@passioncode-ai/fabric-agent-adapter 0.80.2 → 0.82.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -59,7 +59,7 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L0 | `fabric_time` | strict RFC 3339, UTC days, formatting, day windows, the clock ([dates](#dates-and-times)) |
 | L0 | `fabric_identifiers` | identifier equality by normal form (DEC-0076) |
 | L0 | `fabric_secrets` | the contract's one credential detector (DEC-0044) |
-| L0 | `fabric_peer_owner` | which OS account owns each end of a loopback connection, from the computer's socket table (DEC-0154 HA-2, FAA-226): `listener`, `server_end`, `peer`, `CheckedHTTPConnection`; the Python file is Project Observatory's `peer_owner.py` 1.1.0 vendored from commit `f86f0622` with the readings its header names (`1.1.0+kit.4`), the Node twin reads netstat, `/proc` and the owner SID where Python reads `sysctl`, `/proc` and `GetExtendedTcpTable`; on a restricted macOS table (FAA-267) a caller may vouch with a pid it started, proved by `lsof -p` |
+| L0 | `fabric_peer_owner` | which OS account owns each end of a loopback connection, from the computer's socket table (DEC-0154 HA-2, FAA-226): `listener`, `server_end`, `peer`, `CheckedHTTPConnection`; the Python file is Project Observatory's `peer_owner.py`, vendored from commit `f86f0622` (1.1.0) and read against `2180235c` (1.2.0, whose Linux rule it carries), with the readings its header names (`1.2.0+kit.6`; Observatory's 1.3.x libproc proof is FAA-292), the Node twin reads netstat, `/proc` and the owner SID where Python reads `sysctl`, `/proc` and `GetExtendedTcpTable`; on a restricted macOS table (FAA-267) a caller may vouch with a pid it started, proved by `lsof -p` |
 | L0 | `fabric_tailnet` | who calls an agent behind `tailscale serve` and what that person may open (FAA-297): `Tailscale-User-Login` only on the agent's own serve listener from a loopback peer, groups from a generated `tailnet-perimeter/1` file, a personal SHA-256-stored key for MCP no wider than the groups; `authorize`, `load_perimeter`, `load_keys`, `hash_key`, refusals 401/403 with a code ([surfaces-and-auth.md](surfaces-and-auth.md#behind-tailscale-serve)) |
 | L1 | `fabric_crypto` | Ed25519 signing (a Montgomery ladder that does not branch on the key) and verification, P-256 verification, base64url, sha256 |
 | L1 | `fabric_base` | the protocol name, `ServiceError`, small shared helpers |
@@ -79,10 +79,10 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L3 | `fabric_a2a` | the reading side of an A2A Agent Card: `surfaces.a2a` as the schema reads it, and what a public card must not carry (DEC-0122) |
 | L3 | `fabric_page_links` | a service's pages as Fabric Dashboards' open_link: build and read it, a raw local address, FAC-SEM-143 on a link and on a URL-mode input request (DEC-0123); the Python twin reads URLs as WHATWG does by hand |
 | L3 | `fabric_load` | the call queue and the load report of DEC-0104 (FAA-289): `job_caller_key`, `next_queued_job`, `admit_job`, `queue_status_message`, `read_queue_position`, FAC-SEM-131 to 133, the `service-load/1` and `extensions/load/0.1` shapes, `load_extension`; imports `fabric_connections` for ajv's `date-time` ([interop](interop.md#a-nodes-call-queue)) |
-| L3 | `fabric_lock` | the instance lock and the supervisor marker (LC-01, DEC-0057) |
+| L3 | `fabric_lock` | the instance lock, its watch where the lock has no path-keyed name (macOS, FAA-303), and the supervisor marker (LC-01, DEC-0057) |
 | L3 | `fabric_usage` | usage receipts, the ledger, the usage report, attribution, spending limits ([usage](usage.md)) |
 | L3 | `fabric_backups` | settings backups (DEC-0025) |
-| L3 | `fabric_descriptor` | the descriptor, peers, app descriptors, the well-known document |
+| L3 | `fabric_descriptor` | the descriptor, peers, app descriptors, the well-known document, the loopback HTTP server that refuses another OS account's peer before reading it (`LoopbackHTTPServer`, Node `loopbackServer`; FAA-227) |
 | L3 | `fabric_context` | one instance per context (FAA-125, N-11): a context's instance, folders, descriptor, lock and marker; not in the facade, installed with `--module fabric_context` ([contexts](estate-record.md#one-instance-per-context-the-helper)) |
 | L3 | `fabric_auth` | the token, the network guard, login codes |
 | L3 | `fabric_events` | events, paging, the JSONL event log (DEC-0029) |
@@ -92,6 +92,7 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L3 | `fabric_profiles` | runner and model profiles ([profiles](profiles.md)) |
 | L3 | `fabric_interop_rules` | `fabric-interop/0.1` rules without a service: constants, `InteropError`, trace context, job limits (DEC-0087; FAA-92), a job's approval step under the mandate (`job_step`, C3.3) |
 | L3 | `fabric_interop` | `fabric-interop/0.1`: jobs, envelopes, MCP tools; re-exports the rule layer ([interop](interop.md)) |
+| L3 | `fabric_holds` | work a service holds by its own limits (FAA-298): the held job's `statusMessage` in the pause grammar (`waiting_message`, `read_waiting`, `hold_job`), one push per hold and the operator's scoped lift (`HoldBook`: `hold`, `release`, `lift`, `admit`, `limit`) ([interop](interop.md#work-held-by-the-services-own-limits)) |
 | L4 | `fabric_hub` | the Fabric hub's door (`fabric-hub/0.1`) |
 | L4 | `fabric_board_shapes` | the project board's wire: constants, refusal codes, shapes |
 | L4 | `fabric_board_link` | the board's link: the MCP session over the hub, the fsynced checkpoint, a claimed request as data, and the operator's mandate a request carries (FAA-135, imports `fabric_mandate` and `fabric_interop_rules` for the FAA-139 reading) |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -106,7 +106,8 @@ systemd and Task Scheduler do not poll yet, FAA-253).
    then poll the well-known document until it answers with this `id.instance` on a listener of this OS account
    (DEC-0154 HA-2: another account's listener, or one whose owner cannot be told, is `foreign-user` and never a
    successful install; the error names it). Where the socket table hides other processes (macOS 27.2 under an
-   ad-hoc-signed interpreter), the installer vouches with its own job's pid from `launchctl print`; a listener it
+   ad-hoc-signed interpreter), the installer vouches with its own job's pid from `launchctl print`, for a listen on
+   exactly `127.0.0.1` alone (DEC-0155 RT-3; a wildcard bind is never vouched for since FAA-312); a listener it
    cannot prove reads `table-restricted` and the error names the way round it (FAA-267). The pid is the job's own, so a
    `ProgramArguments` wrapper that starts the server as a child (`sh -c` without `exec`, `uv run`, `npm start`) cannot
    vouch for it: on such a host start the server with `exec` or run the installer from Apple's `/usr/bin/python3`.
@@ -145,27 +146,34 @@ it at boot, before any login, as the account its `UserName` names.
   install requires (without it the job would run as root, which every client refuses); the file goes in
   `/Library/LaunchDaemons/<label>.plist`. A plist there is in the system domain by its path (the folder's case is
   ignored); `domain="system"` (Node: `domain: 'system'`) says so for any path, and an explicit domain wins over the
-  path. Everything else is a LaunchAgent's.
+  path, except that an install refuses a pair launchd would contradict: `domain="system"` with a plist in a
+  `LaunchAgents` folder (launchd also loads that into `gui/<uid>` at login) and `domain="gui"` with a plist in
+  `/Library/LaunchDaemons` (launchd loads it at boot as root). A domain name given as the plist path (`"system"`,
+  `"gui"`) is refused, never read as a relative path (FAA-286). Everything else is a LaunchAgent's.
   `UserName` is the account whose Fabric and agents call the service: clients of another account refuse it (HA-2).
 - **Who runs which step.** The release, the descriptor and the service token are written as the `UserName` (steps 1 and
   2 above, for example with `sudo -u <user> -H`), so they live in that user's home with its modes, and the plist's
   working directory and log paths name that home; only the plist, `launchd_install` and `launchd_uninstall` run as root,
   and at uninstall `remove_descriptor` runs as the `UserName` again. A service moved from a LaunchAgent is uninstalled
-  as one first, so launchd never holds both. The descriptor's `lifecycle.plist` names the path exactly,
+  as one first, so launchd never holds both: the install refuses a plist of the same label left in the `UserName`'s
+  `~/Library/LaunchAgents`, and the probe's `lifecycle.one-copy` fails a label loaded in both domains (FAA-286). The descriptor's `lifecycle.plist` names the path exactly,
   `/Library/LaunchDaemons/<label>.plist`: a host that reads the folder by its spelling then knows the domain too.
 - **The label is the machine's.** `/Library/LaunchDaemons` and the system domain are shared by every account of the
   Mac, so a LaunchDaemon's label is unique on the machine, not per account (put the account in it on a Mac with a
   personal and an organization account); an install refuses, before writing anything, a label another plist holds
   (the one launchd loaded the job from, or any plist of that label in the same folder) and the plist at its path when it
   names another `UserName` or another label; an uninstall refuses a label another plist holds before its `bootout`,
-  which would stop that plist's job, so pass it the label the plist at its path names.
+  which would stop that plist's job, so pass it the label the plist at its path names; in either domain an uninstall
+  refuses a plist at its path that names another label, before its `bootout` (FAA-286).
 - **Root installs and removes it.** `launchd_install` and `launchd_uninstall` in the system domain refuse, before writing
   anything, in a process that is not root, and name the command to run as root (`launchctl bootstrap system <plist>`,
   `launchctl bootout system/<label>`, removing the plist and `launchctl enable system/<label>`, as `launchd_uninstall`
   does). `purge` is refused: the data belongs to the `UserName`, so remove it as that user. Upgrade is the same install
   again as root, so a descriptor's `commands.update` for a LaunchDaemon runs as root, writes the new release (and any
   descriptor it rewrites) as the `UserName` as an install does, and runs only the plist and `launchd_install` as root; a
-  host without root reports it as the operator's. A host's verbs need root too and keep LC-14 (off stays off, across a boot as well as a login): stop is
+  host without root reports it as the operator's. Its commands name absolute paths: `~` would be root's home, and the
+  probe's `lifecycle.plist` fails a LaunchDaemon command that starts with `~`, as it fails a LaunchDaemon plist without
+  `UserName` (FAA-286). A host's verbs need root too and keep LC-14 (off stays off, across a boot as well as a login): stop is
   `bootout` + `disable system/<label>`, start is `enable` + `bootstrap system <plist>`, restart is
   `kickstart -k system/<label>`; a host or broker without root reports the job read-only.
 - **Status and pid read without root**: `launchd_loaded(label, "system")` and `launchd_pid(label, "system")` ask
@@ -177,23 +185,32 @@ it at boot, before any login, as the account its `UserName` names.
   that pid accepted, while the pid runs as the `UserName`'s uid (`ps`) and listens on exactly `127.0.0.1` (`lsof -p`);
   an install refuses a `UserName` that is not a short name, no account of the Mac or root, and an origin other than
   `http://127.0.0.1:<port>`, where nothing could prove it. Where the socket table is restricted it accepts a port that
-  pid listens on at exactly `127.0.0.1`, the weaker vouch SECURITY.md names (CT-261). A `ProgramArguments` wrapper that
+  pid listens on at exactly `127.0.0.1`, the weaker vouch SECURITY.md names (DEC-0155 RT-3). A `ProgramArguments` wrapper that
   starts the server as a child cannot pass either check, and the refusal says so: start the server with `exec`. An
   install refused after its bootstrap leaves the job loaded, and its plist starts it again at boot; the error says so,
-  and as root `launchctl bootout system/<label>` and removing the plist (or `launchd_uninstall`) take it away. For hosts and the probe the domain comes from the plist's folder alone, so a LaunchDaemon's plist must live
+  and as root `launchctl bootout system/<label>` and removing the plist (or `launchd_uninstall`) take it away. A
+  bootstrap that fails all five tries removes the plist the call wrote, and names one that was there before, which
+  would load at the next boot (FAA-286). A plist that does not parse is refused as such before anything is written,
+  never as a missing `UserName`; the Node installer refuses a binary plist and reads only the root dict's keys. For hosts and the probe the domain comes from the plist's folder alone, so a LaunchDaemon's plist must live
   in `/Library/LaunchDaemons` even when the installer is given `domain="system"`: the installer neither moves nor checks
   it. A descriptor field for the domain is the contract's CT-234, open.
 - **A contract exception, accepted in principle.** At the pin, HA-2 reads a launch daemon's listener as another
-  account's and nothing it answers as the service's; the contract's later RT-3 vouches only for the caller's own uid. The
+  account's and nothing it answers as the service's; the pin's RT-3 (DEC-0155) vouches only for the caller's own uid. The
   root installer reads its own job's token-free well-known answer anyway, proved by launchd's pid, that pid's uid and its
   bind on exactly `127.0.0.1` (`lsof -p`, never a wildcard), and sends no credential; under a restricted socket table the
-  first proof is the CT-261 weaker vouch (the pid listens on the port; that it accepted the connection is not shown). The contract owner accepted this in
+  first proof is the RT-3 weaker vouch (the pid listens on the port; that it accepted the connection is not shown). The contract owner accepted this in
   principle as DEC-0161 (RT-3 extended to launchd's system domain, the restricted-table vouch included; proposed, its
   text after its readings), so it stays a departure from the pin until the next repin (FAA-288).
   Every other client keeps HA-2 as written.
 - **Hosts.** A host or broker that reads launchd only in `gui/<uid>` sees a LaunchDaemon as not loaded and must not load
   its plist into `gui/<uid>`. Fabric Dashboards from 0.8.39 takes the domain from the plist's folder and offers no verbs
-  for a system job; the lifecycle broker is still asked (FAA-287).
+  for a system job; the lifecycle broker is still asked (FAA-287). A product with its own launchd reader (a status
+  page's `launchd_pid`, an installer of its own in another language) that asks only `gui/<uid>` reports a LaunchDaemon
+  as not loaded: move that reader to the plist's domain before the product moves to the system domain (FAA-286).
+- **Off macOS the twins differ, on purpose.** Python's `launchd_domain()` answers `gui/<uid>` on Linux (it refuses only
+  Windows), so the kit's launchd tests run on Linux CI against a fake `launchctl`; Node's `launchdDomain()` refuses off
+  `darwin` unless a test passes `platform: 'darwin'`. Neither runs launchd off macOS: install with
+  `systemd_install` / `task_install` there (FAA-286 item 5, recorded rather than aligned).
 
 ## One copy under a supervisor
 
@@ -365,6 +382,26 @@ holds the same name beside its file lock, so the two kits exclude each other eve
 name needs Node 22 or later: Node 18 and early 20 collapse every abstract socket name into one, and later 20 pads it so
 no Python copy or probe sees it, so the Node kit refuses to start there with a sentence naming Node 22 (FAA-72).
 
+**A lock that moves under its holder (FAA-303).** `acquire` checks that the inode it locked is the file at the path
+(FAA-293), which closes the race between two copies starting at once. A folder swapped under a copy that already holds
+the lock (a data import replacing the data folder) is a second case. On Linux and Windows the path-keyed name above
+still keeps a second copy out. On macOS the lock is `flock` (Python) or `O_EXLOCK` (Node), both on an inode, so a
+second copy locks the new file and starts. There `hold_single_instance` / `holdSingleInstance` start a watch on the
+held lock (`InstanceLock.watch` / `InstanceLock#watch`): every `LOCK_WATCH_SECONDS` (2 s; one `stat` and one `fstat`)
+the holder compares the inode it locked with the file at the path, and once the path names another file (the imported
+folder's lock, or the one a second copy made) it stops at once with 75 and one sentence naming the path
+(`lost_lock_message` / `lostLockMessage`), so the copy started on the new folder runs alone. The two copies overlap for
+at most one interval. The stop is abrupt on purpose (`stop_lost_holder` / `stopLostHolder`: `os._exit`,
+`process.exit`): a graceful shutdown would write the old copy's state into the folder now at the path, which is not the
+one it read. Under a supervisor the stopped copy is restarted and takes the new folder's lock, or waits as above while
+another copy holds it. A path that is gone or cannot be
+read now (a folder removed, a permission, an I/O error) is read as nothing there yet and tried again next time: a
+second copy has to make a file there to start, and the watch then sees that file. `release` ends the watch. Pass
+`on_lost` / `onLost` to `hold_single_instance` / `holdSingleInstance` (or call `watch` yourself on an `InstanceLock`) to
+react otherwise. A path-keyed name on macOS was weighed and left: it needs a file outside the data folder, in a folder
+the system never cleans and every copy of every user can write, which the standard library cannot promise; and a
+watch also stops a holder that would otherwise go on writing stale state into the imported folder.
+
 **Token files on Windows.** The privacy of `service.token` is its ACL (service.md *Windows
 token files*): the kits write a protected list: the user, SYSTEM and Administrators, set before the
 token's bytes go in, any entry already there dropped. On read, `windows_token_acl_problem` /

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/migrating-a-service.md

@@ -31,4 +31,5 @@ Order matters: each step leaves the service answering.
 | Data, logs or caches inside the repository | the OS data, log and cache directories; the old tree read-only for one release |
 | `KeepAlive {SuccessfulExit:false}`, a plist pointing at a checkout or a worktree | a plist generated by `launchd_plist`, pointing at a release |
 | A port another service already uses by default | the port claim at install; move the newcomer |
+| A port held by socket activation (launchd `Sockets`, a systemd `.socket` unit) or by a root proxy in front of the service | the service binds `127.0.0.1:<port>` itself as its own account; launchd's or root's socket reads as `system` and the hosts' and the probe's `listener.owner` refuse it (DEC-0154 HA-2) |
 | An event log in a private shape | the events view over it, with one sentence per event |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md

@@ -42,6 +42,16 @@ python3 scripts/fabric_package.py pack <folder>           # a dry run: the packa
 python3 scripts/fabric_package.py pack <folder> --apply   # writes fabric.package.json when nothing is wrong
 ```
 
+When the folder carries the agent's source manifest, `fabric.source.json` (contract DEC-0149, `fabric-source/1`), `pack`
+writes `secrets[]` from its `secret` slots (name, purpose and `optional`) and `state[]` from its `store` slots' paths,
+says so in its notes, and lists the manifest in `files[]` like any other file; `pack`, `sign` and `verify` refuse a
+package whose `secrets[]` or `state[]` differ from the slots (FAC-SEM-160). A hand-written `secrets[]` naming a secret
+the manifest has no slot for is never dropped: `pack` refuses (rule `source`, `/secrets`) and names each one, so add
+it as a `secret` slot (or take it out) and pack again. An author's `state: []` is a copy packed
+without state and is kept. A manifest that is no `fabric-source/1` object is refused. The manifest's own rules and the
+tree check under it are the source check's (`references/source-and-instance.md` of adapting-projects-to-fabric, *The
+source manifest*).
+
 Run `adapting-projects-to-fabric/scripts/fabric_source_check.py check <folder> --every-file` on the folder you pack first (a floor under your own
 review, not a secret scanner): a package carries
 the source, and the instance (the owner's paths, keys, strings) stays out of it (`references/source-and-instance.md` of

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1: wire reference
 
-Pinned to `fabric-agent-contract` commit `18f8d48762edc5bfb1433657cbfe1c16196df1a6`
+Pinned to `fabric-agent-contract` commit `93e7db164c7829e2783b4b7705c4113bb5201131`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
@@ -224,21 +224,29 @@ well-known `process.pid` is never proof (`docs/specification/service.md#ha-2` at
 The kit's module is `fabric_peer_owner` / `fabric-peer-owner.mjs` (layer L0, [kit modules](kit-modules.md)): `listener(port)`,
 `server_end(sock)` / `serverEnd(socket)`, `peer`, and a connection checked before a byte is written
 (`CheckedHTTPConnection`; Node `checkedSocket`, `CheckedAgent`). Python reads macOS through `sysctl
-net.inet.tcp.pcblist_n` (calibrated on a connected pair of its own, else `netstat -anv`), Linux through `/proc/net/tcp`
+net.inet.tcp.pcblist_n` (calibrated on a connected pair of its own, else `netstat -anv`; the pinned HA-2 table names
+`netstat -anv` and `pcblist64`, an older record layout of the same kernel table), Linux through `/proc/net/tcp`
 and `/proc/net/tcp6`, Windows through `GetExtendedTcpTable` and the owner's token SID; Node reads `netstat -anv` and `ps`
 on macOS, the same `/proc` files on Linux, and `netstat -ano` with the owner SID from PowerShell `GetOwnerSid` against `whoami /user` on Windows (SIDs, never names). Fail closed: everything but
 `this-account` refuses, `unknown` included.
 
 macOS 27.2 shows an ad-hoc-signed interpreter (a Homebrew Python, measured; a Homebrew Node is ad-hoc-signed too and was not measured) only its own sockets: sysctl lists this
 process alone and netstat prints nothing. The Python calibration therefore also asks for a child process's listener,
-and an empty netstat is `unknown` with reason `table-restricted` (never another account's). A caller that started the
+and a restricted table is `unknown` with a reason beginning `table-restricted` (never another account's): DEC-0155 RT-1
+reads so a netstat that prints nothing or only its header, one that fails or exits non-zero, a table holding no row of
+another uid (sysctl) or of another process (netstat), and a macOS table without the reader's own connection (FAA-312;
+Linux and Windows keep `no-row`). Under it `listener(port)` reads this account's listener as its own only on exactly
+`127.0.0.1` (RT-4). `fabric_peer_owner.py listener <port>` and `fabric-peer-owner.mjs listener <port>` print the kind
+(`--json` the whole owner; FAA-315). A caller that started the
 server itself may vouch with that pid: `lsof -p <pid>` asks the process, which the restriction leaves readable, and a
 listener of this account's pid on the port counts as this account's (`CheckedHTTPConnection(vouch_pid=...)`, Node
 `checkedSocket({vouchPid})`). The launchd installers vouch with their own job's pid; elsewhere a restricted table
 refuses (the probe, the hub client and `fabric_http` included, FAA-272), and Apple's `/usr/bin/python3` sees the
-whole table (FAA-267). A vouch is a weaker proof than the table's: it shows the job's pid listens on the port (`127.0.0.1` or the
-IPv4 wildcard for a LaunchAgent's installer, exactly `127.0.0.1` for a LaunchDaemon's), not that it accepted this connection, so a more specific bind by root over a wildcard job would pass;
-the contract's ruling on vouching is CT-261.
+whole table (FAA-267). A vouch is a weaker proof than the table's: it shows the job's pid listens on exactly `127.0.0.1`
+on the port, not that it accepted this connection. Since FAA-312 every vouch follows DEC-0155 RT-3: a wildcard or `::1`
+listener is never vouched for (`lsof` prints an IPv6-only wildcard as `*:<port>` too), and a reader whose real and
+effective uid differ vouches for nothing. The accepted socket itself (RT-2, libproc or `lsof` of established sockets)
+is not read yet (FAA-292; the repository's `docs/evidence/specs/2026-11-12-faa-292-libproc-decision.md`).
 
 Every kit client that sends a credential to loopback checks first: `check_service.py` (rule `listener.owner`, the first that reads the port for
 a local placement; `FAIL` `foreign-user` and no rule reads the port), the hub client (`HubError` `foreign-user`, its
@@ -248,8 +256,23 @@ a local placement; `FAIL` `foreign-user` and no rule reads the port), the hub cl
 is never a successful install, except a LaunchDaemon's job as its root installer proves it; the systemd and Task Scheduler installers do not poll yet, FAA-253). A running board
 session reports a door another account holds as `board.down` with reason `unreachable` until FAA-252. On macOS the Node
 twin reads the pid from `netstat` and the uid from `ps` a few milliseconds apart, so a pid reused in between would be
-misread; the Python twin's `sysctl` reader takes both from one record. A service's own loopback server refusing another account's peer (HA-3) is FAA-227, and the port
-claim file (HA-1) waits on the contract's CT-228.
+misread; the Python twin's `sysctl` reader takes both from one record. The server side (HA-2, HA-3; FAA-227): the kit's `LoopbackHTTPServer` and Node's `loopbackServer(httpServer)` tell
+each accepted connection's peer (`peer`) before a byte of the request is read, in the connection's own thread or
+while the socket is still paused. `peer_check` / `peerCheck` (`PEER_CHECKS`): `refuse`, the default, closes a peer of
+another OS account unread and serves the rest; `strict` also refuses an owner nobody can tell (a restricted table
+included) and a system account other than root (uid 0, which can read every account's files anyway and installs a
+LaunchDaemon; a Windows service account is refused); `off` reads no table. The check applies to loopback peers
+(127.0.0.0/8, `::1`, either IPv4-mapped): HA-2 is about another account of this computer, so a peer at any other
+address (a service bound to `0.0.0.0`) is served under `refuse` and `strict` alike without a table read, and its
+owner is none (`peer_owner()` None, `connectionOwner` null); such a peer is never T0 or T1. Use `strict` for a dashboard, an MCP
+surface or a token-free door on a computer with several counted accounts, where the interpreter sees the whole
+table (Apple's `/usr/bin/python3`, not an ad-hoc-signed one on macOS 27.2). A refusal writes one line on stderr
+(kind, uid, pid, never the peer's bytes); a handler finds its peer's owner with `self.server.peer_owner()` or
+`connectionOwner(req.socket)`. The cost is one table read per connection, not per request: a few milliseconds from
+`sysctl` or `/proc` in-process; Node on macOS and Windows runs `netstat` and `ps` or PowerShell for each, tens to
+hundreds of milliseconds, so a Node service there that answers the well-known read within 100 ms keeps its
+connections alive or chooses `off` where one account uses the computer. The port claim file (HA-1) waits on the
+contract's CT-228.
 
 ## Semantic rules a host applies
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_dashboard_layout.mjs

@@ -127,6 +127,25 @@ async function serviceTarget(spec, dir) {
   return { url, declared, name: `${id}.${instance}` };
 }
 
+// DEC-0154 PL-3 and HA-2 (FAA-260 items 2 and 14): a raw loopback address opens in the browser only while its port's
+// listener is this OS account's, read from the socket table just before the page opens. The browser connects on its
+// own, so this is the listener's owner, not that connection's: a listener swapped in between stays a residue
+// (SECURITY.md). A copy of this file alone cannot tell the owner and opens no loopback page.
+async function loopbackRefusal(target) {
+  let url;
+  try { url = new URL(target); } catch { return null; }
+  if (url.protocol !== 'http:') return null;
+  const host = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+  if (!(host === 'localhost' || host.endsWith('.localhost') || /^127\./.test(host) || host === '::1'
+    || host === '0.0.0.0' || /^::ffff:(127\.|7f)/.test(host))) return null;
+  const po = await import('./fabric-peer-owner.mjs').catch(() => null);
+  if (!po) return 'fabric-peer-owner.mjs is not beside this file: the loopback listener\'s owner cannot be told, so the page is not opened (DEC-0154 HA-2)';
+  const port = Number(url.port || 80);
+  const who = await po.listener(port);
+  if (who.kind === po.THIS_ACCOUNT) return null;
+  return `foreign-user: the listener on port ${port} reads as ${who.kind}${who.reason ? ` (${who.reason})` : ''}, so the page is not opened (DEC-0154 PL-3, HA-2)`;
+}
+
 // Runs inside the page. Everything it reports is measured from the rendered layout.
 function measure([floor, cap]) {
   const de = document.documentElement;
@@ -319,6 +338,8 @@ async function main(argv) {
   try {
     const context = await browser.newContext({ viewport: { width: Math.max(...opts.widths), height: opts.height } });
     const page = await context.newPage();
+    const refused = await loopbackRefusal(target);
+    if (refused) return notRun(refused);
     const response = await page.goto(target, { waitUntil: 'load' });
     if (response && !response.ok()) {
       return notRun(`the page answered HTTP ${response.status()}`);

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_dashboard_link.py

@@ -28,8 +28,32 @@ CREDENTIAL_PAIRS = {
     'session': {'token', 'id'},
     'code': {'login', 'auth', 'access', 'session'}}
 JWT_SHAPE = re.compile(r'eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*')
-SECRET_VALUE = re.compile(r'(^bearer\s.+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}'
-                          r'|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})', re.I | re.S)
+URL_BASE64_RUN = re.compile(r'[A-Za-z0-9_-]*')
+
+
+def has_jwt(text):
+    # Whether JWT_SHAPE matches anywhere, read in one pass (the contract's hasJwt, FAA-313): the expression backtracks
+    # from every `eyJ` of a long run, quadratic in it, while every `eyJ` of one run shares that run's end, so only its
+    # first is tried. The kit's fabric_secrets.has_jwt reads the same way; this file stands alone, so it has its own.
+    at = text.find('eyJ')
+    while at >= 0:
+        one = URL_BASE64_RUN.match(text, at + 3).end()
+        if one - at - 3 >= 2 and text[one:one + 1] == '.':
+            two = URL_BASE64_RUN.match(text, one + 1).end()
+            if two - one - 1 >= 2 and text[two:two + 1] == '.':
+                return True
+        at = text.find('eyJ', one)
+    return False
+
+
+# The contract's SECRET_VALUE at the pin (DEC-0151): `Bearer ` at a value's start in any case, or a provider key with its
+# prefix in its canonical case after a boundary (the start, a character that is no ASCII letter or digit, or an escape);
+# an `sk-` key holds a digit and an upper-case letter with 16 or more characters, or a digit with 32 or more.
+SECRET_VALUE = re.compile(r'(^[Bb][Ee][Aa][Rr][Ee][Rr]\s.+|(?:^|[^A-Za-z0-9]|%[0-9A-Fa-f]{2}|\\[nrt"\']|\\u[0-9A-Fa-f]{4}'
+                          r'|\\x[0-9A-Fa-f]{2}|\\[bfv0ae]|\\[0-7]{1,3}|%25[0-9A-Fa-f]{2}|\x1b\[[0-9;:]*m'
+                          r'|(?:\\u001[bB]|\\x1[bB]|\\e|\\033|\\33)\[[0-9;:]*m)'
+                          r'(?:sk-(?=[A-Za-z0-9_-]{0,255}?[0-9])(?:(?=[A-Za-z0-9_-]{0,255}?[A-Z])[A-Za-z0-9_-]{16,}|[A-Za-z0-9_-]{32,})'
+                          r'|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,}))', re.S)
 LONG_RUN = re.compile(r'[A-Za-z0-9+/=_-]{40,}')
 
 
@@ -52,7 +76,7 @@ def credential_name(name):
 def secret_value(value):
     long_secret = any(re.search(r'[a-z]', run) and re.search(r'[A-Z]', run) and re.search(r'[0-9]', run)
                       for run in LONG_RUN.findall(value))
-    return bool(JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or long_secret)
+    return bool(has_jwt(value) or SECRET_VALUE.search(value) or long_secret)
 
 
 def carries_credential(text):
@@ -115,6 +139,11 @@ def check(data):
     require(all(isinstance(v, str) and 0 < len(v) <= 200 for v in (target, viewer)), 'missing_device')
     fallback = data.get('fallback', 'if_absent')
     require(fallback in ('if_absent', 'never'), 'invalid_fallback')
+    # DEC-0154 PL-3 and HA-2 (FAA-251): who listens on http_url's port, as the host read it from the socket table
+    # (fabric_peer_owner's kinds, or check_service.py's foreign-user). A browser opens a raw loopback address only
+    # after that listener is this OS account's; absent, it is unknown.
+    owner = data.get('listener_owner', 'unknown')
+    require(owner in ('this-account', 'another-account', 'system', 'unknown', 'none', 'foreign-user'), 'invalid_listener_owner')
     kind = action.get('kind')
     if kind == 'remote_open':
         require(set(action) <= {'kind', 'device_id', 'service', 'path'}, 'unexpected_action_field')
@@ -128,6 +157,7 @@ def check(data):
         require(set(action) == {'kind', 'url'} and action.get('url') == http, 'not_resolved_http_url')
         require(viewer == target, 'wrong_viewer_device')
         require(state == 'not_installed' and fallback == 'if_absent', 'browser_fallback_forbidden')
+        require(owner == 'this-account', 'listener_not_this_account')
     else:
         raise ValueError('unsupported_dashboard_action')
     return {'ok': True, 'kind': kind}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -80,7 +80,7 @@ import fabric_connections as fcn  # noqa: E402
 from check_service_rules import shown_repository  # noqa: E402 - a repository in evidence carries no userinfo or query
 import fabric_interop as fi  # noqa: E402
 import fabric_peer_owner as po  # noqa: E402 - DEC-0154 HA-2: the listener's owner before any credential
-from check_service_rules import ForeignUser, PORT_RULES_UNREAD, listener_owner_verdict  # noqa: E402 - DEC-0154 HA-2
+from check_service_rules import ForeignUser, PORT_RULES_UNREAD, in_launch_daemons, listener_owner_verdict, other_domain_copy, port_claim_verdict  # noqa: E402 - DEC-0154 HA-2
 
 Result = Dict[str, str]
 
@@ -97,7 +97,7 @@ from check_service_rules import usage_problems  # noqa: E402,F401 - moved (FAA-6
 from check_service_rules import same_repository  # noqa: E402,F401 - moved (FAA-65)
 from check_service_rules import merge_headers, session_cookie  # noqa: E402,F401 - FAA-115
 from check_service_rules import well_known_actions_verdict, action_tools_verdict, actions_declared_verdict  # noqa: E402 - DEC-0121
-from check_service_rules import opens_in_host_verdict, service_checkout  # noqa: E402 - FAA-118
+from check_service_rules import opens_in_host_verdict, service_checkout, declared_limits, holds_verdict  # noqa: E402 - FAA-118, FAA-298
 from check_service_rules import well_known_a2a_verdict, a2a_card_verdict  # noqa: E402 - DEC-0122
 import fabric_a2a as fa2  # noqa: E402 - DEC-0122
 import check_service_channel_agent as cac  # noqa: E402 - DEC-0150, FAA-197
@@ -153,6 +153,7 @@ class Probe:
 
     def request(self, method: str, path: str, headers: Optional[Dict[str, str]] = None,
                 body: Optional[bytes] = None) -> Tuple[int, Dict[str, str], bytes]:
+        """`connected_at`: when a local connect and its owner check ended, so the answer is timed from there (r11)."""
         if self.remote:
             context = ssl.create_default_context(cafile=self.ca_file) if self.ca_file else ssl.create_default_context()
             if self.connect:
@@ -167,6 +168,9 @@ class Probe:
             base = {"Host": "127.0.0.1:%d" % self.port}
         base.update(headers or {})
         try:
+            if not self.remote:
+                conn.connect()
+                self.connected_at = time.perf_counter()
             conn.request(method, path, body=body, headers=base)
             resp = conn.getresponse()
             return resp.status, merge_headers(resp.getheaders()), resp.read()
@@ -203,25 +207,7 @@ class Probe:
         else:
             mode = stat.S_IMODE(os.stat(self.path).st_mode)
             self.add("descriptor.private", "PASS" if mode & 0o077 == 0 else "FAIL", "mode %o" % mode)
-        me = "%s.%s" % (self.d.get("id"), self.d.get("instance", "default"))
-        clashes = []
-        for path, other in fs.read_descriptors(self.dir):
-            key = "%s.%s" % (other.get("id"), other.get("instance", "default"))
-            if path.resolve() == self.path.resolve():
-                continue
-            if key == me:
-                clashes.append("%s declared again in %s" % (me, path.name))
-            # DEC-0069: a descriptor without an origin (an app's) claims no port, so two of them never clash.
-            elif (not self.remote and "origin" in self.d and fs.placement_of(other) != "remote"
-                  and other.get("origin") == self.d.get("origin")):
-                clashes.append("port %d also claimed by %s" % (self.port, key))
-        if self.remote:
-            unique = "a remote origin claims no port here"
-        elif "origin" not in self.d:
-            unique = "an app's descriptor names no origin, so it claims no port (FAC-SEM-010)"
-        else:
-            unique = "no other descriptor here declares port %d (HA-1's claim on the computer is FAA-225)" % self.port
-        self.add("descriptor.port-claim", "FAIL" if clashes else "PASS", "; ".join(clashes) or unique)
+        self.add("descriptor.port-claim", *port_claim_verdict(self.path, self.d, self.dir, self.port, self.remote))
         # FAA-198: the repository that links the agent to its project; a new install is refused without it, an installed one
         # is named here (NOT_RUN is no pass) until its owner adds it.
         # A source descriptor.valid refuses is no pass either, and the evidence never carries a URL's userinfo or query,
@@ -260,9 +246,9 @@ class Probe:
         try:
             timings = []
             for _ in range(3):
-                started = time.perf_counter()
+                started = self.connected_at = time.perf_counter()
                 status, headers, body = self.request("GET", "/.well-known/fabric-service", protected)
-                timings.append((time.perf_counter() - started) * 1000)
+                timings.append((time.perf_counter() - max(started, self.connected_at)) * 1000)
         except OSError as exc:
             if self.remote:
                 self.add_no_token(no_token, None)
@@ -276,7 +262,7 @@ class Probe:
         try:
             self.wk = json.loads(body)
             self.wk_bytes = len(body)  # D4 of the 0.73.0 brief: a well-known answer shares a 2 MiB cap
-        except ValueError:
+        except (ValueError, RecursionError):  # Python 3.9 to 3.13 raise RecursionError on deep nesting (unit reading 10)
             if self.remote:
                 self.add_no_token(no_token, None)
             self.add("well-known.answers", "FAIL", "body is not JSON")
@@ -467,7 +453,7 @@ class Probe:
             self.add("usage.report", "FAIL", "HTTP %d with the token" % status)
             return
         try:
-            report = json.loads(body)
+            report = self.usage_report = json.loads(body)  # FAA-298: limits.holds reads its budgets
         except ValueError:
             self.add("usage.report", "FAIL", "not JSON")
             return
@@ -823,7 +809,7 @@ class Probe:
         except (OSError, ValueError) as exc:
             self.add("lifecycle.plist", "FAIL", "cannot read %s: %s" % (plist_path, exc))
             return
-        problems = plist_problems(plist, life.get("label"), self.token)
+        problems = plist_problems(plist, life.get("label"), self.token, system=in_launch_daemons(plist_path), commands=self.d.get("commands"))
         self.add("lifecycle.plist", "FAIL" if problems else "PASS", "; ".join(problems) or "%s: RunAtLoad, KeepAlive, no secrets" % plist_path.name)
         marker = marker_problem(plist)
         self.add("lifecycle.supervisor-marker", "FAIL" if marker else "PASS",
@@ -839,10 +825,15 @@ class Probe:
         out = subprocess.run(["launchctl", "print", "%s/%s" % (domain, life.get("label"))], capture_output=True, text=True)
         match = re.search(r"^\s*pid = (\d+)", out.stdout, re.MULTILINE)
         served = ((self.wk or {}).get("process") or {}).get("pid")
+        # a LaunchDaemon's leftover LaunchAgent runs in its UserName's gui/<uid> (FAA-317)
+        second = other_domain_copy(life.get("label"), domain, plist.get("UserName")) if out.returncode == 0 and match else None
         if out.returncode != 0:
             self.add("lifecycle.one-copy", "FAIL", "launchd job %s is not loaded in %s" % (life.get("label"), domain))
         elif not match:
             self.add("lifecycle.one-copy", "FAIL", "launchd job loaded but not running")
+        elif second:  # loaded in both domains: two copies (FAA-286 item 6)
+            self.add("lifecycle.one-copy", "FAIL", "launchd job %s is loaded in %s and in %s: two copies; uninstall one"
+                     % (life.get("label"), domain, second))
         else:
             same = int(match.group(1)) == served
             self.add("lifecycle.one-copy", "PASS" if same else "FAIL",
@@ -947,8 +938,8 @@ class Probe:
             self.login_rules()
             self.interop_rules()
             self.channel_agent_rule()
-            verdict, evidence = board_responder_verdict(self.wk, self.board_kit)
-            self.add("board.responder", verdict, evidence)
+            self.add("limits.holds", *holds_verdict(declared_limits(self.wk, getattr(self, "usage_report", None)), *service_checkout(self.d, self.repo)))
+            self.add("board.responder", *board_responder_verdict(self.wk, self.board_kit))
         self.lifecycle_rules()
         return self.results
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service_channel_agent.py

@@ -18,7 +18,7 @@ from typing import Any, Callable, Dict, List, Optional, Tuple
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from fabric_jsvalue import indexed_objects, js_keys  # noqa: E402
-from fabric_secrets import JS_SPACE, JWT_SHAPE, SECRET_VALUE, raw_values, secret_argument, secret_url, secret_value  # noqa: E402
+from fabric_secrets import JS_SPACE, SECRET_VALUE, has_jwt, raw_values, secret_argument, secret_url, secret_value  # noqa: E402
 from fabric_secrets import url_parts as _whatwg_url_parts  # noqa: E402 - public since FAA-250
 import check_service_channel_agent_schema as cas  # noqa: E402
 
@@ -208,9 +208,9 @@ def read_as_url(read: str) -> bool:
 
 
 def _url_reading(read: str) -> bool:
-    """secretUrl where read_as_url admits the head, secretArgument otherwise. The kit's secret_url also reads a URL the
-    WHATWG parser refuses (the safe direction for its own callers); the contract's `new URL` throws there and finds only
-    what secretArgument finds, so a refused URL is read by secret_argument alone here."""
+    """secretUrl where read_as_url admits the head, secretArgument otherwise. A URL the WHATWG parser refuses makes the
+    contract's `new URL` throw, which finds only what secretArgument finds, so such a URL is read by secret_argument
+    alone: url_parts answers None for it here, as the kit's secret_url reads it as an argument only since FAA-309."""
     if not read_as_url(read):
         return secret_argument(read)
     return secret_argument(read) or (url_parts(read) is not None and secret_url(read))
@@ -222,7 +222,7 @@ def shaped_read(read: str) -> bool:
 
 def _key_shaped(text: str) -> bool:
     read = head(text)
-    return bool(JWT_SHAPE.search(read) or SECRET_VALUE.search(read))
+    return bool(has_jwt(read) or SECRET_VALUE.search(read))
 
 
 def plain_name(name: str) -> bool:
@@ -397,6 +397,8 @@ def url_parts(text: str) -> Optional[Tuple[str, str]]:
             return None
         if at and hostport == "":
             return None
+        if host == "" and colon > bracket:
+            return None  # an empty host ended by `:`, with an empty port or a port: `new URL` throws
         if host == "" and special and lowered != "file":
             return None
         if host and not _host_ok(host, special):
@@ -457,7 +459,8 @@ def secrets(value: Any, root: str, budget: Budget) -> List[Dict[str, str]]:
     def flag(at: str, what: str, text: str, ident: bool) -> None:
         if budget.named < SECRET_FINDINGS:
             budget.named += 1
-            rename = "; an id that starts with sk- is read as a key; rename it" if ident and re.match(r"sk-", text, re.I | re.A) else ""
+            # canonical case only (DEC-0151): an upper-case SK- is no key, so the advice would name the wrong cause
+            rename = "; an id that starts with sk- is read as a key; rename it" if ident and text.startswith("sk-") else ""
             findings.append(_finding("FAC-SEM-165", at, "%s is shaped like a credential: a token is named by its vault slot, never written%s (DEC-0150 CA-5)" % (what, rename)))
         else:
             budget.more += 1