@passioncode-ai/fabric-agent-adapter 0.78.0 → 0.80.2

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/estate-record.md

@@ -98,6 +98,15 @@ gate = fd.delegation_gate(audience=..., jwks=keys, issuer=pin["iss"], effects=..
                           estate_context="org:acme-rehearsal")     # the context fabric_context started it for
 ```
 
+`fabric_context.context_gate_options(info, record)` / `contextGateOptions(info, record)` hands both back from the
+instance `hold_context_instance` started (FAA-150): `estate_context` always, and `issuer` when the record pins that
+organization; spread it after the estate issuer, so a personal instance keeps the estate's:
+
+```python
+gate = fd.delegation_gate(audience=..., jwks=keys, effects=..., estate=lambda: current,
+                          **{"issuer": estate_issuer, **fabric_context.context_gate_options(info, current)})
+```
+
 The `kid` is then certified only when exactly one machine lists it for that context with the published key and the
 revision pins the organization; omitted or `personal`, the personal `hubKey` is read. A context key never verifies a
 personal token, the personal key never an organization's, and a context that is neither (`Org:x`, a trailing space, a
@@ -218,7 +227,9 @@ const { dirs, instance, lock } = await holdContextInstance('example-agent', 'org
   kept; another context or instance, or unreadable, releases the lock and refuses. The folder never changes context.
 
 A refusal is one sentence on stderr naming the code and the context, never a record or grant value, and exit 78
-(`EXIT_CONTEXT_REFUSED`, EX_CONFIG; 75 stays "already running"). `ContextRefused` carries the code:
+(`EXIT_CONTEXT_REFUSED`, EX_CONFIG; 75 stays "already running"); a copy its supervisor started waits the lock's
+back-off (300 s in all) before that exit, so `KeepAlive` does not restart it every 10 s (FAA-279). `ContextRefused`
+carries the code:
 
 | Code | When |
 |---|---|

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md

@@ -125,6 +125,7 @@ action it also carries the operator's decision, [Actions](#actions)), act on eve
 (`jobs.quotaExhausted(id, message, {retryable, resetsAt})`, `jobCallerAction`, `intentIdempotencyKey`). The guidance
 for an agent's own design is in `creating-fabric-agents/references/resilience-and-autonomy.md`.
 
+<a id="a-nodes-call-queue"></a>
 **A node's call queue (DEC-0104).** A provider that queues refuses a start past its queue with `queue-full`: an `isError`
 result with one text item whose JSON is `{error: {code: "queue-full", message, data: {retryable, retryAfterSeconds}}}`,
 never `structuredContent`; the caller starts again after `retryAfterSeconds` under the same key. Read that refusal
@@ -132,9 +133,31 @@ from the start's own `isError` result, before any answer reaches `job_caller_act
 job, and `queue-full` never ends one, so they answer a job it ended `invalid` (`QUEUE_FULL` names the code, and the
 kit's job store refuses to end a job with it). The kit has no reader for the refusal yet (FAA-103). Through Fabric's hub
 a caller today sees `product-error` instead, kept under the key for 24 hours, until the hub relays `queue-full`
-(Fabric CO-376). The kit does not queue: it declares no load extension (`extensions/load/0.1`) and serves no
-`fabric.job.list`, so its `unknown-job` and repeated keys keep the rules above. A node that will queue needs
-`jobCallerKey`, the contract's `agent-network.json` vectors and the load report first (FAA-103).
+(Fabric CO-376). The kit's job store does not queue by itself: it declares no load extension (`extensions/load/0.1`)
+and serves no `fabric.job.list`, so its `unknown-job` and repeated keys keep the rules above.
+
+A node that queues takes the contract's reference functions from the kit instead of copying them (since 0.80.0,
+FAA-289): `fabric_load.py` and `fabric-load.mjs`, exported by both facades, held to the contract's
+`fixtures/vectors/agent-network.json` and its `job-queue`, `service-load` and `service-well-known-load` fixtures at the
+pin (vendored as `test/fixtures/contract/load-vectors.json` by `make_load_vectors.mjs`):
+
+| Python | Node | What |
+|---|---|---|
+| `job_caller_key(accepted, credential)` | `jobCallerKey` | the caller's opaque key: an accepted delegation's `principal`, `caller` and a partner organization ending the chain, else the credential; `None` / `undefined` for a refused or unreadable call |
+| `next_queued_job(queue, running, limits)` | `nextQueuedJob` | the id to start next per (agentRef, context): nothing at `concurrency`, a caller at `perCaller` waits, the caller running fewest first, then the oldest arrival, ties by id |
+| `admit_job(queue, running, job, limits, retry_after_seconds)` | `admitJob` | `{admit: True}` when the job would start at once or fewer than `queueMax` wait, else the `queue-full` error with `retryAfterSeconds` (1 to 3600, else 60) |
+| `queue_status_message(position, length)` | `queueStatusMessage` | a waiting job's `statusMessage`, `queued <position> of <length>` |
+| `read_queue_position(status_message)` | `readQueuePosition` | `{position, length}` from that message, or none |
+| `job_queue_rules(value)` | `jobQueueRules` | FAC-SEM-131 on `{queue, running, limits, started}` |
+| `load_report_rules(report)` | `loadReportRules` | FAC-SEM-132 on a `service-load/1` report: windows one `windowSeconds` apart, none after `generatedAt`, one row per context, p50 at most p95, a run time only where a job ended |
+| `load_report_problems(report)` | `loadReportProblems` | the report against `service-load.schema.json` (no caller, no job id, counts and durations only) |
+| `load_view(well_known)`, `load_extension_rules(well_known)` | `loadView`, `loadExtensionRules` | the declaration as a reader reads it, and FAC-SEM-133: an invalid one is treated as not declared and reported |
+| `load_extension(path, window_seconds, limits)` | `loadExtension({path, windowSeconds, limits})` | the `extensions` entry a service declares; raises `ServiceError` on one a reader would hide |
+
+Queue times are UTC instants (`T`, `Z`, at most three fraction digits); report times are RFC 3339 read strictly. A
+node keys every per-caller rule with `job_caller_key`, counts every started job that has not ended (`input_required`
+and paused ones too) as running, and answers another caller's job id `unknown-job`. The text-only `queue-full` result
+and `fabric.job.list` are still the node's own (FAA-103).
 
 <a id="actions"></a>
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -59,7 +59,7 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L0 | `fabric_time` | strict RFC 3339, UTC days, formatting, day windows, the clock ([dates](#dates-and-times)) |
 | L0 | `fabric_identifiers` | identifier equality by normal form (DEC-0076) |
 | L0 | `fabric_secrets` | the contract's one credential detector (DEC-0044) |
-| L0 | `fabric_peer_owner` | which OS account owns each end of a loopback connection, from the computer's socket table (DEC-0154 HA-2, FAA-226): `listener`, `server_end`, `peer`, `CheckedHTTPConnection`; the Python file is Project Observatory's `peer_owner.py` 1.1.0 vendored from commit `f86f0622` with the readings its header names (`1.1.0+kit.3`), the Node twin reads netstat, `/proc` and the owner SID where Python reads `sysctl`, `/proc` and `GetExtendedTcpTable`; on a restricted macOS table (FAA-267) a caller may vouch with a pid it started, proved by `lsof -p` |
+| L0 | `fabric_peer_owner` | which OS account owns each end of a loopback connection, from the computer's socket table (DEC-0154 HA-2, FAA-226): `listener`, `server_end`, `peer`, `CheckedHTTPConnection`; the Python file is Project Observatory's `peer_owner.py` 1.1.0 vendored from commit `f86f0622` with the readings its header names (`1.1.0+kit.4`), the Node twin reads netstat, `/proc` and the owner SID where Python reads `sysctl`, `/proc` and `GetExtendedTcpTable`; on a restricted macOS table (FAA-267) a caller may vouch with a pid it started, proved by `lsof -p` |
 | L0 | `fabric_tailnet` | who calls an agent behind `tailscale serve` and what that person may open (FAA-297): `Tailscale-User-Login` only on the agent's own serve listener from a loopback peer, groups from a generated `tailnet-perimeter/1` file, a personal SHA-256-stored key for MCP no wider than the groups; `authorize`, `load_perimeter`, `load_keys`, `hash_key`, refusals 401/403 with a code ([surfaces-and-auth.md](surfaces-and-auth.md#behind-tailscale-serve)) |
 | L1 | `fabric_crypto` | Ed25519 signing (a Montgomery ladder that does not branch on the key) and verification, P-256 verification, base64url, sha256 |
 | L1 | `fabric_base` | the protocol name, `ServiceError`, small shared helpers |
@@ -78,6 +78,7 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L3 | `fabric_connections` | what an agent uses, `fabric-connections/0.1`: the reference reading and the declaration (DEC-0096, FAC-SEM-127) |
 | L3 | `fabric_a2a` | the reading side of an A2A Agent Card: `surfaces.a2a` as the schema reads it, and what a public card must not carry (DEC-0122) |
 | L3 | `fabric_page_links` | a service's pages as Fabric Dashboards' open_link: build and read it, a raw local address, FAC-SEM-143 on a link and on a URL-mode input request (DEC-0123); the Python twin reads URLs as WHATWG does by hand |
+| L3 | `fabric_load` | the call queue and the load report of DEC-0104 (FAA-289): `job_caller_key`, `next_queued_job`, `admit_job`, `queue_status_message`, `read_queue_position`, FAC-SEM-131 to 133, the `service-load/1` and `extensions/load/0.1` shapes, `load_extension`; imports `fabric_connections` for ajv's `date-time` ([interop](interop.md#a-nodes-call-queue)) |
 | L3 | `fabric_lock` | the instance lock and the supervisor marker (LC-01, DEC-0057) |
 | L3 | `fabric_usage` | usage receipts, the ledger, the usage report, attribution, spending limits ([usage](usage.md)) |
 | L3 | `fabric_backups` | settings backups (DEC-0025) |
@@ -105,7 +106,8 @@ Beside the kit, not in `kit.json`: the probe (`check_service.py`, `check_service
 `check_service_channel_agent.py`, `check_service_channel_agent_schema.py` and the
 `service-channel-agent-extension.schema.json` it reads at run time), the sample
 (`sample_service.py`, `sample-remote-service.mjs`), `fabric_kit.py` itself and the dashboard tools. Recipes built on
-the kit live in `../recipes/` ([the draft-and-check step of a support agent](../recipes/support-agent/README.md)).
+the kit live in `../recipes/` ([the draft-and-check step of a support agent](../recipes/support-agent/README.md), [a service that is only a
+dashboard](../recipes/dashboard-only/README.md), [a key-delivery door](../recipes/key-delivery-door/README.md)).
 
 ## What 0.39 code keeps
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -45,13 +45,19 @@ Starting, stopping and restarting go through the supervisor and nothing else:
 atomic, mode 0600) and the uninstaller removes it; a running service never writes its own, except an app
 ([below](#an-apps-own-descriptor-and-the-node)). It names the supervisor and its file (`label` and `plist`, `unit`,
 or `task`; none for `node` and `person`), the `origin` `http://127.0.0.1:<port>` (a port is a claim: an installer
-refuses a port another instance declares), the service's directories, and commands as argument arrays that never
+refuses a port another instance declares, and one another OS account listens on, read with the kit's
+`fabric_peer_owner`, FAA-225; the recorded port per account and its claim file wait on contract DEC-0160), the service's directories, and commands as argument arrays that never
 carry a credential. Only `doctor` and `update` are commands a host may run.
 
 **Started is not ready.** Readiness is the well-known document, `GET /.well-known/fabric-service`: answered without
 authentication, from memory, in under 100 ms, with `service.id` and `service.instance` equal to the descriptor's,
 on a listener of this OS account (DEC-0154 HA-2: another account's listener is `foreign-user` whatever it answers; a
-LaunchDaemon's root installer reads it as *The system domain* says).
+LaunchDaemon's root installer reads it as *The system domain* says). `well_known_of(origin)` / `wellKnownOf(origin)` read
+it so a status tells HA-2's order apart: None / null when nothing answers (`down`), a `ForeignUserAnswer` whose
+`reason` starts `foreign-user` or `table-restricted`, else the document; `fetch_well_known` keeps answering None for
+both (FAA-259). Every loopback spelling of an origin (`127.0.0.1`, another `127/8` address, `localhost`, `[::1]`) is read
+on a checked connection (FAA-257). `launchd_install` takes an injected reader, `fetch_well_known=` and
+`fetch_job_well_known=`, as the Node `launchdInstall` takes `fetchWellKnown` and `fetchJobWellKnown`.
 `status` is `starting`, `ready`, `degraded` or `stopping`; `degraded` is always present, and an empty list asserts
 full health. A process that cannot serve does not answer, and a host derives `down`. An install or upgrade polls
 that document until `service.id` matches (at most 40 s) before it calls the service started (the launchd installers;
@@ -200,6 +206,10 @@ if the holder leaves, and exits 75 only when the wait runs out: a few starts an
 360. It touches nothing while it waits. Two installs sharing one data directory are still the
 defect to remove; the back-off only stops the loop from costing the machine.
 
+A context refusal (`fabric_context`, exit 78: no record, a revoked grant, a folder of another context) is the same
+loop under `KeepAlive`, so a supervised copy waits the same back-off, holding nothing and with the lock released,
+before it exits 78 (FAA-279); started by hand it exits 78 at once.
+
 The marker (contract DEC-0057, CT-01) is the variable `FABRIC_SERVICE_SUPERVISOR=<manager>` or
 the argument `--fabric-supervisor <manager>` (also `--fabric-supervisor=<manager>`), after the
 executable and before any `--`; `<manager>` is `launchd`, `systemd`, `task-scheduler` or `node`
@@ -318,7 +328,7 @@ descriptor says `"lifecycle": {"manager": "systemd", "unit": "<id>.<instance>.se
 
 | Verb | Command |
 |---|---|
-| install, upgrade | `systemd_install` / `systemdInstall`: write `~/.config/systemd/user/<unit>`, `daemon-reload`, `enable`, `restart` (so the new unit is what runs). A unit already installed that `is-enabled` reports `disabled` stays off: the file is rewritten and nothing starts (LC-14), unless `force_enable` |
+| install, upgrade | `systemd_install` / `systemdInstall`: write `~/.config/systemd/user/<unit>`, `daemon-reload`, `enable`, `restart` (so the new unit is what runs). A unit already installed that `is-enabled` reports `disabled` stays off: the file is rewritten and nothing starts (LC-14), unless `force_enable`. With `origin` and `service_id` it then polls the well-known answer as `launchd_install` does until this account's listener answers (another account's is refused, DEC-0154 HA-2; FAA-253); Node's `systemdInstall` then returns a promise |
 | stop, keep off | `systemctl --user disable --now <unit>` |
 | uninstall | `systemd_uninstall` / `systemdUninstall`: `disable --now`, remove the unit, `daemon-reload` |
 
@@ -335,7 +345,7 @@ CI job has the real `schtasks` create, read back and delete such a task. The des
 
 | Verb | Command |
 |---|---|
-| install, upgrade | `task_install` / `taskInstall`: `schtasks /Create /TN <task> /XML <file> /F` from a UTF-16 file it then removes, then `/End` (when it existed) and `/Run`. A task already installed and disabled stays off: it is recreated and disabled again (LC-14), unless `force_enable` |
+| install, upgrade | `task_install` / `taskInstall`: `schtasks /Create /TN <task> /XML <file> /F` from a UTF-16 file it then removes, then `/End` (when it existed) and `/Run`. A task already installed and disabled stays off: it is recreated and disabled again (LC-14), unless `force_enable`. With `origin` and `service_id` it then polls as `launchd_install` does and returns the answer (FAA-253); Node's `taskInstall` then returns a promise |
 | stop, keep off | `schtasks /End /TN <task>`, then `schtasks /Change /TN <task> /DISABLE` |
 | uninstall | `task_uninstall` / `taskUninstall`: `/End`, then `/Delete /F` |
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -157,6 +157,9 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   `auth.delegation {issuer, jwks}` is then required. With `own` or `delegation` the descriptor's
   token is not an MCP credential: a host and the probe never call `/mcp` with it as a caller.
   The kits verify them with `fabric_delegation` / `fabric-delegation.mjs` ([delegation](delegation.md)).
+- `surfaces.mcp.capabilities` and an action's `tool` never name `project.work` (`PRIMARY_CAPABILITY`): DEC-0140 PR-1
+  reserves it for a Project's primary responder, a session, and no service serves or declares it. `build_well_known`
+  / `buildWellKnown` refuse it with `ServiceError` (FAA-244); a longer name such as `project.workspace` is not reserved.
 
 ## Events page: `GET /fabric/v1/events?after=<cursor>&limit=<n>`
 
@@ -238,8 +241,9 @@ IPv4 wildcard for a LaunchAgent's installer, exactly `127.0.0.1` for a LaunchDae
 the contract's ruling on vouching is CT-261.
 
 Every kit client that sends a credential to loopback checks first: `check_service.py` (rule `listener.owner`, the first that reads the port for
-a local placement; `FAIL` `foreign-user` and no rule reads the port), the hub client (`HubError` `foreign-user`),
-`fabric_http` / `fabric-http.mjs` for a plain `http://` loopback URL (`HttpError` kind `foreign-user`, never retried),
+a local placement; `FAIL` `foreign-user` and no rule reads the port), the hub client (`HubError` `foreign-user`, its
+`data.reason` and sentence the owner's reason: `table-restricted`, then not retryable, or the owner's kind or `no-row`, FAA-272),
+`fabric_http` / `fabric-http.mjs` for a plain `http://` loopback URL (`HttpError` kind `foreign-user` with the same `reason`, never retried),
 `check_dashboard_layout.mjs` before a local login code, and the launchd installers' poll (a listener of another account
 is never a successful install, except a LaunchDaemon's job as its root installer proves it; the systemd and Task Scheduler installers do not poll yet, FAA-253). A running board
 session reports a door another account holds as `board.down` with reason `unreachable` until FAA-252. On macOS the Node

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/remote-placement.md

@@ -10,6 +10,7 @@ DEC-0019, at the commit this skill pins. This page is the how-to.
 - [On the platform](#on-the-platform)
 - [Checking it](#checking-it)
 - [What a host does and will not do](#what-a-host-does-and-will-not-do)
+- [Registered from several hosts](#registered-from-several-hosts)
 - [Rotation](#rotation)
 
 ## Is it a remote service?
@@ -68,8 +69,9 @@ watch the gate fail.
 ## On the platform
 
 - **Token**: a random value of at least 16 characters (32 bytes recommended), set as a secret;
-  the same value is written on the operator's computer by `registerRemote`. Compare in constant
-  time (`tokenMatches`).
+  the same value is written on the registering host by `registerRemote`. Compare in constant
+  time (`tokenMatches`). A service registered from more than one host holds one token per host
+  ([Registered from several hosts](#registered-from-several-hosts)).
 - **Session key**: 32 random bytes, a separate secret; rotating it signs every operator out.
 - **Codes and sessions**: `MemoryCodeStore`: a restart forgets every outstanding code, so none
   can be replayed, and every session record, so a deploy signs the operator out (DEC-0039: the
@@ -122,10 +124,49 @@ The login rules keep every `Set-Cookie` of the answer and judge the session cook
 | start, stop, restart, update | not offered |
 | a host older than the remote placement | shows the service as invalid and never contacts it |
 
+## Registered from several hosts
+
+One cloud service is often registered from more than one host: the operator's two computers, or an organization's
+space beside a personal one (FAA-280). Each registering host gets **its own token**; a token is never copied from one
+host to another, so one host can be revoked or rotated without touching the others.
+
+- **On the platform**, keep one secret per host (`FABRIC_HOST_TOKEN_<HOST>`, each at least 16 characters) and accept
+  a request whose bearer matches any of them. Compare it with every token, each with `tokenMatches` /
+  `token_matches`, with no early return, so the answer's timing does not say which host's token matched:
+
+  ```python
+  def host_of(authorization, tokens):  # tokens: {host name: token}; the kit's comparison, once per token
+      matched = [host for host, token in sorted(tokens.items()) if fs.token_matches(authorization, token)]
+      return matched[0] if matched else None  # None: a 401 with an empty body, as with one token
+  ```
+
+  `well_known_allowed` / `wellKnownAllowed` take one token: call it once per token the same way, or gate the route on
+  `host_of(...) is not None`.
+- **On each host**, run `registerRemote` / `register_remote` with that host's token only. The descriptor is the same
+  on every host but its `tokenFile`, which holds that host's value and nothing else (0600, never printed).
+- **Sign-in**: `LoginCodes` binds a session to one token's revision. Give each host its own `LoginCodes` with
+  `token=` that host's token and its own store (`MemoryCodeStore`, or a durable row per host); the session key may be
+  shared. Issue the login code from the instance whose token the bearer matched; redeem a code and check a session by
+  trying each instance in turn (a code another instance issued is not in its store, and a session cookie carries
+  another token's revision, so neither changes anything there). Removing or rotating one host's token then ends that
+  host's sessions only. One `LoginCodes` whose `token=` is a callable returning every token joined also works, and
+  signs every host out when any one rotates.
+- **The probe**: `check_service.py <id>` run on a host sends that host's token, so `well-known.requires-token` passes
+  on each; the request without a token, or with a value no host holds, still gets the `401` with an empty body.
+- **Revoking a host**: delete its secret on the platform and restart; that host then sees `401` and shows the service
+  `down`, never `foreign`. Remove its descriptor there with `remove_descriptor` / `removeDescriptor`.
+- **Adding a host**: create its secret, restart, then `registerRemote` on the new host. The other hosts' tokens and
+  sessions do not change.
+
+A token per host still gives each host the descriptor token's whole authority over the service. A remote surface no
+host token reaches (callers with their own delegation, the page opened only with Fabric Dashboards' one-time code)
+is the "local and cloud" form, FAA-204, which waits on the contract recording that form.
+
 ## Rotation
 
 Rotate the token by setting the new value on the platform and re-running `registerRemote` on the
-operator's computer with it; the old token stops working the moment the platform restarts with the
+registering host with it (on a service registered from several hosts, only that host's token,
+[above](#registered-from-several-hosts)); the old token stops working the moment the platform restarts with the
 new value, and so does every session begun under it when `LoginCodes` has `token=`. The re-run keeps the
 installed `source` when it passes none (one the kit refuses, edited by hand, is dropped with the warning); pass
 `runner`, `peer`, `summary`, `doctor` and `installedBy` / `installed_by` again, since a re-run writes only what it is

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_dashboard_link.py

@@ -133,12 +133,20 @@ def check(data):
     return {'ok': True, 'kind': kind}
 
 
+def read_input(limit=65536):
+    # The handoff's bytes, decoded as UTF-8 with a byte order mark dropped: Windows before Python 3.15 decodes a text
+    # stdin with its code page, which misreads a Cyrillic handoff (FAA-210). A stream without bytes is read as text.
+    stream = getattr(sys.stdin, 'buffer', None)
+    raw = stream.read(limit + 1) if stream is not None else sys.stdin.read(limit + 1)
+    require(len(raw) <= limit, 'input_too_large')
+    return raw.decode('utf-8-sig') if isinstance(raw, bytes) else raw.lstrip('\ufeff')
+
+
 def main():
     try:
-        raw = sys.stdin.read(65537)
-        require(len(raw) <= 65536, 'input_too_large')
-        result = check(json.loads(raw))
-    except (ValueError, TypeError, KeyError, AttributeError):
+        result = check(json.loads(read_input()))
+    # RecursionError: Python 3.9 to 3.13 raise it on a deeply nested document under the cap
+    except (ValueError, TypeError, KeyError, AttributeError, RecursionError):
         # Fixed reasons only: never echo a submitted URL, token or JSON blob.
         result = {'ok': False, 'reason': 'dashboard_handoff_refused'}
     print(json.dumps(result))

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -673,12 +673,14 @@ class Probe:
         self.events_trace_rule(self.events)
 
     def channel_agent_rule(self) -> None:
-        """DEC-0150 (FAA-197): the channel agent's declaration, read from the manifest the descriptor names, else from the
-        well-known answer (CA-1); one read as not declared is NOT_RUN with its evidence, never a FAIL (D3), except a string
-        shaped like a credential in it or in a copy the probe reads beside it (CA-5)."""
+        """DEC-0150 (FAA-197): the declaration, from the manifest the descriptor names, else the well-known answer (CA-1); one
+        read as not declared is NOT_RUN, never a FAIL (D3), except a credential's shape in it or a copy beside it (CA-5)."""
         manifest, _, where = self.load_manifest()
-        self.add("channel-agent.declaration", *cac.declaration_verdict(
-            manifest, bool(self.d.get("fabricManifest")), where, self.wk, getattr(self, "wk_bytes", None)))
+        try:  # a copy of the probe without its schema file is NOT_RUN, and the later rules run (FAA-250)
+            verdict = cac.declaration_verdict(manifest, bool(self.d.get("fabricManifest")), where, self.wk, getattr(self, "wk_bytes", None))
+        except (OSError, ValueError) as exc:
+            verdict = ("NOT_RUN", "the probe cannot read %s beside it (%s)" % (cac.cas.SCHEMA_FILE.name, type(exc).__name__))
+        self.add("channel-agent.declaration", *verdict)
 
     def configuration_rule(self) -> None:
         """DEC-0046: a well-known `configuration` is {slots, resolved} as the schema types it; absent is NOT_RUN."""

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service_channel_agent.py

@@ -18,7 +18,8 @@ from typing import Any, Callable, Dict, List, Optional, Tuple
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from fabric_jsvalue import indexed_objects, js_keys  # noqa: E402
-from fabric_secrets import JS_SPACE, JWT_SHAPE, SECRET_VALUE, _url_parts, raw_values, secret_argument, secret_url, secret_value  # noqa: E402
+from fabric_secrets import JS_SPACE, JWT_SHAPE, SECRET_VALUE, raw_values, secret_argument, secret_url, secret_value  # noqa: E402
+from fabric_secrets import url_parts as _whatwg_url_parts  # noqa: E402 - public since FAA-250
 import check_service_channel_agent_schema as cas  # noqa: E402
 
 KEY = "https://fabric.passioncode.ai/agent-contract/extensions/channel-agent/0.1"
@@ -62,6 +63,9 @@ _IGNORABLE = ((0x00AD, 0x00AD), (0x034F, 0x034F), (0x061C, 0x061C), (0x115F, 0x1
               (0x200B, 0x200F), (0x202A, 0x202E), (0x2060, 0x206F), (0x3164, 0x3164), (0xFE00, 0xFE0F), (0xFEFF, 0xFEFF),
               (0xFFA0, 0xFFA0), (0xFFF0, 0xFFF8), (0x1BCA0, 0x1BCA3), (0x1D173, 0x1D17A), (0xE0000, 0xE0FFF))
 _FILLERS = frozenset("\u115f\u1160\u3164\uffa0\u2800\ufffc")
+#: Format characters (\p{Cf}) assigned after Unicode 13, which Python 3.9's unicodedata reads as unassigned (FAA-250):
+#: U+0890..0891 (Unicode 14) and U+13439..1343F (Unicode 15); the white-space and control categories gained none since.
+_LATER_FORMATS = ((0x0890, 0x0891), (0x13439, 0x1343F))
 
 
 def utf16(text: str) -> str:
@@ -75,7 +79,7 @@ def utf16(text: str) -> str:
 def _blank_char(char: str) -> bool:
     code = ord(char)
     return (char in JS_SPACE or char in _FILLERS or unicodedata.category(char) in ("Cf", "Cc", "Zs", "Zl", "Zp")
-            or any(low <= code <= high for low, high in _IGNORABLE))
+            or any(low <= code <= high for low, high in _IGNORABLE + _LATER_FORMATS))
 
 
 def blank(text: str) -> bool:
@@ -397,7 +401,7 @@ def url_parts(text: str) -> Optional[Tuple[str, str]]:
             return None
         if host and not _host_ok(host, special):
             return None
-    _, query, fragment = _url_parts(text)
+    _, query, fragment = _whatwg_url_parts(text)
     has_query = "?" in rest.partition("#")[0]
     has_fragment = "#" in rest
     return ("?" + query if has_query and query else "", "#" + fragment if has_fragment and fragment else "")
@@ -823,8 +827,9 @@ def declaration_verdict(manifest: Optional[Dict[str, Any]], manifest_named: bool
     where = "the manifest's provider.extensions" if site == "manifest" else "the well-known answer's extensions"
     shapes = _credential_shapes(others + copy)
     if shapes:  # a credential's shape in a copy no reader reads still sits in a document the service publishes (CA-5)
-        return "FAIL", "%d string(s) shaped like a credential outside the read declaration: %s (DEC-0150 CA-5)%s" % (
-            len(shapes), _shown(shapes), tail)
+        also = ("; on the read declaration itself, %d finding(s): %s" % (len(own), _shown(own))) if own else ""
+        return "FAIL", "%d string(s) shaped like a credential outside the read declaration: %s (DEC-0150 CA-5)%s%s" % (
+            len(shapes), _shown(shapes), also, tail)
     if declared and own:
         if not channel_agent_view(doc, site)["declared"] and not _credential_shapes(own):
             # D3: what the contract's reader reads as not declared (an older form, a repeat, a dangling reference) is

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service_rules.py

@@ -3,6 +3,7 @@ network guard's verdict, the board responder's fixture conversation, a session c
 whether two repository URLs name one repository, a service's actions declaration (DEC-0121) and whether its checkout
 opens its pages in a browser (FAA-118), and its A2A member and public Agent Card (DEC-0122). ``check_service.py`` runs them against a live service.
 Standard library only, Python 3.9+."""
+# Example URLs write their scheme in angle brackets: read `<https>` as `https` (FAA-212).
 from __future__ import annotations
 
 import email.utils

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-base.mjs

@@ -11,6 +11,11 @@ export const PROTOCOL = 'fabric-service/0.1';
 
 export const EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/service/0.1';
 
+// DEC-0140 PR-1 (contract project-comms.md, interop.md's C3.1 amendment): the capability of a Project's primary
+// responder, a session's. No service serves it as a tool or declares it (surfaces.mcp.capabilities, an action's tool),
+// and the board kit never enrolls a service's responder for it (FAA-244).
+export const PRIMARY_CAPABILITY = 'project.work';
+
 // Lifecycle rules: references/lifecycle.md (the rule for this kit's users; it implements the public
 // contract's service specification, Lifecycle), the same values as fabric_service.py.
 // A launchd-supervised copy that finds the lock held backs off in-process before its exit 75 (LC-03).

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-link.mjs

@@ -30,6 +30,8 @@ export class BoardSession {
     try {
       return await this.post(this.grant.origin, body, this.grant.bearer(), { session: this.mcpSession, timeout: timeout > 0 ? timeout : this.timeout, method, protocolVersion: this.mcpSession ? this.protocolVersion : undefined });
     } catch (e) {
+      // FAA-252: another OS account's process holds the port; nothing was sent
+      if (e instanceof HubError && e.code === 'foreign-user') throw new BoardError('foreign-user', 'The hub\'s port is held by another OS account\'s process; nothing was sent.', true);
       if (e instanceof HubError) throw new BoardError('unreachable', 'Fabric\'s hub did not answer; a write may have been stored, so send it again with the same idempotency key.', true);
       throw e;
     }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-session.mjs

@@ -3,7 +3,7 @@
 // Part of the Node board connector (FAA-65, layer L4); the twin of fabric_board_session.py. Node 20+, no dependency.
 import crypto from 'node:crypto';
 import { Backoff, HubError, normalProject } from './fabric-hub.mjs';
-import { acceptedRevisions, feedDataProblems, negotiateRevision } from './fabric-service.mjs';
+import { PRIMARY_CAPABILITY, acceptedRevisions, feedDataProblems, negotiateRevision } from './fabric-service.mjs';
 import { BoardError, CAPABILITY, LEASE_SECONDS, REQUEST_STATES, SUMMARY_MAX, Stopped, isInt, isObj, outcomeProblems, receiptProblems } from './fabric-board-shapes.mjs';
 import { BoardRequest, BoardSession, Checkpoint, PERSONAL_BOARD, covers, mandateOptions, readMandate } from './fabric-board-link.mjs';
 import { HOLD_RETRY_MAX_SECONDS, LEASE_MARGIN_SECONDS, SESSION_CODES, SlotKeeper } from './fabric-board-slots.mjs';
@@ -87,6 +87,8 @@ export class Responder extends SlotKeeper {
     if (typeof admit !== 'function' || typeof handler !== 'function') throw new BoardError('invalid_arguments', 'A responder needs the service\'s own input gate (admit) and a handler.');
     const caps = [...(capabilities ?? [])];
     if (!caps.length || caps.some((c) => typeof c !== 'string' || !CAPABILITY.test(c)) || new Set(caps).size !== caps.length) throw new BoardError('invalid_arguments', 'Name each capability once, [a-z][a-z0-9._-]{1,127}.');
+    // FAA-244: DEC-0140 PR-1, a session's slot, never a service's
+    if (caps.includes(PRIMARY_CAPABILITY)) throw new BoardError('invalid_arguments', `${PRIMARY_CAPABILITY} is a Project's primary responder's, a session's: a service answers the capabilities it declares (DEC-0140 PR-1).`);
     Object.assign(this, { hub, capabilities: caps, credentialFile, handler, admit, observe, emitTo: emit, now, rand });
     this.project = normalProject(projectId);
     // FAA-135: read the operator's mandate from a trusted request of his own Project (opt-in; null reads none)
@@ -102,6 +104,8 @@ export class Responder extends SlotKeeper {
     this.state = 'idle';
     this.waitUntil = 0;
     this.stopping = false;
+    /** Whether shutdown found work to drain, published before it waits; null before shutdown starts (FAA-186). */
+    this.draining = null;
     this.claimKeys = {};
     this.probing = new Set(); // moved slots whose move-back claim lost its answer: asked again under the same key
     this.said = {};
@@ -196,7 +200,7 @@ export class Responder extends SlotKeeper {
     this.session = session;
     const status = await this.status();
     if (missing.length) {
-      this.emit('board.access.needed', 'warning', `The operator has not let this service answer ${missing.join(', ')} on this Project; ask in Fabric (Agents & access).`, { notify: true, episode: missing.join(','), capabilities: missing });
+      this.emit('board.access.needed', 'warning', `The operator has not let this service answer ${missing.join(', ')} on this Project; ask in Fabric (Settings → Agent access).`, { notify: true, episode: missing.join(','), capabilities: missing });
     }
     this.slots = {};
     await this.recover(status, this.capabilities.filter((c) => grant.capabilities.includes(c)));
@@ -375,7 +379,8 @@ export class Responder extends SlotKeeper {
     try {
       this.receipt('com.reply', await this.call('com.reply', { ...this.replyExtra(entry), fence: this.fence({ ...entry, generation, attempt, digest, revision }, key) }));
     } catch (e) {
-      if (['unreachable', 'session-ended', 'authority_changed', 'not_authorized', 'not_available', 'capacity_exceeded'].includes(e.code) || !(e instanceof BoardError)) throw e;
+      // foreign-user: nothing was sent now, so whether the old reply was stored is unknown (0.79.0 seam reading)
+      if (['unreachable', 'foreign-user', 'session-ended', 'authority_changed', 'not_authorized', 'not_available', 'capacity_exceeded'].includes(e.code) || !(e instanceof BoardError)) throw e;
       replied = false;
     }
     if (replied) entry.replied = true;
@@ -496,7 +501,7 @@ export class Responder extends SlotKeeper {
     if (['not_authorized', 'authority_changed', 'credential'].includes(code)) {
       this.state = 'not-authorized';
       await this.dropSession();
-      this.emit('board.access.needed', 'warning', 'This service may not answer requests for this Project: the operator has to allow it in Fabric (Agents & access). Nothing is claimed until then.', { notify: true, episode: 'access', reason: code });
+      this.emit('board.access.needed', 'warning', 'This service may not answer requests for this Project: the operator has to allow it in Fabric (Settings → Agent access). Nothing is claimed until then.', { notify: true, episode: 'access', reason: code });
     } else if (code === 'held') {
       this.state = 'paused';
       this.emit('board.held', 'info', 'The operator holds new work on this Project; the responder waits and asks again with a growing pause.', { episode: 'held', reason: code });
@@ -508,8 +513,11 @@ export class Responder extends SlotKeeper {
     } else {
       this.state = 'down';
       // A refusal in recovery that left no slot held reconnects (seam 6); one that left some held serves them (seam 7).
-      if ((connecting || ['session-ended', 'unreachable', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol'].includes(code)) && !keep) await this.dropSession();
-      this.emit('board.down', 'warning', 'Fabric\'s board cannot be reached; the responder tries again with a growing pause.', { episode: 'down', reason: code });
+      if ((connecting || ['session-ended', 'unreachable', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol', 'foreign-user'].includes(code)) && !keep) await this.dropSession();
+      // FAA-252: a port another OS account holds is said as such; nothing was sent there
+      this.emit('board.down', 'warning', code === 'foreign-user'
+        ? 'Fabric\'s board port is held by another OS account\'s process; nothing was sent, and the responder tries again with a growing pause.'
+        : 'Fabric\'s board cannot be reached; the responder tries again with a growing pause.', { episode: 'down', reason: code });
     }
     return wait;
   }
@@ -933,6 +941,7 @@ export class Responder extends SlotKeeper {
   async shutdown(drain = DRAIN_SECONDS) {
     this.stopping = true;
     const work = this.current;
+    this.draining = Boolean(work); // what this shutdown waits for (FAA-186)
     if (work && !work.done) {
       await Promise.race([work.promise, new Promise((resolve) => setTimeout(resolve, drain * 1000).unref?.())]);
       if (!work.done) work.ctx.stopped = true;

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-slots.mjs

@@ -14,7 +14,7 @@ export const HOLD_RETRY_MAX_SECONDS = 900;
 
 /** Refusals that are about the board session, not one capability: they end recovery and go to the responder's fault. */
 export const SESSION_CODES = Object.freeze(new Set(['unreachable', 'session-ended', 'not_authorized', 'authority_changed', 'credential', 'no-epoch',
-  'schema-unsupported', 'checkpoint', 'receipt-shape', 'idempotency_conflict', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol', 'not_available']));
+  'schema-unsupported', 'checkpoint', 'receipt-shape', 'idempotency_conflict', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol', 'not_available', 'foreign-user']));
 
 const sameRecord = (a, b) => JSON.stringify(a ?? {}) === JSON.stringify(b ?? {});
 
@@ -83,7 +83,7 @@ export class SlotKeeper {
         const moved = isInt(before, 1) && isInt(rest.generation, 1) && before > rest.generation;
         if (isInt(generation, 1) && (answer.repeated === true || !moved)) record = { project: this.project, generation };
       } catch (e) {
-        if (LOST.includes(e.code)) throw e;
+        if (LOST.includes(e.code) || e.code === 'foreign-user') throw e; // foreign-user: the earlier ask is unknown
         if (e.code === 'idempotency_window_expired') record = {}; // a retired epoch: unknown, so a first start, no move
       }
     }
@@ -254,6 +254,7 @@ export class SlotKeeper {
       if (!(e instanceof BoardError)) throw e;
       this.retryLater(capability, entries, e);
       if (SESSION_CODES.has(e.code)) throw e;
+      if (e.code === 'idempotency_window_expired') await this.status(); // the epoch moved: read it before the retry (FAA-186)
     }
   }
 }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-context.mjs

@@ -6,7 +6,7 @@
 // An organization's instance whose context the record does not pin (`organizations`, DEC-0127) still starts: the helper
 // checks the placement and its share grant, not the pin (decision D5 of 0.52.0). Its tokens are refused instead:
 // hubKeyCertified reads a context's hub keys only while the record pins that organization (DL-14a, DEC-0128), so the
-// service passes `estateContext: context` to its delegation gate. A refusal at start would stop every organization
+// service passes contextGateOptions(info, record) (its context and its pin's issuer, FAA-150) to its delegation gate. A refusal at start would stop every organization
 // instance on today's records, which pin none until every reader is pinned at or after DEC-0127.
 import crypto from 'node:crypto';
 import fs from 'node:fs';
@@ -14,7 +14,7 @@ import path from 'node:path';
 import { INSTANCE, ServiceError } from './fabric-base.mjs';
 import { descriptorPath } from './fabric-descriptor.mjs';
 import { parseContext } from './fabric-estate.mjs';
-import { InstanceLock, holdSingleInstance } from './fabric-lock.mjs';
+import { InstanceLock, LOCK_BACKOFF_FIRST_SECONDS, LOCK_BACKOFF_MAX_SECONDS, holdSingleInstance, lockWaitBudgetSeconds, supervisorMarker } from './fabric-lock.mjs';
 import { atomicWrite, instanceDirs, servicesDir } from './fabric-paths.mjs';
 import { instanceShareGrant } from './fabric-share.mjs';
 import { clockMs } from './fabric-time.mjs';
@@ -112,9 +112,29 @@ function markerMatches(file, expected) {
   return found !== null && typeof found === 'object' && Object.entries(expected).every(([key, value]) => found[key] === value);
 }
 
+/**
+ * What delegationGate takes from this instance's context (FAA-150): `estateContext`, and for an organization whose
+ * context `record` pins, `issuer`: the pin's context issuer (DL-14a, DEC-0128), so an organization's instance refuses a
+ * token the personal hub key signed. `info` is contextInstance's (or holdContextInstance's) answer; spread it after the
+ * service's own estate issuer: `delegationGate({ ..., issuer: estateIssuer, ...contextGateOptions(info, record) })`.
+ * Throws ContextRefused (`context-invalid`) for an answer with no context.
+ */
+export function contextGateOptions(info, record) {
+  const context = info !== null && typeof info === 'object' ? info.context : undefined;
+  const parsed = parseContext(context);
+  if (!parsed) throw new ContextRefused('context-invalid');
+  const options = { estateContext: context };
+  const pins = record !== null && typeof record === 'object' && !Array.isArray(record) ? record.organizations : undefined;
+  if (parsed.kind === 'org' && Array.isArray(pins)) {
+    const pin = pins.find((p) => p !== null && typeof p === 'object' && p.org === context && typeof p.iss === 'string');
+    if (pin) options.issuer = pin.iss;
+  }
+  return options;
+}
+
 /**
  * Run as `context`'s one instance, before any side effect (brief D17): contextInstance (a refusal writes one sentence
- * naming the code and exits 78, nothing created); then holdSingleInstance on the instance's data folder (its markers,
+ * naming the code and exits 78, nothing created; a supervised copy backs off first, FAA-279); then holdSingleInstance on the instance's data folder (its markers,
  * its supervised wait, its exit 75); then `<data>/fabric-context.json`: absent, written (0600, atomic); equal, kept;
  * another context or instance, or unreadable, releases the lock and exits 78 (`context-mismatch`). Resolves to the
  * instance with its held `lock`; `exit` is injectable as holdSingleInstance has it, and its answer is returned.
@@ -123,8 +143,20 @@ export async function holdContextInstance(id, context, {
   record, machineId, agentRef, at, personalInstance = 'default', servicesDirectory, platform = process.platform,
   waitSeconds, sleep, clock, exit = (code) => process.exit(code), env, argv,
 } = {}) {
-  const refuse = (code) => {
-    process.stderr.write(`${id} will not run for ${shown(context)} (${code}): ${REASONS[code]}.\n`);
+  // FAA-279: under a supervisor that restarts on exit an exit 78 at once is a respawn every few seconds, forever; a
+  // supervised copy first waits the lock's back-off (0.5 s doubling to 30 s, 300 s in all), holding nothing.
+  const refuse = async (code) => {
+    const marker = supervisorMarker({ ...(env === undefined ? {} : { env }), ...(argv === undefined ? {} : { argv }) });
+    const wait = Math.max(0, waitSeconds ?? lockWaitBudgetSeconds(marker));
+    const tail = wait > 0 ? ` Waiting ${Math.round(wait)} s before exiting, so its supervisor does not restart it every few seconds.` : '';
+    process.stderr.write(`${id} will not run for ${shown(context)} (${code}): ${REASONS[code]}.${tail}\n`);
+    const now = clock ?? (() => performance.now() / 1000);
+    const pause = sleep ?? ((seconds) => new Promise((resolve) => { setTimeout(resolve, seconds * 1000); }));
+    const deadline = now() + wait;
+    for (let delay = LOCK_BACKOFF_FIRST_SECONDS, remaining = deadline - now(); remaining > 0; remaining = deadline - now()) {
+      await pause(Math.min(delay, remaining));
+      delay = Math.min(delay * 2, LOCK_BACKOFF_MAX_SECONDS);
+    }
     return exit(EXIT_CONTEXT_REFUSED);
   };
   let info;