@passioncode-ai/fabric-agent-adapter 0.75.0 → 0.76.0

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # Changelog
 
+## 0.76.0 (2026-11-07)
+
+The contract pin stays `18f8d487`. Kit modules change: `fabric_peer_owner` and `fabric-peer-owner.mjs` (peer_owner
+`1.1.0+kit.2`), `fabric_supervisors` and `fabric-supervisors.mjs`, `fabric_http`, and the facades `fabric_service` and
+`fabric-service.mjs` (one more export each).
+
+### Fixed
+
+- **The launchd installers prove their own job on a restricted socket table** (FAA-267). macOS 27.2 shows an
+  ad-hoc-signed interpreter (a Homebrew Python) only its own sockets through sysctl and nothing through netstat, so
+  `launchd_install` refused a service it had just started (`foreign-user`, `no-row`). The sysctl calibration now also
+  requires a child process's listener; an empty netstat answers `unknown` with reason `table-restricted`, never another
+  account's. `CheckedHTTPConnection(vouch_pid=...)` and the Node `checkedSocket({vouchPid})` accept a listener on the
+  port that `lsof -p` shows belongs to that pid of this account; `launchd_install` and `launchdInstall` vouch with their
+  own job's pid (`launchd_pid`, `launchdPid`, read only after a `table-restricted` answer), and a refusal that remains reads `<origin> could not be proved this service's:
+  table-restricted: ...`: the Python installer names the way round it (Apple's `/usr/bin/python3`), the Node one asks for a runtime that sees the table
+  (no Node was measured). `lsof` is asked for IPv4 alone, so a v6-only wildcard never vouches for a `127.0.0.1`
+  connection, and a vouch is an integer pid. The calibration child (one short-lived interpreter per process) is bounded
+  by the table timeout, and a child that cannot be started or does not answer proves nothing. Measured on a host
+  agent's Mac (macOS 27.2) with a pre-release build: the install passes, a root listener on another port is still
+  refused, the method is netstat under Homebrew Python and sysctl under Apple's; the final form was not rerun there
+  ([record](docs/reports/2026-11-07-faa-267/README.md)).
+- **A release folder in a plist's or a supervisor file's environment is no credential** (FAA-266): `PYTHONPATH`
+  holding a release folder under Application Support was refused as a key. An environment value that reads as a path
+  (it starts with `/`, `~`, `.` or a drive, has at least two separators and one all-lower-case part such as
+  `example-agent`) is now read by the path-aware detector (`secret_argument`, `secretArgument`); any other value keeps
+  the strict `secret_value`, so a base64 key whose `/` splits it is still refused: of 60,000 random keys 20 pass,
+  against 13 for the strict detector alone ([record](docs/reports/2026-11-07-faa-267/README.md)). `adapt_project.py`'s LC-21 check reads a plugin MCP
+  server's `env` the same way. A path whose part after a space has no all-lower-case folder and holds a digit
+  run (`.../Application Support/ExampleAgent/Releases/2026-11-07`) is still refused, as in 0.75.0 (FAA-273).
+
+### Known limits
+
+- Only the launchd installers vouch. On a restricted table (macOS 27.2 under an ad-hoc-signed interpreter) every
+  other caller of the owner check still refuses a loopback listener whose owner cannot be told: the probe
+  (`check_service.py`, rule `listener.owner`), the hub client and so the board responder, `fabric_http` and so the
+  OpenRouter connector, `mcp-register`, the `dashboard` command, and the layout probe. The
+  probe and `fabric_http` say `foreign-user` and carry the `table-restricted` reason; the hub client says only
+  `unknown` (FAA-272). The way round for Python is Apple's `/usr/bin/python3`; a Node service has no measured way
+  round yet.
+- The vouch is the launchd job's own pid: a `ProgramArguments` wrapper that starts the server as a child (`sh -c`
+  without `exec`, `uv run`, `npm start`) cannot vouch for it. Start the server with `exec`, or use Apple's Python.
+
+### Upgrading
+
+- `wellKnownOf`'s `ForeignUserAnswer.reason` may start with `table-restricted` beside `foreign-user`. A
+  `launchd_install` or `launchdInstall` refusal on a restricted table now reads `<origin> could not be proved this
+  service's: table-restricted: ...` where it read `<origin> is not this service's: foreign-user: ...`: match the
+  reason as a substring, not the start of the message.
+- New optional arguments: `vouch_pid` on `CheckedHTTPConnection` and `own_connection`, `vouchPid` on `checkedSocket`, `CheckedAgent` and
+  `wellKnownOf`. The vouch is consulted only on macOS when the owner reads `table-restricted`; it never overrides
+  another account's listener or another unknown reason. New names in both peer-owner twins: `TABLE_RESTRICTED` (the
+  reason to match on), `LSOF`, `pid_listens` / `pidListens` and `parse_lsof_listeners` / `parseLsofListeners`; the facades export `launchd_pid` (`fabric_service`) and
+  `launchdPid` (`fabric-service.mjs`).
+- A service that vendored the 0.74.0 or 0.75.0 kit keeps refusing its own install on macOS 27.2 until its copies are
+  refreshed (`fabric_kit.py status` names them older).
+
 ## 0.75.0 (2026-11-07)
 
 Guidance only: no kit module, probe rule or hook changes; the contract pin stays `18f8d487`.

package/README.md

@@ -192,6 +192,8 @@ python3 "$KIT/sample_service.py" serve --port 47190 --data-dir "$DATA" &
 python3 "$KIT/sample_service.py" register --port 47190 --data-dir "$DATA" --services-dir "$SERVICES"
 # The probe exits 0 (no FAIL); only then is the service registered for one client run (listener.owner proves the port
 # is this account's, and the client cannot check it). The token goes in a header, never in argv.
+# On macOS 27.2 run these with Apple's /usr/bin/python3: an ad-hoc-signed Python, such as Homebrew's, sees no other
+# process's sockets (FAA-272).
 python3 "$KIT/check_service.py" sample --services-dir "$SERVICES" && \
 python3 - "$DATA/service.token" "$WORK/mcp.json" <<'EOF'
 import json, os, sys
@@ -206,10 +208,10 @@ EOF
 kill %1
 ```
 
-Verified 2026-11-07 from the published npm package 0.74.0 (`npm pack` into a throwaway folder, `KIT`
+Verified 2026-11-07 from the published npm package 0.75.0 (`npm pack` into a throwaway folder, `KIT`
 pointing at its skill) with Claude Code 2.1.299: the probe reported 44 rules, 0 FAIL, `listener.owner` PASS;
 the CLI connected to the sample over streamable HTTP, called `sample.echo` and printed `ping`
-([record](docs/evidence/runs/2026-11-07-0.74.0-quick-start.md)). The probe prints one line per rule
+([record](docs/evidence/runs/2026-11-07-0.75.0-quick-start.md)). The probe prints one line per rule
 (`PASS`, `FAIL` or `NOT_RUN` with its evidence) and exits 1 on any `FAIL`; run it against your
 own service by its id once its installer has written the descriptor.
 `FABRIC_REAL_CLIENT=1 python3 -m unittest discover -s test -p test_real_client.py` repeats the connection check

package/SECURITY.md

@@ -41,7 +41,11 @@ bounded and non-publishing until explicit scoped grants exist in a project bindi
   -anv -p tcp` and `/bin/ps -o uid= -p <pid>` (the Node twin always); Linux
   `/proc/net/tcp` and `/proc/net/tcp6`; Windows `GetExtendedTcpTable` and the process
   token (Python), or `netstat -ano`, `whoami /user` and one PowerShell `GetOwnerSid` query
-  per new connection (Node). A token-free loopback door is not yet protected against
+  per new connection (Node). On macOS the Python reader calibrates once per process with a
+  short-lived child of its own interpreter listening on a random `127.0.0.1` port; when the
+  table is restricted (macOS 27.2, FAA-267) the launchd installers also run `/usr/sbin/lsof
+  -nP -a -p <pid> -i4TCP -sTCP:LISTEN -Fn` on their own job's pid. That vouch shows the job listens on the port, not that it accepted
+  the connection (a more specific bind by root over a wildcard job would pass; contract CT-261). A token-free loopback door is not yet protected against
   another account's process (HA-3, FAA-227). An MCP client (Claude Code, Codex) sends the
   token it was registered with on every later connection without this check (the contract's
   residue "a coding agent's bearer"): when the port may have changed hands, rotate the token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.75.0",
+  "version": "0.76.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.75.0",
+  "version": "0.76.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.75.0"
+  version: "0.76.0"
   contract-version: "0.1.0"
   contract-commit: "18f8d48762edc5bfb1433657cbfe1c16196df1a6"
 ---

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -586,6 +586,15 @@ def _credential_problems(manifest: Dict[str, Any]) -> List[str]:
 _PLUGIN_SKIP = {".git", "node_modules", ".venv", "venv", "__pycache__", "dist", "build", ".worktrees"}
 
 
+def _secret_env_value(value: str) -> bool:
+    """An MCP server's environment value: path-aware only when it reads as a path (it starts as one, has two separators
+    and a lower-case word between them), as the kit's supervisor writers read one (FAA-266); else `secret_value`."""
+    pieces = re.split(r"[\\/]", value)
+    path = bool(re.match(r"(?:[/~.]|[A-Za-z]:[\\/])", value)) and len(pieces) >= 3 and any(
+        re.fullmatch(r"[a-z][a-z0-9_-]{2,}", x) for x in pieces)
+    return _secrets.secret_argument(value) if path else _secrets.secret_value(value)
+
+
 def _plugin_problems(root: Path) -> List[str]:
     """LC-19 (FAA-22) and LC-21 for the Claude Code plugins in the project: a plugin's stdio MCP server starts in
     every session that enables the plugin; serve it over HTTP from one resident process, or register it at project
@@ -614,7 +623,7 @@ def _plugin_problems(root: Path) -> List[str]:
             if any(isinstance(a, str) and _secrets.secret_argument(a) for a in argv) or (isinstance(entry.get("url"), str) and _secrets.secret_url(entry["url"])):
                 problems.append("LC-21: plugin %s's MCP server %s carries a credential in its argv or URL" % (name, server))
             env = entry.get("env") if isinstance(entry.get("env"), dict) else {}
-            if any(isinstance(v, str) and _secrets.secret_value(v) for v in env.values()):
+            if any(isinstance(v, str) and _secret_env_value(v) for v in env.values()):  # path-aware for a path (FAA-266)
                 problems.append("LC-21: plugin %s's MCP server %s writes a credential value in env; reference it instead" % (name, server))
     return problems
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,7 +14,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.75.0"
+  version: "0.76.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "18f8d48762edc5bfb1433657cbfe1c16196df1a6"
@@ -419,9 +419,10 @@ this estate needs.
 
 ## Gotchas
 
-- `lsof` shows `*:<port>` or `0.0.0.0` → the bind is wrong even if the Host check works.
+- `lsof` shows `*:<port>` or `0.0.0.0` → the bind is wrong.
 - HTTP 200 alone accepts any program on the port: compare `service.id` and `service.instance`, read only from
-  this OS account's listener. On `listener.owner` FAIL (`foreign-user`) send that port nothing.
+  this OS account's listener. On `listener.owner` FAIL (`foreign-user`) send that port nothing; reason
+  `table-restricted`: `references/protocol.md`.
 - `launchctl bootstrap` right after `bootout` fails with I/O error 5: wait for the unload, then retry.
 - Under launchd `PATH` is bare. Pin the interpreter by absolute path; set `PATH`
   explicitly in the plist; never copy the whole shell environment into it.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -59,7 +59,7 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L0 | `fabric_time` | strict RFC 3339, UTC days, formatting, day windows, the clock ([dates](#dates-and-times)) |
 | L0 | `fabric_identifiers` | identifier equality by normal form (DEC-0076) |
 | L0 | `fabric_secrets` | the contract's one credential detector (DEC-0044) |
-| L0 | `fabric_peer_owner` | which OS account owns each end of a loopback connection, from the computer's socket table (DEC-0154 HA-2, FAA-226): `listener`, `server_end`, `peer`, `CheckedHTTPConnection`; the Python file is Project Observatory's `peer_owner.py` 1.1.0 vendored from commit `f86f0622` with the readings its header names (`1.1.0+kit.1`), the Node twin reads netstat, `/proc` and the owner SID where Python reads `sysctl`, `/proc` and `GetExtendedTcpTable` |
+| L0 | `fabric_peer_owner` | which OS account owns each end of a loopback connection, from the computer's socket table (DEC-0154 HA-2, FAA-226): `listener`, `server_end`, `peer`, `CheckedHTTPConnection`; the Python file is Project Observatory's `peer_owner.py` 1.1.0 vendored from commit `f86f0622` with the readings its header names (`1.1.0+kit.2`), the Node twin reads netstat, `/proc` and the owner SID where Python reads `sysctl`, `/proc` and `GetExtendedTcpTable`; on a restricted macOS table (FAA-267) a caller may vouch with a pid it started, proved by `lsof -p` |
 | L1 | `fabric_crypto` | Ed25519 signing (a Montgomery ladder that does not branch on the key) and verification, P-256 verification, base64url, sha256 |
 | L1 | `fabric_base` | the protocol name, `ServiceError`, small shared helpers |
 | L1 | `fabric_platform` | Windows: named pipes, owner-only files (DEC-0032) |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -97,7 +97,11 @@ systemd and Task Scheduler do not poll yet, FAA-253).
    until `launchctl print gui/<uid>/<label>` fails, `bootstrap` with up to five retries,
    then poll the well-known document until it answers with this `id.instance` on a listener of this OS account
    (DEC-0154 HA-2: another account's listener, or one whose owner cannot be told, is `foreign-user` and never a
-   successful install; the error names it).
+   successful install; the error names it). Where the socket table hides other processes (macOS 27.2 under an
+   ad-hoc-signed interpreter), the installer vouches with its own job's pid from `launchctl print`; a listener it
+   cannot prove reads `table-restricted` and the error names the way round it (FAA-267). The pid is the job's own, so a
+   `ProgramArguments` wrapper that starts the server as a child (`sh -c` without `exec`, `uv run`, `npm start`) cannot
+   vouch for it: on such a host start the server with `exec` or run the installer from Apple's `/usr/bin/python3`.
 4. Upgrade = new release, rewrite the plist with the new path, `launchd_install`
    again, then `prune_releases(releases_dir, current=<new release>)`: the running release
    and the one before it stay for rollback, older ones go (LC-11, LC-15).

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -224,6 +224,17 @@ and `/proc/net/tcp6`, Windows through `GetExtendedTcpTable` and the owner's toke
 on macOS, the same `/proc` files on Linux, and `netstat -ano` with the owner SID from PowerShell `GetOwnerSid` against `whoami /user` on Windows (SIDs, never names). Fail closed: everything but
 `this-account` refuses, `unknown` included.
 
+macOS 27.2 shows an ad-hoc-signed interpreter (a Homebrew Python, measured; a Homebrew Node is ad-hoc-signed too and was not measured) only its own sockets: sysctl lists this
+process alone and netstat prints nothing. The Python calibration therefore also asks for a child process's listener,
+and an empty netstat is `unknown` with reason `table-restricted` (never another account's). A caller that started the
+server itself may vouch with that pid: `lsof -p <pid>` asks the process, which the restriction leaves readable, and a
+listener of this account's pid on the port counts as this account's (`CheckedHTTPConnection(vouch_pid=...)`, Node
+`checkedSocket({vouchPid})`). The launchd installers vouch with their own job's pid; elsewhere a restricted table
+refuses (the probe, the hub client and `fabric_http` included, FAA-272), and Apple's `/usr/bin/python3` sees the
+whole table (FAA-267). A vouch is a weaker proof than the table's: it shows the job's pid listens on the port (`127.0.0.1` or the
+IPv4 wildcard), not that it accepted this connection, so a more specific bind by root over a wildcard job would pass;
+the contract's ruling on vouching is CT-261.
+
 Every kit client that sends a credential to loopback checks first: `check_service.py` (rule `listener.owner`, the first that reads the port for
 a local placement; `FAIL` `foreign-user` and no rule reads the port), the hub client (`HubError` `foreign-user`),
 `fabric_http` / `fabric-http.mjs` for a plain `http://` loopback URL (`HttpError` kind `foreign-user`, never retried),

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-peer-owner.mjs

@@ -45,7 +45,7 @@ import http from 'node:http';
 import net from 'node:net';
 import os from 'node:os';
 
-export const PEER_OWNER_VERSION = '1.1.0+kit.1'; // the Python twin's, Observatory's 1.1.0 with the kit's differences
+export const PEER_OWNER_VERSION = '1.1.0+kit.2'; // the Python twin's, Observatory's 1.1.0 with the kit's differences
 export const THIS_ACCOUNT = 'this-account';
 export const ANOTHER_ACCOUNT = 'another-account';
 export const SYSTEM = 'system';
@@ -58,6 +58,10 @@ export const WINDOWS_TIMEOUT_MS = 5000;
 export const LISTENER_TTL_MS = 1000;
 export const NETSTAT = '/usr/sbin/netstat';
 export const PS = '/bin/ps';
+export const LSOF = '/usr/sbin/lsof';
+// The reason a socket table hides other processes' sockets from this one (FAA-267): macOS 27.2 gives an ad-hoc-signed
+// runtime an empty netstat.
+export const TABLE_RESTRICTED = 'table-restricted';
 export const SERVER_NOT_OWN = 'server-not-own';
 export const SERVER_UNVERIFIED = 'server-unverified';
 export const SERVER_NOT_THIS_WORKSPACE = 'server-not-this-workspace';
@@ -143,6 +147,7 @@ function netstatAddress(text) {
 // leading and the trailing columns, both counted from the header; a header without process:pid is unreadable.
 export function parseNetstat(text) {
   const lines = String(text).split(/\r?\n/);
+  if (!lines.some((line) => line.trim())) throw new TableUnreadable(`${TABLE_RESTRICTED}: netstat printed nothing to this process`);
   const header = lines.findIndex((line) => line.includes('process:pid') && line.includes('Proto'));
   if (header < 0) throw new TableUnreadable('netstat-format: no process:pid column');
   const names = lines[header].split(/\s+/).filter(Boolean);
@@ -165,6 +170,18 @@ export function parseNetstat(text) {
   return rows;
 }
 
+// `lsof -nP -a -p PID -i4TCP -sTCP:LISTEN -Fn`: the `n` lines, 127.0.0.1:47480, *:47480 or [::1]:47480.
+export function parseLsofListeners(text) {
+  const found = [];
+  for (const line of String(text).split(/\r?\n/)) {
+    if (!line.startsWith('n') || !line.includes(':')) continue;
+    const at = line.lastIndexOf(':');
+    const port = line.slice(at + 1);
+    if (/^[0-9]+$/.test(port)) found.push([normHost(line.slice(1, at).replace(/^\[|\]$/g, '')), Number(port)]);
+  }
+  return found;
+}
+
 // `ps -o uid= -p PID`: one number, or nothing when the process is gone.
 export function parsePsUid(text) {
   const t = String(text).trim();
@@ -497,10 +514,25 @@ export function refusal(who, port, expectPid = null) {
   return null;
 }
 
+// macOS, when the socket table is restricted (FAA-267): whether process `pid`, this account's, listens on 127.0.0.1:<port>
+// or the IPv4 wildcard (IPv4 alone: a v6-only wildcard never vouches for a 127.0.0.1 connection). `lsof -p` asks the process itself, which the restriction does not hide. Only a caller that started
+// `pid` itself (a launchd job it installed) may vouch with it.
+export async function pidListens(pid, port, { run = runProgram, platform = process.platform, ownUid: mine } = {}) {
+  if (platform !== 'darwin' || !Number.isInteger(pid) || pid <= 1) return false;
+  try {
+    const uid = parsePsUid(await run(PS, ['-o', 'uid=', '-p', String(pid)]));
+    if (uid === null || uid !== (mine ?? ownUid())) return false;
+    const out = await run(LSOF, ['-nP', '-a', '-p', String(pid), '-i4TCP', '-sTCP:LISTEN', '-Fn']);
+    return parseLsofListeners(out).some(([host, p]) => (host === '127.0.0.1' || host === '*') && p === port);
+  } catch {
+    return false;
+  }
+}
+
 // A connected socket to host:port whose server end is this account's (and, with expectPid, that process's). The check
 // runs on the very socket the caller then writes on, so no listener can change between the check and the request.
 // Rejects with ListenerRefused (the socket destroyed, nothing written) or with the connection's own error.
-export function checkedSocket(port, { host = '127.0.0.1', timeoutMs = 10000, expectPid = null, ...ask } = {}) {
+export function checkedSocket(port, { host = '127.0.0.1', timeoutMs = 10000, expectPid = null, vouchPid = null, ...ask } = {}) {
   return new Promise((resolveSocket, reject) => {
     const socket = net.connect({ host, port, noDelay: true }); // as a plain http.Agent's socket
     const timer = setTimeout(() => socket.destroy(Object.assign(new Error('connect timeout'), { code: 'ETIMEDOUT' })), timeoutMs);
@@ -515,6 +547,11 @@ export function checkedSocket(port, { host = '127.0.0.1', timeoutMs = 10000, exp
         // A reader that throws (an injected one; the readers themselves answer unknown) fails closed.
         who = owner(UNKNOWN, { method: method(), reason: `check: ${err?.name ?? 'Error'}` });
       }
+      if (who.kind === UNKNOWN && String(who.reason ?? '').startsWith(TABLE_RESTRICTED) && vouchPid
+        && await pidListens(vouchPid, port, ask)) {
+        // The table hides other processes (FAA-267); the process this caller started holds the listener.
+        who = owner(THIS_ACCOUNT, { uid: ask.ownUid ?? ownUid(), pid: vouchPid, method: 'lsof-pid' });
+      }
       const refused = refusal(who, port, expectPid);
       if (refused) {
         socket.destroy();
@@ -532,14 +569,15 @@ export function checkedSocket(port, { host = '127.0.0.1', timeoutMs = 10000, exp
 // when it is made. A refusal reaches the request as its 'error', a ListenerRefused. Free sockets do not keep the process
 // alive (Node unrefs them).
 export class CheckedAgent extends http.Agent {
-  constructor({ expectPid = null, ask = {}, ...options } = {}) {
+  constructor({ expectPid = null, vouchPid = null, ask = {}, ...options } = {}) {
     super(options);
     this.expectPid = expectPid;
+    this.vouchPid = vouchPid;
     this.ask = ask;
   }
 
   createConnection(options, callback) {
     checkedSocket(Number(options.port), { host: options.host ?? '127.0.0.1', timeoutMs: options.timeout ?? 10000,
-      expectPid: this.expectPid, ...this.ask }).then((socket) => callback(null, socket), (err) => callback(err));
+      expectPid: this.expectPid, vouchPid: this.vouchPid, ...this.ask }).then((socket) => callback(null, socket), (err) => callback(err));
   }
 }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -177,6 +177,7 @@ export {
   taskUninstall,
   launchdPlist,
   launchdLoaded,
+  launchdPid,
   launchdOverride,
   launchdInstall,
   launchdUninstall,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-supervisors.mjs

@@ -9,7 +9,7 @@ import { DRAIN_SECONDS, SUPERVISOR_ENV, ServiceError, TASK, UNIT } from './fabri
 import { atomicWrite, instanceDirs } from './fabric-paths.mjs';
 import { SUPERVISOR_ARG, markerArguments } from './fabric-lock.mjs';
 import { URI } from './fabric-backups.mjs';
-import { CheckedAgent, ListenerRefused } from './fabric-peer-owner.mjs';
+import { CheckedAgent, ListenerRefused, TABLE_RESTRICTED } from './fabric-peer-owner.mjs';
 import http from 'node:http';
 
 export const DEFAULT_EXIT_TIMEOUT = 15;
@@ -55,13 +55,22 @@ function noMarkerArgument(argv) {
   if (markerArguments(argv).length) throw new ServiceError(`${SUPERVISOR_ARG} is written by the supervisor file's writer; leave it out of the program arguments.`);
 }
 
+// An environment value: read path-aware (secretArgument) only when it reads as a path (it starts as one, has at least two
+// separators and a lower-case word between them), so a release folder under Application Support is no key (FAA-266) while
+// a base64 key whose `/` splits it stays one; any other value keeps the strict secretValue.
+const secretEnvValue = (value) => {
+  const pieces = value.split(/[\\/]/);
+  const path = /^(?:[/~.]|[A-Za-z]:[\\/])/.test(value) && pieces.length >= 3 && pieces.some((x) => /^[a-z][a-z0-9_-]{2,}$/.test(x));
+  return path ? secretArgument(value) : secretValue(value);
+};
+
 function noSecretInSupervisorFile(argv, environment) {
   // No supervisor file carries a secret (service.md): not in an argument, an environment name or its value.
   for (const arg of argv) {
     if (secretArgument(arg)) throw new ServiceError('An argument carries a credential; a supervisor file never does (read it from the token file or a secret reference).');
   }
   for (const [name, value] of Object.entries(environment ?? {})) {
-    if (credentialName(name) || secretValue(String(value))) throw new ServiceError(`Environment ${name} looks like a credential; a supervisor file never carries one.`);
+    if (credentialName(name) || secretEnvValue(String(value))) throw new ServiceError(`Environment ${name} looks like a credential; a supervisor file never carries one.`);
   }
 }
 
@@ -264,7 +273,7 @@ export function launchdPlist(label, programArguments, { workingDirectory, stdout
   const env = { ...environment };
   for (const [name, value] of Object.entries(env)) {
     if (/(TOKEN|SECRET|PASSWORD|KEY)$/.test(name) && !name.endsWith('_FILE')) throw new ServiceError(`Environment variable ${name} looks like a secret; pass a *_FILE path instead.`);
-    if (secretValue(String(value))) throw new ServiceError(`Environment ${name} holds a value shaped like a credential; a plist never carries one.`);
+    if (secretEnvValue(String(value))) throw new ServiceError(`Environment ${name} holds a value shaped like a credential; a plist never carries one.`);
   }
   for (const arg of argv) {
     if (secretArgument(arg)) throw new ServiceError('An argument carries a credential; a plist never does (read it from the token file or a secret reference).');
@@ -302,6 +311,14 @@ export function launchdLoaded(label, { run = defaultRun, platform = process.plat
   return run(['launchctl', 'print', `${launchdDomain(platform, uid)}/${launchdLabel(label)}`])?.status === 0;
 }
 
+// The running pid of this account's launchd job `label`, or null (not running, or not readable).
+export function launchdPid(label, { run = defaultRun, platform = process.platform, uid } = {}) {
+  const result = run(['launchctl', 'print', `${launchdDomain(platform, uid)}/${launchdLabel(label)}`]);
+  if (result?.status !== 0) return null;
+  const hit = /^\s*pid\s*=\s*([0-9]+)\s*$/m.exec(String(result.stdout ?? ''));
+  return hit ? Number(hit[1]) : null;
+}
+
 const OVERRIDE_ROW = /^\s*"([^"]+)"\s*=>\s*(\S+)\s*$/;
 
 /**
@@ -326,7 +343,7 @@ export class ForeignUserAnswer {
 // The well-known answer at a loopback origin, read only on a connection whose server end is this OS account's process
 // (DEC-0154 HA-2): null when nothing answers or the answer is not JSON, a ForeignUserAnswer when the listener is another
 // account's or its owner cannot be told.
-export async function wellKnownOf(origin) {
+export async function wellKnownOf(origin, { vouchPid = null } = {}) {
   const m = /^http:\/\/127\.0\.0\.1:([0-9]{1,5})$/.exec(origin);
   if (!m) {
     try {
@@ -338,7 +355,7 @@ export async function wellKnownOf(origin) {
   }
   // A CheckedAgent without keep-alive: the request goes on the very socket it checked, and the socket closes after the
   // answer, so a poll leaves no connection open behind it.
-  const agent = new CheckedAgent({ keepAlive: false });
+  const agent = new CheckedAgent({ keepAlive: false, vouchPid });
   return new Promise((resolve) => {
     const req = http.request({ host: '127.0.0.1', port: Number(m[1]), path: '/.well-known/fabric-service', agent,
       timeout: 2000 }, (res) => {
@@ -350,7 +367,9 @@ export async function wellKnownOf(origin) {
       res.on('error', () => resolve(null));
     });
     req.on('timeout', () => req.destroy());
-    req.on('error', (err) => resolve(err instanceof ListenerRefused ? new ForeignUserAnswer(`foreign-user: ${err.message}`) : null));
+    req.on('error', (err) => resolve(err instanceof ListenerRefused
+      ? new ForeignUserAnswer(`${String(err.owner?.reason ?? '').startsWith(TABLE_RESTRICTED) ? TABLE_RESTRICTED : 'foreign-user'}: ${err.message}`)
+      : null));
     req.end();
   }).finally(() => agent.destroy());
 }
@@ -390,13 +409,18 @@ export async function launchdInstall(label, plistPath, plistText, { origin, serv
   }
   const deadline = Date.now() + timeout * 1000;
   let foreign = null;
+  let vouchPid = null;
   while (Date.now() < deadline) {
-    const doc = await fetchWellKnown(origin);
+    const doc = await fetchWellKnown(origin, { vouchPid });
     foreign = doc instanceof ForeignUserAnswer ? doc.reason : null;
+    if (foreign?.startsWith(TABLE_RESTRICTED)) vouchPid = launchdPid(label, opts); // only a restricted table needs it (FAA-267)
     if (!foreign && doc?.service?.id === serviceId && doc?.service?.instance === instance) return doc;
     await sleep(500);
   }
   // DEC-0154 HA-2 and service.md's Install row: a listener of another account is never a successful install.
+  if (foreign?.startsWith(TABLE_RESTRICTED)) {
+    throw new ServiceError(`${origin} could not be proved this service's: ${foreign} (DEC-0154 HA-2); this runtime sees no other process's sockets and the job's pid did not show the listener: run the installer from a runtime that sees them, or read the job's log.`);
+  }
   if (foreign) {
     throw new ServiceError(`${origin} is not this service's: ${foreign} (DEC-0154 HA-2); the port is another OS account's or its owner cannot be told.`);
   }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_http.py

@@ -354,6 +354,7 @@ class _CheckedHTTPConnection(_po.CheckedHTTPConnection):
                  **kwargs: Any) -> None:
         http.client.HTTPConnection.__init__(self, host, port, timeout=timeout, **kwargs)
         self.expect_pid = None
+        self.vouch_pid = None  # a loopback URL is never a process this caller started (FAA-267)
 
 
 def _opener(watchdog: _Watchdog, direct: bool = False) -> urllib.request.OpenerDirector:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_peer_owner.py

@@ -1,6 +1,6 @@
 """peer_owner: which OS account owns each end of a loopback TCP connection.
 
-    peer_owner 1.1.0+kit.1: Observatory's peer_owner 1.1.0, vendored into the Fabric service kit as `fabric_peer_owner` (layer L0;
+    peer_owner 1.1.0+kit.2: Observatory's peer_owner 1.1.0, vendored into the Fabric service kit as `fabric_peer_owner` (layer L0;
     DEC-0154 HA-2, FAA-226) from Project Observatory's `observatory/engine/peer_owner.py` at
     commit f86f0622 (passioncode-ai/project-observatory-dashboard, the same licence). It differs
     from that file in this paragraph, in `Owner` and `Row` (NamedTuples here where it has
@@ -15,7 +15,10 @@
     row with inode 0 (a closed client) as unknown, and several rows of one owner are that owner;
     a row printed twice by a `/proc` read under churn counts once, and a `/proc` question that
     finds no row or several reads the table once more; ctypes is imported where it is used, so a
-    Python without it reads netstat on macOS and imports the module everywhere.
+    Python without it reads netstat on macOS and imports the module everywhere. Since kit.2 (FAA-267), on
+    macOS: the sysctl calibration also requires a child process's listener, an empty netstat reads as
+    `TABLE_RESTRICTED`, and a caller may vouch for a listener with a pid it started (`pid_listens`,
+    `parse_lsof_listeners`, `LSOF`, `CheckedHTTPConnection(vouch_pid=...)`).
     A limit /proc sets: it carries a socket's creator and no pid, so a listening socket that root
     created and handed to another account (systemd socket activation with User=) reads as root's. Standard library only, no import of another kit module.
     The kit's tests are `test/test_fabric_peer_owner.py`, over `test/fixtures/peer-owner/`;
@@ -64,6 +67,12 @@ addresses are `unknown` (`several-rows`), never a guess.
   accept) and the listener and both ends of the pair must read back with their exact addresses,
   this process's uid and its pid. A layout that fails calibration is not used again in that
   process.
+- macOS 27.2 restricts both tables for an ad-hoc-signed interpreter (a Homebrew Python, measured on 2026-11-07 on a
+  host agent's Mac): sysctl lists only this process's own sockets and netstat prints nothing. The calibration therefore
+  also requires a child process's listener, and an empty netstat is `unknown` with reason `table-restricted`, never
+  another account's (FAA-267). A caller that started the server itself (an installer and its launchd job) may vouch
+  with that pid: `lsof -p PID` asks the process, which the restriction leaves readable, and `CheckedHTTPConnection`
+  accepts its listener on the port as this account's (`vouch_pid`). Apple's own `/usr/bin/python3` sees the tables.
 - macOS, fallback (`netstat`): `/usr/sbin/netstat -anv -p tcp`, its `process:pid` column, then
   `ps -o uid= -p PID` for the owner of the one row a question needs. Measured: about 20 ms over
   846 sockets, and it names the pids of root's listeners, which `lsof` run by an ordinary account
@@ -100,7 +109,7 @@ import time
 from typing import NamedTuple, Optional, Tuple
 
 # This file's own version, for projects that copy it; not the engine's (that is configuration.VERSION).
-PEER_OWNER_VERSION = "1.1.0+kit.1"  # Observatory's 1.1.0 with the kit's differences above
+PEER_OWNER_VERSION = "1.1.0+kit.2"  # Observatory's 1.1.0 with the kit's differences above
 
 THIS_ACCOUNT = "this-account"
 ANOTHER_ACCOUNT = "another-account"
@@ -120,6 +129,11 @@ LISTENER_TTL = 1.0
 
 NETSTAT = "/usr/sbin/netstat"
 PS = "/bin/ps"
+LSOF = "/usr/sbin/lsof"
+
+#: The reason a socket table hides other processes' sockets from this one (FAA-267: macOS 27.2 shows an ad-hoc-signed
+#: interpreter, such as a Homebrew Python, only its own sockets through sysctl and nothing through netstat).
+TABLE_RESTRICTED = "table-restricted"
 
 #: Client codes of `own_connection` (ListenerRefused.code).
 SERVER_NOT_OWN = "server-not-own"
@@ -221,6 +235,8 @@ def parse_netstat(text: str) -> list[Row]:
     `process:pid` column is what is left between the leading and the trailing columns, both
     counted from the header. A header without `process:pid` (an older macOS) is unreadable."""
     lines = text.splitlines()
+    if not any(line.strip() for line in lines):
+        raise TableUnreadable(f"{TABLE_RESTRICTED}: netstat printed nothing to this process")
     header = next((i for i, line in enumerate(lines) if "process:pid" in line and "Proto" in line), None)
     if header is None:
         raise TableUnreadable("netstat-format: no process:pid column")
@@ -259,6 +275,18 @@ def _netstat_address(text: str) -> Optional[tuple[str, int]]:
         return None
 
 
+def parse_lsof_listeners(text: str) -> list[tuple[str, int]]:
+    """`lsof -nP -a -p PID -i4TCP -sTCP:LISTEN -Fn`: the `n` lines, `127.0.0.1:47480`, `*:47480` or `[::1]:47480`."""
+    found: list[tuple[str, int]] = []
+    for line in text.splitlines():
+        if not line.startswith("n") or ":" not in line:
+            continue
+        host, port = line[1:].rsplit(":", 1)
+        if port.isdigit():
+            found.append((norm_host(host.strip("[]")), int(port)))
+    return found
+
+
 def parse_ps_uid(text: str) -> Optional[int]:
     """`ps -o uid= -p PID`: one number, or nothing when the process is gone."""
     text = text.strip()
@@ -468,10 +496,47 @@ def calibration_holds(rows: list[Row], server: tuple[str, int], client: tuple[st
     return (one(server, ("*", 0), True) and one(server, client, False) and one(client, server, False))
 
 
+_CHILD_LISTENER = ("import socket,sys\ns=socket.socket();s.bind(('127.0.0.1',0));s.listen(1)\n"
+                   "print(s.getsockname()[1],flush=True);sys.stdin.read()")
+
+
+def _child_listener_seen(rows_of) -> Optional[bool]:
+    """Whether the table shows a listener of a child process of this one: False when it does not (the table shows
+    this process alone, FAA-267), None when no child could be started or did not answer within TIMEOUT_SECONDS (a
+    frozen or embedded host has no interpreter to start). The calibration trusts only True."""
+    if not sys.executable or getattr(sys, "frozen", False):
+        return None
+    try:
+        child = subprocess.Popen([sys.executable, "-I", "-c", _CHILD_LISTENER], stdin=subprocess.PIPE,
+                                 stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
+    except OSError:
+        return None
+    try:
+        import select  # POSIX: this reader runs on macOS alone
+        if not select.select([child.stdout], [], [], TIMEOUT_SECONDS)[0]:
+            return None
+        line = child.stdout.readline().strip()
+        if not line.isdigit():
+            return None
+        port = int(line)
+        return any(r.listening and r.local == ("127.0.0.1", port) and r.pid == child.pid for r in rows_of())
+    except (TableUnreadable, OSError, struct.error, ValueError):
+        return False
+    finally:
+        try:
+            child.stdin.close()
+            child.wait(timeout=TIMEOUT_SECONDS)
+        except (OSError, subprocess.TimeoutExpired):
+            child.kill()
+            child.wait()
+        child.stdout.close()
+
+
 def _calibrate_sysctl() -> bool:
     """Open a connected pair of this process's own (listen, connect, accept) and read it back
-    (`calibration_holds`). A layout that does not hold is never trusted in this process, and
-    `netstat` answers instead."""
+    (`calibration_holds`), then require a child process's listener in the table too: a table that shows this process
+    alone (FAA-267) would pass the first check and find nobody else. A layout that does not hold is never trusted in
+    this process, and `netstat` answers instead."""
     probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     client = accepted = None
     try:
@@ -480,8 +545,10 @@ def _calibrate_sysctl() -> bool:
         client = socket.create_connection(probe.getsockname(), timeout=TIMEOUT_SECONDS)
         accepted, _ = probe.accept()
         rows = parse_pcblist_n(_sysctl_blob())
-        return calibration_holds(rows, _address(probe.getsockname()), _address(client.getsockname()),
-                                 uid=_posix_uid(), pid=os.getpid())
+        if not calibration_holds(rows, _address(probe.getsockname()), _address(client.getsockname()),
+                                 uid=_posix_uid(), pid=os.getpid()):
+            return False
+        return _child_listener_seen(lambda: parse_pcblist_n(_sysctl_blob())) is True
     except (TableUnreadable, OSError, struct.error, ValueError):
         return False
     finally:
@@ -805,6 +872,23 @@ def refusal(owner: Owner, port: int, expect_pid: Optional[int] = None) -> Option
     return None
 
 
+def pid_listens(pid: int, port: int) -> bool:
+    """macOS, when the socket table is restricted (FAA-267): whether process `pid`, this account's, listens on
+    127.0.0.1:<port> or the IPv4 wildcard (IPv4 alone: a v6-only wildcard never vouches for a 127.0.0.1 connection).
+    `lsof -p` asks the process itself (libproc), which the restriction does not hide. Only a caller that started `pid`
+    itself (a launchd job it installed) may vouch with it."""
+    if sys.platform != "darwin" or not isinstance(pid, int) or isinstance(pid, bool) or pid <= 1:
+        return False
+    try:
+        uid = parse_ps_uid(_run([PS, "-o", "uid=", "-p", str(pid)]))
+        if uid is None or uid != _posix_uid():
+            return False
+        out = _run([LSOF, "-nP", "-a", "-p", str(pid), "-i4TCP", "-sTCP:LISTEN", "-Fn"])
+    except TableUnreadable:
+        return False
+    return any(host in ("127.0.0.1", "*") and p == port for host, p in parse_lsof_listeners(out))
+
+
 class CheckedHTTPConnection(http.client.HTTPConnection):
     """An `http.client.HTTPConnection` whose every `connect()` checks the server end before
     returning. `http.client` connects again by itself (`auto_open`) when the server answered
@@ -812,9 +896,11 @@ class CheckedHTTPConnection(http.client.HTTPConnection):
     different listener; so the check is in `connect()`, not once in `own_connection`. A refused
     connect closes the socket and raises ListenerRefused before any byte of a request is sent."""
 
-    def __init__(self, host: str, port: int, *, expect_pid: Optional[int] = None, timeout: float = 10.0) -> None:
+    def __init__(self, host: str, port: int, *, expect_pid: Optional[int] = None, timeout: float = 10.0,
+                 vouch_pid: Optional[int] = None) -> None:
         super().__init__(host, port, timeout=timeout)
         self.expect_pid = expect_pid
+        self.vouch_pid = vouch_pid
 
     def set_tunnel(self, *args, **kwargs):  # noqa: D401 - a tunnel would put a proxy's socket under the check
         raise ListenerRefused(SERVER_UNVERIFIED, "a tunnel would check the proxy, not the server; nothing was sent")
@@ -822,6 +908,10 @@ class CheckedHTTPConnection(http.client.HTTPConnection):
     def connect(self) -> None:
         super().connect()
         owner = server_end(self.sock)
+        if (owner.kind == UNKNOWN and (owner.reason or "").startswith(TABLE_RESTRICTED) and getattr(self, "vouch_pid", None)
+                and pid_listens(self.vouch_pid, self.port)):
+            # The table hides other processes (FAA-267); the process this caller started holds the listener.
+            owner = Owner(THIS_ACCOUNT, _posix_uid(), self.vouch_pid, "lsof-pid")
         refused = refusal(owner, self.port, self.expect_pid)
         if refused is not None:
             self.close()
@@ -829,7 +919,7 @@ class CheckedHTTPConnection(http.client.HTTPConnection):
 
 
 def own_connection(port: int, *, expect_pid: Optional[int] = None, timeout: float = 10.0,
-                   host: str = "127.0.0.1") -> CheckedHTTPConnection:
+                   host: str = "127.0.0.1", vouch_pid: Optional[int] = None) -> CheckedHTTPConnection:
     """A `CheckedHTTPConnection` to `host:port`, connected, whose server end is this account's
     (and, with `expect_pid`, that process's). The check runs on the very connection the caller
     then sends on, so no listener can change between the check and the request, and it runs
@@ -839,7 +929,10 @@ def own_connection(port: int, *, expect_pid: Optional[int] = None, timeout: floa
         server-not-own             another account's or the system's process accepted it
         server-unverified          its owner could not be told (nothing is sent: fail closed)
         server-not-this-workspace  this account's process, but not the pid expected
+
+    `vouch_pid`, as on `CheckedHTTPConnection` and the Node twin's `checkedSocket`: a pid the caller started
+    (FAA-267).
     """
-    conn = CheckedHTTPConnection(host, port, expect_pid=expect_pid, timeout=timeout)
+    conn = CheckedHTTPConnection(host, port, expect_pid=expect_pid, timeout=timeout, vouch_pid=vouch_pid)
     conn.connect()
     return conn

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -314,6 +314,7 @@ from fabric_supervisors import (  # noqa: F401
     _launchctl,
     _domain,
     launchd_loaded,
+    launchd_pid,
     fetch_well_known,
     _OVERRIDE_ROW,
     launchd_override,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_supervisors.py

@@ -53,6 +53,20 @@ def _no_marker_argument(argv: Sequence[str]) -> None:
         raise ServiceError("%s is written by the supervisor file's writer; leave it out of the program arguments" % SUPERVISOR_ARG)
 
 
+_PATH_ANCHOR = re.compile(r"^(?:[/~.]|[A-Za-z]:[\\/])")
+_PATH_WORD = re.compile(r"[a-z][a-z0-9_-]{2,}")
+
+
+def _secret_env_value(value: str) -> bool:
+    """An environment value: read path-aware (`secret_argument`) only when it reads as a path (it starts as one, has at
+    least two separators and a lower-case word between them), so a release folder under Application Support is no key
+    (FAA-266) while a base64 key whose `/` splits it stays one; any other value keeps the strict `secret_value`."""
+    import fabric_secrets  # noqa: E402 - beside this file; the contract's detector (DEC-0044)
+    pieces = re.split(r"[\\/]", value)
+    path = bool(_PATH_ANCHOR.match(value)) and len(pieces) >= 3 and any(_PATH_WORD.fullmatch(x) for x in pieces)
+    return fabric_secrets.secret_argument(value) if path else fabric_secrets.secret_value(value)
+
+
 def _no_secret_in_supervisor_file(argv: Sequence[str], environment: Optional[Dict[str, str]]) -> None:
     """No supervisor file carries a secret (service.md): not in an argument, an environment name or its value."""
     import fabric_secrets  # noqa: E402 - beside this file; the contract's detector (DEC-0044)
@@ -60,7 +74,7 @@ def _no_secret_in_supervisor_file(argv: Sequence[str], environment: Optional[Dic
         if fabric_secrets.secret_argument(arg):
             raise ServiceError("an argument carries a credential; a supervisor file never does (read it from the token file or a secret reference)")
     for name, value in (environment or {}).items():
-        if fabric_secrets.credential_name(name) or fabric_secrets.secret_value(str(value)):
+        if fabric_secrets.credential_name(name) or _secret_env_value(str(value)):
             raise ServiceError("environment %s looks like a credential; a supervisor file never carries one" % name)
 
 
@@ -263,7 +277,7 @@ def launchd_plist(label: str, program_arguments: Sequence[str], *, working_direc
     for key, value in env.items():
         if re.search(r"(TOKEN|SECRET|PASSWORD|KEY)\Z", key) and not key.endswith("_FILE"):
             raise ServiceError("Environment variable %s looks like a secret; pass a *_FILE path instead." % key)
-        if fabric_secrets.secret_value(str(value)):
+        if _secret_env_value(str(value)):  # path-aware only for a path: a release folder is no key (FAA-266)
             raise ServiceError("Environment %s holds a value shaped like a credential; a plist never carries one." % key)
     for arg in argv:
         if fabric_secrets.secret_argument(arg):
@@ -307,19 +321,37 @@ def launchd_loaded(label: str) -> bool:
     return _launchctl("print", "%s/%s" % (_domain(), label)).returncode == 0
 
 
-def _read_well_known(origin: str, timeout: float = 2.0) -> Tuple[Optional[Dict[str, Any]], Optional[str]]:
+_PID_ROW = re.compile(r"^\s*pid\s*=\s*(\d+)\s*\Z")
+
+
+def launchd_pid(label: str) -> Optional[int]:
+    """The running pid of this account's launchd job ``label``, or None (not running, or not readable)."""
+    result = _launchctl("print", "%s/%s" % (_domain(), label))
+    if result.returncode != 0:
+        return None
+    for line in (result.stdout or "").splitlines():
+        hit = _PID_ROW.match(line)
+        if hit:
+            return int(hit.group(1))
+    return None
+
+
+def _read_well_known(origin: str, timeout: float = 2.0,
+                     vouch_pid: Optional[int] = None) -> Tuple[Optional[Dict[str, Any]], Optional[str]]:
     """(the well-known answer or None, why the listener was refused or None). A loopback origin is read only on a
     connection whose server end is this OS account's process (DEC-0154 HA-2): another account's, root's, or one whose
-    owner cannot be told is `foreign-user`, never this service's answer."""
+    owner cannot be told is `foreign-user`, never this service's answer. `vouch_pid`, the pid of a launchd job this
+    caller started, proves the listener when the socket table hides other processes (FAA-267)."""
     parts = urllib.parse.urlsplit(origin)
     if parts.scheme == "http" and parts.hostname == "127.0.0.1" and parts.port:
-        conn = _po.CheckedHTTPConnection("127.0.0.1", parts.port, timeout=timeout)
+        conn = _po.CheckedHTTPConnection("127.0.0.1", parts.port, timeout=timeout, vouch_pid=vouch_pid)
         try:
             conn.request("GET", "/.well-known/fabric-service", headers={"Host": "127.0.0.1:%d" % parts.port})
             response = conn.getresponse()
             return (json.loads(response.read().decode()) if response.status == 200 else None), None
         except _po.ListenerRefused as exc:
-            return None, "foreign-user: %s" % exc
+            restricted = exc.owner is not None and (exc.owner.reason or "").startswith(_po.TABLE_RESTRICTED)
+            return None, "%s: %s" % (_po.TABLE_RESTRICTED if restricted else "foreign-user", exc)
         except (OSError, ValueError, http.client.HTTPException):
             return None, None
         finally:
@@ -392,14 +424,20 @@ def launchd_install(label: str, plist_path: Path, plist_bytes: bytes, *, origin:
     else:
         raise ServiceError("launchctl bootstrap failed: %s" % last)
     deadline = time.time() + timeout
-    foreign = None
+    foreign = vouch = None
     while time.time() < deadline:
-        doc, foreign = _read_well_known(origin)
+        doc, foreign = _read_well_known(origin, vouch_pid=vouch)
+        if foreign and foreign.startswith(_po.TABLE_RESTRICTED):
+            vouch = launchd_pid(label)  # only a restricted table needs the job's pid (FAA-267)
         if doc and doc.get("service", {}).get("id") == service_id and doc.get("service", {}).get("instance") == instance:
             return doc
         time.sleep(0.5)
     if foreign:
         # DEC-0154 HA-2 and service.md's Install row: a listener of another account is never a successful install.
+        if foreign.startswith(_po.TABLE_RESTRICTED):
+            raise ServiceError("%s could not be proved this service's: %s (DEC-0154 HA-2); this interpreter sees no other "
+                               "process's sockets and the job's pid did not show the listener: run the installer from "
+                               "Apple's /usr/bin/python3, or read the job's log." % (origin, foreign))
         raise ServiceError("%s is not this service's: %s (DEC-0154 HA-2); the port is another OS account's or its owner "
                            "cannot be told." % (origin, foreign))
     raise ServiceError("%s did not answer as %s.%s within %.0f s; read its log." % (origin, service_id, instance, timeout))

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/kit.json

@@ -1,6 +1,6 @@
 {
  "name": "fabric-service-kit",
- "version": "0.75.0",
+ "version": "0.76.0",
  "about": "The service kit's modules in dependency order: a module imports only modules listed before it. Written by fabric_kit.py build; edit the order and layers by hand, never the digests.",
  "python": [
   {
@@ -38,7 +38,7 @@
    "file": "fabric_peer_owner.py",
    "layer": "L0",
    "imports": [],
-   "sha256": "3d66b1084c0b8b11ccfc4c66c1b32751ea237df03d864bfc0661d1a2e4665338"
+   "sha256": "628c8e56eb067ecb7c343a606f8c75661257d7f349c47d9628449850d41d1f78"
   },
   {
    "module": "fabric_crypto",
@@ -338,7 +338,7 @@
     "fabric_peer_owner",
     "fabric_secrets"
    ],
-   "sha256": "bf5aac4034468f966cefae28dcbdca7f04f42fe73aefd1bac1b377cf4bda2b74"
+   "sha256": "1ebf842de248ff0f154939ae6c9d5d0229b3358aecaefea07a80ed1b8755ac70"
   },
   {
    "module": "fabric_service",
@@ -362,7 +362,7 @@
     "fabric_time",
     "fabric_usage"
    ],
-   "sha256": "4b13f90aa26881fbfe0d9f3077fbb3552f3ce0a3c59279d6baa92df872867d8d"
+   "sha256": "73082f69844739708732f6331742e00f17d27385d3c3efa3331a1fd61b523595"
   },
   {
    "module": "fabric_profiles",
@@ -494,7 +494,7 @@
     "fabric_jsvalue",
     "fabric_peer_owner"
    ],
-   "sha256": "e02b049b40eaabd994d93c7b084ee34ef3a78b5cbb61303b8e519b906af3c27a"
+   "sha256": "b11b9930c3f0ab911a9cd325086a4c07a5ed4c246799d290f6085245669f4994"
   },
   {
    "module": "fabric_openrouter",
@@ -542,7 +542,7 @@
    "file": "fabric-peer-owner.mjs",
    "layer": "L0",
    "imports": [],
-   "sha256": "0e65d59bc1048a5635c8ac04e73fe4fd1f34094902ced1580859017e5ca5a991"
+   "sha256": "0d5a52385127546dea797e2dec36daeec6e05b04fdef04c1d8fd1ecf8db1a4e8"
   },
   {
    "module": "fabric-crypto",
@@ -841,7 +841,7 @@
     "fabric-peer-owner",
     "fabric-secrets"
    ],
-   "sha256": "e33b2b8916aeed617eee6233e05bd637bb4ecd87064248fd7ea08fdfcd45d375"
+   "sha256": "de6468aa2876be437a374499dd084281a10d62c3fd23bd7c65285da3ee282ce2"
   },
   {
    "module": "fabric-service",
@@ -863,7 +863,7 @@
     "fabric-supervisors",
     "fabric-usage"
    ],
-   "sha256": "297fef11ac76dc831d12d24c5581b7a93587c300c20664db703b3f924c0f9f1a"
+   "sha256": "2fec45eb56d4a9ddc479f05d99abda4d2bb324746e94c156d96157462b824de0"
   },
   {
    "module": "fabric-profiles",
@@ -6061,6 +6061,98 @@
    "fabric-openrouter.mjs": "6041f3ab30f516658e1dbab4897a651cc8509b2136cfa8e769802c6b40ec2f35",
    "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
    "share-registration.schema.json": "34b3997eeaf936ebc861342a23045634a7c18c19f01d7ed4198310d81989f5b0"
+  },
+  "0.76.0": {
+   "fabric_jsvalue.py": "052f1b40bab18600b3731dbdca27cbff17588c21d9458fa6241efd1340d0e09a",
+   "fabric_time.py": "588f383da4ac6a243ea95b6ffc3a0aa99ca94245732dc4937734f190b7af4ae9",
+   "fabric_identifiers.py": "0fd814d521ac3aa39907458265870753046a73f48af3d8581ab864b93b211607",
+   "fabric_secrets.py": "53c5df8d6f2c87433c288853bfaad9a43f544789bdf1e39bda8d3ff14485c89d",
+   "fabric_peer_owner.py": "628c8e56eb067ecb7c343a606f8c75661257d7f349c47d9628449850d41d1f78",
+   "fabric_crypto.py": "9c34aee20dbe4d6742e4fdbaab68ceb934bbe7dbd3a904c0010824ace16cdeaa",
+   "fabric_base.py": "f62bcc2ed9912660fa875d27a09f60867260cc4925f79873501fd9620be59611",
+   "fabric_platform.py": "a9350dff55ef0fb3a23cdb4d0320a15868b15a8deb10d2eb74d72c58740c284b",
+   "fabric_paths.py": "8a1ee742f80f436e9f28c61b4f049a9545de2a9e0d66bfc61faa6ee5d1ba3734",
+   "fabric_estate_rules.py": "8b36a7f4108d9c2b1fb38c8bff344778c807bed631a99b4a563ecb0a49c10b1c",
+   "fabric_estate.py": "0737ae1d1bb12586bae49de1f15ef1348bc207b5007cced9dad4c55bb5870874",
+   "fabric_mandate.py": "fb19ce5359606bd6e3352ab02b2a12f49605ec6e5c49b55cce1f79c831325044",
+   "fabric_delegation.py": "716f0ff7ac01095f54b24970beac1962128e8ff33026b243fc0467876142ab03",
+   "fabric_share.py": "da36a466426fc29dd7dd40013167f3959a18375f8fedd228bf64f298cec1040c",
+   "fabric_ceremonies.py": "a59e83cf4adb2669a9b98008e3d3a0cba991a35cbff97bc604fc82fe81cfd49f",
+   "fabric_package_schema.py": "e623f0408d38e3343ed66222fb812907c6c52e1a286eb1c1176ab2e64640c9ad",
+   "fabric_package.py": "1f2b9e73b2b32a7e1e887d4b69f87c6e21b4d1227ad924a235334223e6dd51ca",
+   "fabric_protocols.py": "077c6f03f3b887a2e22d9ce6b5bd3750199d71a29d4c82b1d5af8a615b509d93",
+   "fabric_actions.py": "ae21d1199614c4f74d1dcd1e0a87107a9d52434cd9e2d64aa24a7b1e196fb723",
+   "fabric_connections.py": "7de55cb7d808f756d650effabfaa12027d40a5bd5d2f6d448c32969d47529ecb",
+   "fabric_a2a.py": "8b01502131215bb4de1c01866187c56e99b791543923ed8577535573db33b919",
+   "fabric_page_links.py": "1b57ea573c550e2f90d1ec3edcc655917ceaa0db9dd1635fccf422ec3024d25e",
+   "fabric_lock.py": "dfaf92a7086cbb097d832a305869b7964e2d2a9da0e3365c8ec1685a7bb4fef9",
+   "fabric_usage.py": "5cc2e03ccc5b06e81987ed7bc3eead7a7e6cbf1a7cb8e05c6c64315eed9d91b6",
+   "fabric_backups.py": "1f3f0d7ecf361b29e9101e07f1c53e5dc304d598bf26fd59ec89f16b9fed2420",
+   "fabric_descriptor.py": "c08c91ca0960c694ed7677e7e9247d6307c7b63f37a7e614db022c080cd92ccc",
+   "fabric_context.py": "6ae311ddc7217a4aff915e7ce2646486931acd128462b7bebe4a52bbb5fbb6c7",
+   "fabric_auth.py": "74ccc10239b65a3567cec5213a7b344cbd88d6eee1fd1c5f7be1d6daf985993c",
+   "fabric_events.py": "cd94b186e2a8f8cb4ad2b6bd44d83ec5021933075e28c5d655f387f16dff42b8",
+   "fabric_logs.py": "86dc55bfafa2a57264722e2403510a249b95de0e4a722b2e4bc3948e3bd93da9",
+   "fabric_supervisors.py": "1ebf842de248ff0f154939ae6c9d5d0229b3358aecaefea07a80ed1b8755ac70",
+   "fabric_service.py": "73082f69844739708732f6331742e00f17d27385d3c3efa3331a1fd61b523595",
+   "fabric_profiles.py": "26e21ec29c016000f8ca8053b7b489184854a73be1b7fdc0a18d12990203db9b",
+   "fabric_interop_rules.py": "9bdb7989e57b9d0b0d15eb9982d396499823a5e2c528230b71c67866c736e0f5",
+   "fabric_interop.py": "d27e31834611a37cf2a117746f2f60fc187ccc48718eb546ff923c5d0fce7dea",
+   "fabric_hub.py": "c261a81616c52f603eb28cc12ec4034dc479f0517328a65f0dc48d436cf0708b",
+   "fabric_board_shapes.py": "0a0e8d3d40e33dfd8c457aedb85330b2ff25f8c49a33eb6cbd5a5cc8a5007f7e",
+   "fabric_board_link.py": "052bc3c474ece835bb428c37ca864810d04e394d991ddb9c93989a7a825073a5",
+   "fabric_board_slots.py": "92b065e3df935547cf46653245f1129e4a1f8b59b0a41e8fa9ffdc41596ee592",
+   "fabric_board_session.py": "1fd3c3884f3044b56a40f78b33ff88dcac9272284f6681ea359c662879826f7e",
+   "fabric_board_fixture.py": "69761ce205ec640762ec9b591c6903e5a87f844e8d423b041681924027e39d1e",
+   "fabric_board.py": "f86c40b8291f8c818f6924910f4022b013d5fd107abaf8825dd0aa6c5e418638",
+   "fabric_http.py": "b11b9930c3f0ab911a9cd325086a4c07a5ed4c246799d290f6085245669f4994",
+   "fabric_openrouter.py": "d06a40f83f2fb8bd441ab3485ae882f1fbdd9cd7a9c1ec175eb47cb8ae2cce81",
+   "fabric-jsvalue.mjs": "dfbdb8c41584972c9389750a41719374a1cfc5652ed438dd1623025190b0106e",
+   "fabric-time.mjs": "3ff932069038a720df1c68c6492976906737b2e67e5c12d9c81c418597f661de",
+   "fabric-identifiers.mjs": "a18c2a501a4aa170bfd3d99e571ad6b7662649b4d3b9d2a540c002ea42811bbf",
+   "fabric-secrets.mjs": "5822a7e25ecf2e87b5bab4f99c1074af7379d8b49e2784283b5d7d8c25022cde",
+   "fabric-peer-owner.mjs": "0d5a52385127546dea797e2dec36daeec6e05b04fdef04c1d8fd1ecf8db1a4e8",
+   "fabric-crypto.mjs": "038e03689701e3c9721a1e7f8e0a4d02a52d6a5d1661b0dc84035edc3ebbfcf6",
+   "fabric-base.mjs": "7804b2df7715dbbf9702a9b61b6b8cef2110f9a52b04cabd8fb0a66458d87512",
+   "fabric-platform.mjs": "a8119d95ebba4d589a9e401f5d6fc8dda62d59d44e4c1ff811d97fac3771ac0c",
+   "fabric-paths.mjs": "aa630d611e748a899e7043480f4a4e46b444f2e15ff945f30c2fbef21c1ceea5",
+   "fabric-estate-rules.mjs": "7476be71174aa5b1026134f2b335abf647feaa55584e2f9de8618e3054aa8e1e",
+   "fabric-estate.mjs": "e8a2e62d2313121e6cb502f6e6abad94d1d546a44b4d9b3ce2be29e7808e8cf3",
+   "fabric-mandate.mjs": "b70f3de03a659e60bba7b5a0580b3582825cd7b8a8e30a28c79621919ec5b7bb",
+   "fabric-delegation.mjs": "8f63a63aab9a8746b7f664720b87e9398137d01b8d50880974d5070038e414a0",
+   "fabric-share.mjs": "bfb26581c21ad984c2a337da02429f9f3a165cc582f8ba48de4d3dfb7d163a59",
+   "fabric-ceremonies.mjs": "117d4374c9e95c930a38de7adbd4323774798f4fe6ec6f24afcd6f2c7298ca44",
+   "fabric-package-schema.mjs": "cd28092375db0fc21ffab1f0bb7794f7f8979ee08c64d3b9faf4b3845357caa6",
+   "fabric-package.mjs": "8cfb32eebbd4e1bcf28a6e4437344ae2dd54479b0e7c820f002e9f94ab9ecaad",
+   "fabric-protocols.mjs": "a560b7d6eb0d26204c5536711c3dda9daae90cc91e07cdc75412e75c86272767",
+   "fabric-actions.mjs": "06e42f5e24c96311d5417d0d1effa93479ef7128a7ab139903b2bcf59253f6be",
+   "fabric-connections.mjs": "303432e547ce563e90ca9ffcd827f5612f51d3582929834e1add0fdaf6485dcc",
+   "fabric-a2a.mjs": "51b72fe1d80649d659fcad3a8f96370db3476c4a7b30cbabd8522c138be69346",
+   "fabric-page-links.mjs": "a8834926e9d4bbf7c4857f551451d2ebf6ac8873bbccaaf89c5e30cf45b17ee6",
+   "fabric-lock.mjs": "02cf833c97a07a8b3c788f9c93f70c4b9c9066efa25318dccf0038e0fc79717f",
+   "fabric-usage.mjs": "1c4d18004639409624ac3516a02f2b60bbf55abdb612e9a96c37e83666eb87a7",
+   "fabric-backups.mjs": "cfd8c9085e3d597a783099c2bd2ffe2f3faa0daaadab46dedd30523894cfeb06",
+   "fabric-descriptor.mjs": "7c0ef7d245c037eb9e859ab481f6e66fb3e5ef2cf6d1e0a8d32b6d303097ca43",
+   "fabric-context.mjs": "1112d695e872f9825cbc94f08484974bff3880087bc29b8be59f885f03e8f7be",
+   "fabric-auth.mjs": "10ff37a39f9e3adb4d0f05db66c45f49b10eef582e9220c213907964109d7e52",
+   "fabric-events.mjs": "c463d6ffcae24229a5c608d8fcea4268d2ccc5024b19fa10e5a452284068fa71",
+   "fabric-logs.mjs": "58467e5719c16e099d05bbedec47a95712506ab03c33f3cd4be1252e8498a946",
+   "fabric-supervisors.mjs": "de6468aa2876be437a374499dd084281a10d62c3fd23bd7c65285da3ee282ce2",
+   "fabric-service.mjs": "2fec45eb56d4a9ddc479f05d99abda4d2bb324746e94c156d96157462b824de0",
+   "fabric-profiles.mjs": "314376cf2deb87f235fb18b11d3b532e211f585b9af0a9302b5f4cc39971b532",
+   "fabric-interop-rules.mjs": "b4e386c359a48e49ffff8a842215760c18a7c98a0af4754a808a35fb2820d458",
+   "fabric-interop.mjs": "989040aed33b2712a258244192bdf70e811a51076aa1b62f2adc2a6db051dbed",
+   "fabric-hub.mjs": "73ab07f72320a50042f39b52893b563157be2ac94615614416df45a796eac988",
+   "fabric-board-shapes.mjs": "c1db7b7bd0d58d82bb6d8dfbc3cd1547a256a333052d367e82ff1b3edf2804d7",
+   "fabric-board-link.mjs": "6e7d51f4fd9730d93455f50dd30e97907b8b9e1ca65a1d69f036f2e8ec05cc0d",
+   "fabric-board-slots.mjs": "fc77a3c6e62aa18575568bef4f703cce2edaba8cef648813ebcdbb21bdc27a11",
+   "fabric-board-session.mjs": "18555962e5f6d18080a3e7971c4c6640452542f6042d07917e7ebc073721c415",
+   "fabric-board-fixture.mjs": "83c4b7e33ee47b68385faf2569d38d5c8a0c5cb0f8656090f41e1b0eed2f436e",
+   "fabric-board.mjs": "15fbb4441fcf7d2f285375b75de64ad6cffea129c515084c110245376b07775f",
+   "fabric-http.mjs": "b83b4c0c208763d56c3eebda5fe9e4a46d595cd91227699bf6876e65a3c7f9b9",
+   "fabric-openrouter.mjs": "6041f3ab30f516658e1dbab4897a651cc8509b2136cfa8e769802c6b40ec2f35",
+   "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
+   "share-registration.schema.json": "34b3997eeaf936ebc861342a23045634a7c18c19f01d7ed4198310d81989f5b0"
   }
  },
  "data": {

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.75.0"
+  version: "0.76.0"
   contract-version: "0.1.0"
   contract-commit: "18f8d48762edc5bfb1433657cbfe1c16196df1a6"
 ---

package/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -18,7 +18,7 @@ compatibility: >-
   this plugin; Codex/Kimi use command hooks; Hermes/OpenCode/OpenClaw/Pi use native context plugins after opt-in.
 metadata:
   author: PassionCode.ai
-  version: "0.75.0"
+  version: "0.76.0"
 ---
 
 # Working with Fabric

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session_env.py

@@ -58,7 +58,7 @@ SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 
 
-VERSION = "0.75.0"
+VERSION = "0.76.0"
 
 
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",