@passioncode-ai/fabric-agent-adapter 0.81.0 → 0.83.1

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_board_session.py

@@ -3,7 +3,6 @@ accept the exact digest, effect, progress, complete; stop when fenced). The sess
 in fabric_board_link and are re-exported here. Part of the board connector (FAA-65, layer L4)."""
 from __future__ import annotations
 
-import inspect
 import json
 import random
 import re
@@ -28,6 +27,8 @@ from fabric_board_link import (  # noqa: E402,F401 - re-exported: callers import
     BoardSession,
     Checkpoint,
     PERSONAL_BOARD,
+    notice_subject as _notice_subject,
+    takes_subject as _takes_subject,
 )
 from fabric_board_slots import (  # noqa: E402,F401 - the slot records (FAA-155, FAA-163); the constants re-exported
     HOLD_RETRY_MAX_SECONDS,
@@ -51,6 +52,9 @@ IDLE_LEAVE_SECONDS = 3.0
 
 EVENT_SCHEMA = "urn:fabric:schema:board-responder-event:1"
 
+#: `board.down` is said once per outage window: said again only after the board stayed up this long (FAA-187 (22)).
+DOWN_QUIET_SECONDS = 300.0
+
 #: On these the attempt is no longer ours: stop acting at once (C4).
 STOP_CODES = frozenset(["fenced", "lease_expired", "authority_changed"])
 
@@ -60,8 +64,6 @@ TERMINAL = frozenset(["completed", "failed_known", "cancelled", "expired"])
 NOT_OURS = frozenset(["queued", "claimed", "answered"])
 
 
-
-
 class WorkContext:
     """What a handler may do while it works: `progress(note)` posts a note on the request's thread (and renews the
     lease); `begin_effect(summary)` must be called (and must return) before the handler spends or acts outside
@@ -70,12 +72,12 @@ class WorkContext:
     `mandate_covers(call)` whether it covers a call (`mandate_covers`' answer), None when none travelled."""
 
     def __init__(self, responder: "Responder", entry: Dict[str, Any], mandate: Optional[Dict[str, Any]] = None,
-                 caller: Optional[str] = None):
-        self._responder, self._entry, self.mandate, self._caller = responder, entry, mandate, caller
+                 caller: Optional[str] = None, caller_agent: Optional[str] = None):
+        self._responder, self._entry, self.mandate, self._caller, self._agent = responder, entry, mandate, caller, caller_agent
         self.stopped = threading.Event()
 
     def mandate_covers(self, call: Dict[str, Any]) -> Optional[Dict[str, Any]]:
-        return _link.covers(self.mandate, call, self._responder.agent_id, self._responder.wall, self._caller)
+        return _link.covers(self.mandate, call, self._responder.agent_id, self._responder.wall, self._caller, self._agent)
 
     def progress(self, note: Optional[str] = None) -> None:
         if self.stopped.is_set():
@@ -100,33 +102,6 @@ class _Work:
 Handler = Callable[[BoardRequest, WorkContext], Dict[str, Any]]
 
 
-
-def _notice_subject(value: Dict[str, Any], project: str, episode: Optional[str] = None) -> Dict[str, str]:
-    """A notice's subject (`{type, id}`): its request, else its capability, else its episode (a cause such as a block's
-    code, so two causes are two episodes for a host, seam r31), else the Project."""
-    for kind, given in (("request", value.get("request")), ("capability", value.get("capability")), ("episode", episode)):
-        if isinstance(given, str) and 0 < len(given) <= 128:
-            return {"type": kind, "id": given}
-    return {"type": "project", "id": project}
-
-
-def _takes_subject(emit: Callable[..., Any]) -> bool:
-    """Whether an emit's signature names a `subject` parameter, as JsonlEventLog.append does. Any other emit (one with
-    only **kwargs, which may forward them to a sink without it or set its own, or one whose signature cannot be read)
-    is called as 0.55.0 called it, without one (0.56.0 unit r33). A subject already bound into the emit, as with
-    functools.partial(log.append, subject=...), stands.
-
-    The signature is the emit's own, not a wrapped function's: a functools.wraps forwarder that sets its own subject
-    would otherwise be passed a second one (0.56.0 unit r34). Nothing here raises, so a notice never stops the
-    responder."""
-    try:
-        params = inspect.signature(emit, follow_wrapped=False).parameters.values()
-        return any(p.name == "subject" and p.kind is not inspect.Parameter.VAR_KEYWORD
-                   and (p.default is inspect.Parameter.empty or p.default is None) for p in params)
-    except Exception:  # noqa: BLE001 - an unreadable signature (or a default that raises) is called without one
-        return False
-
-
 class Responder(SlotKeeper):
     """One service's responder for one Project and one or more capabilities, one request at a time.
 
@@ -142,9 +117,11 @@ class Responder(SlotKeeper):
                  emit: Optional[Callable[..., Any]] = None, service: str = "service",
                  now: Callable[[], float] = time.monotonic, rand: Callable[[], float] = random.random,
                  spawn: Optional[Callable[[Callable[[], None]], Any]] = None, session_factory: Optional[Callable[..., BoardSession]] = None,
-                 agent_id: Optional[str] = None, mandate_from: Any = None, wall: Callable[[], float] = time.time):
-        if admit is None or handler is None:
-            raise BoardError("invalid_arguments", "A responder needs the service's own input gate (admit) and a handler.")
+                 agent_id: Optional[str] = None, mandate_from: Any = None, wall: Callable[[], float] = time.time,
+                 identify_agent: Optional[Callable[[Dict[str, Any]], Optional[str]]] = None, links: Any = None):
+        if admit is None or handler is None or not (identify_agent is None or callable(identify_agent)):
+            raise BoardError("invalid_arguments", "A responder needs the service's own input gate (admit) and a handler; "
+                             "identify_agent, when given, is a function of the sender (FAA-135).")
         caps = list(capabilities)
         if not caps or any(not isinstance(c, str) or not _CAPABILITY.fullmatch(c) for c in caps) or len(set(caps)) != len(caps):
             raise BoardError("invalid_arguments", "Name each capability once, [a-z][a-z0-9._-]{1,127}.")
@@ -152,8 +129,10 @@ class Responder(SlotKeeper):
             raise BoardError("invalid_arguments", "%s is a Project's primary responder's, a session's: a service answers "
                              "the capabilities it declares (DEC-0140 PR-1)." % _fs.PRIMARY_CAPABILITY)
         self.hub, self.project = hub, _hub._project(project_id)
-        #: FAA-135: read the operator's mandate from a trusted request of his own Project (opt-in; None reads none).
+        #: FAA-135: read the operator's mandate from a trusted request of his own Project (opt-in; None reads none), and
+        #: bind its chain with the agent id identify_agent names for the sender (asked only when a mandate travelled).
         self.mandate_from, self.agent_id, self.wall = _link.mandate_options(agent_id, mandate_from), agent_id, wall
+        self.identify_agent, self.links = identify_agent, _link.notice_links(links)  # FAA-187 (21): a link per notify kind
         self.capabilities = caps
         self.credential_file, self.handler, self.admit, self.observe = Path(credential_file), handler, admit, observe
         self.checkpoint = Checkpoint(Path(checkpoint_file))
@@ -172,6 +151,7 @@ class Responder(SlotKeeper):
         self.claim_keys: Dict[str, str] = {}
         self._probing: set = set()  # moved slots whose move-back claim lost its answer: asked again under the same key
         self._said: Dict[str, str] = {}
+        self._up_since: Optional[float] = None  # when the board was last seen up after a fault (FAA-187 (22))
         self._rr = 0
         #: The first pause under an operator's hold (DEC-0079); it doubles to HOLD_RETRY_MAX_SECONDS.
         self.hold_delay = POLL_SECONDS
@@ -203,6 +183,8 @@ class Responder(SlotKeeper):
         # goes once, without a subject there (unit r31, seam r31).
         if _takes_subject(self._emit_to):
             extra["subject"] = _notice_subject(value, self.project, episode)
+        if notify and kind in getattr(self, "links", {}):  # the page that resolves it, which the service named (FAA-187 (21))
+            extra["link"] = self.links[kind]
         try:
             self._emit_to(kind, level, text, notify=notify, **extra)
         except Exception:  # noqa: BLE001 - an event that cannot be written never stops the responder
@@ -267,8 +249,8 @@ class Responder(SlotKeeper):
         self.slots = {}
         self._recover(status, [c for c in self.capabilities if c in grant.capabilities])
         self.state = "ready"
-        for kind in ("board.down", "board.blocked") + (() if missing else ("board.access.needed",)):
-            self._said.pop(kind, None)
+        for kind in ("board.blocked",) + (() if missing else ("board.access.needed",)):
+            self._said.pop(kind, None)  # board.down waits for its quiet window (step)
 
     def _enroll(self, capability: str) -> None:
         args = {"idempotency": self._idem(self._key("enroll")), "capability": capability}
@@ -525,6 +507,8 @@ class Responder(SlotKeeper):
             self.backoff.reset()
             if self.state == "down":  # a lost call was sent again and answered: the session held throughout
                 self.state = "ready"
+            self._up_since = now if self._up_since is None else self._up_since
+            if now - self._up_since >= DOWN_QUIET_SECONDS:  # up a whole window: a later outage is said again
                 self._said.pop("board.down", None)
             return self.interval()
         except (BoardError, _hub.HubError) as exc:
@@ -542,7 +526,7 @@ class Responder(SlotKeeper):
         return min(renewed) + LEASE_SECONDS - self.now() if renewed and self.session is not None else 0.0
 
     def _fault(self, exc: Exception) -> float:
-        code, slots = getattr(exc, "code", "unreachable"), self.slots.values()
+        code, slots, self._up_since = getattr(exc, "code", "unreachable"), self.slots.values(), None
         connecting = self.state == "connecting" and not any(s.get("state") == "held" for s in slots)
         wait = self.backoff.next()
         left = self._lease_left() - LEASE_MARGIN_SECONDS
@@ -613,10 +597,11 @@ class Responder(SlotKeeper):
         for capability in list(self._suspect):  # kept until com.status answered, so it is asked before any enroll
             self._gone(capability)
             self._suspect.discard(capability)
+        shared: Dict[str, Any] = {}  # one com.status read a tick for every moved slot (FAA-194 (5))
         for capability, slot in list(self.slots.items()):
             if slot.get("state") == "moved":  # never enrolled again on its own, even when the new holder lapses (FAA-155)
                 if self.now() - slot.get("renewed_at", 0) >= RENEW_SECONDS - 0.5:
-                    self._moved_back(capability)  # unless com.status shows a later generation it may hold (FAA-165)
+                    self._moved_back(capability, shared)  # unless com.status shows a later generation it may hold (FAA-165)
                 continue
             if slot.get("state") == "paused":
                 if capability != held_by_work and self.now() >= slot.get("retry_at", 0.0) and not self._gone(capability):
@@ -699,15 +684,14 @@ class Responder(SlotKeeper):
                  "revision": receipt["request"]["revision"], "step": "claimed", "keys": {}, "effect": False}
         self.checkpoint.put(entry)
         message = self._call("com.get", {"message": entry["message"]})
-        req = message.get("request") if isinstance(message, dict) else None
-        if message.get("digest") != entry["digest"]:
+        problem = _link.read_back_problem(message, entry, self.project)
+        if problem == "digest-mismatch":
             self.checkpoint.drop(entry["request"])
             self._emit("board.request.skipped", "warning", "A claimed request was not accepted: the message read back carries "
                        "another digest than the claim. Nothing was done; the claim lapses.", request=entry["request"],
                        capability=capability, reason="digest-mismatch")
             return
-        if not isinstance(req, dict) or req.get("id") != entry["request"] or req.get("capability") != capability \
-                or req.get("target") != self.project:
+        if problem:
             self.checkpoint.drop(entry["request"])
             self._emit("board.request.skipped", "warning", "A claimed request was not accepted: it is not addressed to this "
                        "Project and capability. Nothing was done; the claim lapses.", request=entry["request"],
@@ -754,12 +738,15 @@ class Responder(SlotKeeper):
         self.checkpoint.put(entry)
         return True
 
-    def _run(self, entry: Dict[str, Any], request: BoardRequest) -> None:
+    def _run(self, entry: Dict[str, Any], request: BoardRequest, problem: Optional[str] = None) -> None:
         mandate, unread = _link.read_mandate(request, self.mandate_from, self.agent_id)
+        if problem and (mandate is not None or unread):  # FAA-196 (1): a resume read back another message than accepted
+            mandate, unread = None, problem
         if unread:  # by its code alone: the block holds the operator's words
             self._emit("board.request.mandate_unread", "warning", "Request %s carries a mandate the kit does not read (%s); "
                        "it is worked without one." % (entry["request"], unread), request=entry["request"], reason=unread)
-        ctx = WorkContext(self, entry, mandate, request.sender.get("project") if isinstance(request.sender, dict) else None)
+        sender = request.sender if isinstance(request.sender, dict) else {}
+        ctx = WorkContext(self, entry, mandate, sender.get("project"), _link.sender_agent(self.identify_agent, sender, mandate))
         work = _Work(entry, request, ctx)
         work.renewed_at = self.now()
         self.current = work
@@ -781,7 +768,7 @@ class Responder(SlotKeeper):
             self._complete(entry)
             return
         message = self._call("com.get", {"message": entry["message"]})
-        self._run(entry, BoardRequest(message, entry["capability"]))
+        self._run(entry, BoardRequest(message, entry["capability"]), _link.read_back_problem(message, entry, self.project))
 
     def _fenced(self, op: str, entry: Dict[str, Any], key: str, extra: Optional[Dict[str, Any]] = None,
                 apply: Optional[Callable[[Dict[str, Any]], None]] = None) -> Optional[Dict[str, Any]]:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_board_slots.py

@@ -125,19 +125,20 @@ class SlotKeeper:
                 self._note(capability, dict(held, moved=now))  # said again at the next start if it cannot be written
         if "moved" not in held:  # once, even across restarts
             self._emit("board.slot.moved", "warning", "The %s slot on this Project moved to another session. This service stopped answering it; accepted "
-                       "work stays `accepted` (work begun is the new holder's). The operator brings it back by take-back (once the "
-                       "other session lets it go, or at a restart with accepted work waiting; a restart alone does not) or, where "
-                       "Fabric offers it, a move back here. Else ask its maintainer." % capability,
+                       "work stays accepted (work begun is the new holder's). The operator brings it back by take-back (once the "
+                       "other session lets it go, or at a restart or reconnect with accepted work waiting; neither alone does) or, "
+                       "where Fabric can, a move back here. Else ask its maintainer." % capability,
                        notify=True, episode=capability, capability=capability, generation=now, held=held["generation"])
         return True
 
-    def _moved_back(self, capability: str) -> None:
+    def _moved_back(self, capability: str, shared: Optional[Dict[str, Any]] = None) -> None:
         """A moved slot asked about once per later generation (FAA-165): the operator may move it back to this session
         (DEC-0140 PR-2), which this client cannot hear, so when com.status shows a generation past the recorded move, one
         `com.claim` asks whether the slot is its own. A claim that lands makes it held again and starts what it handed
         out; a `lease_expired` one (the move reached this session but its lease lapsed) enrolls again; a fenced one is
         another session's, recorded so the same generation is not asked about twice. Never an enroll or a replace on a
-        slot another session holds: a slot moved off stays off unless it is handed back."""
+        slot another session holds: a slot moved off stays off unless it is handed back. `shared` holds the tick's one
+        com.status read, shared by every moved slot (FAA-194 (5))."""
         if self.current is not None or self.stopping:
             return  # a claim now could hand out a second request, or start work while the responder stops
         held = self.checkpoint.slots.get(capability) or {}
@@ -145,7 +146,12 @@ class SlotKeeper:
         if held.get("project") != self.project or not _is_int(seen, 1):
             return
         (self.slots.get(capability) or {})["renewed_at"] = self.now()
-        status = self._status()
+        if shared is not None and "status" in shared:
+            status = shared["status"]
+        else:
+            status = self._status()
+            if shared is not None:
+                shared["status"] = status
         now = _whole(next((r.get("generation") for r in status.get("responders") or [] if isinstance(r, dict) and r.get("capability") == capability), None))
         if not _is_int(now, 1) or now <= seen:
             return
@@ -202,7 +208,9 @@ class SlotKeeper:
             self.slots[capability] = {"state": "held", "generation": generation, "renewed_at": float("-inf")}  # no lease yet
             self._held_at(capability, generation)
             self._said.pop("board.slot.moved", None)  # a later move is said again
-        return True
+        self._emit("board.slot.returned", "info", "The %s slot on this Project is this service's again: the operator moved it "
+                   "back here, and it answers it from now on." % capability, capability=capability, generation=generation)
+        return True  # FAA-194 (8): the feed no longer ends on the move's warning
 
     def take_back(self, capability: str) -> None:
         """The operator's act, never the kit's: forget the move; the next tick enrolls once the slot is free (FAA-155)."""

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_connections.py

@@ -4,12 +4,9 @@
 `degraded[]`. Part of the service kit (FAA-62, layer L3). Standard library only."""
 from __future__ import annotations
 
-import bisect
-import ipaddress
 import re
-import unicodedata
 import urllib.parse
-from typing import Any, Dict, Iterable, List, Mapping, Optional, Sequence
+from typing import Any, Dict, Iterable, List, Mapping, Optional, Sequence, Tuple
 
 import sys as _sys  # noqa: E402
 from pathlib import Path as _Path  # noqa: E402
@@ -18,7 +15,12 @@ if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from
 
 from fabric_base import ServiceError  # noqa: E402
 from fabric_secrets import (  # noqa: E402
-    JWT_SHAPE, _BEARER_INSIDE as _BEARER, _long_secret, credential_name, raw_values, secret_argument, secret_value,
+    _BEARER_INSIDE as _BEARER, _long_secret, credential_name, has_jwt, raw_values, secret_argument, secret_value,
+)
+# The WHATWG host reading and its IDNA tables (FAA-98) live in fabric_secrets since FAA-309, where secret_url reads a
+# URL's host with them; the names stay here for code and tests that reached them.
+from fabric_secrets import (  # noqa: E402,F401
+    _FORBIDDEN_DOMAIN, _FORBIDDEN_HOST, _IDNA_DISALLOWED, _IDNA_IGNORED, _domain_ok, _idna_host, _ipv4_number, _ipv6_ok,
 )
 
 CONNECTIONS_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/connections/0.1"
@@ -50,7 +52,8 @@ _KEY_SHAPE = re.compile(
     r"(?:^|[^A-Za-z0-9])(?:sk-(?=[A-Za-z0-9_-]*[0-9])(?:(?=[A-Za-z0-9_-]*[A-Z])[A-Za-z0-9_-]{16,}|[A-Za-z0-9_-]{32,})"
     r"|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,}"
     r"|(?:bot)?[0-9]{6,12}:(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[a-z])[A-Za-z0-9_-]{34,35}(?![A-Za-z0-9_-]))")
-_URL_SCHEME = re.compile(r"[a-z][a-z0-9+.-]*://", re.IGNORECASE | re.ASCII)
+_SCHEME_LETTERS = frozenset("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
+_SCHEME_CHARS = _SCHEME_LETTERS | frozenset("0123456789+.-")
 _CLOSING = ")]}>\"'.,;:!?"
 _TRIED_BACK = 1
 
@@ -137,13 +140,33 @@ def _shape_problems(value: Any) -> List[str]:
     return problems
 
 
+def _scheme_spans(piece: str) -> List[Tuple[int, int]]:
+    """The (start, end) of each URL scheme and its `://` in a piece, where `[a-z][a-z0-9+.-]*://` (case-insensitive,
+    ASCII) finds them left to right, read in linear time (FAA-322: the pattern tried every letter of a long run with no
+    `://`). From each `://` the run of scheme characters before it is read back, and the match starts at its first
+    letter at or after where the last match ended."""
+    spans: List[Tuple[int, int]] = []
+    after, at = 0, piece.find("://")
+    while at >= 0:
+        start = at
+        while start > after and piece[start - 1] in _SCHEME_CHARS:
+            start -= 1
+        while start < at and piece[start] not in _SCHEME_LETTERS:
+            start += 1
+        if start < at:
+            spans.append((start, at + 3))
+            after = at + 3
+        at = piece.find("://", at + 1)
+    return spans
+
+
 def _urls_in(value: str) -> List[str]:
     """The URLs a member may hold, from every scheme in each whitespace-delimited piece, without the closing brackets,
     quotes and punctuation that end a sentence, and with _TRIED_BACK of them put back (`]` closes an IPv6 host)."""
     urls: List[str] = []
     for piece in _SPACES.split(value):
-        for match in _URL_SCHEME.finditer(piece):
-            url = piece[match.start():]
+        for start, _end in _scheme_spans(piece):
+            url = piece[start:]
             end = len(url)
             while end > 0 and url[end - 1] in _CLOSING:
                 end -= 1
@@ -158,8 +181,8 @@ def _long_run(value: str) -> bool:
     """A long secret-shaped run in a piece read whole; in a piece that holds a URL, the text before its first scheme's
     `://` (the URL itself is read by secret_url)."""
     for piece in _SPACES.split(value):
-        found = _URL_SCHEME.search(piece)
-        cut = piece.find("://", found.start()) if found else -1
+        found = _scheme_spans(piece)
+        cut = found[0][1] - 3 if found else -1
         if _long_secret(piece if cut < 0 else piece[:cut]):
             return True
     return False
@@ -171,153 +194,6 @@ _credential_name, _secret_value, _secret_argument = credential_name, secret_valu
 
 
 _SPECIAL = ("http", "https", "ws", "wss", "ftp", "file")
-_FORBIDDEN_HOST = set("\x00\t\n\r #/:<>?@[\\]^|")
-_FORBIDDEN_DOMAIN = _FORBIDDEN_HOST | set(chr(c) for c in range(0x20)) | {"%", "\x7f"}
-
-
-# FAA-98: UTS46 narrowed, not ported. A non-ASCII host is refused only where every Node from 20 to 26 refuses it, so
-# the doubt stays on the closed side (its URL's credentials are read). The two tables are measured by
-# test/fixtures/idna/make_idna_tables.mjs (idna-tables.json, held equal by test_the_idna_tables_are_the_measured_ones):
-# code points refused in every context, and code points removed between letters. The contextual rules read Unicode 3.2
-# classes (`unicodedata.ucd_3_2_0`) and skip what that Unicode does not know, since Node's own UTS46 data lags its
-# Unicode: an Arabic letter of Unicode 14 is no right-to-left letter to it.
-_IDNA_DISALLOWED = (
-    (0x80, 0xa0), (0xa8, 0xa8), (0xaf, 0xaf), (0xb4, 0xb4), (0xb8, 0xb8), (0x2d8, 0x2dd), (0x37a, 0x37a),
-    (0x384, 0x385), (0x600, 0x605), (0x61c, 0x61c), (0x6dd, 0x6dd), (0x70f, 0x70f), (0x890, 0x891), (0x8e2, 0x8e2),
-    (0x1680, 0x1680), (0x1fbd, 0x1fbd), (0x1fbf, 0x1fc1), (0x1fcd, 0x1fcf), (0x1fdd, 0x1fdf), (0x1fed, 0x1fee),
-    (0x1ffd, 0x1ffe), (0x2000, 0x200a), (0x200e, 0x200f), (0x2017, 0x2017), (0x2024, 0x2026), (0x2028, 0x202f),
-    (0x203e, 0x203e), (0x2047, 0x2049), (0x205f, 0x205f), (0x2066, 0x2069), (0x2100, 0x2101), (0x2105, 0x2106),
-    (0x2488, 0x249b), (0x2a74, 0x2a74), (0x2ff0, 0x3000), (0x309b, 0x309c), (0x31ef, 0x31ef), (0x33c2, 0x33c2),
-    (0x33c7, 0x33c7), (0x33d8, 0x33d8), (0xe000, 0xf8ff), (0xfc5e, 0xfc63), (0xfdfa, 0xfdfb), (0xfe12, 0xfe13),
-    (0xfe16, 0xfe16), (0xfe19, 0xfe19), (0xfe30, 0xfe30), (0xfe47, 0xfe4c), (0xfe52, 0xfe52), (0xfe55, 0xfe56),
-    (0xfe5f, 0xfe5f), (0xfe64, 0xfe65), (0xfe68, 0xfe68), (0xfe6a, 0xfe6b), (0xfe70, 0xfe70), (0xfe72, 0xfe72),
-    (0xfe74, 0xfe74), (0xfe76, 0xfe76), (0xfe78, 0xfe78), (0xfe7a, 0xfe7a), (0xfe7c, 0xfe7c), (0xfe7e, 0xfe7e),
-    (0xff03, 0xff03), (0xff05, 0xff05), (0xff0f, 0xff0f), (0xff1a, 0xff1a), (0xff1c, 0xff1c), (0xff1e, 0xff20),
-    (0xff3b, 0xff3e), (0xff5c, 0xff5c), (0xffe3, 0xffe3), (0xfff9, 0xfffd), (0x110bd, 0x110bd), (0x110cd, 0x110cd),
-    (0x13430, 0x1343f), (0x1f100, 0x1f100), (0xe0001, 0xe0001), (0xe0020, 0xe007f), (0xf0000, 0xffffd),
-    (0x100000, 0x10fffd),
-)
-_IDNA_IGNORED = (
-    (0xad, 0xad), (0x34f, 0x34f), (0x180b, 0x180d), (0x180f, 0x180f), (0x200b, 0x200b), (0x2060, 0x2060),
-    (0x2064, 0x2064), (0xfe00, 0xfe0f), (0xfeff, 0xfeff), (0x1bca0, 0x1bca3), (0xe0100, 0xe01ef),
-)
-_IDNA_DOTS = re.compile("[.\u3002\uff0e\uff61]")
-_U32 = unicodedata.ucd_3_2_0
-_RTL_OK = {"R", "AL", "AN", "EN", "ES", "CS", "ET", "ON", "BN", "NSM"}
-_JOINERS = "\u200c\u200d"
-
-
-def _in_ranges(ranges: Sequence[tuple], cp: int) -> bool:
-    i = bisect.bisect_right(ranges, (cp, 0x10ffff)) - 1
-    return i >= 0 and ranges[i][0] <= cp <= ranges[i][1]
-
-
-def _known(c: str) -> bool:
-    return _U32.category(c) != "Cn" and unicodedata.category(c) != "Cn"
-
-
-def _joiner_refused(label: str, i: int) -> bool:
-    """CheckJoiners as Node 20 to 26 all read it: they find a joining context, or a virama, anywhere in the label
-    (`\u0628a\u200c\u0627` and `\u0628\u200c\u0627\u200d` parse), so only a joiner with nothing but ASCII beside it
-    in its label has none for certain."""
-    return all(c.isascii() for j, c in enumerate(label) if j != i)
-
-
-def _bidi_refused(label: str) -> bool:
-    """RFC 5893 as Node 20 to 26 all read it: only a label holding R, AL or AN is judged, and its first code point is
-    not (Node 26 alone refuses a label opening with a digit or a hyphen)."""
-    if not label or not all(_known(c) for c in label) or any(c in _JOINERS for c in label):
-        return False  # Node 20 to 26 pass a label holding a joiner over (`\u05d0a\u094d\u200d` parses)
-    k = [_U32.bidirectional(c) for c in label]
-    if not any(x in ("R", "AL", "AN") for x in k):
-        return False
-    body = list(k)
-    while body and body[-1] == "NSM":
-        body.pop()
-    if not body or body[-1] not in ("R", "AL", "EN", "AN"):
-        return True
-    return k[0] in ("R", "AL") and (any(x not in _RTL_OK for x in k) or ("EN" in k and "AN" in k))
-
-
-def _idna_host(host: str) -> Optional[str]:
-    """None where WHATWG's domain-to-ASCII refuses a non-ASCII host for certain; else the host as UTS46 maps it, read
-    as NFKC with case folding (exact enough for the ASCII rules that follow, which read digits and dots)."""
-    if any(_in_ranges(_IDNA_DISALLOWED, ord(c)) for c in host):
-        return None
-    kept = "".join(c for c in host if not _in_ranges(_IDNA_IGNORED, ord(c)))
-    if kept == "":
-        return None  # nothing left: an empty host
-    if not all(_known(c) for c in kept):
-        return host  # a code point this Python's Unicode does not know: the contextual rules are not read
-    mapped = unicodedata.normalize("NFC", unicodedata.normalize("NFKC", unicodedata.normalize("NFKC", kept).casefold()))
-    for label in _IDNA_DOTS.split(mapped):
-        first = label[:1]
-        if first and first not in "\u17b4\u17b5" and _U32.category(first)[0] == "M" and unicodedata.category(first)[0] == "M":
-            return None  # a label opening with a mark (U+17B4 and U+17B5 are ignored by the newer Nodes)
-        if any(c in _JOINERS and _joiner_refused(label, i) for i, c in enumerate(label)):
-            return None
-        if _bidi_refused(label):
-            return None
-    return _IDNA_DOTS.sub(".", mapped)
-
-
-def _ipv4_number(part: str) -> Optional[int]:
-    if part == "":
-        return None  # an empty part fails WHATWG's IPv4 parser (`1..2`); `0x` alone is 0
-    base = 10
-    if part[:2].lower() == "0x":
-        part, base = part[2:], 16
-    elif len(part) > 1 and part[0] == "0":
-        part, base = part[1:], 8
-    if part == "":
-        return 0
-    digits = {10: "0123456789", 16: "0123456789abcdefABCDEF", 8: "01234567"}[base]
-    return int(part, base) if all(c in digits for c in part) else None
-
-
-def _domain_ok(host: str) -> bool:
-    """The WHATWG host parser on a special scheme's host, enough to know when `new URL` refuses it."""
-    if host.startswith("["):
-        return host.endswith("]") and _ipv6_ok(host[1:-1])
-    if re.search(r"%(?![0-9A-Fa-f]{2})", host) is None:
-        try:
-            host = urllib.parse.unquote_to_bytes(host).decode("utf-8")
-        except UnicodeDecodeError:
-            return False
-    if any(c in _FORBIDDEN_DOMAIN for c in host):
-        return False
-    # A non-ASCII host goes through UTS46 in WHATWG; this module reads it narrowly (_idna_host, FAA-98). When unsure,
-    # the host is taken as valid, so its URL's credentials are read: the doubt then hides a list rather than publish one
-    # (round-2 reading). A host UTS46 maps to ASCII is read by the ASCII rules below (`１２７.０.０.１` is an address).
-    if any(ord(c) > 0x7f for c in host):
-        mapped = _idna_host(host)
-        if mapped is None:
-            return False
-        if not mapped.isascii() or any(c in _FORBIDDEN_DOMAIN for c in mapped):
-            return True
-        host = mapped
-    labels = host.split(".")
-    if labels and labels[-1] == "" and len(labels) > 1:
-        labels = labels[:-1]
-    last = labels[-1] if labels else ""
-    if not (last and (last.isdigit() and last.isascii() or re.fullmatch(r"0[xX][0-9A-Fa-f]*", last))):
-        return host != ""
-    numbers = [_ipv4_number(label) for label in labels]
-    if len(numbers) > 4 or any(n is None for n in numbers):
-        return False
-    return all(n <= 255 for n in numbers[:-1]) and numbers[-1] < 256 ** (5 - len(numbers))
-
-
-def _ipv6_ok(text: str) -> bool:
-    if "%" in text:
-        return False  # a zone id: `ipaddress` takes one, WHATWG does not
-    try:
-        ipaddress.IPv6Address(text)
-        return True
-    except ValueError:
-        return False
-
-
 _SURROGATE = re.compile("[\ud800-\udfff]")
 _QUERY_ENCODE = set(chr(c) for c in range(0x21)) | set('"#<>')
 _FRAGMENT_ENCODE = set(chr(c) for c in range(0x21)) | set('"<>`')
@@ -388,7 +264,7 @@ def _whatwg_parts(value: str) -> Optional[Dict[str, str]]:
             return None
     elif any(c in _FORBIDDEN_HOST for c in host):
         return None
-    elif host == "" and ("@" in authority or port):
+    elif host == "" and ("@" in authority or ":" in hostport):
         return None
     return {"password": password, "query": query, "fragment": fragment}
 
@@ -424,7 +300,7 @@ def _secret_url(value: str) -> bool:
 
 
 def _credential(value: str, runs: bool) -> bool:
-    return bool(JWT_SHAPE.search(value) or _KEY_SHAPE.search(value) or _BEARER.search(value)
+    return bool(has_jwt(value) or _KEY_SHAPE.search(value) or _BEARER.search(value)  # has_jwt: one pass (FAA-313)
                 or (runs and _long_run(value)) or any(_secret_url(url) for url in _urls_in(value)))
 
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -46,6 +46,8 @@ from fabric_jsvalue import (  # noqa: E402 - the core (FAA-65)
 )
 from fabric_paths import atomic_write as _atomic_write  # noqa: E402 - the kit's private writer (FAA-85)
 import fabric_peer_owner as _po  # noqa: E402 - a loopback key set is read from this account's listener only (FAA-255)
+import fabric_secrets  # noqa: E402 - the WHATWG host reading (FAA-98, FAA-309)
+import fabric_socket_proof  # noqa: E402 - the one loopback host rule (FAA-187 (15))
 from fabric_mandate import effect_closure  # noqa: E402,F401 - defined once beside the mandate that reads it too (DEC-0125)
 
 REFUSAL_CODES = (
@@ -621,16 +623,10 @@ def action_digest(action: Any) -> str:
 
 # --- the estate's keys ----------------------------------------------------------------------------------------
 
-def _loopback(host: str) -> bool:
-    if host == "localhost":
-        return True
-    try:
-        address = ipaddress.ip_address(host)
-    except ValueError:
-        return False
-    # A zone (`::1%eth0`) is no loopback: urllib decodes `%3A80` in it into another address (0.56.0 seam r13).
-    # Nor an IPv4-mapped address, which Python 3.13+ counts as loopback and 3.9 and Node do not (0.56.0 seam r14).
-    return address.is_loopback and not getattr(address, "scope_id", None) and not getattr(address, "ipv4_mapped", None)
+#: A key set source's loopback host, the kit's one rule (fabric_socket_proof.loopback_host), shared with fabric_http's
+#: check_url, so a source starts a service on both kits alike (FAA-187 (15); `127.1`, `2130706433`, a name under
+#: `.localhost`). A zone and an IPv4-mapped address stay refused, as before (0.56.0 seam r13, r14).
+_loopback = fabric_socket_proof.loopback_host
 
 
 # fabric_http._URL_ENDS (this module may not import fabric_http; test_fabric_delegation pins them equal).
@@ -663,7 +659,16 @@ def _source_authority_ok(parts: urllib.parse.SplitResult) -> bool:
         parts.port  # noqa: B018 - raises on a port above 65535
     except ValueError:
         return False
-    return bool(parts.hostname)
+    # A host `new URL` refuses for its structure (`a127.0.0.1`, `09`), or one Python's IDNA codec cannot write for
+    # http.client (U+180E), is refused here as check_url refuses it, never read and failed on every call (FAA-187 (14),
+    # (16)).
+    host = parts.hostname or ""
+    try:
+        if not host.isascii():
+            host.encode("idna")
+    except UnicodeError:
+        return False
+    return bool(host) and not fabric_secrets.url_refused(parts.geturl())
 
 
 class _NoRedirect(urllib.request.HTTPRedirectHandler):
@@ -734,7 +739,7 @@ def _fetch(source: str) -> Any:
                     body += chunk
             if deadline["fired"] or time.monotonic() > deadline["end"]:
                 raise TimeoutError("the key set did not arrive within %s s" % JWKS_FETCH_SECONDS)
-            return json.loads(body[:65536])
+            return json.loads(body[:65536], parse_constant=_no_constant)  # NaN is no JSON, as JSON.parse reads it (FAA-194)
         except urllib.error.HTTPError as exc:
             exc.close()
             raise
@@ -745,7 +750,7 @@ def _fetch(source: str) -> Any:
         finally:
             if deadline["timer"] is not None:
                 deadline["timer"].cancel()
-    return json.loads(Path(source).expanduser().read_text())
+    return json.loads(Path(source).expanduser().read_text(), parse_constant=_no_constant)
 
 
 class JwksCache: