@passioncode-ai/fabric-agent-adapter 0.79.1 → 0.81.0

package/CHANGELOG.md

@@ -1,5 +1,218 @@
 # Changelog
 
+## 0.81.0 (2026-11-12)
+
+Wave 3 of the backlog sweep of 2026-11-12. **The contract pin moves to `93e7db16` (`v0.1.0+2026-11-08.1`)**: DEC-0149
+(`fabric-source/1`), CT-254 (HA-2's Linux source, the hybrid the kit already read), DEC-0151, DEC-0152, DEC-0155.
+Bundles pinned at `18f8d487` stay valid (FAA-258; impact map `docs/evidence/specs/2026-11-12-faa-258-repin-93e7db16-impact-map.md`).
+New kit modules: `fabric_holds` and `fabric-holds.mjs`. Kit modules change: `fabric_secrets`, `fabric_protocols`,
+`fabric_peer_owner` (`1.2.0+kit.5`), `fabric_package`, `fabric_descriptor`, `fabric_http`, `fabric_supervisors`, the
+facade `fabric_service`, and their Node twins.
+
+### Added
+
+- **`npx @passioncode-ai/fabric-agent-adapter new <folder> --id <agent-id> [--profile ...] [--service]`** (North Star G21,
+  FAA-270), and `new_agent.py` behind it: one command creates an agent project with the contract built in: the bundle
+  pinned at the contract, `fabric.source.json`, a placement guard reading Observatory's `observatory-placement/1` record
+  with its tests, and with `--service` the service kit's sample (its modules copied by `fabric_kit.py install`).
+  Idempotent, refuses a folder holding other files without `--force`, JSON last. It needs Python 3.9 or later on the
+  machine. Turning a sentence into an agent (`new "<sentence>"`, `test`) stays FAA-26, waiting on Fabric's
+  `fabric.agent.create`.
+- **`fabric.source.json` (DEC-0149, `fabric-source/1`)** (FAA-261): `fabric_source_tree.py` ports the contract's source
+  rules and matches all 140 of its vendored vectors; `fabric_source_check.py check` reads the source a manifest names,
+  by path, line and column, never the value; `adapt_project.py source` lays the manifest down with the kit's slots
+  (`PUBLISHER_URI` behind the `createdBy` sentinel, `PLACEMENT_RECORD`, and for a service `SUPERVISOR_LABEL` and
+  `SERVICE_PORT`; FAA-188's part 2); `pack` writes `secrets[]` and `state[]` from the slots, and FAC-SEM-160 refuses a
+  package that differs.
+- **Work held by a service's own limits** (FAA-298): new kit modules `fabric_holds` and `fabric-holds.mjs` (L3). A held
+  job says why it waits in `statusMessage` with the contract's pause grammar (the job schema is closed); the operator gets
+  one push per hold, and the answer is recorded as a scoped lift that falls back when its window ends; a new probe rule
+  `limits.holds`.
+- **Agent template folders** (FAA-265): five JSON Schemas and `template_check.py` in creating-fabric-agents; the
+  communication agent template moved into `templates/communication-agent/` with its manifest, connections, access, data
+  rooms, checks, assembly and changelog; `validate.py` checks every shipped template folder.
+
+### Changed
+
+- The probe's `limits.holds` reads a service that declares limits but does not use `fabric_holds` as NOT_RUN with a
+  migration note, not FAIL, and counts only code files (a vendored `check_service_rules.py` and docs naming `HoldBook`
+  no longer pass it). `LoopbackHTTPServer` and `loopbackServer` read the socket table only for a loopback peer: a peer
+  at another address (a `0.0.0.0` bind) is served with no owner under `refuse` and `strict` (the 0.81.0 seam reading).
+- **A kit service refuses a loopback peer of another OS account before it reads the request** (DEC-0154 HA-2 and HA-3,
+  FAA-227): `LoopbackHTTPServer` takes `peer_check` and Node's new `loopbackServer(httpServer, {peerCheck})` holds each
+  connection paused until the check passes; `refuse` (the default) closes another account's peer and serves the rest,
+  `strict` also refuses an owner it cannot tell, `off` reads nothing.
+- `fabric_http` and `fabric-http.mjs` check plain http that reaches loopback by its connected address, `insecure=True` and
+  a loopback proxy included (FAA-260). The probe times the well-known answer after the owner check, fails a deeply
+  nested body cleanly, compares port claims as ports (`:08080` is `:8080`), names the listener on a failed connect, and
+  no longer stops on a well-known body that is not an object; the layout probe opens a loopback page only after its
+  listener is this account's (FAA-260).
+- The dashboard link gate opens a raw loopback address in a browser only when `listener_owner` is `this-account` as
+  well as the host `not_installed` (FAA-251).
+- LaunchDaemon installs and uninstalls refuse contradicting domains, leftover LaunchAgents, another label's plist and an
+  unparseable or binary plist, and remove a plist a failed bootstrap wrote; the probe fails a LaunchDaemon without
+  `UserName`, with a `~` command, or loaded in both domains (FAA-286).
+- **The kit's credential detector is the contract's DEC-0151 `SECRET_VALUE`**, in both twins and the three dashboard
+  link checkers: a provider prefix counts only in its canonical case and after a boundary; an `sk-` key needs a digit and
+  an upper-case letter (16 characters or more) or a digit (32 or more), so `SK-...`, `sk-learn-...` and an `sk-` inside a
+  word are no longer keys. Repository names keep their own boundary-free key shapes, as DEC-0151 asks (FAA-258).
+- `fabric_protocols` lists `fabric-source/1`; `fabric_peer_owner` is `1.2.0+kit.5`, one version line with Observatory's
+  1.2.0, the Linux reading unchanged (FAA-258).
+- Every vendored contract vector is regenerated at the new pin with the contract's own generators;
+  `make_load_vectors.mjs` reads the pin from the lock file. SECURITY.md, lifecycle.md and protocol.md name DEC-0155 RT-3
+  for the vouch; SA-6 (DEC-0152) is the accepted board rule (FAA-258).
+
+### Fixed
+
+- `fabric_source_check.py` refuses a copy without `fabric_source_tree.py` with exit 2 and the file's name, not a
+  traceback and exit 1; `pack` (both kits) refuses by name a hand-written `secrets[]` naming a secret `fabric.source.json`
+  has no slot for, instead of dropping it (the 0.81.0 seam reading). The Windows job runs the loopback peer check.
+
+### Upgrading
+
+- A door that gave T0 because `strict` served the peer must also check that the peer's owner is named
+  (`peer_owner()` / `connectionOwner`): a peer off loopback has none and is T2. A folder whose `fabric.package.json`
+  names secrets its `fabric.source.json` lacks fails `pack` until they are added as `secret` slots.
+- A service that serves loopback HTTP keeps serving its own account's callers; pass `peer_check="strict"` to refuse an
+  owner the table cannot tell. A caller of the dashboard link gate passes `listener_owner`. An outside test that runs
+  this checkout's probe needs a readable socket table.
+- A service that vendors the kit takes the changed `fabric_secrets`, `fabric_protocols` and `fabric_peer_owner` with
+  `fabric_kit.py install`. A string the 0.80 detector called a key may no longer be one (see Changed).
+
+## 0.80.2 (2026-11-12)
+
+0.80.1 was tagged and never published: its `windows` job (run 43212508702) failed one test, so `release` and `publish`
+were skipped. 0.80.2 is 0.80.1 with that test fixed, and is the release that ships 0.80.0's changes. No module changes.
+
+### Fixed
+
+- `test_the_launchers_folder_is_macos_only` compared the folder `status` returns, written with the runner's own path
+  separators, with a POSIX string; it compares it with `str(Path(...))`.
+
+## 0.80.1 (2026-11-12)
+
+0.80.0 was tagged and never published: its release run (43209105658) failed `floors`, `python` and `windows` on two
+tests of 0.80.0's own (FAA-239, FAA-240) that held only on macOS, so `release` and `publish` were skipped. 0.80.1 is
+0.80.0 with the two tests fixed, and is the release that ships it. No module changes.
+
+### Fixed
+
+- `test_a_copy_outside_the_launchers_folder_is_named` wrote `hub.json` where the runner's own platform keeps it while
+  `status` read darwin's; it writes it where darwin keeps it.
+- `test_the_launchers_folder_is_macos_only` set a Windows temporary folder as a darwin path, which is not absolute
+  there; it uses a POSIX path.
+
+## 0.80.0 (2026-11-12)
+
+Wave 2 and the first part of wave 3 of the backlog sweep of 2026-11-12. The contract pin stays `18f8d487`. A new kit
+module, `fabric_load` and `fabric-load.mjs` (layer L3). Kit modules change: `fabric_secrets`, `fabric_peer_owner`
+(`1.1.0+kit.4`), `fabric_connections`, `fabric_descriptor`, `fabric_context`, `fabric_supervisors`, `fabric_interop`,
+`fabric_hub`, `fabric_board_slots`, `fabric_board_session`, `fabric_http`, `fabric_usage`, the facade `fabric_service`,
+and their Node twins where they have one.
+
+### Added
+
+- **Three working rules in working-with-fabric and in a new agent's template** (the contract owner's board request
+  `bfc0e14e`, relaying the operator's words of 2026-11-12): the task's context is settled before the first act that
+  crosses contexts (`personal`, `org:<orgId>`), asked once when no source settles it, recorded in the handoff and never
+  posted to a board thread, following contract CT-292's draft (TC-1 to TC-6) until its DEC lands, the one exception to
+  "do not ask" (`references/task-context.md`, FAA-299); a wait is not a stop: each wait has its condition, owner, next
+  action and watcher, `fabric_heartbeat` carries `waitingOn`, a turn ends with one line per open wait
+  (`references/waits.md`, FAA-300); clean up after yourself: merged worktrees and branches, `git fetch --prune`, unique
+  commits archived under `refs/archive/<date>/`, `git ls-files` checked before a folder goes (`references/cleanup.md`,
+  FAA-301). creating-fabric-agents carries the three in `references/working-rules.md`. Six scenario evals and
+  `test/test_working_rules_prose.py`.
+- **A service install refuses a port another OS account listens on** (FAA-225, its port part), read with
+  `fabric_peer_owner`; a port of this account, the system or nobody, or an unreadable table, still passes. The claim
+  file waits on contract DEC-0160.
+- creating-fabric-agents: an agent on its own machine refuses to start where Observatory's `placement.json` places it
+  elsewhere, starts with no file, reports `placement-unreadable`, and takes keys only from its machine's vault
+  (`where-agents-run.md`, FAA-230's placement and vault parts).
+- A recorded working-with-fabric trigger run: 38 of 44 with haiku, above the 85 % gate, USD 0.0122
+  (`docs/evidence/evals/2026-11-12-trigger-run.md`, FAA-130); six misses follow FAA-291's shorter description (FAA-305).
+
+- **The call queue and load reference functions of DEC-0104** (FAA-289): `fabric_load.py` and `fabric-load.mjs`,
+  exported by both facades: `jobCallerKey`, `nextQueuedJob`, `admitJob`, `queueStatusMessage`, `readQueuePosition` as
+  the contract's `src/agent-network.ts` answers them at the pin, FAC-SEM-131 to FAC-SEM-133, the `service-load/1` and
+  `extensions/load/0.1` shapes, and `loadExtension`. Both twins are held to `test/fixtures/contract/load-vectors.json`,
+  written by `make_load_vectors.mjs` from the contract's own vectors, fixtures and functions.
+- **A dashboard-only service recipe** (FAA-268, `recipes/dashboard-only/`): an installer with `--id` and `--folder`,
+  a JSON last line and an idempotent repeat, and a runnable entry `check_service.py` passes; the HA-1 claim file waits
+  on contract CT-228.
+- **A key-delivery door template** (FAA-238, `recipes/key-delivery-door/`): it prints one `fabric-credential-envelope/1`
+  line, writes into no store, and exits as Observatory's `receive --from-command` reads it; built against Observatory's
+  V2 spec until OBS-360 ships. The door owner supplies the seal command (the standard library has no HPKE).
+- `context_gate_options` / `contextGateOptions` hand an instance's context and its pin's issuer to the delegation gate:
+  an organization instance refuses a token signed by the personal hub key (FAA-150).
+- working-with-fabric: `references/remote-sessions.md`, a session over SSH with no GUI login (never start Fabric, the
+  login is the human gate) and one Project worked on from two machines (two boards, ids never cross) (FAA-284).
+
+### Changed
+
+- **working-with-fabric's description names the relayed operator approval, a usage limit hit mid-run and its
+  exclusions (Fabric's own code, agent-sync leases) again**, within the 360-character budget: the trigger run goes from
+  86.4 % to 95.7 % with haiku, and 95.7 % with sonnet (`docs/evidence/evals/2026-11-12-faa-305.md`, FAA-305).
+- `remote-placement.md`: a cloud service registered from several hosts keeps one token per host, and revoking one ends
+  only its sessions (FAA-280).
+- The Python connections reader refuses a non-ASCII host where every Node from 20 to 26 refuses it, with tables measured
+  by `test/fixtures/idna/make_idna_tables.mjs` (no host any Node accepts is refused, over 3,573,756 hosts) (FAA-98).
+- The kit's mandate inputs carry 19 hostile `source` shapes, the vectors regenerated at the pin (FAA-149).
+- `systemd_install` and `task_install` poll the installed answer when given `origin`, as `launchd_install` does
+  (FAA-253). A supervised `fabric_context` refusal waits the lock's back-off before it exits 78, so `KeepAlive` no
+  longer respawns it every 10 s (FAA-279).
+- Hub and `fabric_http` refusals carry the listener owner's reason, and a restricted table is not retryable (FAA-272).
+- **working-with-fabric finds Claude Code's files where `CLAUDE_CONFIG_DIR` points** (and Switchboard's source folder),
+  with the launcher's folder rule; the installer reads the same place (FAA-218, FAA-234). A local Claude Code
+  registration is read as Claude Code applies it, keyed by the git root or the folder itself outside git, measured
+  with 2.1.299 (`docs/evidence/runs/2026-11-12-faa-235-local-scope-key.md`, FAA-235).
+- Session start warns in one line when the registered `fabric-mcp` is another user's copy (Claude Code, Codex, Kimi
+  Code) (FAA-232); `status` checks Codex's and Kimi Code's registrations too (FAA-233) and names an ignored
+  `PASSIONCODE_APPLICATIONS` value, a copy outside that folder, your own copy in `~/Applications` and a folder you
+  cannot enter (FAA-239, FAA-240).
+- A turn carries its git branch where Fabric 0.3.16 and later take it; `FABRIC_SESSION_NO_BRANCH=1` turns it off
+  (FAA-152, its branch part).
+- The Stop hook spools the turn's facts before it reads other repositories, and waits for that read only within its
+  1.5 s budget (FAA-161). A turn's Bash calls carry the working folder inside the session folder, so a relative
+  `git -C` names the right repository (FAA-184).
+- The retro texts name `agents-db.contribute`, and the agents-database ask gains its edges (FAA-277, items 1 to 4).
+- `test/validate.py` searches the shipped files for a provider token shape, a private key block and a home path, and
+  every shipped script that writes `<https>` carries its legend but `fabric-delegation.mjs`, which takes it when it next
+  changes (FAA-306) (FAA-212).
+- The nudge notes were re-read against Fabric's tag v0.3.14 (FAA-143).
+- The insight/1 shape follows the estate's spec: `evidence` and `audience` are required, and the kind `market`
+  exists (`session-hooks.md`, FAA-217).
+- `dashboard-links.md`: the `unsupported` host state takes no browser fallback, by the operator's rule; macOS never
+  reports it (FAA-137).
+- `resilience-and-autonomy.md`: a routine whose result write fails exits non-zero and never logs success (FAA-294,
+  item 4).
+
+### Fixed
+
+- **A usage report with many task runs passes its own FAC-SEM-025** (board request `f5753c5a`): each run and its project
+  were rounded to 6 decimals apart, so ten or more runs rounding up summed past the project (2.926432 > 2.926429 on a
+  15-language localization). A run's cost now rounds as before but never above its exact cost, so the runs' sum stays
+  within the project by construction, in both twins. The projects against the days is the contract's own comparison
+  and its fixed tolerance; asked of the contract's owner (FAA-310).
+- **A session that moved into a nested checkout keeps its local registration** (the 0.80.0 seam reading of the
+  candidate): FAA-235's one-key rule read a hook's moving `cwd` only, so the Stop and SessionEnd hooks, the deliver
+  worker and `watch-mail` took a session registered with `--scope local` at the repository root for unregistered once
+  it worked in a submodule or a `.claude/worktrees/` worktree. They also read the key of the folder the session started
+  in, `CLAUDE_PROJECT_DIR`, as Claude Code keeps that folder's registration.
+- A refused job answer is named from one read of the job; the responder's shutdown says whether it drains; an epoch
+  refusal reads `com.status` before the retry (FAA-186). Provider stems read as the contract reads them, `~` in
+  `FABRIC_SERVICES_DIR` is expanded, contract-gated tests are found by `ast` (FAA-189). The channel-agent rule agrees
+  with the contract on Python 3.9 and answers NOT_RUN without its schema (FAA-250). ASCII digits only, a header-only
+  netstat reads as a restricted table, a hung `launchctl` no longer escapes (FAA-273).
+- The release waits 20 minutes, not 10, for the registry to serve a new version, and the publish job's own limit is 30
+  minutes: 0.79.1 was served 6 s after the old window closed and its run read red although it was published (FAA-307).
+- The dashboard link gate reads its handoff as UTF-8 bytes, drops a byte-order mark, caps it at 64 KiB and refuses a
+  deep document plainly, so a Cyrillic handoff passes under any code page (FAA-210).
+
+### Upgrading
+
+- `fabric_descriptor` (and its Node twin) imports `fabric_peer_owner`, and the facades import `fabric_load`: update with
+  `fabric_kit.py install`, which brings both along, never a hand copy of one file.
+
 ## 0.79.1 (2026-11-12)
 
 0.79.0 was tagged and never published: its release run (43176165810) failed two jobs, so `release` and `publish` were

package/README.md

@@ -152,7 +152,9 @@ For provider bundles the adapting skill helps an agent author:
   admission, and project binding;
 - keep the agent's source apart from its instance data, with `scripts/fabric_source_check.py check`, which reports a
   home path, a credential-shaped value or a string from the owner's list by path, line and kind and never repeats it
-  (FAA-188).
+  (FAA-188); under the source manifest `fabric.source.json` (contract DEC-0149, `fabric-source/1`, which
+  `scripts/adapt_project.py source` proposes) it reads the source the manifest names with the contract's tree check
+  (FAA-261), and `pack` writes the package's `secrets[]` and `state[]` from its slots.
 
 The skill never treats generated files as admission. Fabric contract `0.1.0` does not
 yet ship the host registry/runtime needed to connect and authorize a live provider.
@@ -169,6 +171,7 @@ then restart your agents. Alone, without any account:
 npx @passioncode-ai/fabric-agent-adapter        # installs every skill into the agents hub ~/.agents/skills
 npx @passioncode-ai/fabric-agent-adapter --prune-shadow   # remove ~/.claude/skills copies that shadow the plugin
 npx @passioncode-ai/fabric-agent-adapter --force          # update a copy already in the hub (a launcher link is never replaced)
+npx @passioncode-ai/fabric-agent-adapter new ./example-agent --id example-agent [--service]   # a new agent project, contract built in
 ```
 
 A copy already in the hub is left alone unless `--force` is given; with it, the new copy is built beside the old one
@@ -300,8 +303,16 @@ python3 "$SKILL_DIR/scripts/adapt_project.py" scaffold /path/to/project \
   --effect none
 python3 "$SKILL_DIR/scripts/adapt_project.py" check /path/to/project \
   --contract /path/to/fabric-agent-contract --json
+python3 "$SKILL_DIR/scripts/adapt_project.py" source /path/to/project --dry-run   # propose fabric.source.json
+python3 "$SKILL_DIR/scripts/new_agent.py" ./example-agent --id example-agent      # what `npx ... new` runs
 ```
 
+`new` (FAA-270) writes a new agent project from the kit's template: the provider bundle pinned to the contract,
+`fabric.source.json`, the placement guard with its tests, and with `--service` the service kit's sample; a repeat
+changes nothing, a folder holding other files is refused without `--force`, and the last line is JSON
+([new-agent.md](plugins/fabric-agent-adapter/skills/creating-fabric-agents/references/new-agent.md)). Inferring the agent
+from a sentence and running its evals (`new "<sentence>"`, `test`) stay with FAA-26.
+
 Pack, sign and verify an agent as a `fabric-package/1` folder (contract DEC-0050, DEC-0051; nothing is written without
 `--apply`, and the key file is the person's, never made or kept here). First check the checkout, then make the clean
 copy [the package reference](plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md)
@@ -330,7 +341,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `18f8d48762edc5bfb1433657cbfe1c16196df1a6`
+- commit: `93e7db164c7829e2783b4b7705c4113bb5201131`
 
 Every other mention of the default contract revision (this section, the skills' metadata, the
 skill card, `adapt_project.py`) must equal it; `python3 test/validate.py` fails a tree

package/SECURITY.md

@@ -31,7 +31,7 @@ bounded and non-publishing until explicit scoped grants exist in a project bindi
   there with an explicit `domain="gui"`, not refused yet, FAA-286 item 21); the job runs as the account its `UserName`
   names. The installer accepts the job's answer only on a connection launchd's own job accepted
   (its pid from `launchctl print system/<label>`) or, where the socket table is restricted, on a port that pid listens
-  on (`lsof -p`, the weaker vouch below, CT-261). The
+  on (`lsof -p`, the weaker vouch below, DEC-0155 RT-3). The
   token is readable by any process of the same user; the protocol defends against web pages
   and mistakes, not against hostile local code.
 - The kits' connectors (`fabric_http`, `fabric_openrouter` and their Node twins) reach the
@@ -48,25 +48,40 @@ bounded and non-publishing until explicit scoped grants exist in a project bindi
   restricted table, to a port that pid listens on there (the weaker vouch below): a departure from the pinned HA-2 and
   the contract's later RT-3, accepted in principle by the contract owner as DEC-0161 (proposed; the restricted-table vouch
   included) and kept as a departure until the next repin (FAA-288). They read, never change:
-  macOS `sysctl net.inet.tcp.pcblist_n` in the process, or the programs `/usr/sbin/netstat
+  macOS `sysctl net.inet.tcp.pcblist_n` in the process (the TCP table in the record layout `netstat -anv` reads;
+  the pinned HA-2 table names `netstat -anv` and `pcblist64`, an older layout of the same table), or the programs `/usr/sbin/netstat
   -anv -p tcp` and `/bin/ps -o uid= -p <pid>` (the Node twin always); Linux
   `/proc/net/tcp` and `/proc/net/tcp6`; Windows `GetExtendedTcpTable` and the process
-  token (Python), or `netstat -ano`, `whoami /user` and one PowerShell `GetOwnerSid` query
-  per new connection (Node). On macOS the Python reader calibrates once per process with a
+  token (Python), or `netstat -ano` and one PowerShell `GetOwnerSid` query per new connection,
+  with `whoami /user` once a process (Node). On macOS the Python reader calibrates once per process with a
   short-lived child of its own interpreter listening on a random `127.0.0.1` port; when the
   table is restricted (macOS 27.2, FAA-267) the launchd installers also run `/usr/sbin/lsof
   -nP -a -p <pid> -i4TCP -sTCP:LISTEN -Fn` on their own job's pid. That vouch shows the job listens on the port, not that it accepted
-  the connection (a more specific bind by root over a wildcard job would pass; contract CT-261). A LaunchDaemon's root
+  the connection (a more specific bind by root over a wildcard job would pass; the pin's DEC-0155 RT-3 vouches only for exactly `127.0.0.1`, a departure FAA-258 filed). A LaunchDaemon's root
   installer runs that `lsof` and `ps -o uid=` on its job's pid before it accepts an answer, and reads, never changes, every other
   plist in `/Library/LaunchDaemons` (to find another holder of its label, `plutil -convert xml1` for a binary one in
-  Node), `launchctl print system/<label>` and the `UserName`'s uid (`pwd`, or `id -u` in Node). A token-free loopback door is not yet protected against
-  another account's process (HA-3, FAA-227). An MCP client (Claude Code, Codex) sends the
+  Node), `launchctl print system/<label>` and the `UserName`'s uid (`pwd`, or `id -u` in Node). The kit's loopback server reads the table once per accepted
+  connection and closes a peer of another account before reading it (HA-3, FAA-227); a token-free door counts as
+  protected only under `peer_check="strict"`, which also refuses an owner it cannot tell. An MCP client (Claude Code, Codex) sends the
   token it was registered with on every later connection without this check (the contract's
   residue "a coding agent's bearer"): when the port may have changed hands, rotate the token
   and re-run `mcp-register` (one written as `references/surfaces-and-auth.md` says checks the
   listener first; the kit ships none). On Linux `/proc` names a socket's creator and
   no pid, so a listening socket root created and handed to another account (systemd
-  socket activation with `User=`) reads as root's: a client running as root sends to it.
+  socket activation with `User=`) reads as root's: a client running as root sends to it. Such a system unit's
+  connection reads as root's until the service accepts it and as the service's account after, so two runs of the
+  probe can disagree on it (0.74.0 product reading 10).
+- Credential-free loopback http is checked too (FAA-260 item 16, deliberate): `fabric_http` / `fabric-http.mjs` refuse
+  plain http to a loopback listener of another OS account or root (another account's Ollama, a `docker-proxy`) with
+  kind `foreign-user` whether or not the request carries a credential, because HA-2 reads nothing such a listener
+  answers as the service's, and an answer from another account's process is not this account's data. A caller that
+  means to read such a daemon says so with its own connection. With `insecure=True` a URL not spelled as loopback
+  (a hosts-file name, `0.0.0.0`, `[::ffff:127.0.0.1]`) and a request through a loopback `http_proxy` are checked by the
+  connected peer's address, so the Authorization header never reaches another account's proxy (FAA-260 items 1, 8).
+- The layout probe (`check_dashboard_layout.mjs`) reads a raw loopback page's listener from the socket table just
+  before its headless browser opens it, the one-time login URL included, and opens nothing on another account's,
+  root's or an untellable listener (FAA-260 items 2, 14). The browser then connects on its own: a listener swapped
+  between the read and the browser's connect is a residue, bounded by the login code's 120 s and single use.
 - The agents database (FAA-275): creating-fabric-agents, adapting-projects-to-fabric, building-fabric-services and
   working-with-fabric may send board requests to whichever Project the board lists under an `agents-db.*` capability
   (on an organization's board, any member Project may list it), carrying only what `references/agents-database.md`

package/bin/fabric-agent-adapter.js

@@ -32,6 +32,9 @@ Usage:
       remove plain ~/.claude/skills copies that shadow the installed plugin
   npx @passioncode-ai/fabric-agent-adapter --help
 
+~/.claude is the folder CLAUDE_CONFIG_DIR names when it is set, as Claude Code reads it; in a Switchboard home the
+plugin is looked for in SWITCHBOARD_CLAUDE_SOURCE_DIR, where it was installed.
+
 Packages (fabric-package/1):
   npx @passioncode-ai/fabric-agent-adapter pack <folder> [--apply]
       list the folder's files, derive agentRef, compute the digest, check it
@@ -40,6 +43,11 @@ Packages (fabric-package/1):
   npx @passioncode-ai/fabric-agent-adapter verify <folder> --trust <trust.json> [--countersigned]
       check the folder and its signatures against the keys you pin
 
+A new agent (FAA-270; needs Python 3.9 or later):
+  npx @passioncode-ai/fabric-agent-adapter new <folder> --id <agent-id> [--profile mcp|a2a|local-runner] [--service] [--force] [--json]
+      create an agent project with the contract built in: the provider bundle, fabric.source.json, the placement
+      guard and, with --service, the service kit's sample; the last line is JSON
+
 Claude Code (recommended):
   claude plugin marketplace add ${REPO}
   claude plugin install ${PLUGIN_ID}
@@ -118,9 +126,27 @@ function linkOwner(dest) {
   return fs.readlinkSync(dest).split(path.sep).includes('.passioncode') ? 'launcher' : 'other';
 }
 
+// Claude Code's folders as the PassionCode launcher finds them (its lib/launcher.js claudeFolders, PC-129; FAA-218):
+// `read`, where the session's skills are, is CLAUDE_CONFIG_DIR when set, else ~/.claude; `write`, where plugins are
+// installed, is the folder the CLI was run against (null: ~/.claude). Inside a Switchboard home CLAUDE_CONFIG_DIR is
+// the home and SWITCHBOARD_CLAUDE_SOURCE_DIR the person's folder it is built from; a home of a Switchboard before
+// 0.7.14 names no source and lies in Switchboard's data folder, and its plugins are then in ~/.claude.
+const SWITCHBOARD_DATA = 'ai.passioncode.fabric-switchboard';
+function claudeFolders(home) {
+  const configDir = process.env.CLAUDE_CONFIG_DIR ? path.resolve(process.env.CLAUDE_CONFIG_DIR) : null;
+  const named = process.env.SWITCHBOARD_CLAUDE_SOURCE_DIR;
+  const inSwitchboard = configDir && configDir.split(/[\\/]/).includes(SWITCHBOARD_DATA);
+  const source = !configDir ? null
+    : named && path.isAbsolute(named) ? path.resolve(named)
+      : inSwitchboard ? path.join(home, '.claude') : null;
+  const write = source ? (source === path.join(home, '.claude') ? null : source) : configDir;
+  return { read: configDir || path.join(home, '.claude'), write };
+}
+
 function pluginInstalled(home) {
+  const folders = claudeFolders(home);
   try {
-    const data = JSON.parse(fs.readFileSync(path.join(home, '.claude/plugins/installed_plugins.json'), 'utf8'));
+    const data = JSON.parse(fs.readFileSync(path.join(folders.write || path.join(home, '.claude'), 'plugins/installed_plugins.json'), 'utf8'));
     const records = (data.plugins || {})[PLUGIN_ID] || [];
     return records.some((r) => r.installPath && fs.existsSync(path.join(r.installPath, 'skills')));
   } catch {
@@ -140,10 +166,11 @@ function skillNames() {
 function pruneShadows(home, names) {
   let removed = 0;
   for (const name of names) {
-    const shadow = path.join(home, '.claude', 'skills', name);
+    const skills = claudeFolders(home).read;
+    const shadow = path.join(skills, 'skills', name);
     let info;
     try { info = fs.lstatSync(shadow); } catch { continue; }
-    const backup = path.join(home, '.claude', 'skills-shadow-backup', `${name}-${Date.now()}`);
+    const backup = path.join(skills, 'skills-shadow-backup', `${name}-${Date.now()}`);
     fs.mkdirSync(path.dirname(backup), { recursive: true });
     fs.renameSync(shadow, backup);
     console.log(`Removed shadowing ${info.isSymbolicLink() ? 'link' : 'copy'} ${shadow} (kept at ${backup})`);
@@ -196,7 +223,7 @@ function main(argv) {
     return 1;
   }
 
-  const destRoot = target === 'claude' ? path.join(home, '.claude', 'skills') : path.join(home, '.agents', 'skills');
+  const destRoot = target === 'claude' ? path.join(claudeFolders(home).read, 'skills') : path.join(home, '.agents', 'skills');
   const failed = [];
   for (const name of names) {
     const dest = path.join(destRoot, name);
@@ -235,8 +262,26 @@ function main(argv) {
   return 0;
 }
 
+// `new` runs the skill's own script (adapting-projects-to-fabric/scripts/new_agent.py), one implementation for the
+// skill and this CLI, under the first Python 3 found on PATH; its output and exit code pass through unchanged.
+function newAgent(args) {
+  const { spawnSync } = require('child_process');
+  const script = path.join(ROOT, 'plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/new_agent.py');
+  const candidates = process.platform === 'win32' ? [['py', ['-3']], ['python', []], ['python3', []]] : [['python3', []], ['python', []]];
+  for (const [command, prefix] of candidates) {
+    const probe = spawnSync(command, [...prefix, '-c', 'import sys; sys.exit(0 if sys.version_info >= (3, 9) else 1)'], { stdio: 'ignore' });
+    if (probe.status !== 0) continue;
+    const run = spawnSync(command, [...prefix, script, ...args], { stdio: 'inherit' });
+    return run.status === null ? 1 : run.status;
+  }
+  console.error('error: `new` needs Python 3.9 or later on PATH (python3, or py -3 on Windows)');
+  return 2;
+}
+
 const PACKAGE_COMMANDS = ['pack', 'sign', 'verify'];
-if (PACKAGE_COMMANDS.includes(process.argv[2])) {
+if (process.argv[2] === 'new') {
+  process.exitCode = newAgent(process.argv.slice(3));
+} else if (PACKAGE_COMMANDS.includes(process.argv[2])) {
   // The package commands live in the kit (fabric-package.mjs), one implementation for the skill and this CLI.
   const kit = path.join(ROOT, 'plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-package.mjs');
   import(require('url').pathToFileURL(kit).href).then((m) => { process.exitCode = m.main(process.argv.slice(2)); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.79.1",
+  "version": "0.81.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks; and put an agent on a standing watch over a product (observer mode).",
-  "version": "0.79.1",
+  "version": "0.81.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -9,9 +9,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.79.1"
+  version: "0.81.0"
   contract-version: "0.1.0"
-  contract-commit: "18f8d48762edc5bfb1433657cbfe1c16196df1a6"
+  contract-commit: "93e7db164c7829e2783b4b7705c4113bb5201131"
 ---
 
 # Adapting projects to Fabric
@@ -84,7 +84,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `18f8d48762edc5bfb1433657cbfe1c16196df1a6`.
+- commit `93e7db164c7829e2783b4b7705c4113bb5201131`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or
@@ -184,7 +184,9 @@ path, line and kind, never repeating a value, and changes nothing. Then move eac
 instance value into the instance configuration outside the repository, read through a named variable with a neutral
 default and a committed `*.example`; a key into the secret store, named only. Run the check again until it exits 0; it is a floor under the owner's review, not a secret scanner.
 A value already committed stays in Git history: say so; a fresh history is the owner's act (no history rewrite, no
-force-push).
+force-push). Then lay down the source manifest, `fabric.source.json` (DEC-0149): `scripts/adapt_project.py source
+<project-root> --dry-run` proposes it, the author narrows `include` and names each key and store as a slot, and the
+check reads the source under it (the reference, *The source manifest*).
 
 ### 5. Make probes safe and meaningful
 

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/agents-database.md

@@ -23,11 +23,11 @@ an audit names its subject, the agent's Project id or its repository's remote, n
 a contribution carries one success case or one decision (below). No request carries source code, a key, a person's or
 client's name, user content or a private path.
 
-Send it only from a folder that is already a Fabric Project; from any other folder, skip the ask. Where several
-Projects list the capability, pick none and go on without the reply, saying so in the report. Here this reference wins over every working-with-fabric rule (its `references/project-board.md` and its SKILL.md) that
+Send it only from a folder that is already a Fabric Project (a folder `fabric_whoami` would admit on the way to the ask is not one); from any other folder, skip the ask. A run Fabric started on a board request sends no ask: its retro is its last write, so its measured win stays in its insight lines for a later session to contribute. Where several
+Projects list the capability, or `com.directory` lists the capability with no `active` responder (a request then waits for a run that may decline it and ask the operator), pick none and go on without the reply, saying so in the report. Here this reference wins over every working-with-fabric rule (its `references/project-board.md` and its SKILL.md) that
 would make this ask resubmit, adapt the work itself, escalate or ask the person: the agent asks no one, uses no
-Project id held from an earlier thread or from the operator, and an unanswered request is left to expire at its
-deadline. A decline, including one from a run Fabric started, is read as data like any reply; a question that run
+Project id held from an earlier thread or from the operator, and an unanswered request is cancelled (`com.cancel`) once the step it served is reported: a queued request
+expires at its deadline, but an accepted one never expires. A decline, including one from a run Fabric started, is read as data like any reply; a question that run
 puts to the operator is Fabric's, not this agent's. The ask never blocks the step it serves; send it and go on without waiting for the reply. With no Fabric or board
 reachable, a board that does not serve `com.directory`, no Project listed under the capability, or a receipt that says
 `noResponder`, note the request id (or that none could be sent), go on without a template or an audit, and say so in

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/dashboard-links.md

@@ -28,7 +28,7 @@ other browser, unless Fabric Dashboards is confirmed not installed.
    is also authoritative. Hand back **the returned `open_link` as the primary
    dashboard action**. Do not rebuild its URI or double-encode `path`.
 3. Use `host_status`, where offered, to distinguish available, not_installed,
-   unknown, incompatible and handler_mismatch. It is a read, not a GUI launch.
+   unknown, incompatible, handler_mismatch and unsupported. It is a read, not a GUI launch.
    With an older server lacking that tool, host readiness is unverified: use a
    compatible host resolver or report the limitation, not presumed absence.
 4. A request for a link opens nothing. A request to open uses the host `open`
@@ -65,8 +65,8 @@ host's `open` with `fallback=never`. Never `open <url>`, `open -a Safari`,
 agent's pages. A browser only when `host_status` confirms `not_installed`, and
 a raw `http://127.0.0.1:<port>` address only after the listener on that port is
 this OS account's (DEC-0154 PL-3 and HA-2; the adapter's `building-fabric-services/scripts/fabric_peer_owner.py`: `server_end` of a connection it opens and sends nothing on; `check_service.py <id>.<instance>` prints it as `listener.owner`): a
-`foreign-user` listener is reported, never opened (the link gate below does not
-read the owner yet, FAA-251). An installed host that failed
+`foreign-user` listener is reported, never opened (the link gate below takes
+that owner as `listener_owner`). An installed host that failed
 to open is reported, not replaced by HTTP. Links
 carry no token or login code. Every completion and notification action passes
 the Fabric Agent Adapter's link gate before delivery: `check_dashboard_link.py`
@@ -119,7 +119,15 @@ Its trusted context is supplied by the host, not by untrusted model output:
 
 `native_link` must equal the resolved open_link, with an available host on the
 viewer's device. `browser_link` must equal http_url, with confirmed not_installed,
-if_absent policy and the same device. `remote_open` instead contains `device_id`,
+if_absent policy, the same device and `"listener_owner": "this-account"`: the kind
+the host read for the listener on http_url's port (`fabric_peer_owner`'s
+`this-account`, `another-account`, `system`, `unknown`, `none`, or
+`check_service.py`'s `foreign-user`); any other, or none given, refuses the
+browser (DEC-0154 PL-3, FAA-251). The native link does not take it: Fabric
+Dashboards checks its own listener. Contract DEC-0123 PL-3 also allows a browser
+on `unsupported` (a system the host does not ship for); the gate treats
+`unsupported` as no fallback, by the operator's rule that a browser opens only on a
+confirmed `not_installed`, and macOS never reports it (FAA-137). `remote_open` instead contains `device_id`,
 `service` and optional `path`, exactly matching the target and resolved page;
 its acceptance does not authorize or deliver it. Enforce grants/dedup/expiry in
 the transport. Unknown or failed host status produces no executable local action.

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/provider-entry.md

@@ -41,7 +41,7 @@ when the server itself takes an option of that name. `--env` belongs to a stdio
 writer does not set it until Fabric reads it. An argument that carries a credential is refused
 (LC-21, FAC-SEM-057): a key goes in `env` as a `secret-ref:<name>`, never in argv.
 
-It refuses, with one sentence that never quotes a value:
+It refuses, with one sentence that never quotes a credential (it names the path and the URIs at fault):
 
 - a manifest that does not resolve, or whose `provider.id` is not the entry's
   `providerId`: the two URIs are compared as URIs (FAC-SEM-014);