@passioncode-ai/fabric-agent-adapter 0.9.0 → 0.11.1

package/CHANGELOG.md

@@ -1,5 +1,106 @@
 # Changelog
 
+## 0.11.1 - 2026-10-12
+
+0.11.0 plus one fix. The `v0.11.0` tag was refused by the release's own validation and never published: on Node 22,
+the CI version, the Node kit accepted a forged delegation token signed "under" a small-order key. Node 26's
+`crypto.verify` refuses such keys, but Node 20 and 22 accept them with the same OpenSSL.
+
+### Security
+
+- **The Node kit refuses small-order Ed25519 keys itself** (`isSmallOrderKey`: libsodium's list, including the
+  non-canonical encodings, compared with the sign bit cleared), so `verifyDelegation` and `verifyApproval` no longer
+  depend on the Node version. Checked on Node 20, 22 and 26. The contract's own verifier uses `crypto.verify` the
+  same way and has the same exposure on Node before 26; the contract repository was told.
+
+## 0.11.0 - 2026-10-12 (tagged, never published; see 0.11.1)
+
+Contract DEC-0039, second part (FAA-20): a service built with the kit checks a delegation token and an operator's
+approval offline, in Python and in Node, with the same answers as the contract's own verifier at the pin
+(`8e49fbd`, unchanged).
+
+### Added
+
+- **`scripts/fabric_delegation.py` and `scripts/fabric-delegation.mjs`**: `verify_delegation` / `verifyDelegation`
+  (the eleven DL-13 checks in their order), `verify_approval` / `verifyApproval` (DL-18, the jti consumed last),
+  `read_delegation_token` / `readDelegationToken` (`Fabric-Delegation` first, then a delegation-typ Bearer),
+  `jcs` and `action_digest` / `actionDigest` (RFC 8785), the jti stores (`MemoryJtiStore` / `createMemoryJtiStore`,
+  `FileJtiStore`, `UNSAFE_NO_JTI_STORE`), `JwksCache` (DL-15: at most 10 minutes, an unknown `kid` re-read at most
+  once a minute, 10 s between failed reads, no redirects), `delegation_gate` / `delegationGate`, and the DL-19
+  refusal shapes `refusal_tool_result` / `refusalToolResult` and `refusal_http` / `refusalHttp`.
+- **The Python kit verifies Ed25519 itself** (standard library only): RFC 8032, cofactorless, and as strict as
+  OpenSSL. `S` must be below the group order, points must be canonical, and small-order keys are refused.
+- **`McpToolServer(authorize=)`**: the gate runs before every tool; `ctx.delegation` carries the principal, caller
+  and chain. A job records who started it, and `fabric.job.get` / `fabric.job.cancel` answer only that principal
+  and caller, with a token that still covers the job's capability.
+- **Shared vectors** `test/fixtures/delegation/vectors.json` (66 delegation, 15 approval, 8 header, 5 JCS, 2 digest
+  and 330 Ed25519 cases), produced by `make_vectors.mjs`. Every expected answer comes from the contract's verifier
+  or from OpenSSL. Both kits' tests run over them.
+- `references/delegation.md`; `surfaces-and-auth.md` and `protocol.md` no longer say the kits do not verify. Scenario
+  evals `mcp-auth-delegation` (updated) and `approval-before-an-external-effect` came first.
+
+### Security
+
+- An independent review of the port found, before release:
+  - The Python Ed25519 verifier accepted forged signatures under a small-order key.
+  - A nested token with a duplicate member crashed the gate on Python 3.9–3.11.
+  - An unreadable jti file allowed approvals to be replayed.
+  - The key-set fetch followed redirects.
+  - The job tools were ungated.
+
+  All are fixed, and each has a test that failed first. The small-order forgery is now in the shared vectors.
+
+## 0.10.0 - 2026-10-11
+
+Contract DEC-0039, first part (FAA-20, issue #52): the operator's dashboard session now lives no longer than
+the contract allows, and the server enforces it; the probe treats `surfaces.mcp.auth: "delegation"` like `own`.
+The contract pin moves to Fabric Agent Contract `main` `8e49fbd` (the DEC-0039 merge, contract PR #30). Bundles
+issued under the DEC-0036, DEC-0035, DEC-0033, DEC-0031, DEC-0024, DEC-0021, DEC-0020 and DEC-0019 revisions
+stay valid.
+
+### Security
+
+- **Operator sessions end on the server (DEC-0039).** Until now `LoginCodes.session_valid` checked only an HMAC
+  and the cookie lived 30 days, so a copied cookie stayed valid until the session key was rotated. Now a
+  session ends 12 h after its last use, 7 days after the login code was redeemed however often it is used, on
+  `logout`, and when the descriptor token rotates. The cookie carries a signed claim (session id, sign-in time,
+  token revision); the code store keeps a record per session (last use, logout), so a cookie with no record is
+  refused. Both kits, the same behaviour.
+
+### Changed
+
+- **Every operator signs in once more after the upgrade**: a cookie of the old format is refused. The host does
+  it on the page's `401`.
+- **A remote service with `MemoryCodeStore` loses its sessions on a deploy** (it already lost its login codes):
+  the store now holds the session records. Pass a durable store to keep them.
+- **`session_cookie_header` / `remote_session_cookie_header`** (and the Node `sessionCookieHeader` /
+  `remoteSessionCookieHeader`) default to `Max-Age` 604800 (7 days), not 30 days.
+- **Default contract pin `a83bec6` → `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`.** `a83bec6` (DEC-0036) joins
+  `SUPPORTED_CONTRACT_COMMITS`. The revisions between (DEC-0037 spend policy, DEC-0038 grant windows,
+  DEC-0039 delegation, DEC-0040 Fabric's button) add schemas and optional properties only: the provider
+  manifest gains optional cost presets, the governance grant's `effects` may be omitted by a delegation grant,
+  and the well-known document gains `auth.delegation` and the `delegation` value of `surfaces.mcp.auth`.
+  Every descriptor, well-known document and bundle the kits wrote before stays valid.
+
+### Added
+
+- **`LoginCodes(..., token=, idle_seconds=, max_seconds=, clock=)`** (`{ token, idleSeconds, maxSeconds, clock }`
+  in Node): `token` is the descriptor token or a callable returning the current one; the bounds may be
+  shortened, and longer values are clamped. **`logout(cookie)`** and **`expired_session_cookie_header(remote=)`**
+  (`logout`, `expiredSessionCookieHeader`); `OPERATOR_SESSION_IDLE_SECONDS`, `OPERATOR_SESSION_MAX_SECONDS`.
+- **`check_service.py`**: `surfaces.mcp.auth: "delegation"` is checked like `own` — the MCP surface must refuse
+  the descriptor token, and the caller rules are `NOT_RUN` (DL-16); rule **`auth.delegation-declared`** (with
+  `delegation`, the well-known document names `auth.delegation {issuer, jwks}`); rule
+  **`login.session-lifetime`** (the cookie set at sign-in does not outlive 7 days).
+- **The sample services** pass `token=` and serve `POST /logout` (a browser write: it needs `X-Fabric-Request`).
+- `references/surfaces-and-auth.md`, `remote-placement.md` and `protocol.md` describe the lifetime, logout and
+  DL-16. Scenario evals `operator-session-lifetime` and `mcp-auth-delegation` came first.
+
+### Not yet
+
+- Verifying delegation tokens and approvals in the kits (`verifyDelegation` / `verifyApproval`) and Fabric's
+  button in the dashboard kit (FB-7) follow in a later release (FAA-20 stays open).
+
 ## 0.9.0 - 2026-10-11
 
 The dashboard kit (`fabric-dashboard/0.1`, contract DEC-0036): a Fabric service's dashboard holds inside a

package/README.md

@@ -202,7 +202,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `a83bec6b47776af688402c18efec507143061f68`
+- commit: `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`
 
 Every other mention of the default contract revision — this section, the skills' metadata, the
 skill card, `adapt_project.py` — must equal it; `python3 test/validate.py` fails a tree
@@ -229,8 +229,8 @@ FABRIC_CONTRACT_OLD=/path/to/legacy-contract FABRIC_CONTRACT_NEW=/path/to/curren
 ```
 
 Without both environment variables, those tests explicitly skip as `NOT_RUN`.
-This source checkout is 0.9.0. 0.8.3 is the latest published GitHub/npm release (2026-10-10; 0.7.0 was never
-released); 0.9.0 is published by its `v0.9.0` tag. Source delivery does not update installed skills or live sessions.
+This source checkout is 0.11.1. 0.10.0 is the latest published GitHub/npm release (2026-10-11; 0.7.0 and 0.11.0
+were never released); 0.11.1 is published by its `v0.11.1` tag. Source delivery does not update installed skills or live sessions.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.9.0",
+  "version": "0.11.1",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.9.0",
+  "version": "0.11.1",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.9.0"
+  version: "0.11.1"
   contract-version: "0.1.0"
-  contract-commit: "a83bec6b47776af688402c18efec507143061f68"
+  contract-commit: "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `a83bec6b47776af688402c18efec507143061f68`.
+- commit `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -16,10 +16,10 @@ from urllib.parse import urlparse
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "a83bec6b47776af688402c18efec507143061f68"
+CONTRACT_COMMIT = "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.9.0"
+  version: "0.11.1"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "a83bec6b47776af688402c18efec507143061f68"
+  extension-commit: "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
 ---
 
 # Building Fabric services
@@ -80,7 +80,10 @@ each manifest capability is the tool of its name, long work is a job with a stab
 a question for a person is an elicitation, and every call carries one trace. Read
 [the interop reference](references/interop.md) before writing an MCP tool; the helpers
 are in [`scripts/fabric_interop.py`](scripts/fabric_interop.py) and
-[`scripts/fabric-interop.mjs`](scripts/fabric-interop.mjs).
+[`scripts/fabric-interop.mjs`](scripts/fabric-interop.mjs). When the callers are agents of the estate, the
+service checks each call's delegation token (DEC-0039): read [the delegation reference](references/delegation.md);
+the verifier is [`scripts/fabric_delegation.py`](scripts/fabric_delegation.py) /
+[`scripts/fabric-delegation.mjs`](scripts/fabric-delegation.mjs).
 
 ## Step 2 — the non-negotiables
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -0,0 +1,84 @@
+# Delegation — checking who acts for whom (DEC-0039)
+
+A service that other agents of the estate call checks each call offline with the kit's verifier: the estate hub
+signs a delegation token naming the person (`sub`), the actor chain (`act`), this service (`aud`), the
+capabilities (`scope`) and the effect ceiling (`effect`); the service checks the signature against the estate's
+published keys and answers `ok` or one refusal code. Contract: `docs/specification/delegation.md` (DL-1…DL-19)
+at the pin. Python: [`scripts/fabric_delegation.py`](../scripts/fabric_delegation.py); Node:
+[`scripts/fabric-delegation.mjs`](../scripts/fabric-delegation.mjs). Both answer the shared vectors exactly as the
+contract's own verifier does.
+
+## Contents
+
+- Declaring it
+- Wiring the gate
+- Approvals
+- What a refusal looks like
+- Keys and the cache
+- What the kit does not do
+
+## Declaring it
+
+In the well-known document: `surfaces.mcp.auth: "delegation"` (only delegation tokens) and
+`auth.delegation: {issuer, jwks}` — the `iss` you trust (`urn:fabric:estate:<id>`) and where the key set is read.
+The descriptor's token stays the host's: it is never a caller's credential on `/mcp` (DL-12). The probe checks
+the declaration (`auth.delegation-declared`) and that `/mcp` refuses the descriptor token.
+
+## Wiring the gate
+
+```python
+import fabric_delegation as fd, fabric_interop as fi
+keys = fd.JwksCache(well_known["auth"]["delegation"]["jwks"])          # https, loopback http, or a file
+gate = fd.delegation_gate(audience="example-agent", jwks=keys, issuer=well_known["auth"]["delegation"]["issuer"],
+                          effects={"example.write": "draft", "example.publish": "publish"})   # each tool's manifest effect
+server = fi.McpToolServer("example-agent", VERSION, authorize=gate)    # pass the request headers to handle()
+# in a handler: ctx.delegation["principal"], ["caller"], ["chain"] — record the chain with the work
+```
+
+```js
+import { JwksCache, delegationGate, refusalToolResult } from './fabric-delegation.mjs';
+const gate = delegationGate({ audience: 'example-agent', jwks: new JwksCache(wk.auth.delegation.jwks), issuer: wk.auth.delegation.issuer,
+  effects: { 'example.write': 'draft' } });
+const verdict = await gate(params.name, req.headers);
+if (!verdict.ok) return refusalToolResult(verdict);
+```
+
+The token is read from `Fabric-Delegation` first (a forwarded call; present but empty is refused, never skipped),
+then from `Authorization: Bearer` when the bearer is a delegation JWT (DL-9, DL-10). A tool with no declared
+effect is refused (`unknown-state`), never guessed. The checks run in the DL-13 order; nothing about a token is
+believed before its signature. The built-in job tools (`fabric.job.get`, `fabric.job.cancel`) are gated too: by the
+job's own capability and effect, and only for the principal and caller that started the job (another caller is
+`scope-not-granted`); `on_input` gets the checked delegation on its context. Start jobs with `ctx.start_job()` so the
+job records who started it.
+
+## Approvals
+
+An action with an external effect may need the operator's approval (DL-17, DL-18). The order is fixed: the token,
+then the grant check where there is one, then `verify_approval` / `verifyApproval`, which consumes the approval's
+`jti` last, then the action. Without an approval, answer `approval-required` with
+`action_digest(action)` / `actionDigest(action)` — the SHA-256 of the action's RFC 8785 form (`jcs`) — so the caller
+can ask the hub. Keep consumed ids in `FileJtiStore` (0600, survives a restart); `MemoryJtiStore` is for tests
+and `UNSAFE_NO_JTI_STORE` exists only by name. No store at all, or a store file that cannot be read, is
+`unknown-state` — never a pass.
+
+## What a refusal looks like
+
+DL-19: an MCP tool answers `refusal_tool_result(r)` / `refusalToolResult(r)` — `isError: true` and
+`structuredContent: {error: {code, message, data: {detail}}}`; an HTTP route answers `refusal_http(r)` /
+`refusalHttp(r)` with the code's status (401 for `unauthenticated`, `token-expired`, `principal-unproven`, with
+`WWW-Authenticate: Bearer error="invalid_token"`; 503 for `issuer-unavailable` and `unknown-state`; 403 for the
+rest). `detail` is a short machine word; the token, the approval and the keys never appear in a result or a log.
+
+## Keys and the cache
+
+`JwksCache` holds the estate's key set at most 10 minutes and, on a `kid` it does not hold, re-reads at most once
+a minute (DL-15), and waits 10 s after a failed read before trying again; after 10 minutes without a successful read it answers nothing, and the verifier says
+`issuer-unavailable`. It reads https, http on loopback only, or a file; a URL with credentials is refused. The
+Python kit verifies Ed25519 itself (RFC 8032, standard library only, strict as OpenSSL: `S` below the group order,
+canonical points, no small-order key); it follows no redirect when it reads the key set; the Node kit uses `node:crypto` and refuses small-order keys
+itself (`isSmallOrderKey`), because Node before 26 lets OpenSSL accept a signature under one.
+
+## What the kit does not do
+
+It does not mint tokens, check attenuation against a parent (the issuer's rule, DL-5), check a grant or a spend
+window (the meter's, DL-21), or decide which actions need an approval — the service decides that.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,11 +1,20 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `a83bec6b47776af688402c18efec507143061f68`
+Pinned to `fabric-agent-contract` commit `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
-DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036). The contract's schemas are normative;
+DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
+delegation and the operator session's lifetime DEC-0039). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
+## Contents
+
+- Descriptor — written by the installer
+- Well-known document
+- Events page
+- Login code and the operator session
+- Semantic rules a host applies
+
 ## Descriptor — written by the installer
 
 Directory: macOS `~/Library/Application Support/ai.passioncode.fabric/services/`,
@@ -59,6 +68,11 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   ED-9): `minWidth` 360…1280 (required), `appearance` ⊆ `scheme`, `theme`, `themes`, `kit`
   (`name@semver`), nothing else. The kits build it with `dashboard_extension()` /
   `dashboardExtension()`; see [the dashboard kit reference](dashboard-kit.md).
+- `surfaces.mcp.auth`: `descriptor` (default), `own` (DEC-0024) or `delegation` (DEC-0039, DL-16):
+  the MCP surface takes only the estate's delegation tokens, and the top-level
+  `auth.delegation {issuer, jwks}` is then required. With `own` or `delegation` the descriptor's
+  token is not an MCP credential: a host and the probe never call `/mcp` with it as a caller.
+  The kits verify them with `fabric_delegation` / `fabric-delegation.mjs` ([delegation](delegation.md)).
 
 ## Events page — `GET /fabric/v1/events?after=<cursor>&limit=<n>`
 
@@ -78,11 +92,14 @@ empty, or `null` for an empty log. Retain at least seven days or 1000 events.
 path on the service origin, never an absolute URL. Optional SSE stream at
 `surfaces.events.stream` carrying the same objects.
 
-## Login code — `POST /fabric/v1/login-code`
+## Login code and the operator session — `POST /fabric/v1/login-code`
 
 Token required → `{ "url": "/fabric/v1/login?code=<16–256 url-safe chars>", "expiresAt": "…" }`,
 single use, at most 120 s, recorded as used before it is honoured. `GET` that URL →
 `Set-Cookie` `HttpOnly; SameSite=Strict`, `302` to `surfaces.dashboard.path`.
+The session it starts ends 12 h after its last use, 7 days after sign-in, on logout and when the
+descriptor token rotates (DEC-0039); a service may shorten either bound, never lengthen one. An
+ended session answers `401` on the dashboard page.
 
 ## Semantic rules a host applies
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/remote-placement.md

@@ -36,9 +36,11 @@ same objects — well-known document, events feed, login code — at the same pa
 - **Token**: a random value of at least 16 characters (32 bytes recommended), set as a secret;
   the same value is written on the operator's computer by `registerRemote`. Compare in constant
   time (`tokenMatches`).
-- **Session key**: 32 random bytes, a separate secret. With it, sessions survive a deploy; without
-  it, every deploy signs the operator out.
-- **Codes**: `MemoryCodeStore` — a restart forgets every outstanding code, so none can be replayed.
+- **Session key**: 32 random bytes, a separate secret; rotating it signs every operator out.
+- **Codes and sessions**: `MemoryCodeStore` — a restart forgets every outstanding code, so none
+  can be replayed, and every session record, so a deploy signs the operator out (DEC-0039: the
+  server keeps each session's last use and logout). The host signs in again on the page's `401`.
+  To keep sessions across a deploy, pass a durable store (any object with `load()` and `save()`).
   Several processes behind one origin need a shared store (a database row with the same
   "used before honoured" write); memory works for one process.
 - **Behind a router**: check the platform-set forwarded scheme; `Host` is preserved by common
@@ -68,4 +70,5 @@ reach the service, and still need its own `403`.
 
 Rotate the token by setting the new value on the platform and re-running `registerRemote` on the
 operator's computer with it; the old token stops working the moment the platform restarts with the
-new value. Rotate the session key on the platform to sign every operator out.
+new value, and so does every session begun under it when `LoginCodes` has `token=`. Rotate the
+session key on the platform to sign every operator out.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/surfaces-and-auth.md

@@ -12,6 +12,11 @@
   for agents, `host.token` named by the descriptor), declare `surfaces.mcp.auth: "own"`, and
   make `/mcp` refuse the host's token. `check_service.py` then checks only that refusal
   (`interop.mcp-own-auth`) and leaves the caller rules NOT_RUN.
+- **Delegation (DEC-0039, DL-16).** `surfaces.mcp.auth: "delegation"` means `/mcp` takes only
+  the estate's delegation tokens; declare `auth.delegation {issuer, jwks}` in the well-known
+  document. The probe treats it like `own` and checks the declaration
+  (`auth.delegation-declared`). The kits verify the tokens: put `delegation_gate` /
+  `delegationGate` in front of the tools — see [the delegation reference](delegation.md).
 - Register it into a client config with the service's own command
   (`<tool> mcp-register`), which writes `{"type":"http","url":"http://127.0.0.1:<port>/mcp","headers":{...}}`
   atomically, aborts if the file changed meanwhile, and keeps one 0600 backup. The token
@@ -50,8 +55,20 @@ else will notice it expire.
 - `POST /fabric/v1/login-code` (token) → single-use code, at most 120 s, persisted as
   used before it is honoured, burned even when expired.
 - `GET /fabric/v1/login?code=` → `HttpOnly; SameSite=Strict` cookie, 302 to the
-  dashboard. Sessions are HMAC-signed; `revoke_all` rotates the key and ends every
-  session at once.
+  dashboard. `revoke_all` rotates the session key and ends every session at once.
+- **The session's lifetime (DEC-0039).** A session ends 12 h after its last use, 7 days after
+  the code was redeemed however often it is used, on logout, and when the descriptor token
+  rotates. The server enforces all four, not the cookie: `LoginCodes` signs a claim (session
+  id, sign-in time, token revision) into the cookie and keeps a record per session (last use,
+  logout) in its code store; `session_valid` refuses a session past either bound and refreshes
+  the 12 hours on use (at most one write a minute). Pass `token=` (the descriptor token, or a
+  callable returning the current one), or a rotation goes unseen. `idle_seconds` and
+  `max_seconds` may shorten the bounds; longer values are clamped. The cookie headers default to
+  `Max-Age` 7 days, and the probe's `login.session-lifetime` fails a longer one.
+- **Logout** is the service's own route and a browser write (the custom header below):
+  `codes.logout(cookie)` ends the session for every copy of the cookie, and
+  `expired_session_cookie_header()` (`expiredSessionCookieHeader()`) clears the browser's copy.
+- An ended session answers `401` on the dashboard page itself, so the host can sign in again.
 - Browser writes need the cookie **and** a custom header such as `X-<Tool>-Request: 1`,
   which forces a preflight the service never answers.
 - A dashboard that is deliberately read-open to local pages declares

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -24,6 +24,7 @@ exist. They never call a capability.
 from __future__ import annotations
 
 import argparse
+import email.utils
 import errno
 import http.client
 import json
@@ -416,6 +417,12 @@ class Probe:
                      "the session cookie is __Host-, Secure, Path=/, no Domain" if host_bound else "cookie: %s" % cookie.split(";", 1)[0].split("=")[0])
         self.add("login.single-use", "PASS" if ok else "FAIL",
                  "first redeem HTTP %d (%s), second HTTP %d" % (status1, "cookie ok" if "HttpOnly" in cookie else "no HttpOnly cookie", status2))
+        if cookie:
+            problem = session_lifetime_problem(cookie)
+            self.add("login.session-lifetime", "FAIL" if problem else "PASS",
+                     problem or "the session cookie lives at most 7 days (DEC-0039); the server's own bounds are not observable from here")
+        else:
+            self.add("login.session-lifetime", "NOT_RUN", "no session cookie was set")
 
     # interop (fabric-interop/0.1) ----------------------------------------------------
     # #region probe-interop — docs: plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md#what-the-probe-checks
@@ -479,21 +486,25 @@ class Probe:
             extra = sorted(set(listed) - names)
             self.add("interop.well-known-capabilities", "FAIL" if extra else "PASS",
                      ("listed but not in the manifest: " + ", ".join(extra)) if extra else "%d listed, all in the manifest" % len(listed))
-        own = bool(mcp_surface) and mcp_surface.get("auth") == "own"
+        auth = (mcp_surface or {}).get("auth")
+        # DEC-0024 own, and DEC-0039 DL-16 delegation: the descriptor's token is not an MCP credential.
+        own = bool(mcp_surface) and auth in ("own", "delegation")
+        why = "DL-16, DEC-0039" if auth == "delegation" else "DEC-0024"
+        self.delegation_declared_rule(mcp_surface)
         if own and self.token:
-            # DEC-0024: the MCP surface has credentials of its own and must refuse the host's token.
+            # The MCP surface has credentials of its own and must refuse the host's token.
             try:
                 self.mcp_call("tools/list", {})
-                self.add("interop.mcp-own-auth", "FAIL", "surfaces.mcp.auth is own, yet the MCP surface accepted the descriptor's token")
+                self.add("interop.mcp-own-auth", "FAIL", "surfaces.mcp.auth is %s, yet the MCP surface accepted the descriptor's token (%s)" % (auth, why))
             except OSError as exc:
                 refused = any(code in str(exc) for code in ("HTTP 401", "HTTP 403"))
                 self.add("interop.mcp-own-auth", "PASS" if refused else "NOT_RUN",
-                         ("the MCP surface refuses the host's token (%s), as auth: own says" % exc) if refused else str(exc))
+                         ("the MCP surface refuses the host's token (%s), as auth: %s says (%s)" % (exc, auth, why)) if refused else str(exc))
             except ValueError as exc:
                 self.add("interop.mcp-own-auth", "NOT_RUN", str(exc))
         if not mcp_surface or not self.token or own:
             reason = ("no MCP surface" if not mcp_surface
-                      else "surfaces.mcp.auth is own: the MCP surface takes its callers' credentials, not the host's token (DEC-0024)" if own
+                      else "surfaces.mcp.auth is %s: the MCP surface takes its callers' credentials, not the host's token (%s)" % (auth, why) if own
                       else "no readable token")
             for rule in ("interop.output-schema-object", "interop.tools-match", "interop.job-tools", "interop.unknown-job", "interop.trace-propagation"):
                 self.add(rule, "NOT_RUN", reason)
@@ -513,6 +524,23 @@ class Probe:
                 self.trace_rule(listing, sent)
         self.events_trace_rule(self.events)
 
+    def delegation_declared_rule(self, mcp_surface: Optional[Dict[str, Any]]) -> None:
+        """DL-16 (DEC-0039): a service that accepts delegation tokens names the issuer it trusts and its JWKS
+        in auth.delegation; with surfaces.mcp.auth delegation that declaration is required."""
+        auth = (self.wk or {}).get("auth")
+        declared = auth.get("delegation") if isinstance(auth, dict) else None
+        required = bool(mcp_surface) and mcp_surface.get("auth") == "delegation"
+        if declared is None and not required:
+            self.add("auth.delegation-declared", "NOT_RUN", "the service declares no delegation")
+            return
+        if not isinstance(declared, dict):
+            self.add("auth.delegation-declared", "FAIL", "surfaces.mcp.auth is delegation, yet auth.delegation is missing (DL-16)")
+            return
+        missing = [k for k in ("issuer", "jwks") if not isinstance(declared.get(k), str) or not declared.get(k)]
+        self.add("auth.delegation-declared", "FAIL" if missing else "PASS",
+                 ("auth.delegation lacks %s (DL-16)" % ", ".join(missing)) if missing
+                 else "auth.delegation names its issuer and JWKS (DL-16)")
+
     def object_root_rule(self, tools: Dict[str, Any]) -> None:
         """FAC-SEM-023 (DEC-0018): every listed tool's outputSchema, when present, has root type object —
         a client may refuse the whole tools/list otherwise, whatever the SDK in the tests accepted."""
@@ -728,6 +756,30 @@ class Probe:
         return self.results
 
 
+def session_lifetime_problem(set_cookie: str, now: Optional[float] = None) -> Optional[str]:
+    """DEC-0039: a session cookie set at sign-in lives at most 7 days. Max-Age wins over Expires (RFC 6265
+    §5.3); a cookie with neither ends with the browser session. None when it is within the bound."""
+    attrs = {}
+    for part in set_cookie.split(";")[1:]:
+        name, _, value = part.strip().partition("=")
+        attrs[name.strip().lower()] = value.strip()
+    bound = fs.OPERATOR_SESSION_MAX_SECONDS
+    if "max-age" in attrs:
+        if not re.fullmatch(r"-?\d+", attrs["max-age"]):
+            return "the session cookie's Max-Age %r is not a number" % attrs["max-age"]
+        if int(attrs["max-age"]) > bound:
+            return "the session cookie's Max-Age %s outlives 7 days (%d s, DEC-0039)" % (attrs["max-age"], bound)
+        return None
+    if "expires" in attrs:
+        try:
+            at = email.utils.parsedate_to_datetime(attrs["expires"]).timestamp()
+        except (TypeError, ValueError, IndexError, OverflowError):
+            return "the session cookie's Expires %r is not a date" % attrs["expires"]
+        if at - (time.time() if now is None else now) > bound:
+            return "the session cookie's Expires %s outlives 7 days (DEC-0039)" % attrs["expires"]
+    return None
+
+
 def _semver(text: str) -> Tuple[int, int, int]:
     m = re.match(r"^(\d+)\.(\d+)\.(\d+)", text or "")
     return (int(m.group(1)), int(m.group(2)), int(m.group(3))) if m else (0, 0, 0)