `sk-`, `u%3Apw` is `u:pw`;
+    0.62.0 readings 11). The Node twin is asciiDecoded."""
+    return re.sub(r"%([0-7][0-9A-Fa-f])", lambda escape: chr(int(escape.group(1), 16)), text)
+
+
+def repository_password(value: str) -> bool:
+    """Whether a repository URI's user information holds a password, in any scheme, `file` too: every slash and
+    backslash after the colon skipped, then up to the next `/`, `?` or `#`, a backslash kept in the user. That one
+    reading holds git's (`https://h\\u:pw@x/r`), curl's (`https:///h\\u:pw@x`) and the URL standard's
+    (`https:///u:pw@h`, which stops at a backslash, a prefix of it) (0.62.0 readings 10 to 14). The user information
+    ends at the last `@`; a password follows its first `:`, as written or ascii_decoded. The Node twin is
+    repositoryPassword."""
+    value = re.sub(r"[\t\n\r]", "", value.strip(_C0_OR_SPACE))
+    scheme, colon, rest = value.partition(":")
+    authorities = [re.match(r"[^/?#]*", rest.lstrip("/\\")).group(0)] if colon else []
+    users = [authority.rpartition("@")[0] for authority in authorities]
+    return any(user.partition(":")[2] for user in users + [ascii_decoded(user) for user in users])
+
+
+def repository_credential(value: str) -> bool:
+    """FAA-198 (0.62.0 readings 6 and 7): whether a repository URI carries a credential: in its scheme and authority (a
+    user), in its query or fragment as secret_url reads them, or as a path segment shaped like a key. A path segment in
+    lower case, or of letters with no digit (task-pipeline-dashboard, Task-Pipeline-Dashboard), is the repository's
+    name, never a key, though it reads as an `sk-` shape, unless a key's shape starts it or follows a `.`, `_` or `-` in
+    it (repository_name); a segment is read as written and ascii_decoded. A
+    user outside a URL's authority (an scp form, `https:user@host/path`) counts as one: a user is an authority's."""
+    if "@" in value and not _REPOSITORY_AUTHORITY.match(value):
+        return True
+    match = _REPOSITORY_URI.match(value)
+    if not match:
+        return secret_argument(value)
+    head, path, tail = match.groups()
+    if repository_password(value):
+        return True
+    odd = [piece for written in (path, ascii_decoded(path)) for piece in re.split(r"[/\\:]", written)
+           if piece and not repository_name(piece)]
+    # the scheme and authority decoded too: git sends `https://%67hp_...@h` with its user decoded (unit reading 12)
+    return secret_url(head + tail) or secret_argument(ascii_decoded(head)) or any(secret_argument(piece) for piece in odd)

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,7 +14,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.60.0"
+  version: "0.62.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "3830a3353923e20f826d466610e1c479f120bec0"
@@ -65,16 +65,17 @@ Answer before writing code, and record the answers in the project README:
 | What it stores | the store, where it lives (Step 2, rule 5), and what survives uninstall |
 | Data and uptime | kind U or O, kit folders, a durable store or `<id>-data`, uptime A or B; a new agent's `LICENSE` holder, transfer audit per release (creating-fabric-agents) |
 | What it tells the operator | the events worth a notification (Step 5) |
+| Source | `source.repository`, required (Step 4); connections, `[]` if none |
 
 ## Step 1: choose the surfaces
 
 | Caller | Surface | Why |
 |---|---|---|
-| Another agent on this machine | MCP `2026-07-28`, `streamable-http`, at `/mcp` on the service origin, token in a header | one process serves every session; stdio-per-session once left twenty stray servers on this machine |
+| Another agent on this machine | MCP `2026-07-28`, `streamable-http`, at `/mcp` on the service origin, token in a header | one process serves every session (stdio-per-session once left twenty stray servers) |
 | The operator or a script | a CLI: `<tool> service status\|start\|stop\|restart`, `<tool> dashboard` (opens only in Fabric Dashboards, below), `<tool> doctor --json` | every verb delegates to launchd and the well-known document, never to its own process table |
 | A remote agent | A2A `1.0` over HTTPS, or MCP behind an authenticated gateway | loopback reachability is not authorization |
 | An A2A peer on this computer | `surfaces.a2a` names a public Agent Card, served without the token; its interface URLs are loopback (DEC-0122); the kits read it, serving one is FAA-10 | the card carries no credential, process member or required Fabric extension |
-| The dashboard page | same-origin REST under `/api`, session cookie plus a custom request header; every button on it also a tool on the MCP surface (Step 5) | the CSRF defence all four existing dashboards use |
+| The dashboard page | same-origin REST under `/api`, session cookie plus a custom request header; every button on it also a tool on the MCP surface (Step 5) | the existing dashboards' CSRF defence |
 
 Read [the surfaces and auth reference](references/surfaces-and-auth.md) when wiring
 MCP registration into a client config, the login flow or the CSRF header.
@@ -213,8 +214,8 @@ descriptor's `fabricManifest` at a manifest whose service key names this
 The installer, not the service, owns the plist and the descriptor. Sequence:
 
 1. `write_descriptor(descriptor)`: refuses a port or `id.instance` another descriptor
-   claims. A preview or branch copy is a second **instance**, never a second id, and it is
-   one more service the operator sees, probes and gets notified by. Verify a release with its
+   claims, and a new one without `source.repository` (a rewrite warns). A preview or branch
+   copy is a second **instance**, never a second id: one more service the operator sees. Verify a release with its
    own doctor or self-check before it replaces `default`; a temporary instance is uninstalled
    (`launchd_uninstall`, `remove_descriptor`) as soon as its check is done, not left running.
 2. `launchd_plist(...)` then `launchd_install(...)`: writes and lints the plist,
@@ -269,7 +270,7 @@ refusals.
 **Say what the agent uses** (`fabric-connections/0.1`, DEC-0096) so Fabric Dashboards draws its chain: the other
 agents, models, connectors, stores and channels, each with its state, from
 `connections_extension()` / `connectionsExtension()` in `fabric_connections`. Never a credential in it, never a call
-count (that is the usage report); the details are in [the wire reference](references/protocol.md).
+count (that is the usage report); details: [the wire reference](references/protocol.md).
 
 The events feed is a **view over the log you already keep** (a jobs table, a JSONL
 journal), not a second store. Each event is one sentence a person reads; set
@@ -298,7 +299,8 @@ rule it can reach and says which it could not:
 python3 <skill-dir>/scripts/check_service.py <id>[.<instance>]
 ```
 
-It reports `PASS`, `FAIL` or `NOT_RUN` per rule (descriptor, port claim, well-known
+It reports `PASS`, `FAIL` or `NOT_RUN` per rule (descriptor, port claim, `descriptor.source-repository`,
+`well-known.connections`, well-known
 shape, identity, latency, Host/Origin/cross-site guards, loopback bind, token file,
 events auth and shape, single-use login, state outside code, instance lock, plist,
 launchd pid equals answering pid, `dashboard.declared` (ED-9), `well-known.actions` (DEC-0121),
@@ -405,8 +407,8 @@ this estate needs.
 - **Not macOS / no launchd:** the kits write a systemd user unit (Linux) or a per-user Scheduled Task (Windows); with
   no supervisor at all declare `lifecycle.manager: "none"`, and hosts show the service read-only. Keep every other rule.
 - **A desktop app with no supervisor** (DEC-0069): its descriptor says `manager: "person"` with `lifecycle.app`, no
-  origin, `installedBy {by: "person", role, tool}`; its live origin is in its own liveness file
-  (the lifecycle reference, *An app's own descriptor and the node*).
+  origin, `installedBy {by: "person", role, tool}`, `source.repository` (the lifecycle reference, *An app's own
+  descriptor and the node*).
 - **No Python:** use the Node kit; run the probe from any machine that has Python and
   can reach the port, or mark the probe `NOT_RUN` with the reason.
 - **Neither kit fits the framework:** implement the four routes and the lock by hand

package/plugins/fabric-agent-adapter/skills/building-fabric-services/recipes/support-agent/README.md

@@ -71,9 +71,16 @@ names the same file.
 
 ## Install into a service
 
+The service that runs it says what it uses (FAA-199): `agent.connections()` names the two models, and the service adds
+its own hand-off route, in its well-known document:
+`fs.connections_extension(agent.connections() + [...], degraded=degraded)`. The two take the ids `model` and `fallback`
+(a `degraded` entry whose source is `fallback` marks the fallback); the service's own items take other ids, since one id
+named twice is refused.
+
 ```bash
 python3 <adapter>/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_kit.py \
-  install <service>/support --lang py --module fabric_openrouter --module fabric_usage --module fabric_paths
+  install <service>/support --lang py --module fabric_openrouter --module fabric_usage --module fabric_paths \
+  --module fabric_connections
 cp <adapter>/plugins/fabric-agent-adapter/skills/building-fabric-services/recipes/support-agent/support_agent.py <service>/support/
 python3 <adapter>/.../fabric_kit.py status <service>/support      # current, older or modified, per file
 ```

package/plugins/fabric-agent-adapter/skills/building-fabric-services/recipes/support-agent/support_agent.py

@@ -24,8 +24,9 @@ For each message it:
 What the agent does not do: send the reply anywhere (the service that calls it owns its channel), judge facts with a
 model, or answer outside the knowledge file. The model's text is data: a citation it invents fails the check.
 
-The kit modules (fabric_openrouter and its closure) sit beside this file in a service
-(`fabric_kit.py install <dir> --module fabric_openrouter`); in this repository they are read from ../../scripts.
+The kit modules sit beside this file in a service, installed as the README's "Install into a service" says
+(`fabric_kit.py install <dir> --lang py --module fabric_openrouter --module fabric_usage --module fabric_paths
+--module fabric_connections`); in this repository they are read from ../../scripts.
 Standard library only. FAA-65 REQ-09.
 """
 from __future__ import annotations
@@ -371,6 +372,22 @@ class SupportAgent:
         self._local = threading.local()
         self._log = DecisionLog(self.state_dir)
 
+    def connections(self) -> List[Dict[str, Any]]:
+        """FAA-199: what the agent uses, for `connections_extension` in the well-known document of the service that runs
+        it (DEC-0096); that service adds its own hand-off route and channels."""
+        # A model id that is not one (empty, missing, with a space) is left out, so a misconfigured fallback degrades the
+        # replies, never the well-known document (0.62.0 seam reading 1).
+        named = [("model", self.model, "drafts replies from the knowledge file"),
+                 ("fallback", self.fallback, "drafts when the first model fails")]
+        import fabric_connections  # the service that declares them installs it (README); the agent runs without it
+        kept = []
+        for ident, target, purpose in named:  # by the connections rule itself, never a second copy of it (seam reading 2)
+            item = {"id": ident, "kind": "model", "target": target, "purpose": purpose}
+            probe = {"extensions": {fabric_connections.CONNECTIONS_EXTENSION_KEY: {"connections": [dict(item, state="unknown")]}}}
+            if not fabric_connections.connections_rules(probe):
+                kept.append(item)
+        return kept
+
     @property
     def decisions_file(self) -> Path:
         return self._log.path