@passioncode-ai/fabric-agent-adapter 0.82.0 → 0.84.1

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 """The callee's side of fabric-delegation/0.1 (Fabric Agent Contract DEC-0039, Fabric ADR-0144): check a
 delegation token or an approval offline against the estate's published keys, and answer `ok` or one refusal
 code. A port of the contract's `src/delegation.ts` at the pinned revision; the shared vectors in
@@ -46,6 +47,8 @@ from fabric_jsvalue import (  # noqa: E402 - the core (FAA-65)
 )
 from fabric_paths import atomic_write as _atomic_write  # noqa: E402 - the kit's private writer (FAA-85)
 import fabric_peer_owner as _po  # noqa: E402 - a loopback key set is read from this account's listener only (FAA-255)
+import fabric_secrets  # noqa: E402 - the WHATWG host reading (FAA-98, FAA-309)
+import fabric_socket_proof  # noqa: E402 - the one loopback host rule (FAA-187 (15))
 from fabric_mandate import effect_closure  # noqa: E402,F401 - defined once beside the mandate that reads it too (DEC-0125)
 
 REFUSAL_CODES = (
@@ -621,16 +624,10 @@ def action_digest(action: Any) -> str:
 
 # --- the estate's keys ----------------------------------------------------------------------------------------
 
-def _loopback(host: str) -> bool:
-    if host == "localhost":
-        return True
-    try:
-        address = ipaddress.ip_address(host)
-    except ValueError:
-        return False
-    # A zone (`::1%eth0`) is no loopback: urllib decodes `%3A80` in it into another address (0.56.0 seam r13).
-    # Nor an IPv4-mapped address, which Python 3.13+ counts as loopback and 3.9 and Node do not (0.56.0 seam r14).
-    return address.is_loopback and not getattr(address, "scope_id", None) and not getattr(address, "ipv4_mapped", None)
+#: A key set source's loopback host, the kit's one rule (fabric_socket_proof.loopback_host), shared with fabric_http's
+#: check_url, so a source starts a service on both kits alike (FAA-187 (15); `127.1`, `2130706433`, a name under
+#: `.localhost`). A zone and an IPv4-mapped address stay refused, as before (0.56.0 seam r13, r14).
+_loopback = fabric_socket_proof.loopback_host
 
 
 # fabric_http._URL_ENDS (this module may not import fabric_http; test_fabric_delegation pins them equal).
@@ -663,7 +660,16 @@ def _source_authority_ok(parts: urllib.parse.SplitResult) -> bool:
         parts.port  # noqa: B018 - raises on a port above 65535
     except ValueError:
         return False
-    return bool(parts.hostname)
+    # A host `new URL` refuses for its structure (`a127.0.0.1`, `09`), or one Python's IDNA codec cannot write for
+    # http.client (U+180E), is refused here as check_url refuses it, never read and failed on every call (FAA-187 (14),
+    # (16)).
+    host = parts.hostname or ""
+    try:
+        if not host.isascii():
+            host.encode("idna")
+    except UnicodeError:
+        return False
+    return bool(host) and not fabric_secrets.url_refused(parts.geturl())
 
 
 class _NoRedirect(urllib.request.HTTPRedirectHandler):
@@ -734,7 +740,7 @@ def _fetch(source: str) -> Any:
                     body += chunk
             if deadline["fired"] or time.monotonic() > deadline["end"]:
                 raise TimeoutError("the key set did not arrive within %s s" % JWKS_FETCH_SECONDS)
-            return json.loads(body[:65536])
+            return json.loads(body[:65536], parse_constant=_no_constant)  # NaN is no JSON, as JSON.parse reads it (FAA-194)
         except urllib.error.HTTPError as exc:
             exc.close()
             raise
@@ -745,7 +751,7 @@ def _fetch(source: str) -> Any:
         finally:
             if deadline["timer"] is not None:
                 deadline["timer"].cancel()
-    return json.loads(Path(source).expanduser().read_text())
+    return json.loads(Path(source).expanduser().read_text(), parse_constant=_no_constant)
 
 
 class JwksCache:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_descriptor.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 """How a service is found (fabric-service/0.1): its descriptor, peers and app descriptors (DEC-0061, DEC-0069),
 build identity and the well-known document, the loopback HTTP server. Part of the service kit (FAA-65, layer L3)."""
 # Example URLs write their scheme in angle brackets: read `<https>` as `https` (FAA-212).
@@ -55,7 +56,7 @@ from fabric_usage import (
 DASHBOARD_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1"
 
 
-DASHBOARD_KIT = "fabric-dashboard-kit@1.1.7"
+DASHBOARD_KIT = "fabric-dashboard-kit@1.1.9"
 
 
 REFERENCE_THEMES = ("graphite", "fabric", "paper", "forest", "ocean", "ember", "contrast")
@@ -197,9 +198,11 @@ def read_descriptors(directory: Optional[Path] = None) -> List[Tuple[Path, Dict[
         return found
     for path in sorted(root.glob("*.json")):
         try:
-            found.append((path, json.loads(path.read_text(encoding="utf-8"))))
-        except (OSError, ValueError):
+            value = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, ValueError, RecursionError):
             continue
+        if isinstance(value, dict):  # a file that holds no object is no descriptor (FAA-200 (50))
+            found.append((path, value))
     return found
 
 
@@ -222,10 +225,11 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
         return problems
     if descriptor["protocol"] != PROTOCOL:
         problems.append("protocol must be %s" % PROTOCOL)
-    if not _ID.match(str(descriptor["id"])):
-        problems.append("id must match %s" % _ID.pattern)
-    if not _INSTANCE.match(str(descriptor["instance"])):
-        problems.append("instance must match %s" % _INSTANCE.pattern)
+    for key, pattern in (("id", _ID), ("instance", _INSTANCE)):  # a string before its pattern (FAA-200 (9), (36))
+        if not isinstance(descriptor[key], str):
+            problems.append("%s must be a string" % key)
+        elif not pattern.match(descriptor[key]):
+            problems.append("%s must match %s" % (key, pattern.pattern))
     if remote:
         problems.extend(remote_origin_problems(descriptor["origin"]))
     elif "origin" in descriptor and not _ORIGIN.match(str(descriptor["origin"])):
@@ -234,11 +238,11 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
     if "tokenFile" not in auth:
         problems.append("auth.tokenFile is required")
     elif not _LOCAL_PATH.match(str(auth["tokenFile"])):
-        problems.append("auth.tokenFile must be a local path, never a network share")
+        problems.append("auth.tokenFile must be an absolute local path (/, ~/ or a drive letter), never a relative path, never a network share")
     paths = descriptor.get("paths") or {}
     for value in ([paths["data"]] if "data" in paths else []) + list(paths.get("logs") or []):
         if not _LOCAL_PATH.match(str(value)):
-            problems.append("paths must be local paths, never a network share: %r" % value)
+            problems.append("paths must be absolute local paths (/, ~/ or a drive letter), never a relative path, never a network share: %r" % value)
     header = auth.get("header", "Authorization")
     scheme = auth.get("scheme", "Bearer")
     if not (isinstance(header, str) and _AUTH_HEADER.fullmatch(header)):
@@ -405,7 +409,7 @@ def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
             elif "@" in repository and not _HIERARCHICAL.match(repository):  # 0.62.0 readings 7: never an scp form's user
                 problems.append("source.repository with a user is a URL with an authority (https://user@host/path), never an scp form")
             elif fabric_secrets.repository_credential(repository):  # its name is no key (0.62.0 seam reading 6)
-                problems.append("FAC-SEM-086: /source/repository holds a value shaped like a credential; it names a repository")
+                problems.append("FAC-SEM-086: /source/repository holds a value shaped like a credential; it names a repository: write the repository's name in lower case if it is one")
     if "peer" in descriptor:
         peer = descriptor.get("peer")
         if not isinstance(peer, dict):
@@ -589,8 +593,15 @@ def port_listener_refusal(port: int, reader: Optional[Any] = None) -> Optional[s
             "FAA-225)." % (port, uid))
 
 
+def warn_no_source(descriptor: Dict[str, Any], stacklevel: int = 2) -> None:
+    """The rewrite warning of a descriptor that names no source.repository (FAA-198)."""
+    me = "%s.%s" % (descriptor["id"], descriptor["instance"])
+    warnings.warn("Descriptor %s %s; a new install is refused without it." % (me, NO_SOURCE_REPOSITORY),
+                  NoSourceRepositoryWarning, stacklevel=stacklevel + 1)
+
+
 def write_descriptor(descriptor: Dict[str, Any], directory: Optional[Path] = None, *, _stacklevel: int = 2,
-                     port_owner: Optional[Any] = None) -> Path:
+                     port_owner: Optional[Any] = None, _warned: bool = False) -> Path:
     """Installer-only. Refuses a port or id.instance another descriptor claims (a port is a claim), and a port another
     OS account listens on (FAA-225; ``port_owner(port) -> (kind, uid) | None`` reads it, the kit's own by default).
 
@@ -604,9 +615,8 @@ def write_descriptor(descriptor: Dict[str, Any], directory: Optional[Path] = Non
     refusal = source_refusal(descriptor, root)
     if refusal:
         raise ServiceError(refusal)
-    if not names_repository(descriptor):
-        warnings.warn("Descriptor %s %s; a new install is refused without it." % (me, NO_SOURCE_REPOSITORY),
-                      NoSourceRepositoryWarning, stacklevel=_stacklevel)
+    if not names_repository(descriptor) and not _warned:  # register_remote warns itself, before its token (FAA-200 (1))
+        warn_no_source(descriptor, _stacklevel)
     # DEC-0019: only a local placement claims a port on this computer; DEC-0069: an app's descriptor names none.
     port = None if placement_of(descriptor) == "remote" or "origin" not in descriptor else port_of(descriptor["origin"])
     for path, other in read_descriptors(root):

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_estate.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 """`estate-record/1` (Fabric Agent Contract DEC-0055): verify an estate revision and check its rules.
 
 One revision of one person's estate: the passkeys that sign it, the machines with their device keys and hub-key

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_estate_rules.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 """`estate-record/1` (Fabric Agent Contract DEC-0055): the record's own rules, without a verifier.
 
 The contract's `src/estate-record-rules.ts` at the pin, ported answer for answer and held to the contract's own vectors

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_events.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 """A service's events (DEC-0029): making them, paging them and the JSONL event log. Part of the service kit
 (FAA-65, layer L3)."""
 from __future__ import annotations
@@ -51,7 +52,9 @@ def make_event(event_id: Any, at: str, kind: str, level: str, text: str, *, subj
                link: Optional[str] = None, notify: bool = False, trace_id: Optional[str] = None,
                span_id: Optional[str] = None, data: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     """One activity event: one sentence a person reads, never a machine id. `level` is one of `LEVELS`; `warn`, the
-    dashboard chip's name, is stored as `warning`. `data` (DEC-0070) adds machine-readable
+    dashboard kit's chip for "a person is needed" (`.fd-s-warn`), is stored as `warning`, the feed's name for the same
+    level, so a reader that draws chips shows a stored `warning` as the `warn` chip (FAA-276, FAA-277 (6)). `data`
+    (DEC-0070) adds machine-readable
     fields beside the sentence, `{schema, value}`, never a secret: it is refused here, so no feed carries one.
 
     An event about traced work carries its trace as a pair, `trace_id` and `span_id`

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_holds.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 """Work a service holds by its own limits, said to its caller and its operator (FAA-298). Part of the service kit
 (layer L3, after fabric_interop).
 
@@ -21,7 +22,8 @@ says so three ways:
 
 `HoldBook` keeps one JSON file (0600, written atomically); a ThreadingHTTPServer's handlers share it under the store
 lock. It holds caller names, work labels, reasons and the operator's words, never a credential: `hold` refuses a text
-the contract's detector reads as one.
+the contract's detector reads as one. A record written since 0.83.0 carries `squash: "ecmascript"`; one without it
+(0.81.0, 0.82.0) is matched under both squashes, since 0.81.0's Python twin squashed names with str.split() (FAA-320).
 """
 from __future__ import annotations
 
@@ -65,6 +67,27 @@ def _squash(text: str) -> str:
     return _SPACES.sub(" ", text).strip(" ")
 
 
+#: What a record written since 0.83.0 carries: its names were squashed with ECMAScript's whitespace (FAA-320).
+SQUASH = "ecmascript"
+#: Python's str.isspace() class, the one 0.81.0's Python twin squashed a name with (`" ".join(text.split())`).
+_PY_SPACES = re.compile("[\t\n\x0b\x0c\r\x1c-\x1f \x85\xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]+")
+
+
+def _legacy_squash(text: str) -> str:
+    """A name as 0.81.0's Python twin wrote it (str.split()), written out so both twins read it alike."""
+    return _PY_SPACES.sub(" ", text).strip(" ")
+
+
+def _names(caller: Any, record: Dict[str, Any]) -> tuple:
+    """The stored forms `caller` matches in `record`: the ECMAScript squash, and for a record with no `squash` mark
+    (written before 0.83.0) also the squash 0.81.0's Python twin wrote (FAA-320). None matches only None."""
+    if not isinstance(caller, str):
+        return (caller,)
+    if record.get("squash") == SQUASH:
+        return (_squash(caller),)
+    return (_squash(caller), _legacy_squash(caller))
+
+
 def _instant(value: Any, name: str) -> str:
     if utc_time(value) is None:
         raise ServiceError("%s is a UTC instant (Z, at most 3 fraction digits)." % name)
@@ -197,6 +220,7 @@ class HoldBook:
              job_id: Optional[str] = None, now: Optional[str] = None) -> Dict[str, Any]:
         """Hold `work` for `caller` by `reason`. Returns {hold, statusMessage, push}: `push` is the notify event when this
         call opened the hold, None when the work joined an open one (one push per hold)."""
+        raw_caller = caller
         caller, work = _text(caller, "caller"), _text(work, "work")
         if reason not in HOLD_REASONS:
             raise ServiceError("A hold's reason is one of %s." % ", ".join(HOLD_REASONS))
@@ -207,11 +231,11 @@ class HoldBook:
             data = self._load()
             self._expire(data, utc_time(at))
             hold = next((h for h in data["holds"] if h.get("closed") is None and h["reason"] == reason
-                         and h["caller"] == caller), None)
+                         and h["caller"] in _names(raw_caller, h)), None)
             opened = hold is None
             if opened:
                 hold = {"id": uuid.uuid4().hex, "reason": reason, "caller": caller, "work": work, "since": at,
-                        "until": until, "jobs": [], "closed": None}
+                        "until": until, "jobs": [], "closed": None, "squash": SQUASH}
                 data["holds"].append(hold)
             if job_id is not None and job_id not in hold["jobs"]:
                 hold["jobs"].append(str(job_id))
@@ -229,7 +253,7 @@ class HoldBook:
         with self._lock:
             data = self._load()
             hold = next((h for h in data["holds"] if h.get("closed") is None and h["reason"] == reason
-                         and h["caller"] == caller), None)
+                         and h["caller"] in _names(caller, h)), None)
             if hold is None:
                 return None
             hold["closed"], hold["closedAt"] = "released", at
@@ -269,14 +293,15 @@ class HoldBook:
             raise ServiceError("A raised limit needs its window's end (until): it falls back when the window ends.")
         record: Dict[str, Any] = {"id": uuid.uuid4().hex, "reason": reason, "caller": None if caller is None else _text(caller, "caller"),
                                   "job": None if job_id is None else str(job_id), "from": at, "until": until,
-                                  given[0]: size, "decision": dict(decision), "at": at}
+                                  given[0]: size, "decision": dict(decision), "at": at, "squash": SQUASH}
         if given[0] != "limit":
             record["left"] = size
         with self._lock:
             data = self._load()
             self._expire(data, utc_time(at))
             for hold in data["holds"]:
-                if hold.get("closed") is None and hold["reason"] == reason and record["caller"] in (None, hold["caller"]) and (
+                if hold.get("closed") is None and hold["reason"] == reason and (
+                        caller is None or hold["caller"] in _names(caller, hold)) and (
                         job_id is None or str(job_id) in hold["jobs"]):
                     hold["closed"], hold["closedAt"], hold["lift"] = "lifted", at, record["id"]
             data["lifts"].append(record)
@@ -291,7 +316,7 @@ class HoldBook:
     def _matching(self, data: Dict[str, Any], reason: str, caller: Optional[str], job_id: Optional[str], at: int,
                   kind: str) -> List[Dict[str, Any]]:
         return [l for l in data["lifts"] if l["reason"] == reason and kind in l and self._live(l, at)
-                and l.get("caller") in (None, caller) and l.get("job") in (None, job_id)]
+                and (l.get("caller") is None or l["caller"] in _names(caller, l)) and l.get("job") in (None, job_id)]
 
     def admit(self, *, reason: str, caller: str, job_id: Optional[str] = None, cost_usd: Optional[float] = None,
               now: Optional[str] = None) -> Dict[str, Any]:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_http.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 """An outbound HTTP client for a service: one deadline across every attempt, bounded retries with jittered backoff,
 `Retry-After` honoured up to a cap, a response size cap, and no secret in an error.
 
@@ -50,6 +51,8 @@ from pathlib import Path as _Path  # noqa: E402
 if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from any working directory (FAA-65)
     _sys.path.insert(0, str(_Path(__file__).resolve().parent))
 from fabric_jsvalue import json_stringify  # noqa: E402 - beside this file
+import fabric_secrets  # noqa: E402 - beside this file: the WHATWG host reading (FAA-98, FAA-309)
+import fabric_socket_proof  # noqa: E402 - beside this file: the one loopback host rule (FAA-187 (15))
 import fabric_peer_owner as _po  # noqa: E402 - beside this file: the listener's owner (DEC-0154 HA-2)
 
 RETRY_STATUSES = (408, 425, 429, 500, 502, 503, 504)
@@ -211,28 +214,28 @@ def redact_url(url: str) -> str:
     return urllib.parse.urlunsplit((parts.scheme.lower(), netloc, path, "", ""))
 
 
-def _is_loopback(host: str) -> bool:
-    """Loopback as a WHATWG URL parser leaves the host: one trailing dot dropped from an IPv4 address, no whitespace,
-    and an IPv4-mapped IPv6 address not counted (Node writes it in hex and the Node twin refuses it)."""
-    if host == "localhost" or host.endswith(".localhost"):
+#: Loopback as a WHATWG URL parser leaves the host: the kit's one rule, shared with fabric_delegation (FAA-187 (15)).
+_is_loopback = fabric_socket_proof.loopback_host
+
+
+def _idna_sendable(host: Optional[str]) -> bool:
+    """Whether http.client can write the host: a non-ASCII one goes out in IDNA through Python's own codec, which refuses
+    some hosts `new URL` maps (U+180E, a fullwidth dot beside a dot), so such a URL would fail on every call (FAA-187
+    (16)); it is refused at the check instead."""
+    if not host or host.isascii():
         return True
-    if not host or any(c.isspace() for c in host):
-        return False
     try:
-        address = ipaddress.ip_address(host)
-        return address.is_loopback and not getattr(address, "ipv4_mapped", None)
-    except ValueError:
-        pass
-    host = host[:-1] if host.endswith(".") else host
-    try:  # the short IPv4 forms a WHATWG URL also reads (127.1, 2130706433, 0x7f.1)
-        return socket.inet_aton(host)[0] == 127
-    except (OSError, ValueError):
+        host.encode("idna")
+        return True
+    except UnicodeError:
         return False
 
 
 def check_url(url: str, *, insecure: bool = False) -> None:
     """Refuse what this client never sends: a scheme other than http or https, no host, credentials in the URL, or
-    plain http to a host that is not loopback (unless `insecure`)."""
+    plain http to a host that is not loopback (unless `insecure`). A host `new URL` refuses for its structure (a last
+    label that is a number but no IPv4 address, `a127.0.0.1`, `09`; a host UTS46 refuses, a joiner beside ASCII alone) is
+    refused as the Node twin refuses it, read by fabric_secrets.url_refused (FAA-187 (14))."""
     try:
         # The ends are trimmed as urllib trims what it sends (and `new URL` too); a URL ending in a line break, which
         # 0.55.0 sent, still passes (0.56.0 product r17).
@@ -242,7 +245,7 @@ def check_url(url: str, *, insecure: bool = False) -> None:
         parts = urllib.parse.urlsplit(sent)
         host = parts.hostname
         parts.port  # noqa: B018 - raises on a bad port
-        if not _authority_ok(parts.netloc):
+        if not _authority_ok(parts.netloc) or fabric_secrets.url_refused(sent) or not _idna_sendable(host):
             raise ValueError("authority")
     except (ValueError, TypeError):
         raise HttpError("the URL does not parse", url=redact_url(url), kind="refused")

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 """The Fabric hub's door, as a service agent reaches it (fabric-hub/0.1; Fabric ADR-0115 §1, ADR-0149 §4; FAA-12b).
 
 A service that answers a Project's requests on the board (`fabric-project-comms/0.1`) needs three things from Fabric's
@@ -96,20 +97,24 @@ def fabric_root(platform: str = sys.platform, env: Optional[Dict[str, str]] = No
 
 
 def _windows_pid_alive(pid: int, kernel: Any = None, last_error: Any = None) -> Optional[bool]:
-    """pid_alive on Windows, where os.kill(pid, 0) would send CTRL_C_EVENT: OpenProcess with query access only. Refused
-    with ERROR_ACCESS_DENIED (5), another account's or an elevated process: None, as Node's process.kill(pid, 0)
-    answers EPERM there (FAA-304); refused otherwise, no process. `kernel` and `last_error` stand in for kernel32 and
+    """pid_alive on Windows, where os.kill(pid, 0) would send CTRL_C_EVENT: the check Node's process.kill(pid, 0) makes
+    (libuv's uv_kill), asking OpenProcess for the same access (terminate, query, synchronize; never the limited query an
+    elevated process of the same user grants, FAA-323). Refused with ERROR_ACCESS_DENIED (5), another account's or an
+    elevated process: None, as Node answers EPERM there (FAA-304); refused otherwise, no process; opened, running
+    while its exit code is STILL_ACTIVE and a zero wait times out. `kernel` and `last_error` stand in for kernel32 and
     ctypes.get_last_error in a test."""
     import ctypes
     if kernel is None:
         kernel = ctypes.WinDLL("kernel32", use_last_error=True)  # type: ignore[attr-defined]
         last_error = ctypes.get_last_error  # type: ignore[attr-defined]
-    handle = kernel.OpenProcess(0x1000, False, pid)  # PROCESS_QUERY_LIMITED_INFORMATION
+    handle = kernel.OpenProcess(0x0001 | 0x0400 | 0x00100000, False, pid)  # TERMINATE | QUERY_INFORMATION | SYNCHRONIZE
     if not handle:
         return None if last_error() == 5 else False  # ERROR_ACCESS_DENIED: not verified, never called running
     try:
         code = ctypes.c_ulong()
-        return bool(kernel.GetExitCodeProcess(handle, ctypes.byref(code))) and code.value == 259  # STILL_ACTIVE
+        if not kernel.GetExitCodeProcess(handle, ctypes.byref(code)) or code.value != 259:  # STILL_ACTIVE
+            return False
+        return kernel.WaitForSingleObject(handle, 0) != 0  # WAIT_OBJECT_0: ended, with exit code 259
     finally:
         kernel.CloseHandle(handle)
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_identifiers.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 """Identifier equality (contract DEC-0076): two identifiers are the same when their normal forms are equal.
 
 A port of the contract's `src/identifiers.ts`, held to its `fixtures/vectors/identifiers.json`. The normal form of a URI