@passioncode-ai/fabric-agent-adapter 0.81.0 → 0.83.1

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_descriptor.py

@@ -55,7 +55,7 @@ from fabric_usage import (
 DASHBOARD_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1"
 
 
-DASHBOARD_KIT = "fabric-dashboard-kit@1.1.6"
+DASHBOARD_KIT = "fabric-dashboard-kit@1.1.8"
 
 
 REFERENCE_THEMES = ("graphite", "fabric", "paper", "forest", "ocean", "ember", "contrast")
@@ -197,9 +197,11 @@ def read_descriptors(directory: Optional[Path] = None) -> List[Tuple[Path, Dict[
         return found
     for path in sorted(root.glob("*.json")):
         try:
-            found.append((path, json.loads(path.read_text(encoding="utf-8"))))
-        except (OSError, ValueError):
+            value = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, ValueError, RecursionError):
             continue
+        if isinstance(value, dict):  # a file that holds no object is no descriptor (FAA-200 (50))
+            found.append((path, value))
     return found
 
 
@@ -222,10 +224,11 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
         return problems
     if descriptor["protocol"] != PROTOCOL:
         problems.append("protocol must be %s" % PROTOCOL)
-    if not _ID.match(str(descriptor["id"])):
-        problems.append("id must match %s" % _ID.pattern)
-    if not _INSTANCE.match(str(descriptor["instance"])):
-        problems.append("instance must match %s" % _INSTANCE.pattern)
+    for key, pattern in (("id", _ID), ("instance", _INSTANCE)):  # a string before its pattern (FAA-200 (9), (36))
+        if not isinstance(descriptor[key], str):
+            problems.append("%s must be a string" % key)
+        elif not pattern.match(descriptor[key]):
+            problems.append("%s must match %s" % (key, pattern.pattern))
     if remote:
         problems.extend(remote_origin_problems(descriptor["origin"]))
     elif "origin" in descriptor and not _ORIGIN.match(str(descriptor["origin"])):
@@ -234,11 +237,11 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
     if "tokenFile" not in auth:
         problems.append("auth.tokenFile is required")
     elif not _LOCAL_PATH.match(str(auth["tokenFile"])):
-        problems.append("auth.tokenFile must be a local path, never a network share")
+        problems.append("auth.tokenFile must be an absolute local path (/, ~/ or a drive letter), never a relative path, never a network share")
     paths = descriptor.get("paths") or {}
     for value in ([paths["data"]] if "data" in paths else []) + list(paths.get("logs") or []):
         if not _LOCAL_PATH.match(str(value)):
-            problems.append("paths must be local paths, never a network share: %r" % value)
+            problems.append("paths must be absolute local paths (/, ~/ or a drive letter), never a relative path, never a network share: %r" % value)
     header = auth.get("header", "Authorization")
     scheme = auth.get("scheme", "Bearer")
     if not (isinstance(header, str) and _AUTH_HEADER.fullmatch(header)):
@@ -405,7 +408,7 @@ def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
             elif "@" in repository and not _HIERARCHICAL.match(repository):  # 0.62.0 readings 7: never an scp form's user
                 problems.append("source.repository with a user is a URL with an authority (https://user@host/path), never an scp form")
             elif fabric_secrets.repository_credential(repository):  # its name is no key (0.62.0 seam reading 6)
-                problems.append("FAC-SEM-086: /source/repository holds a value shaped like a credential; it names a repository")
+                problems.append("FAC-SEM-086: /source/repository holds a value shaped like a credential; it names a repository: write the repository's name in lower case if it is one")
     if "peer" in descriptor:
         peer = descriptor.get("peer")
         if not isinstance(peer, dict):
@@ -589,8 +592,15 @@ def port_listener_refusal(port: int, reader: Optional[Any] = None) -> Optional[s
             "FAA-225)." % (port, uid))
 
 
+def warn_no_source(descriptor: Dict[str, Any], stacklevel: int = 2) -> None:
+    """The rewrite warning of a descriptor that names no source.repository (FAA-198)."""
+    me = "%s.%s" % (descriptor["id"], descriptor["instance"])
+    warnings.warn("Descriptor %s %s; a new install is refused without it." % (me, NO_SOURCE_REPOSITORY),
+                  NoSourceRepositoryWarning, stacklevel=stacklevel + 1)
+
+
 def write_descriptor(descriptor: Dict[str, Any], directory: Optional[Path] = None, *, _stacklevel: int = 2,
-                     port_owner: Optional[Any] = None) -> Path:
+                     port_owner: Optional[Any] = None, _warned: bool = False) -> Path:
     """Installer-only. Refuses a port or id.instance another descriptor claims (a port is a claim), and a port another
     OS account listens on (FAA-225; ``port_owner(port) -> (kind, uid) | None`` reads it, the kit's own by default).
 
@@ -604,9 +614,8 @@ def write_descriptor(descriptor: Dict[str, Any], directory: Optional[Path] = Non
     refusal = source_refusal(descriptor, root)
     if refusal:
         raise ServiceError(refusal)
-    if not names_repository(descriptor):
-        warnings.warn("Descriptor %s %s; a new install is refused without it." % (me, NO_SOURCE_REPOSITORY),
-                      NoSourceRepositoryWarning, stacklevel=_stacklevel)
+    if not names_repository(descriptor) and not _warned:  # register_remote warns itself, before its token (FAA-200 (1))
+        warn_no_source(descriptor, _stacklevel)
     # DEC-0019: only a local placement claims a port on this computer; DEC-0069: an app's descriptor names none.
     port = None if placement_of(descriptor) == "remote" or "origin" not in descriptor else port_of(descriptor["origin"])
     for path, other in read_descriptors(root):

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_events.py

@@ -51,7 +51,9 @@ def make_event(event_id: Any, at: str, kind: str, level: str, text: str, *, subj
                link: Optional[str] = None, notify: bool = False, trace_id: Optional[str] = None,
                span_id: Optional[str] = None, data: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     """One activity event: one sentence a person reads, never a machine id. `level` is one of `LEVELS`; `warn`, the
-    dashboard chip's name, is stored as `warning`. `data` (DEC-0070) adds machine-readable
+    dashboard kit's chip for "a person is needed" (`.fd-s-warn`), is stored as `warning`, the feed's name for the same
+    level, so a reader that draws chips shows a stored `warning` as the `warn` chip (FAA-276, FAA-277 (6)). `data`
+    (DEC-0070) adds machine-readable
     fields beside the sentence, `{schema, value}`, never a secret: it is refused here, so no feed carries one.
 
     An event about traced work carries its trace as a pair, `trace_id` and `span_id`

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_holds.py

@@ -21,7 +21,8 @@ says so three ways:
 
 `HoldBook` keeps one JSON file (0600, written atomically); a ThreadingHTTPServer's handlers share it under the store
 lock. It holds caller names, work labels, reasons and the operator's words, never a credential: `hold` refuses a text
-the contract's detector reads as one.
+the contract's detector reads as one. A record written since 0.83.0 carries `squash: "ecmascript"`; one without it
+(0.81.0, 0.82.0) is matched under both squashes, since 0.81.0's Python twin squashed names with str.split() (FAA-320).
 """
 from __future__ import annotations
 
@@ -55,6 +56,35 @@ LIFT_ACTION = "limit.lift"
 _MAX_STATUS_MESSAGE = 500
 _WAITING = re.compile(r"^waiting (daily-quota|caller-share|concurrency|money) since ([0-9][0-9TZ:.-]*?)(?:: ([\s\S]+))?\Z")
 _SIZES = ("jobs", "usd", "limit")
+#: One run of ECMAScript's whitespace, the class both twins squash with (FAA-316): Python's str.split() also takes
+#: U+001C to U+001F and U+0085 and not U+FEFF, so the twins wrote different statusMessages.
+_SPACES = re.compile("[%s]+" % fabric_secrets.JS_SPACE)
+
+
+def _squash(text: str) -> str:
+    """Runs of ECMAScript whitespace as one space, none at either end (the Node twin's `squash`)."""
+    return _SPACES.sub(" ", text).strip(" ")
+
+
+#: What a record written since 0.83.0 carries: its names were squashed with ECMAScript's whitespace (FAA-320).
+SQUASH = "ecmascript"
+#: Python's str.isspace() class, the one 0.81.0's Python twin squashed a name with (`" ".join(text.split())`).
+_PY_SPACES = re.compile("[\t\n\x0b\x0c\r\x1c-\x1f \x85\xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]+")
+
+
+def _legacy_squash(text: str) -> str:
+    """A name as 0.81.0's Python twin wrote it (str.split()), written out so both twins read it alike."""
+    return _PY_SPACES.sub(" ", text).strip(" ")
+
+
+def _names(caller: Any, record: Dict[str, Any]) -> tuple:
+    """The stored forms `caller` matches in `record`: the ECMAScript squash, and for a record with no `squash` mark
+    (written before 0.83.0) also the squash 0.81.0's Python twin wrote (FAA-320). None matches only None."""
+    if not isinstance(caller, str):
+        return (caller,)
+    if record.get("squash") == SQUASH:
+        return (_squash(caller),)
+    return (_squash(caller), _legacy_squash(caller))
 
 
 def _instant(value: Any, name: str) -> str:
@@ -75,10 +105,10 @@ def waiting_message(reason: str, since: str, until: Optional[str] = None, messag
     text = "waiting %s since %s" % (reason, since)
     head = len(QUOTA_EXHAUSTED) + (0 if until is None else len(" until ") + len(until)) + len(": ")
     if message is not None:
-        message = " ".join(str(message).split())
+        message = _squash(str(message))
         room = _MAX_STATUS_MESSAGE - head - len(text) - len(": ")
         if message and room > 0:
-            text += ": " + (message if len(message) <= room else message[:room - 3].rstrip() + "...")
+            text += ": " + (message if len(message) <= room else message[:room - 3].rstrip(" ") + "...")
     return pause_message(until, text)
 
 
@@ -124,11 +154,11 @@ def hold_sentence(caller: str, work: str, reason: str, until: Optional[str]) ->
 
 
 def _text(value: Any, name: str, high: int = 200) -> str:
-    if not isinstance(value, str) or not value.strip() or len(value) > high:
+    if not isinstance(value, str) or not _squash(value) or len(value) > high:
         raise ServiceError("%s is a text of 1 to %d characters." % (name, high))
     if fabric_secrets.secret_value(value):
         raise ServiceError("%s looks like a credential; a hold names callers and work, never a secret." % name)
-    return " ".join(value.split())
+    return _squash(value)
 
 
 class HoldBook:
@@ -189,6 +219,7 @@ class HoldBook:
              job_id: Optional[str] = None, now: Optional[str] = None) -> Dict[str, Any]:
         """Hold `work` for `caller` by `reason`. Returns {hold, statusMessage, push}: `push` is the notify event when this
         call opened the hold, None when the work joined an open one (one push per hold)."""
+        raw_caller = caller
         caller, work = _text(caller, "caller"), _text(work, "work")
         if reason not in HOLD_REASONS:
             raise ServiceError("A hold's reason is one of %s." % ", ".join(HOLD_REASONS))
@@ -199,11 +230,11 @@ class HoldBook:
             data = self._load()
             self._expire(data, utc_time(at))
             hold = next((h for h in data["holds"] if h.get("closed") is None and h["reason"] == reason
-                         and h["caller"] == caller), None)
+                         and h["caller"] in _names(raw_caller, h)), None)
             opened = hold is None
             if opened:
                 hold = {"id": uuid.uuid4().hex, "reason": reason, "caller": caller, "work": work, "since": at,
-                        "until": until, "jobs": [], "closed": None}
+                        "until": until, "jobs": [], "closed": None, "squash": SQUASH}
                 data["holds"].append(hold)
             if job_id is not None and job_id not in hold["jobs"]:
                 hold["jobs"].append(str(job_id))
@@ -221,7 +252,7 @@ class HoldBook:
         with self._lock:
             data = self._load()
             hold = next((h for h in data["holds"] if h.get("closed") is None and h["reason"] == reason
-                         and h["caller"] == caller), None)
+                         and h["caller"] in _names(caller, h)), None)
             if hold is None:
                 return None
             hold["closed"], hold["closedAt"] = "released", at
@@ -261,14 +292,15 @@ class HoldBook:
             raise ServiceError("A raised limit needs its window's end (until): it falls back when the window ends.")
         record: Dict[str, Any] = {"id": uuid.uuid4().hex, "reason": reason, "caller": None if caller is None else _text(caller, "caller"),
                                   "job": None if job_id is None else str(job_id), "from": at, "until": until,
-                                  given[0]: size, "decision": dict(decision), "at": at}
+                                  given[0]: size, "decision": dict(decision), "at": at, "squash": SQUASH}
         if given[0] != "limit":
             record["left"] = size
         with self._lock:
             data = self._load()
             self._expire(data, utc_time(at))
             for hold in data["holds"]:
-                if hold.get("closed") is None and hold["reason"] == reason and record["caller"] in (None, hold["caller"]) and (
+                if hold.get("closed") is None and hold["reason"] == reason and (
+                        caller is None or hold["caller"] in _names(caller, hold)) and (
                         job_id is None or str(job_id) in hold["jobs"]):
                     hold["closed"], hold["closedAt"], hold["lift"] = "lifted", at, record["id"]
             data["lifts"].append(record)
@@ -283,7 +315,7 @@ class HoldBook:
     def _matching(self, data: Dict[str, Any], reason: str, caller: Optional[str], job_id: Optional[str], at: int,
                   kind: str) -> List[Dict[str, Any]]:
         return [l for l in data["lifts"] if l["reason"] == reason and kind in l and self._live(l, at)
-                and l.get("caller") in (None, caller) and l.get("job") in (None, job_id)]
+                and (l.get("caller") is None or l["caller"] in _names(caller, l)) and l.get("job") in (None, job_id)]
 
     def admit(self, *, reason: str, caller: str, job_id: Optional[str] = None, cost_usd: Optional[float] = None,
               now: Optional[str] = None) -> Dict[str, Any]:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_http.py

@@ -50,6 +50,8 @@ from pathlib import Path as _Path  # noqa: E402
 if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from any working directory (FAA-65)
     _sys.path.insert(0, str(_Path(__file__).resolve().parent))
 from fabric_jsvalue import json_stringify  # noqa: E402 - beside this file
+import fabric_secrets  # noqa: E402 - beside this file: the WHATWG host reading (FAA-98, FAA-309)
+import fabric_socket_proof  # noqa: E402 - beside this file: the one loopback host rule (FAA-187 (15))
 import fabric_peer_owner as _po  # noqa: E402 - beside this file: the listener's owner (DEC-0154 HA-2)
 
 RETRY_STATUSES = (408, 425, 429, 500, 502, 503, 504)
@@ -73,8 +75,9 @@ class HttpError(Exception):
         self.retry_after_s = retry_after_s
         self.body = bytes(body[:2048])
         self.kind = kind  # http (an answer), connection, timeout, too-large, refused, foreign-user
-        #: For foreign-user, why (FAA-272): `table-restricted` (this process sees no other process's sockets, which
-        #: never clears), the owner's kind (`another-account`, `system`) or the check's reason (`no-row`).
+        #: For foreign-user, why (FAA-272): `table-restricted` (this process sees no other process's sockets, or on
+        #: macOS no row for this connection, DEC-0155 RT-1; it never clears), the owner's kind (`another-account`,
+        #: `system`) or the check's reason (`no-row`, from Linux and Windows only).
         self.reason = reason
 
 
@@ -210,28 +213,28 @@ def redact_url(url: str) -> str:
     return urllib.parse.urlunsplit((parts.scheme.lower(), netloc, path, "", ""))
 
 
-def _is_loopback(host: str) -> bool:
-    """Loopback as a WHATWG URL parser leaves the host: one trailing dot dropped from an IPv4 address, no whitespace,
-    and an IPv4-mapped IPv6 address not counted (Node writes it in hex and the Node twin refuses it)."""
-    if host == "localhost" or host.endswith(".localhost"):
+#: Loopback as a WHATWG URL parser leaves the host: the kit's one rule, shared with fabric_delegation (FAA-187 (15)).
+_is_loopback = fabric_socket_proof.loopback_host
+
+
+def _idna_sendable(host: Optional[str]) -> bool:
+    """Whether http.client can write the host: a non-ASCII one goes out in IDNA through Python's own codec, which refuses
+    some hosts `new URL` maps (U+180E, a fullwidth dot beside a dot), so such a URL would fail on every call (FAA-187
+    (16)); it is refused at the check instead."""
+    if not host or host.isascii():
         return True
-    if not host or any(c.isspace() for c in host):
-        return False
     try:
-        address = ipaddress.ip_address(host)
-        return address.is_loopback and not getattr(address, "ipv4_mapped", None)
-    except ValueError:
-        pass
-    host = host[:-1] if host.endswith(".") else host
-    try:  # the short IPv4 forms a WHATWG URL also reads (127.1, 2130706433, 0x7f.1)
-        return socket.inet_aton(host)[0] == 127
-    except (OSError, ValueError):
+        host.encode("idna")
+        return True
+    except UnicodeError:
         return False
 
 
 def check_url(url: str, *, insecure: bool = False) -> None:
     """Refuse what this client never sends: a scheme other than http or https, no host, credentials in the URL, or
-    plain http to a host that is not loopback (unless `insecure`)."""
+    plain http to a host that is not loopback (unless `insecure`). A host `new URL` refuses for its structure (a last
+    label that is a number but no IPv4 address, `a127.0.0.1`, `09`; a host UTS46 refuses, a joiner beside ASCII alone) is
+    refused as the Node twin refuses it, read by fabric_secrets.url_refused (FAA-187 (14))."""
     try:
         # The ends are trimmed as urllib trims what it sends (and `new URL` too); a URL ending in a line break, which
         # 0.55.0 sent, still passes (0.56.0 product r17).
@@ -241,7 +244,7 @@ def check_url(url: str, *, insecure: bool = False) -> None:
         parts = urllib.parse.urlsplit(sent)
         host = parts.hostname
         parts.port  # noqa: B018 - raises on a bad port
-        if not _authority_ok(parts.netloc):
+        if not _authority_ok(parts.netloc) or fabric_secrets.url_refused(sent) or not _idna_sendable(host):
             raise ValueError("authority")
     except (ValueError, TypeError):
         raise HttpError("the URL does not parse", url=redact_url(url), kind="refused")

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py

@@ -70,8 +70,9 @@ class HubError(Exception):
 def listener_refusal(exc: Any) -> HubError:
     """The HubError for a hub port the peer-owner check refused (DEC-0154 HA-2): code `foreign-user`, the pinned
     contract's state name, with the owner's reason in the sentence and in `data.reason` (FAA-272): `table-restricted`
-    when this process's socket table hides other processes' sockets, which never clears, so it is not retryable;
-    otherwise the owner's kind or the check's reason (`another-account`, `no-row`), retryable as before."""
+    when this process's socket table hides other processes' sockets, or, on macOS, holds no row for this connection
+    (DEC-0155 RT-1, FAA-312), which never clears, so it is not retryable; otherwise the owner's kind or the check's
+    reason (`another-account`, or `no-row`, which only Linux and Windows give), retryable."""
     owner = getattr(exc, "owner", None)
     why = (getattr(owner, "reason", None) or getattr(owner, "kind", None) or getattr(exc, "code", None) or "unknown")
     reason = _po.TABLE_RESTRICTED if str(why).startswith(_po.TABLE_RESTRICTED) else str(why).split(":", 1)[0]
@@ -94,25 +95,41 @@ def fabric_root(platform: str = sys.platform, env: Optional[Dict[str, str]] = No
     return Path(env.get("XDG_DATA_HOME") or str(home / ".local/share")) / "passioncode-fabric"
 
 
-def pid_alive(pid: int) -> bool:
-    """Whether a process with this id runs as this user (Fabric `hub.ts#pidAlive`); never signals it."""
+def _windows_pid_alive(pid: int, kernel: Any = None, last_error: Any = None) -> Optional[bool]:
+    """pid_alive on Windows, where os.kill(pid, 0) would send CTRL_C_EVENT: the check Node's process.kill(pid, 0) makes
+    (libuv's uv_kill), asking OpenProcess for the same access (terminate, query, synchronize; never the limited query an
+    elevated process of the same user grants, FAA-323). Refused with ERROR_ACCESS_DENIED (5), another account's or an
+    elevated process: None, as Node answers EPERM there (FAA-304); refused otherwise, no process; opened, running
+    while its exit code is STILL_ACTIVE and a zero wait times out. `kernel` and `last_error` stand in for kernel32 and
+    ctypes.get_last_error in a test."""
+    import ctypes
+    if kernel is None:
+        kernel = ctypes.WinDLL("kernel32", use_last_error=True)  # type: ignore[attr-defined]
+        last_error = ctypes.get_last_error  # type: ignore[attr-defined]
+    handle = kernel.OpenProcess(0x0001 | 0x0400 | 0x00100000, False, pid)  # TERMINATE | QUERY_INFORMATION | SYNCHRONIZE
+    if not handle:
+        return None if last_error() == 5 else False  # ERROR_ACCESS_DENIED: not verified, never called running
+    try:
+        code = ctypes.c_ulong()
+        if not kernel.GetExitCodeProcess(handle, ctypes.byref(code)) or code.value != 259:  # STILL_ACTIVE
+            return False
+        return kernel.WaitForSingleObject(handle, 0) != 0  # WAIT_OBJECT_0: ended, with exit code 259
+    finally:
+        kernel.CloseHandle(handle)
+
+
+def pid_alive(pid: int) -> Optional[bool]:
+    """True: a process of this OS account runs under `pid`; False: none does. None (falsy): a process of another account
+    does (EPERM; on Windows, OpenProcess refused with access denied), as when the id hub.json names was reused: not
+    verified, never called running (FAA-304, the session hooks' answer since FAA-254). Never signals it."""
     if pid <= 0:
         return False
     if sys.platform == "win32":
-        import ctypes
-        kernel = ctypes.windll.kernel32  # type: ignore[attr-defined]
-        handle = kernel.OpenProcess(0x1000, False, pid)  # PROCESS_QUERY_LIMITED_INFORMATION
-        if not handle:
-            return False
-        try:
-            code = ctypes.c_ulong()
-            return bool(kernel.GetExitCodeProcess(handle, ctypes.byref(code))) and code.value == 259  # STILL_ACTIVE
-        finally:
-            kernel.CloseHandle(handle)
+        return _windows_pid_alive(pid)
     try:
         os.kill(pid, 0)
     except PermissionError:
-        return False  # another user's process under a reused id: not this user's Fabric
+        return None  # another account's process under a reused id: not verified, and not this account's Fabric
     except OSError:
         return False
     return True
@@ -142,7 +159,8 @@ def _read_small(path: Path) -> Optional[str]:
 def locate_hub(root: Optional[Path] = None, alive: Callable[[int], bool] = pid_alive, estate: Optional[Dict[str, Any]] = None,
                now: Optional[float] = None) -> Dict[str, Any]:
     """`hub.json` read the way an agent must, every call. Answers `{origin, mcpUrl, doorTokenFile, pid, startedAt,
-    features}` or raises `HubError` (`not-running`, retryable; `not-a-hub`). Reads no token. `estate` is
+    features}` or raises `HubError` (`not-running`, retryable; `not-a-hub`, retryable when hub.json names a process of
+    another OS account, which is not verified, FAA-304). Reads no token. `estate` is
     `{"record": <estate record>, "applied": {"revision", "digest"?} | None}`: with it, a `hubKey` the document names is
     checked by `hub_key_certified` (DEC-0060); fabric-hub/0.1 names none, and then nothing is checked."""
     root = Path(root) if root is not None else fabric_root()
@@ -174,7 +192,11 @@ def locate_hub(root: Optional[Path] = None, alive: Callable[[int], bool] = pid_a
     token_file = doc.get("doorTokenFile") if isinstance(doc.get("doorTokenFile"), str) else ""
     if not os.path.isabs(token_file) or os.path.realpath(os.path.dirname(token_file)) != os.path.realpath(str(root)):
         raise not_hub("names a door token outside the registry root")
-    if not alive(pid):
+    live = alive(pid)
+    if live is None:  # FAA-304: another account's process under that id, so not this account's Fabric (as FAA-254)
+        raise HubError("not-a-hub", "Fabric's hub.json names process %d, which runs under another OS account: not "
+                       "verified." % pid, True)
+    if not live:
         raise HubError("not-running", "Fabric is not running: hub.json names process %d, which is not running." % pid, True)
     features = doc.get("features")
     features = [f for f in features if isinstance(f, str)] if isinstance(features, list) else []