@passioncode-ai/fabric-agent-adapter 0.80.2 → 0.82.0

package/CHANGELOG.md

@@ -1,5 +1,162 @@
 # Changelog
 
+## 0.82.0 (2026-11-12)
+
+Wave 4 of the backlog sweep of 2026-11-12. The contract pin stays at `93e7db16` (`v0.1.0+2026-11-08.1`). Kit modules
+change: `fabric_secrets`, `fabric_connections`, `fabric_peer_owner` (`1.2.0+kit.6`), `fabric_descriptor`,
+`fabric_holds`, `fabric_hub`, `fabric_lock`, the facade `fabric_service`, `fabric-delegation.mjs`, and their Node twins;
+dashboard kit 1.1.7.
+
+### Changed
+
+- **working-with-fabric answers a board request as contract DEC-0152 SA-6 says** (FAA-311): a session reads the
+  capability's slot in `com.status` first; at an `active` slot, or an enroll refused `fenced`, it leaves the request to
+  that holder, sends nothing and asks no one; it declines only at a slot `absent` at generation 0, and asks the operator
+  with `fabric_question_ask` after any refusal that is not retryable. A session without the slot does no work on a
+  request and gives it no state. The exit contract, the preamble, `SKILL.md` and the references say so, the exit
+  contract within Hermes' 4000 characters (3996).
+- **The peer owner reads DEC-0155's restricted table** (FAA-312): a `netstat` that fails or exits non-zero, a macOS
+  table with no row of another uid (sysctl) or process (netstat), and one without the reader's own connection read
+  `table-restricted` (RT-1); Linux and Windows keep `no-row`. Under a restricted table a listener is this account's only
+  on exactly `127.0.0.1` (RT-4). The launchd vouch takes only a listen on exactly `127.0.0.1` (RT-3), never the IPv4
+  wildcard or `::1`, and nothing from a set-uid reader: the kit's wildcard departure ends. `PEER_OWNER_VERSION` is
+  `1.2.0+kit.6`.
+- **The kit's hub locator answers a pid another OS account holds as the session hooks do** (FAA-304, after FAA-254):
+  `pid_alive` / `pidAlive` give None / null and `locate_hub` / `locateHub` refuse with `not-a-hub`, retryable, "not
+  verified", never `not-running`.
+- **`fabric_secrets.secret_url` refuses a URL whose host or port `new URL` refuses** (FAA-309), as `secretUrl` does:
+  the WHATWG host reading and the IDNA tables of FAA-98 move into `fabric_secrets` (`fabric_connections` imports them;
+  new `url_refused`). `repository_credential` still reads a repository's parameters whatever its host.
+- **One-pass JWT reading** (FAA-313): `has_jwt` / `jwt_spans` (Node `hasJwt` / `jwtSpans`), the same answers in linear
+  time; `secret_value`, `secret_argument`, the channel-agent check and `fabric_source_tree` use it.
+- **The holds twins agree on whitespace** (FAA-316): both squash a `statusMessage` with one ECMAScript class, so
+  U+001C, U+0085 and U+FEFF read the same; four vectors in `test/fixtures/holds/waiting-vectors.json`.
+- **The probe's `lifecycle.one-copy` finds a LaunchDaemon's leftover LaunchAgent** (FAA-317) in its `UserName`'s
+  `gui/<uid>` first, then in the probe's own; `in_launch_daemons` is `fabric_supervisors._in_daemons`, imported.
+- **Dashboard kit 1.1.7** (FAA-314): `fabric-button.js` reads credentials with DEC-0151's `SECRET_VALUE`, held to the
+  contract's `secretValue` and `credentialName` vectors.
+
+### Fixed
+
+- **A copy holding the instance lock stops when its lock file is replaced** (FAA-303, the 0.79.0 seam reading). On
+  macOS `flock` and `O_EXLOCK` lock an inode, so a data folder swapped under a running copy let a second copy lock the
+  new file and start. `hold_single_instance` / `holdSingleInstance` now start `InstanceLock.watch` /
+  `InstanceLock#watch` there: every `LOCK_WATCH_SECONDS` (2 s) it compares the locked inode with the file at the path,
+  and once the path names another file the copy exits 75 with one sentence naming the path (`lost_lock_message` /
+  `lostLockMessage`; `on_lost` / `onLost` replaces that reaction). The two copies overlap for at most one interval.
+  Linux and Windows keep their path-keyed name and are unchanged.
+- **Tests that failed under load** (FAA-308): the linear-time tests for `raw_values` and the minified JSON line read the
+  thread's CPU time, not the wall clock (kept on Windows), so a load near 110 no longer fails them, while a quadratic
+  implementation still does; the board sample's probe test lets `well-known.fast`, which times the machine, go either
+  way, as `test_probe_interop` does.
+- A flaky test drew a SAS signature without a digit about once in 1500 runs, a shape the long-run rule excludes by its
+  definition; it now draws one in the rule's shape.
+
+- **What the 0.82.0 seam reading found, fixed before the release**: Python's credential readers
+  (`fabric_secrets.url_refused` and its copy, `fabric_connections._whatwg_parts`, `check_service_channel_agent.url_parts`)
+  refuse a URL whose empty host is followed by `:`, with or without a port, as `new URL` does (`foo://:/?token=...`;
+  four shared vectors in both suites). `adapt_project`'s LC-21 gates read a stored URL's credential without the host
+  check, so a password in a manifest or `plugin.json` URL is found whatever its host. Every other reader of the JWT rule
+  reads it in one pass too (`fabric_source_check`, `fabric_connections` and its Node twin, the three
+  `check_dashboard_link.py` copies, `fabric-button.js`). Python `pid_alive` on Windows (`fabric_hub`,
+  `fabric_session_env`) answers None when OpenProcess is refused with access denied, as Node's EPERM does. The README
+  states the preamble's request rule; the exit contract's closing checkpoint names its `status` again (done if
+  completed, blocked if failed_known); the hub and HTTP docstrings say a missing row on macOS is `table-restricted`.
+  New rows FAA-320 to FAA-323.
+
+### Added
+
+- **`fabric_peer_owner.py listener <port> [--json]`** and **`fabric-peer-owner.mjs listener <port>`** print the
+  listener's kind (FAA-315): the route for the dashboard link gate's `listener_owner`, named in the three
+  `dashboard-links.md`.
+
+### Documented
+
+- On a host with a restricted socket table the dashboard layout probe measures nothing: every rule `NOT_RUN`, exit 3
+  (FAA-318). It does not vouch by the service's pid, which DEC-0155 RT-3 reserves for the caller that started it.
+- FAA-292's decision: RT-2 through libproc waits for an L0 module of its own, as `fabric_peer_owner.py` is at the
+  1000-line cap (`docs/evidence/specs/2026-11-12-faa-292-libproc-decision.md`); the row stays open.
+- `fabric-delegation.mjs` carries the `<https>` legend; `HTTPS_LEGEND_PENDING` in `test/validate.py` is empty (FAA-306).
+
+## 0.81.0 (2026-11-12)
+
+Wave 3 of the backlog sweep of 2026-11-12. **The contract pin moves to `93e7db16` (`v0.1.0+2026-11-08.1`)**: DEC-0149
+(`fabric-source/1`), CT-254 (HA-2's Linux source, the hybrid the kit already read), DEC-0151, DEC-0152, DEC-0155.
+Bundles pinned at `18f8d487` stay valid (FAA-258; impact map `docs/evidence/specs/2026-11-12-faa-258-repin-93e7db16-impact-map.md`).
+New kit modules: `fabric_holds` and `fabric-holds.mjs`. Kit modules change: `fabric_secrets`, `fabric_protocols`,
+`fabric_peer_owner` (`1.2.0+kit.5`), `fabric_package`, `fabric_descriptor`, `fabric_http`, `fabric_supervisors`, the
+facade `fabric_service`, and their Node twins.
+
+### Added
+
+- **`npx @passioncode-ai/fabric-agent-adapter new <folder> --id <agent-id> [--profile ...] [--service]`** (North Star G21,
+  FAA-270), and `new_agent.py` behind it: one command creates an agent project with the contract built in: the bundle
+  pinned at the contract, `fabric.source.json`, a placement guard reading Observatory's `observatory-placement/1` record
+  with its tests, and with `--service` the service kit's sample (its modules copied by `fabric_kit.py install`).
+  Idempotent, refuses a folder holding other files without `--force`, JSON last. It needs Python 3.9 or later on the
+  machine. Turning a sentence into an agent (`new "<sentence>"`, `test`) stays FAA-26, waiting on Fabric's
+  `fabric.agent.create`.
+- **`fabric.source.json` (DEC-0149, `fabric-source/1`)** (FAA-261): `fabric_source_tree.py` ports the contract's source
+  rules and matches all 140 of its vendored vectors; `fabric_source_check.py check` reads the source a manifest names,
+  by path, line and column, never the value; `adapt_project.py source` lays the manifest down with the kit's slots
+  (`PUBLISHER_URI` behind the `createdBy` sentinel, `PLACEMENT_RECORD`, and for a service `SUPERVISOR_LABEL` and
+  `SERVICE_PORT`; FAA-188's part 2); `pack` writes `secrets[]` and `state[]` from the slots, and FAC-SEM-160 refuses a
+  package that differs.
+- **Work held by a service's own limits** (FAA-298): new kit modules `fabric_holds` and `fabric-holds.mjs` (L3). A held
+  job says why it waits in `statusMessage` with the contract's pause grammar (the job schema is closed); the operator gets
+  one push per hold, and the answer is recorded as a scoped lift that falls back when its window ends; a new probe rule
+  `limits.holds`.
+- **Agent template folders** (FAA-265): five JSON Schemas and `template_check.py` in creating-fabric-agents; the
+  communication agent template moved into `templates/communication-agent/` with its manifest, connections, access, data
+  rooms, checks, assembly and changelog; `validate.py` checks every shipped template folder.
+
+### Changed
+
+- The probe's `limits.holds` reads a service that declares limits but does not use `fabric_holds` as NOT_RUN with a
+  migration note, not FAIL, and counts only code files (a vendored `check_service_rules.py` and docs naming `HoldBook`
+  no longer pass it). `LoopbackHTTPServer` and `loopbackServer` read the socket table only for a loopback peer: a peer
+  at another address (a `0.0.0.0` bind) is served with no owner under `refuse` and `strict` (the 0.81.0 seam reading).
+- **A kit service refuses a loopback peer of another OS account before it reads the request** (DEC-0154 HA-2 and HA-3,
+  FAA-227): `LoopbackHTTPServer` takes `peer_check` and Node's new `loopbackServer(httpServer, {peerCheck})` holds each
+  connection paused until the check passes; `refuse` (the default) closes another account's peer and serves the rest,
+  `strict` also refuses an owner it cannot tell, `off` reads nothing.
+- `fabric_http` and `fabric-http.mjs` check plain http that reaches loopback by its connected address, `insecure=True` and
+  a loopback proxy included (FAA-260). The probe times the well-known answer after the owner check, fails a deeply
+  nested body cleanly, compares port claims as ports (`:08080` is `:8080`), names the listener on a failed connect, and
+  no longer stops on a well-known body that is not an object; the layout probe opens a loopback page only after its
+  listener is this account's (FAA-260).
+- The dashboard link gate opens a raw loopback address in a browser only when `listener_owner` is `this-account` as
+  well as the host `not_installed` (FAA-251).
+- LaunchDaemon installs and uninstalls refuse contradicting domains, leftover LaunchAgents, another label's plist and an
+  unparseable or binary plist, and remove a plist a failed bootstrap wrote; the probe fails a LaunchDaemon without
+  `UserName`, with a `~` command, or loaded in both domains (FAA-286).
+- **The kit's credential detector is the contract's DEC-0151 `SECRET_VALUE`**, in both twins and the three dashboard
+  link checkers: a provider prefix counts only in its canonical case and after a boundary; an `sk-` key needs a digit and
+  an upper-case letter (16 characters or more) or a digit (32 or more), so `SK-...`, `sk-learn-...` and an `sk-` inside a
+  word are no longer keys. Repository names keep their own boundary-free key shapes, as DEC-0151 asks (FAA-258).
+- `fabric_protocols` lists `fabric-source/1`; `fabric_peer_owner` is `1.2.0+kit.5`, one version line with Observatory's
+  1.2.0, the Linux reading unchanged (FAA-258).
+- Every vendored contract vector is regenerated at the new pin with the contract's own generators;
+  `make_load_vectors.mjs` reads the pin from the lock file. SECURITY.md, lifecycle.md and protocol.md name DEC-0155 RT-3
+  for the vouch; SA-6 (DEC-0152) is the accepted board rule (FAA-258).
+
+### Fixed
+
+- `fabric_source_check.py` refuses a copy without `fabric_source_tree.py` with exit 2 and the file's name, not a
+  traceback and exit 1; `pack` (both kits) refuses by name a hand-written `secrets[]` naming a secret `fabric.source.json`
+  has no slot for, instead of dropping it (the 0.81.0 seam reading). The Windows job runs the loopback peer check.
+
+### Upgrading
+
+- A door that gave T0 because `strict` served the peer must also check that the peer's owner is named
+  (`peer_owner()` / `connectionOwner`): a peer off loopback has none and is T2. A folder whose `fabric.package.json`
+  names secrets its `fabric.source.json` lacks fails `pack` until they are added as `secret` slots.
+- A service that serves loopback HTTP keeps serving its own account's callers; pass `peer_check="strict"` to refuse an
+  owner the table cannot tell. A caller of the dashboard link gate passes `listener_owner`. An outside test that runs
+  this checkout's probe needs a readable socket table.
+- A service that vendors the kit takes the changed `fabric_secrets`, `fabric_protocols` and `fabric_peer_owner` with
+  `fabric_kit.py install`. A string the 0.80 detector called a key may no longer be one (see Changed).
+
 ## 0.80.2 (2026-11-12)
 
 0.80.1 was tagged and never published: its `windows` job (run 43212508702) failed one test, so `release` and `publish`

package/README.md

@@ -23,10 +23,12 @@ The skills are `adapting-projects-to-fabric`, `creating-fabric-agents`,
 `working-with-fabric` is for the other side: a coding agent (Claude Code, Codex, Kimi Code, Kilo, Hermes) opened in
 a terminal that works in a project through Fabric. It finds Fabric (`hub.json`, its `pid`), has the machine's
 lifecycle broker start it when it is down, registers `fabric-mcp` once with no secret, calls `fabric_whoami`
-first, reads the project board (`com.status`, `com.list`, `com.read_ack` only what was read), answers what waits on its
-Project in the same turn with its state (the result later; a request its Project's service should take stays queued; before Fabric 0.3.17 a run Fabric starts
+first, reads the project board (`com.status`, `com.list`, `com.read_ack` only what was read): an announcement or
+question waiting on its Project gets its state in the same turn (the result later), and a request to its Project is
+read through its capability's slot in `com.status` (`active` is left to its holder and nobody is asked; otherwise
+`com.enroll`, and only the slot's holder gives the request its state; before Fabric 0.3.17 a run Fabric starts
 declines a request no session can take and the asker resends, and from 0.3.17 the session's own Project is granted
-`board.respond` at `com.enroll`, CO-506), and asks other
+`board.respond` at `com.enroll`, CO-506). It asks other
 Projects only through `com.submit`, asks who is working on what and claims its task before it starts
 (`fabric_work_list`, `fabric_work_claim`, Fabric v0.3.5 and later), links tasks to backlog rows instead of copying them, and
 releases at the end (`fabric_work_release`). `scripts/fabric_session.py status` prints where Fabric stands and one
@@ -152,7 +154,9 @@ For provider bundles the adapting skill helps an agent author:
   admission, and project binding;
 - keep the agent's source apart from its instance data, with `scripts/fabric_source_check.py check`, which reports a
   home path, a credential-shaped value or a string from the owner's list by path, line and kind and never repeats it
-  (FAA-188).
+  (FAA-188); under the source manifest `fabric.source.json` (contract DEC-0149, `fabric-source/1`, which
+  `scripts/adapt_project.py source` proposes) it reads the source the manifest names with the contract's tree check
+  (FAA-261), and `pack` writes the package's `secrets[]` and `state[]` from its slots.
 
 The skill never treats generated files as admission. Fabric contract `0.1.0` does not
 yet ship the host registry/runtime needed to connect and authorize a live provider.
@@ -169,6 +173,7 @@ then restart your agents. Alone, without any account:
 npx @passioncode-ai/fabric-agent-adapter        # installs every skill into the agents hub ~/.agents/skills
 npx @passioncode-ai/fabric-agent-adapter --prune-shadow   # remove ~/.claude/skills copies that shadow the plugin
 npx @passioncode-ai/fabric-agent-adapter --force          # update a copy already in the hub (a launcher link is never replaced)
+npx @passioncode-ai/fabric-agent-adapter new ./example-agent --id example-agent [--service]   # a new agent project, contract built in
 ```
 
 A copy already in the hub is left alone unless `--force` is given; with it, the new copy is built beside the old one
@@ -300,8 +305,16 @@ python3 "$SKILL_DIR/scripts/adapt_project.py" scaffold /path/to/project \
   --effect none
 python3 "$SKILL_DIR/scripts/adapt_project.py" check /path/to/project \
   --contract /path/to/fabric-agent-contract --json
+python3 "$SKILL_DIR/scripts/adapt_project.py" source /path/to/project --dry-run   # propose fabric.source.json
+python3 "$SKILL_DIR/scripts/new_agent.py" ./example-agent --id example-agent      # what `npx ... new` runs
 ```
 
+`new` (FAA-270) writes a new agent project from the kit's template: the provider bundle pinned to the contract,
+`fabric.source.json`, the placement guard with its tests, and with `--service` the service kit's sample; a repeat
+changes nothing, a folder holding other files is refused without `--force`, and the last line is JSON
+([new-agent.md](plugins/fabric-agent-adapter/skills/creating-fabric-agents/references/new-agent.md)). Inferring the agent
+from a sentence and running its evals (`new "<sentence>"`, `test`) stay with FAA-26.
+
 Pack, sign and verify an agent as a `fabric-package/1` folder (contract DEC-0050, DEC-0051; nothing is written without
 `--apply`, and the key file is the person's, never made or kept here). First check the checkout, then make the clean
 copy [the package reference](plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md)
@@ -330,7 +343,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `18f8d48762edc5bfb1433657cbfe1c16196df1a6`
+- commit: `93e7db164c7829e2783b4b7705c4113bb5201131`
 
 Every other mention of the default contract revision (this section, the skills' metadata, the
 skill card, `adapt_project.py`) must equal it; `python3 test/validate.py` fails a tree

package/SECURITY.md

@@ -31,7 +31,7 @@ bounded and non-publishing until explicit scoped grants exist in a project bindi
   there with an explicit `domain="gui"`, not refused yet, FAA-286 item 21); the job runs as the account its `UserName`
   names. The installer accepts the job's answer only on a connection launchd's own job accepted
   (its pid from `launchctl print system/<label>`) or, where the socket table is restricted, on a port that pid listens
-  on (`lsof -p`, the weaker vouch below, CT-261). The
+  on (`lsof -p`, the weaker vouch below, DEC-0155 RT-3). The
   token is readable by any process of the same user; the protocol defends against web pages
   and mistakes, not against hostile local code.
 - The kits' connectors (`fabric_http`, `fabric_openrouter` and their Node twins) reach the
@@ -48,25 +48,42 @@ bounded and non-publishing until explicit scoped grants exist in a project bindi
   restricted table, to a port that pid listens on there (the weaker vouch below): a departure from the pinned HA-2 and
   the contract's later RT-3, accepted in principle by the contract owner as DEC-0161 (proposed; the restricted-table vouch
   included) and kept as a departure until the next repin (FAA-288). They read, never change:
-  macOS `sysctl net.inet.tcp.pcblist_n` in the process, or the programs `/usr/sbin/netstat
+  macOS `sysctl net.inet.tcp.pcblist_n` in the process (the TCP table in the record layout `netstat -anv` reads;
+  the pinned HA-2 table names `netstat -anv` and `pcblist64`, an older layout of the same table), or the programs `/usr/sbin/netstat
   -anv -p tcp` and `/bin/ps -o uid= -p <pid>` (the Node twin always); Linux
   `/proc/net/tcp` and `/proc/net/tcp6`; Windows `GetExtendedTcpTable` and the process
-  token (Python), or `netstat -ano`, `whoami /user` and one PowerShell `GetOwnerSid` query
-  per new connection (Node). On macOS the Python reader calibrates once per process with a
+  token (Python), or `netstat -ano` and one PowerShell `GetOwnerSid` query per new connection,
+  with `whoami /user` once a process (Node). On macOS the Python reader calibrates once per process with a
   short-lived child of its own interpreter listening on a random `127.0.0.1` port; when the
   table is restricted (macOS 27.2, FAA-267) the launchd installers also run `/usr/sbin/lsof
   -nP -a -p <pid> -i4TCP -sTCP:LISTEN -Fn` on their own job's pid. That vouch shows the job listens on the port, not that it accepted
-  the connection (a more specific bind by root over a wildcard job would pass; contract CT-261). A LaunchDaemon's root
+  the connection; it counts only a listen on exactly `127.0.0.1`, as the pin's DEC-0155 RT-3 asks (since FAA-312; a wildcard
+  or `::1` listener is never vouched for, and a set-uid reader vouches for nothing). A LaunchDaemon's root
   installer runs that `lsof` and `ps -o uid=` on its job's pid before it accepts an answer, and reads, never changes, every other
   plist in `/Library/LaunchDaemons` (to find another holder of its label, `plutil -convert xml1` for a binary one in
-  Node), `launchctl print system/<label>` and the `UserName`'s uid (`pwd`, or `id -u` in Node). A token-free loopback door is not yet protected against
-  another account's process (HA-3, FAA-227). An MCP client (Claude Code, Codex) sends the
+  Node), `launchctl print system/<label>` and the `UserName`'s uid (`pwd`, or `id -u` in Node). The kit's loopback server reads the table once per accepted
+  connection and closes a peer of another account before reading it (HA-3, FAA-227); a token-free door counts as
+  protected only under `peer_check="strict"`, which also refuses an owner it cannot tell. An MCP client (Claude Code, Codex) sends the
   token it was registered with on every later connection without this check (the contract's
   residue "a coding agent's bearer"): when the port may have changed hands, rotate the token
   and re-run `mcp-register` (one written as `references/surfaces-and-auth.md` says checks the
   listener first; the kit ships none). On Linux `/proc` names a socket's creator and
   no pid, so a listening socket root created and handed to another account (systemd
-  socket activation with `User=`) reads as root's: a client running as root sends to it.
+  socket activation with `User=`) reads as root's: a client running as root sends to it. Such a system unit's
+  connection reads as root's until the service accepts it and as the service's account after, so two runs of the
+  probe can disagree on it (0.74.0 product reading 10).
+- Credential-free loopback http is checked too (FAA-260 item 16, deliberate): `fabric_http` / `fabric-http.mjs` refuse
+  plain http to a loopback listener of another OS account or root (another account's Ollama, a `docker-proxy`) with
+  kind `foreign-user` whether or not the request carries a credential, because HA-2 reads nothing such a listener
+  answers as the service's, and an answer from another account's process is not this account's data. A caller that
+  means to read such a daemon says so with its own connection. With `insecure=True` a URL not spelled as loopback
+  (a hosts-file name, `0.0.0.0`, `[::ffff:127.0.0.1]`) and a request through a loopback `http_proxy` are checked by the
+  connected peer's address, so the Authorization header never reaches another account's proxy (FAA-260 items 1, 8).
+- The layout probe (`check_dashboard_layout.mjs`) reads a raw loopback page's listener from the socket table just
+  before its headless browser opens it, the one-time login URL included, and opens nothing on another account's,
+  root's or an untellable listener (FAA-260 items 2, 14); under a restricted table (DEC-0155) that is every listener,
+  so it measures nothing there and never vouches by a pid it did not start (FAA-318). The browser then connects on its own: a listener swapped
+  between the read and the browser's connect is a residue, bounded by the login code's 120 s and single use.
 - The agents database (FAA-275): creating-fabric-agents, adapting-projects-to-fabric, building-fabric-services and
   working-with-fabric may send board requests to whichever Project the board lists under an `agents-db.*` capability
   (on an organization's board, any member Project may list it), carrying only what `references/agents-database.md`

package/bin/fabric-agent-adapter.js

@@ -43,6 +43,11 @@ Packages (fabric-package/1):
   npx @passioncode-ai/fabric-agent-adapter verify <folder> --trust <trust.json> [--countersigned]
       check the folder and its signatures against the keys you pin
 
+A new agent (FAA-270; needs Python 3.9 or later):
+  npx @passioncode-ai/fabric-agent-adapter new <folder> --id <agent-id> [--profile mcp|a2a|local-runner] [--service] [--force] [--json]
+      create an agent project with the contract built in: the provider bundle, fabric.source.json, the placement
+      guard and, with --service, the service kit's sample; the last line is JSON
+
 Claude Code (recommended):
   claude plugin marketplace add ${REPO}
   claude plugin install ${PLUGIN_ID}
@@ -257,8 +262,26 @@ function main(argv) {
   return 0;
 }
 
+// `new` runs the skill's own script (adapting-projects-to-fabric/scripts/new_agent.py), one implementation for the
+// skill and this CLI, under the first Python 3 found on PATH; its output and exit code pass through unchanged.
+function newAgent(args) {
+  const { spawnSync } = require('child_process');
+  const script = path.join(ROOT, 'plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/new_agent.py');
+  const candidates = process.platform === 'win32' ? [['py', ['-3']], ['python', []], ['python3', []]] : [['python3', []], ['python', []]];
+  for (const [command, prefix] of candidates) {
+    const probe = spawnSync(command, [...prefix, '-c', 'import sys; sys.exit(0 if sys.version_info >= (3, 9) else 1)'], { stdio: 'ignore' });
+    if (probe.status !== 0) continue;
+    const run = spawnSync(command, [...prefix, script, ...args], { stdio: 'inherit' });
+    return run.status === null ? 1 : run.status;
+  }
+  console.error('error: `new` needs Python 3.9 or later on PATH (python3, or py -3 on Windows)');
+  return 2;
+}
+
 const PACKAGE_COMMANDS = ['pack', 'sign', 'verify'];
-if (PACKAGE_COMMANDS.includes(process.argv[2])) {
+if (process.argv[2] === 'new') {
+  process.exitCode = newAgent(process.argv.slice(3));
+} else if (PACKAGE_COMMANDS.includes(process.argv[2])) {
   // The package commands live in the kit (fabric-package.mjs), one implementation for the skill and this CLI.
   const kit = path.join(ROOT, 'plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-package.mjs');
   import(require('url').pathToFileURL(kit).href).then((m) => { process.exitCode = m.main(process.argv.slice(2)); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.80.2",
+  "version": "0.82.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks; and put an agent on a standing watch over a product (observer mode).",
-  "version": "0.80.2",
+  "version": "0.82.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -9,9 +9,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.80.2"
+  version: "0.82.0"
   contract-version: "0.1.0"
-  contract-commit: "18f8d48762edc5bfb1433657cbfe1c16196df1a6"
+  contract-commit: "93e7db164c7829e2783b4b7705c4113bb5201131"
 ---
 
 # Adapting projects to Fabric
@@ -84,7 +84,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `18f8d48762edc5bfb1433657cbfe1c16196df1a6`.
+- commit `93e7db164c7829e2783b4b7705c4113bb5201131`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or
@@ -184,7 +184,9 @@ path, line and kind, never repeating a value, and changes nothing. Then move eac
 instance value into the instance configuration outside the repository, read through a named variable with a neutral
 default and a committed `*.example`; a key into the secret store, named only. Run the check again until it exits 0; it is a floor under the owner's review, not a secret scanner.
 A value already committed stays in Git history: say so; a fresh history is the owner's act (no history rewrite, no
-force-push).
+force-push). Then lay down the source manifest, `fabric.source.json` (DEC-0149): `scripts/adapt_project.py source
+<project-root> --dry-run` proposes it, the author narrows `include` and names each key and store as a slot, and the
+check reads the source under it (the reference, *The source manifest*).
 
 ### 5. Make probes safe and meaningful
 

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/dashboard-links.md

@@ -65,8 +65,8 @@ host's `open` with `fallback=never`. Never `open <url>`, `open -a Safari`,
 agent's pages. A browser only when `host_status` confirms `not_installed`, and
 a raw `http://127.0.0.1:<port>` address only after the listener on that port is
 this OS account's (DEC-0154 PL-3 and HA-2; the adapter's `building-fabric-services/scripts/fabric_peer_owner.py`: `server_end` of a connection it opens and sends nothing on; `check_service.py <id>.<instance>` prints it as `listener.owner`): a
-`foreign-user` listener is reported, never opened (the link gate below does not
-read the owner yet, FAA-251). An installed host that failed
+`foreign-user` listener is reported, never opened (the link gate below takes
+that owner as `listener_owner`). An installed host that failed
 to open is reported, not replaced by HTTP. Links
 carry no token or login code. Every completion and notification action passes
 the Fabric Agent Adapter's link gate before delivery: `check_dashboard_link.py`
@@ -119,7 +119,20 @@ Its trusted context is supplied by the host, not by untrusted model output:
 
 `native_link` must equal the resolved open_link, with an available host on the
 viewer's device. `browser_link` must equal http_url, with confirmed not_installed,
-if_absent policy and the same device. Contract DEC-0123 PL-3 also allows a browser
+if_absent policy, the same device and `"listener_owner": "this-account"`: the kind
+the host read for the listener on http_url's port (`fabric_peer_owner`'s
+`this-account`, `another-account`, `system`, `unknown`, `none`, or
+`check_service.py`'s `foreign-user`); any other, or none given, refuses the
+browser (DEC-0154 PL-3, FAA-251). The host reads that kind right before it opens
+the page with the adapter's
+`python3 building-fabric-services/scripts/fabric_peer_owner.py listener <port>`
+(or `node building-fabric-services/scripts/fabric-peer-owner.mjs listener <port>`),
+which prints it on one line (`--json` prints the whole owner) and sends nothing
+to the port (FAA-315). Where the socket table is restricted (macOS 27.2 for an
+ad-hoc-signed Python or Node, DEC-0155 RT-4) only this account's listener on
+exactly `127.0.0.1` reads `this-account`; a wildcard or `::1` bind reads
+`unknown` (`table-restricted`), and the browser is refused. The native link does not take it: Fabric
+Dashboards checks its own listener. Contract DEC-0123 PL-3 also allows a browser
 on `unsupported` (a system the host does not ship for); the gate treats
 `unsupported` as no fallback, by the operator's rule that a browser opens only on a
 confirmed `not_installed`, and macOS never reports it (FAA-137). `remote_open` instead contains `device_id`,

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/source-and-instance.md

@@ -7,13 +7,15 @@ first commit, so that its owner can hand the source over later without rewriting
 by itself: handing over, a new remote, a push or a change of visibility stays the owner's act, each time (a personal
 agent stays private until its owner says so about that act).
 
-The format of a source manifest, export and import is the contract's to decide (CT-194). What follows does not depend
-on it.
+The format of a source manifest, export and import is the contract's: DEC-0149 (`fabric-source/1`, its `source.md`) at
+the pin. The kit lays down `fabric.source.json` ([the source manifest](#the-source-manifest)), and the check reads the
+source under it.
 
 ## Contents
 
 - [The layout](#the-layout)
 - [The data home and its kind](#the-data-home-and-its-kind)
+- [The source manifest](#the-source-manifest)
 - [The check](#the-check)
 
 ## The layout
@@ -42,11 +44,11 @@ on it.
 - **Fixtures on neutral ids.** A test that needs a home folder, an owner or an account uses `example`, `example-agent`,
   `owner@example.com` or a one-letter home, and a credential-shaped test value says it is synthetic
   (`sk-test-not-a-key`) or is assembled at run time.
-- **Two names stay in the source until the contract decides (CT-194).** A service's supervisor label is the agent's
-  own name, reverse-DNS on the publisher's domain (`com.example.example-agent`), and `AGENTS.md` names it (LC-09):
-  never the owner's account or name. A provider's `createdBy` names the publisher; until one is chosen it
-  keeps the scaffold's sentinel, and a person's name or account is never written there. The adapter moves both when the
-  contract decides how an instance renames them (FAA-188 part 2).
+- **Two names are slots, never values (DEC-0149, FAA-188 part 2).** A service's supervisor label is the agent's own
+  name, reverse-DNS on the publisher's domain (`com.example.example-agent`), and `AGENTS.md` names it (LC-09): never the
+  owner's account or name; the label an installation runs under is its `SUPERVISOR_LABEL` slot, with its port in
+  `SERVICE_PORT`. A provider's `createdBy` names the publisher; the source keeps the scaffold's sentinel, and the
+  publisher's URI is the installation's `PUBLISHER_URI` slot, so a person's name or account is never written there.
 
 ## The data home and its kind
 
@@ -69,6 +71,41 @@ on it.
   configuration and dependency folders `--every-file` reads too), each exit 0, with the owner's list or its absence recorded, until the contract's export (CT-194)
   replaces it.
 
+## The source manifest
+
+`fabric.source.json` at the source's root says what is source and which slots an installation fills, never a value
+(DEC-0149, `fabric-source/1`):
+
+| Member | What |
+|---|---|
+| `include` | the source, default deny: a file outside every entry is not source; an entry ending in `/` is a folder, no globs |
+| `exclude` | holes in `include`, read in any letter case and Unicode form (a file an entry names only in another spelling is left out, and the check says `excluded-by-fold`) |
+| `binaries` | the binary files that are source (an icon, a font); another binary blocks |
+| `unchecked` | source paths that travel unread, each with its reason (synthetic test vectors, a licence naming a holder on the owner's list) |
+| `publicAddresses` | the e-mail addresses the source may carry (a support address); another one warns |
+| `slots` | what an installation fills, by name: `secret` (a key), `config` (a setting: a repository URL, a folder, the supervisor label, the publisher's identity), `store` (a data store, with its path in the data folder), `endpoint` (the operator's infrastructure by role) |
+
+- **Laying it down.** A new agent gets it from `new_agent.py` (creating-fabric-agents' `references/new-agent.md`); an
+  existing project from `adapt_project.py source <project-root>` (adapting-projects-to-fabric's scripts), which proposes `include` from the
+  project's top-level entries (what Git would commit, instance data by its name left out) and names the kit's slots
+  (`PUBLISHER_URI` where a provider manifest is there, `PLACEMENT_RECORD`, and with `--service` `SUPERVISOR_LABEL` and
+  `SERVICE_PORT`); `--secret NAME:PURPOSE` and `--store NAME:PATH:PURPOSE` add the agent's own. `--dry-run` prints the
+  proposal and writes nothing; an existing manifest is the owner's and is replaced only with `--force`. The author then
+  narrows `include` to what is source.
+- **The check under it.** When the folder it checks holds `fabric.source.json`, `fabric_source_check.py check` reads
+  the source the manifest names and reports the contract's kinds (`fabric_source_tree.py`, held to the contract's
+  vectors): blocking `home-path`, `credential`, `binary`, `nested-repository`, `instance-string`, `missing`,
+  `no-include` and the manifest's own findings (FAC-SEM-156, FAC-SEM-157); warnings `email`, `link-outside`,
+  `no-license`, `unused-exclude`, `excluded-by-fold`, each by path, line and column (UTF-16 units), never by the text
+  found. Exit 1 on a blocking finding, 0 when only warnings remain and every source file was read, 2 when one was not.
+  `.fabric-source-ignore` and `--exclude` are not read there: `exclude` and `unchecked` say it. A declared home
+  (`home: <name>`) is still found in every source file.
+- **Packing it.** `pack` (building-fabric-services' `references/package.md`) writes the package's `secrets[]` from the secret slots and `state[]` from the store slots' paths, and refuses a
+  package whose members differ (FAC-SEM-160); an empty `state[]` is a copy packed without state, and stays so. A
+  hand-written `secrets[]` naming a secret the manifest has no slot for is refused by name, never dropped.
+- **Handing it over** stays the owner's act, each time, on their word for that act (the contract's `source.md`,
+  Handing over).
+
 ## The check
 
 `fabric_source_check.py check` reads the files the source would carry (what Git would commit: tracked files and