@passioncode-ai/passioncode 0.1.19 → 0.1.21

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.21 - 2026-10-03
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.6.1`:** `check_service.py` no longer fails an online
+  service hosted behind a platform router. Heroku, Fly, Render and CDNs answer a foreign `Host`
+  themselves (`404`/`421`), and that now counts as the refusal it is, unless the body is the
+  well-known document.
+
+## 0.1.20 - 2026-10-02
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.6.0`:** `building-fabric-services` also makes an online
+  agent or dashboard (an `https` origin on a platform) a Fabric service — the remote placement of
+  `fabric-service/0.1`, Fabric Agent Contract DEC-0019 — with Node and Python kits, a TLS sample
+  online service and a probe that checks remote services over verified TLS.
+
 ## 0.1.19 - 2026-10-02
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.5.7",
+      "ref": "v0.6.1",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.5.7",
+      "version": "0.6.1",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.5.7",
-      "commit": "de21d9548bc836fe09ca6049afb647b11450dda8",
-      "version": "0.5.7",
+      "ref": "v0.6.1",
+      "commit": "d3a4c67262e242b0a4422ecdcf99a7d892db6caa",
+      "version": "0.6.1",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -22,7 +22,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:bebf6fe75b96b059558f0ad4f771db6784b07f429f88db2b5e285f3420284d5a",
+      "contentHash": "sha256:654511f4332892aa9a709e1946566d017179edc294e136fbe5c6466c5c32b5c8",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.19",
+      "ref": "v0.1.21",
       "commit": null,
-      "version": "0.1.19",
+      "version": "0.1.21",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:1ae5a6355e3e3692bc95172ba297cbb7ed1d048dae8410c6766f376e6336f320",
+      "contentHash": "sha256:63c4bc3c353c3e7b3762c4ab20a50e4684504c142a378c988c73d86049892a50",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.5.7",
+  "version": "0.6.1",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.5.7"
+  version: "0.6.1"
   contract-version: "0.1.0"
-  contract-commit: "74d3852f122f5ca5cbc4138a201483531dfa5006"
+  contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `74d3852f122f5ca5cbc4138a201483531dfa5006`.
+- commit `2ce392291c6668598d12cd38327e24696b5ca15c`.
 
 Read the pinned contract's guide
 `docs/guides/connecting-compatible-agents.md`, the selected profile specification, and

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -16,7 +16,7 @@ from urllib.parse import urlparse
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "74d3852f122f5ca5cbc4138a201483531dfa5006"
+CONTRACT_COMMIT = "2ce392291c6668598d12cd38327e24696b5ca15c"
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"
 A2A_VERSION = "1.0"

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -1,24 +1,24 @@
 ---
 name: building-fabric-services
 description: >-
-  Use when handing out or opening a Fabric service dashboard, or building a local agent service on
-  a macOS machine — «сделай агенту дашборд», «локальный сервис агента», «дашборд должен всегда
-  работать и не плодить копии», «где агенту хранить настройки», «подключи агента к Fabric
-  Dashboards», "make this agent a local service", "always-on dashboard", "fabric-service
-  protocol", "add the well-known endpoint", "migrate a service to fabric-service". Covers the
-  fabric-service/0.1 extension: which surface to expose (MCP streamable HTTP, CLI, A2A), the token
-  and one-time login, where state, config, logs and cache live, one copy per machine, launchd, the
-  descriptor, the well-known document, the events feed and notifications; ships Python and Node
-  reference kits and a live conformance probe. NOT for a one-off script or cron job, a hosted
-  SaaS, the provider manifest itself (adapting-projects-to-fabric), or building Fabric Dashboards.
+  Use when handing out or opening a Fabric service dashboard, building a local agent service on a
+  macOS machine, or making an ONLINE agent or dashboard (https origin, the remote placement) a
+  Fabric service — «сделай агенту дашборд», «локальный сервис агента», «онлайн-дашборд в Fabric»,
+  «подключи агента к Fabric Dashboards», "make this agent a local service", "make an online
+  dashboard a Fabric service", "fabric-service protocol", "add the well-known endpoint". Covers
+  fabric-service/0.1: surfaces, token and one-time login, state, one copy, launchd, descriptor,
+  well-known document, events; online: the https guard, the token-gated well-known document, the
+  __Host- cookie, registering it on the operator's computer; ships Python and Node kits, a TLS
+  sample and a live probe. NOT for a one-off script or cron job, a hosted product with no agent
+  behind it, the provider manifest (adapting-projects-to-fabric), or building Fabric Dashboards.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.5.7"
+  version: "0.6.1"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "74d3852f122f5ca5cbc4138a201483531dfa5006"
+  extension-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---
 
 # Building Fabric services
@@ -40,7 +40,8 @@ to review one. Do not use it for:
 
 - a script, a cron job or a one-shot CLI — nothing stays running, so there is nothing
   to supervise; a launchd `StartInterval` job needs no descriptor;
-- a hosted SaaS — the protocol is loopback-only by design;
+- a hosted product with no agent behind it. An online agent or dashboard that should appear in
+  Fabric IS in scope: it is the remote placement — read [Online services](#online-services--the-remote-placement);
 - the provider manifest and admission bundle — that is `adapting-projects-to-fabric`
   (a service that is also a provider does both);
 - the Fabric Dashboards app itself.
@@ -235,6 +236,36 @@ someone builds for themselves is not a PassionCode.ai repository:** its licence
 choice, nothing about it is published or listed by the organization, and none of these files is
 required of it — though the verified MCP quick start is still how anyone learns to drive it.
 
+## Online services — the remote placement
+
+An agent or a dashboard that runs online — on a platform, a server, a hosted app — becomes a
+Fabric service with the same four routes and one descriptor on the operator's computer
+(`placement: "remote"`, DEC-0019). Nothing about launchd, the lock or loopback applies; three
+things change and the kits implement each:
+
+| | What the online service does | Kit |
+|---|---|---|
+| Guard | refuse a foreign `Host`/`Origin` and `cross-site`; behind a TLS router refuse a forwarded scheme that is not `https` | `checkRemoteRequest` / `check_remote_request` |
+| Well-known | only for the token; otherwise `401` with an **empty** body | `wellKnownAllowed('remote', …)` / `well_known_allowed` |
+| Session | `__Host-fabric_session`, `Secure`; codes in memory, the key from a platform secret so sessions survive a deploy | `remoteSessionCookieHeader`, `new LoginCodes(null, 120, { store: new MemoryCodeStore(), key })` |
+
+1. **Serve the four routes** in the app that already exists — not beside it. The complete worked
+   example is [`scripts/sample-remote-service.mjs`](scripts/sample-remote-service.mjs): it runs
+   with its own TLS or behind a platform router.
+2. **Secrets live on the platform:** the service token and the session key (32 bytes) are
+   platform secrets, never in the repository, a URL or an argument vector.
+3. **Register it on the operator's computer** — the installer side, run there:
+   `registerRemote({ id, name, origin, token })` / `register_remote(...)` writes the token file
+   (0600) and the descriptor; pass the token from a file or stdin, never in argv. Public names
+   only in public artifacts: a private service is registered by a local descriptor and nowhere
+   else.
+4. **Verify** with the probe: `check_service.py <id>` checks TLS, the token-gated well-known
+   document, the guards, events, the single-use login and the host-bound cookie; launchd, lock
+   and loopback rules are `NOT_RUN` with that reason.
+
+Read [the remote placement reference](references/remote-placement.md) for the failure
+behaviour a host shows, rotation, a multi-process platform, and what a host will not do.
+
 ## Migrating an existing service
 
 Read [the migration reference](references/migrating-a-service.md) — the order of

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `74d3852f122f5ca5cbc4138a201483531dfa5006`
+Pinned to `fabric-agent-contract` commit `2ce392291c6668598d12cd38327e24696b5ca15c`
 (`docs/specification/service.md`, DEC-0015). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/remote-placement.md

@@ -0,0 +1,71 @@
+# The remote placement — online agents and dashboards
+
+Normative source: `fabric-agent-contract` `docs/specification/service.md` → *Remote placement*,
+DEC-0019, at the commit this skill pins. This page is the how-to.
+
+## Is it a remote service?
+
+It is, when it runs outside the operator's computer and the operator wants it in Fabric beside
+the local services: a hosted dashboard, an agent on a server, a bot's web console. It keeps the
+same objects — well-known document, events feed, login code — at the same paths.
+
+## The descriptor
+
+```json
+{
+  "protocol": "fabric-service/0.1",
+  "id": "example-agent",
+  "instance": "default",
+  "name": "Example Agent",
+  "placement": "remote",
+  "origin": "https://agent.example.com",
+  "auth": { "tokenFile": "~/Library/Application Support/ai.passioncode.fabric/tokens/example-agent.default.token" },
+  "lifecycle": { "manager": "none" },
+  "installedAt": "2026-10-02T18:00:00Z",
+  "installedBy": "fabric-service register-remote"
+}
+```
+
+- `origin`: `https://` + a public DNS name + an optional port. No path, query, userinfo or IP
+  literal; not `localhost`, `*.local`, `*.internal`, `*.home.arpa`, `*.lan`, `*.localdomain`.
+- `lifecycle.manager` is `none`, with no `label` or `plist`. `paths` is optional.
+- `commands` may carry `doctor` (a local executable); never `update`.
+
+## On the platform
+
+- **Token**: a random value of at least 16 characters (32 bytes recommended), set as a secret;
+  the same value is written on the operator's computer by `registerRemote`. Compare in constant
+  time (`tokenMatches`).
+- **Session key**: 32 random bytes, a separate secret. With it, sessions survive a deploy; without
+  it, every deploy signs the operator out.
+- **Codes**: `MemoryCodeStore` — a restart forgets every outstanding code, so none can be replayed.
+  Several processes behind one origin need a shared store (a database row with the same
+  "used before honoured" write); memory works for one process.
+- **Behind a router**: check the platform-set forwarded scheme; `Host` is preserved by common
+  platforms and must equal the origin's host.
+
+## Checking it
+
+`check_service.py <id>` probes a remote placement over verified TLS. Behind a platform router
+(Heroku, Fly, Render, a CDN) a request that names a foreign `Host` never reaches the process: the
+router answers it, usually `404` or `421`. The probe counts that as the refusal it is, as long as
+the body is not the well-known document. The Origin and cross-site checks name the right `Host`,
+reach the service, and still need its own `403`.
+
+## What a host does and will not do
+
+| Situation | Host |
+|---|---|
+| `401` on the well-known document | `down` — the service refused the token; never `foreign` |
+| answer names another `id.instance` | `foreign`; the token is not sent again until the descriptor changes |
+| certificate invalid or for another name | `down`, the reason names TLS |
+| redirect | not followed; `down` |
+| one probe missed | not an outage; the last state holds until the threshold |
+| start, stop, restart, update | not offered |
+| a host older than the remote placement | shows the service as invalid and never contacts it |
+
+## Rotation
+
+Rotate the token by setting the new value on the platform and re-running `registerRemote` on the
+operator's computer with it; the old token stops working the moment the platform restarts with the
+new value. Rotate the session key on the platform to sign every operator out.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -4,6 +4,13 @@
   check_service.py <id>[.<instance>]          # find the descriptor in the services directory
   check_service.py --descriptor PATH
   options: --services-dir DIR  --json  --skip-login
+           --ca-file PEM  --connect HOST:PORT     (remote placement: trust a test CA; dial another address)
+
+A remote placement (DEC-0019 — an online agent or dashboard at an https origin) is probed over
+TLS with the certificate verified: the well-known document must refuse a request without the
+token (401, empty body), the guards must refuse a foreign Host/Origin and cross-site requests,
+and the session cookie must be __Host- and Secure. Loopback, launchd, lock and state rules do
+not apply to it and are reported NOT_RUN with that reason.
 
 Every rule gets PASS, FAIL or NOT_RUN with its evidence. Exit 0 when nothing
 FAILs, 1 when something does, 2 on a usage error. The probe only reads, except
@@ -29,7 +36,10 @@ import shutil
 import stat
 import subprocess
 import sys
+import socket
+import ssl
 import time
+import urllib.parse
 from typing import Any, Dict, List, Optional, Tuple
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
@@ -69,8 +79,42 @@ def priority_problems(plist: dict) -> list:
     return out
 
 
+# A platform router (Heroku, Fly, Render, a CDN) routes by Host, so a request naming a foreign
+# Host never reaches an online service: the router itself answers, typically 404 or 421. That is
+# still a refusal — the service disclosed nothing — so for a remote placement the host check
+# accepts it, as long as the body is not the well-known document. Every other guard request names
+# the right Host, reaches the service, and must be the service's own 403.
+PLATFORM_HOST_REFUSALS = (400, 404, 421)
+
+
+def guard_verdict(rule: str, remote: bool, status: int, body: bytes) -> Tuple[str, str]:
+    if status == 403:
+        return "PASS", "HTTP 403"
+    disclosed = b"fabric-service/" in (body or b"")
+    if rule == "network.host-check" and remote and status in PLATFORM_HOST_REFUSALS and not disclosed:
+        return "PASS", "HTTP %d from the platform router: a foreign Host never reaches the service" % status
+    return "FAIL", "HTTP %d%s" % (status, ", and the body is the well-known document" if disclosed else "")
+
+
+class _PinnedHTTPS(http.client.HTTPSConnection):
+    """HTTPS to the origin's name (SNI, certificate, Host) over a socket dialled elsewhere."""
+
+    def __init__(self, name: str, port: int, dial: Tuple[str, int], context: ssl.SSLContext, timeout: float):
+        super().__init__(name, port, context=context, timeout=timeout)
+        self._dial = dial
+        self._ctx = context
+
+    def connect(self) -> None:
+        raw = socket.create_connection(self._dial, timeout=self.timeout)
+        self.sock = self._ctx.wrap_socket(raw, server_hostname=self.host)
+
+
 class Probe:
-    def __init__(self, descriptor_path: Path, descriptor: Dict[str, Any], services_dir: Path, skip_login: bool):
+    def __init__(self, descriptor_path: Path, descriptor: Dict[str, Any], services_dir: Path, skip_login: bool,
+                 ca_file: Optional[str] = None, connect: Optional[str] = None):
+        self.remote = fs.placement_of(descriptor) == "remote"
+        self.ca_file = ca_file
+        self.connect = connect
         self.path = descriptor_path
         self.d = descriptor
         self.dir = services_dir
@@ -80,6 +124,13 @@ class Probe:
         self.token: Optional[str] = None
         self.events: Optional[List[Dict[str, Any]]] = None
         self.sent_traceparent: Optional[str] = None
+        self.netloc = ""
+        if self.remote:
+            parts = urllib.parse.urlsplit(str(descriptor.get("origin", "")))
+            self.netloc = parts.netloc
+            self.host_name = parts.hostname or ""
+            self.port = (parts.port or 443) if not fs.remote_origin_problems(descriptor.get("origin")) else 0
+            return
         try:
             self.port = fs.port_of(str(descriptor.get("origin", "")))
         except fs.ServiceError:
@@ -90,8 +141,17 @@ class Probe:
 
     def request(self, method: str, path: str, headers: Optional[Dict[str, str]] = None,
                 body: Optional[bytes] = None) -> Tuple[int, Dict[str, str], bytes]:
-        conn = http.client.HTTPConnection("127.0.0.1", self.port, timeout=5)
-        base = {"Host": "127.0.0.1:%d" % self.port}
+        if self.remote:
+            context = ssl.create_default_context(cafile=self.ca_file) if self.ca_file else ssl.create_default_context()
+            if self.connect:
+                host, _, port = self.connect.rpartition(":")
+                conn = _PinnedHTTPS(self.host_name, self.port, (host, int(port)), context, 8)
+            else:
+                conn = http.client.HTTPSConnection(self.host_name, self.port, context=context, timeout=8)
+            base = {"Host": self.netloc}
+        else:
+            conn = http.client.HTTPConnection("127.0.0.1", self.port, timeout=5)
+            base = {"Host": "127.0.0.1:%d" % self.port}
         base.update(headers or {})
         try:
             conn.request(method, path, body=body, headers=base)
@@ -120,17 +180,32 @@ class Probe:
                 continue
             if key == me:
                 clashes.append("%s declared again in %s" % (me, path.name))
-            elif other.get("origin") == self.d.get("origin"):
+            elif not self.remote and fs.placement_of(other) != "remote" and other.get("origin") == self.d.get("origin"):
                 clashes.append("port %d also claimed by %s" % (self.port, key))
-        self.add("descriptor.port-claim", "FAIL" if clashes else "PASS", "; ".join(clashes) or "port %d is unique" % self.port)
+        unique = "a remote origin claims no port here" if self.remote else "port %d is unique" % self.port
+        self.add("descriptor.port-claim", "FAIL" if clashes else "PASS", "; ".join(clashes) or unique)
 
     # well-known ----------------------------------------------------------------
     def well_known_rules(self) -> None:
+        protected: Dict[str, str] = {}
+        if self.remote:
+            try:
+                status, _, body = self.request("GET", "/.well-known/fabric-service")
+            except (OSError, ssl.SSLError) as exc:
+                self.add("well-known.answers", "FAIL", "no TLS answer on %s: %s" % (self.d.get("origin"), exc))
+                return
+            self.add("well-known.requires-token", "PASS" if status == 401 and not body else "FAIL",
+                     "HTTP %d without a token, %d byte(s)" % (status, len(body)))
+            self.read_token()
+            if not self.token:
+                self.add("well-known.answers", "NOT_RUN", "no readable token to ask with")
+                return
+            protected = self.auth_headers()
         try:
             timings = []
             for _ in range(3):
                 started = time.perf_counter()
-                status, headers, body = self.request("GET", "/.well-known/fabric-service")
+                status, headers, body = self.request("GET", "/.well-known/fabric-service", protected)
                 timings.append((time.perf_counter() - started) * 1000)
         except OSError as exc:
             self.add("well-known.answers", "FAIL", "no answer on %s: %s" % (self.d.get("origin"), exc))
@@ -145,7 +220,10 @@ class Probe:
             return
         self.add("well-known.answers", "PASS", "HTTP 200")
         median = sorted(timings)[1]
-        self.add("well-known.fast", "PASS" if median < 100 else "FAIL", "median %.1f ms" % median)
+        if self.remote:
+            self.add("well-known.fast", "PASS" if median < 8000 else "FAIL", "median %.1f ms (remote: no 100 ms budget)" % median)
+        else:
+            self.add("well-known.fast", "PASS" if median < 100 else "FAIL", "median %.1f ms" % median)
         wk = self.wk
         problems = []
         if wk.get("protocol") != fs.PROTOCOL:
@@ -177,10 +255,19 @@ class Probe:
             ("network.cross-site-check", {"Sec-Fetch-Site": "cross-site"}),
         ):
             try:
-                status, _, _ = self.request("GET", "/.well-known/fabric-service", headers)
-                self.add(rule, "PASS" if status == 403 else "FAIL", "HTTP %d" % status)
-            except OSError as exc:
+                sent = dict(headers)
+                if self.remote:
+                    sent.update(self.auth_headers())
+                    if "Origin" in sent:
+                        sent["Origin"] = "https://evil.example"
+                status, _, body = self.request("GET", "/.well-known/fabric-service", sent)
+                verdict, evidence = guard_verdict(rule, self.remote, status, body)
+                self.add(rule, verdict, evidence)
+            except (OSError, ssl.SSLError) as exc:
                 self.add(rule, "NOT_RUN", str(exc))
+        if self.remote:
+            self.add("network.loopback-only", "NOT_RUN", "a remote placement is reached over https, not loopback")
+            return
         if not shutil.which("lsof"):
             self.add("network.loopback-only", "NOT_RUN", "lsof is not installed")
             return
@@ -191,13 +278,18 @@ class Probe:
                  ", ".join(names) or "nothing listens on %d" % self.port)
 
     # auth, events, login ----------------------------------------------------------
-    def auth_rules(self) -> None:
+    def read_token(self) -> None:
+        if any(r["rule"] == "auth.token-file" for r in self.results):
+            return
         token_file = str((self.d.get("auth") or {}).get("tokenFile", ""))
         try:
             self.token = fs.read_token(fs.expand(token_file))
             self.add("auth.token-file", "PASS", "%s is 0600 and owned by you" % token_file)
         except (fs.ServiceError, OSError) as exc:
             self.add("auth.token-file", "FAIL", str(exc))
+
+    def auth_rules(self) -> None:
+        self.read_token()
         events_path = ((self.wk or {}).get("surfaces") or {}).get("events", {}).get("path", "/fabric/v1/events")
         try:
             status, _, _ = self.request("GET", events_path + "?limit=1")
@@ -251,6 +343,10 @@ class Probe:
             return
         cookie = headers1.get("set-cookie", "")
         ok = status1 in (302, 303) and "HttpOnly" in cookie and "SameSite=Strict" in cookie and status2 not in (302, 303)
+        if self.remote:
+            host_bound = cookie.startswith("__Host-") and "Secure" in cookie and "Path=/" in cookie and "domain=" not in cookie.lower()
+            self.add("login.cookie-host-bound", "PASS" if host_bound else "FAIL",
+                     "the session cookie is __Host-, Secure, Path=/, no Domain" if host_bound else "cookie: %s" % cookie.split(";", 1)[0].split("=")[0])
         self.add("login.single-use", "PASS" if ok else "FAIL",
                  "first redeem HTTP %d (%s), second HTTP %d" % (status1, "cookie ok" if "HttpOnly" in cookie else "no HttpOnly cookie", status2))
 
@@ -432,6 +528,9 @@ class Probe:
 
     # lifecycle ----------------------------------------------------------------
     def lifecycle_rules(self) -> None:
+        if self.remote:
+            self.add("lifecycle.platform", "NOT_RUN", "a remote placement is supervised by its platform; launchd, lock and state rules do not apply")
+            return
         life = self.d.get("lifecycle") or {}
         data = fs.expand(str((self.d.get("paths") or {}).get("data", "~/")))
         inside = subprocess.run(["git", "-C", str(data), "rev-parse", "--show-toplevel"], capture_output=True, text=True) if data.is_dir() and shutil.which("git") else None
@@ -555,6 +654,8 @@ def main(argv: Optional[List[str]] = None) -> int:
     parser.add_argument("--services-dir")
     parser.add_argument("--json", action="store_true")
     parser.add_argument("--skip-login", action="store_true")
+    parser.add_argument("--ca-file", help="remote placement: trust this CA bundle instead of the system store (tests)")
+    parser.add_argument("--connect", help="remote placement: dial HOST:PORT while speaking TLS to the origin's name (tests)")
     args = parser.parse_args(argv)
     if not args.target and not args.descriptor:
         parser.print_usage(sys.stderr)
@@ -566,7 +667,7 @@ def main(argv: Optional[List[str]] = None) -> int:
     except (OSError, ValueError) as exc:
         print("No readable descriptor at %s: %s" % (path, exc), file=sys.stderr)
         return 1
-    results = Probe(path, descriptor, services_dir, args.skip_login).run()
+    results = Probe(path, descriptor, services_dir, args.skip_login, args.ca_file, args.connect).run()
     failed = sum(r["verdict"] == "FAIL" for r in results)
     if args.json:
         print(json.dumps({"descriptor": str(path), "results": results, "failed": failed}, indent=2))

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -1,6 +1,7 @@
 // Reference kit for the fabric-service/0.1 local service extension — Node.js 20+, no dependencies.
 // The Node twin of fabric_service.py: same rules, same file formats, interoperable locks.
-// Normative source: fabric-agent-contract docs/specification/service.md (DEC-0015).
+// Normative source: fabric-agent-contract docs/specification/service.md (DEC-0015; the remote
+// placement — an online agent or dashboard at an https origin — DEC-0019).
 
 import crypto from 'node:crypto';
 import fs from 'node:fs';
@@ -16,11 +17,16 @@ export const STATUSES = ['starting', 'ready', 'degraded', 'stopping'];
 export const EVENTS_DEFAULT_LIMIT = 50;
 export const EVENTS_MAX_LIMIT = 200;
 export const SESSION_COOKIE = 'fabric_session';
+// DEC-0019: a remote placement's cookie is host-bound and HTTPS-only.
+export const REMOTE_SESSION_COOKIE = '__Host-fabric_session';
+export const PLACEMENTS = ['local', 'remote'];
 
 const ID = /^[a-z][a-z0-9-]{1,62}$/;
 const INSTANCE = /^[a-z][a-z0-9-]{0,31}$/;
 const KIND = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*){0,5}$/;
 const ORIGIN = /^http:\/\/127\.0\.0\.1:([0-9]{3,5})$/;
+const REMOTE_ORIGIN = /^https:\/\/((?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(?::([0-9]{1,5}))?$/;
+const RESERVED_HOST = /(^|\.)(localhost|local|internal|home\.arpa|lan|localdomain)$/;
 const CODE = /^[A-Za-z0-9_-]{16,256}$/;
 const TRACE_ID = /^(?!0{32}$)[0-9a-f]{32}$/;
 const SPAN_ID = /^(?!0{16}$)[0-9a-f]{16}$/;
@@ -212,14 +218,18 @@ export function readDescriptors(dir = servicesDir()) {
 
 export function validateDescriptor(d) {
   const problems = [];
-  for (const key of ['protocol', 'id', 'instance', 'name', 'origin', 'auth', 'lifecycle', 'paths', 'installedAt', 'installedBy']) {
+  const remote = placementOf(d) === 'remote';
+  if (d.placement !== undefined && !PLACEMENTS.includes(d.placement)) problems.push('placement must be local or remote');
+  const required = ['protocol', 'id', 'instance', 'name', 'origin', 'auth', 'lifecycle', 'installedAt', 'installedBy'];
+  for (const key of remote ? required : [...required, 'paths']) {
     if (!(key in d)) problems.push(`missing ${key}`);
   }
   if (problems.length) return problems;
   if (d.protocol !== PROTOCOL) problems.push(`protocol must be ${PROTOCOL}`);
   if (!ID.test(d.id)) problems.push(`id must match ${ID}`);
   if (!INSTANCE.test(d.instance)) problems.push(`instance must match ${INSTANCE}`);
-  if (!ORIGIN.test(d.origin)) problems.push('origin must be http://127.0.0.1:<port>');
+  if (remote) problems.push(...remoteOriginProblems(d.origin));
+  else if (!ORIGIN.test(d.origin)) problems.push('origin must be http://127.0.0.1:<port>');
   if (!d.auth?.tokenFile) problems.push('auth.tokenFile is required');
   if ((d.auth?.header ?? 'Authorization') !== 'Authorization' && (d.auth?.scheme ?? 'Bearer') !== 'none') {
     problems.push('a custom auth header carries the raw token: scheme must be none');
@@ -228,6 +238,11 @@ export function validateDescriptor(d) {
   if (d.lifecycle?.manager === 'launchd' && !(d.lifecycle.label && String(d.lifecycle.plist ?? '').endsWith('.plist'))) {
     problems.push('a launchd service declares label and plist');
   }
+  if (remote) {
+    if (d.lifecycle?.manager !== 'none') problems.push('a remote service is supervised by its platform: lifecycle.manager must be none');
+    for (const field of ['label', 'plist']) if (d.lifecycle?.[field] !== undefined) problems.push(`a remote service has no launchd ${field}`);
+    if (d.commands?.update !== undefined) problems.push('a remote service declares no update command');
+  }
   for (const [name, argv] of Object.entries(d.commands ?? {})) {
     if (!['doctor', 'update'].includes(name)) problems.push(`unknown command ${name}`);
     else if (!Array.isArray(argv) || !argv.length || !argv.every((a) => typeof a === 'string')) problems.push(`command ${name} must be an argument array`);
@@ -236,6 +251,20 @@ export function validateDescriptor(d) {
   return problems;
 }
 
+/** DEC-0019: `local` unless the descriptor says `remote`. */
+export function placementOf(d) {
+  return d?.placement === 'remote' ? 'remote' : 'local';
+}
+
+/** Problems with a remote origin: https, a public DNS name, an optional port, nothing else. */
+export function remoteOriginProblems(origin) {
+  const m = REMOTE_ORIGIN.exec(String(origin ?? ''));
+  if (!m) return ['a remote origin must be https://<dns-name>[:<port>] with no path, query or IP literal'];
+  if (RESERVED_HOST.test(m[1])) return [`a remote service cannot live on the reserved name ${m[1]}`];
+  if (m[2] !== undefined && (Number(m[2]) < 1 || Number(m[2]) > 65535)) return ['the origin port is out of range'];
+  return [];
+}
+
 export function portOf(origin) {
   const m = ORIGIN.exec(origin);
   if (!m) throw new ServiceError(`Origin ${origin} is not http://127.0.0.1:<port>.`);
@@ -246,10 +275,12 @@ export function writeDescriptor(d, dir = servicesDir()) {
   const problems = validateDescriptor(d);
   if (problems.length) throw new ServiceError(`Descriptor is invalid: ${problems.join('; ')}.`);
   const me = `${d.id}.${d.instance}`;
-  const port = portOf(d.origin);
+  // DEC-0019: only a local placement claims a port on this computer.
+  const port = placementOf(d) === 'remote' ? null : portOf(d.origin);
   for (const [file, other] of readDescriptors(dir)) {
     const key = `${other.id}.${other.instance ?? 'default'}`;
     if (key === me) continue;
+    if (port === null) continue; // a remote origin's port is another computer's
     let otherPort = null;
     try { otherPort = portOf(String(other.origin ?? '')); } catch { continue; }
     if (otherPort === port) throw new ServiceError(`Port ${port} is already claimed by ${key} (${file}).`);
@@ -318,25 +349,39 @@ export async function eventsPage(fetch, after, limit) {
 // --- operator login -------------------------------------------------------------------
 
 export class LoginCodes {
-  constructor(stateDir, ttlSeconds = 120) {
-    this.dir = ensurePrivateDir(stateDir);
+  // `stateDir` — a local service keeps codes and the session key in files. An online service
+  // (DEC-0019) usually has no durable disk: pass `stateDir = null` with `{ store, key }` — `store`
+  // like `new MemoryCodeStore()` (a restart forgets every code, so none can be replayed) and
+  // `key` a Buffer from a platform secret, so sessions survive a deploy.
+  constructor(stateDir, ttlSeconds = 120, { store = null, key = null } = {}) {
     this.ttl = Math.min(ttlSeconds, 120);
-    this.keyPath = path.join(this.dir, 'session.key');
-    this.codesPath = path.join(this.dir, 'login-codes.json');
+    this.store = store;
+    this.fixedKey = key;
+    if (stateDir) {
+      this.dir = ensurePrivateDir(stateDir);
+      this.keyPath = path.join(this.dir, 'session.key');
+      this.codesPath = path.join(this.dir, 'login-codes.json');
+    } else if (!store || !key) {
+      throw new ServiceError('LoginCodes without a state directory needs { store, key }.');
+    }
+    if (key && Buffer.from(key).length < 32) throw new ServiceError('the session key must be at least 32 bytes.');
   }
 
   key() {
+    if (this.fixedKey) return Buffer.from(this.fixedKey);
     if (!fs.existsSync(this.keyPath)) atomicWrite(this.keyPath, crypto.randomBytes(32), 0o600);
     return fs.readFileSync(this.keyPath);
   }
 
   load() {
+    if (this.store) return this.store.load();
     try { return JSON.parse(fs.readFileSync(this.codesPath, 'utf8')); } catch { return {}; }
   }
 
   save(codes) {
     const horizon = Date.now() / 1000 - 3600;
     const kept = Object.fromEntries(Object.entries(codes).filter(([, v]) => (v.expires ?? 0) > horizon));
+    if (this.store) { this.store.save(kept); return; }
     atomicWrite(this.codesPath, JSON.stringify(kept), 0o600);
   }
 
@@ -372,11 +417,71 @@ export class LoginCodes {
   }
 
   revokeAll() {
+    if (this.fixedKey) throw new ServiceError('a platform-held session key is rotated on the platform, not here.');
     atomicWrite(this.keyPath, crypto.randomBytes(32), 0o600);
   }
 }
 
+/** DEC-0019: a code store held in memory — for an online service with no durable disk. */
+export class MemoryCodeStore {
+  constructor() { this.codes = {}; }
+  load() { return JSON.parse(JSON.stringify(this.codes)); }
+  save(codes) { this.codes = JSON.parse(JSON.stringify(codes)); }
+}
+
 export const sessionCookieHeader = (value, maxAge = 30 * 86400) => `${SESSION_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}`;
+/** DEC-0019: the remote cookie — `__Host-` name, Secure, no Domain, Path=/. */
+export const remoteSessionCookieHeader = (value, maxAge = 30 * 86400) => `${REMOTE_SESSION_COOKIE}=${value}; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=${maxAge}`;
+
+/**
+ * DEC-0019: the request guard of an online service. `origin` is the service's own origin
+ * (`https://agent.example.com`). `forwardedProto` is the platform-set scheme where TLS ends
+ * before the process (`x-forwarded-proto`); pass `undefined` when the process terminates TLS.
+ * Returns the refusal sentence, or null.
+ */
+export function checkRemoteRequest(origin, host, requestOrigin, secFetchSite, forwardedProto) {
+  const own = new URL(origin);
+  if (String(host ?? '').toLowerCase() !== own.host) return `Host ${host} is not this service.`;
+  if (forwardedProto !== undefined && forwardedProto !== null && String(forwardedProto).split(',')[0].trim() !== 'https') return 'This service answers over https only.';
+  if (requestOrigin !== undefined && requestOrigin !== null && requestOrigin !== own.origin) return `Origin ${requestOrigin} is not this service.`;
+  if (secFetchSite === 'cross-site') return 'Cross-site requests are refused.';
+  return null;
+}
+
+/**
+ * DEC-0019: may this request read the well-known document? A local service answers anyone (the
+ * loopback guard already ran); a remote one only the bearer of the service token. A `false`
+ * answer is a `401` with an EMPTY body — nothing about the service is disclosed.
+ */
+export function wellKnownAllowed(placement, authorization, token, scheme = 'Bearer') {
+  return placement !== 'remote' || tokenMatches(authorization, token, scheme);
+}
+
+/** The token directory a host-side installer uses for remote services on this computer. */
+export function remoteTokenFile(id, instance = 'default', dir = servicesDir()) {
+  return path.join(path.dirname(dir), 'tokens', `${id}.${instance}.token`);
+}
+
+/**
+ * DEC-0019, installer side: register an online service on THIS computer. Writes the token file
+ * (0600, never printed) and the descriptor; the same token must be set on the hosting platform as
+ * a secret. Returns the descriptor path. `token` is read from the caller — a file or stdin —
+ * never from an argument vector.
+ */
+export function registerRemote({ id, instance = 'default', name, summary, origin, token, doctor, dir = servicesDir(), installedBy = 'fabric-service register-remote' }) {
+  if (!token || String(token).trim().length < 16) throw new ServiceError('the service token must be at least 16 characters.');
+  const tokenFile = remoteTokenFile(id, instance, dir);
+  const d = {
+    protocol: PROTOCOL, id, instance, name, ...(summary ? { summary } : {}), placement: 'remote', origin,
+    auth: { tokenFile }, lifecycle: { manager: 'none' }, ...(doctor ? { commands: { doctor } } : {}),
+    installedAt: nowIso(), installedBy,
+  };
+  const problems = validateDescriptor(d);
+  if (problems.length) throw new ServiceError(`Descriptor is invalid: ${problems.join('; ')}.`);
+  ensurePrivateDir(path.dirname(tokenFile));
+  atomicWrite(tokenFile, String(token).trim(), 0o600);
+  return writeDescriptor(d, dir);
+}
 
 export function cookieValue(header, name = SESSION_COOKIE) {
   for (const part of String(header ?? '').split(';')) {

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -30,6 +30,7 @@ import tempfile
 import time
 from typing import Any, Callable, Dict, Iterable, List, Optional, Sequence, Tuple
 import urllib.error
+import urllib.parse
 import urllib.request
 
 PROTOCOL = "fabric-service/0.1"
@@ -45,6 +46,10 @@ _ID = re.compile(r"^[a-z][a-z0-9-]{1,62}$")
 _INSTANCE = re.compile(r"^[a-z][a-z0-9-]{0,31}$")
 _KIND = re.compile(r"^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*){0,5}$")
 _ORIGIN = re.compile(r"^http://127\.0\.0\.1:([0-9]{3,5})$")
+# DEC-0019: a remote placement — an online agent or dashboard — lives at an https DNS name.
+_REMOTE_ORIGIN = re.compile(r"^https://((?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(?::([0-9]{1,5}))?$")
+_RESERVED_HOST = re.compile(r"(^|\.)(localhost|local|internal|home\.arpa|lan|localdomain)$")
+PLACEMENTS = ("local", "remote")
 _CODE = re.compile(r"^[A-Za-z0-9_-]{16,256}$")
 _TRACE_ID = re.compile(r"^(?!0{32}$)[0-9a-f]{32}$")
 _SPAN_ID = re.compile(r"^(?!0{16}$)[0-9a-f]{16}$")
@@ -275,7 +280,12 @@ def read_descriptors(directory: Optional[Path] = None) -> List[Tuple[Path, Dict[
 def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
     """Structural checks mirroring service-descriptor.schema.json (the schema stays normative)."""
     problems: List[str] = []
-    required = ("protocol", "id", "instance", "name", "origin", "auth", "lifecycle", "paths", "installedAt", "installedBy")
+    remote = placement_of(descriptor) == "remote"
+    if "placement" in descriptor and descriptor["placement"] not in PLACEMENTS:
+        problems.append("placement must be local or remote")
+    required = ("protocol", "id", "instance", "name", "origin", "auth", "lifecycle", "installedAt", "installedBy")
+    if not remote:
+        required = required + ("paths",)
     for key in required:
         if key not in descriptor:
             problems.append("missing %s" % key)
@@ -287,7 +297,9 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
         problems.append("id must match %s" % _ID.pattern)
     if not _INSTANCE.match(str(descriptor["instance"])):
         problems.append("instance must match %s" % _INSTANCE.pattern)
-    if not _ORIGIN.match(str(descriptor["origin"])):
+    if remote:
+        problems.extend(remote_origin_problems(descriptor["origin"]))
+    elif not _ORIGIN.match(str(descriptor["origin"])):
         problems.append("origin must be http://127.0.0.1:<port>")
     auth = descriptor.get("auth") or {}
     if "tokenFile" not in auth:
@@ -301,6 +313,14 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
         problems.append("lifecycle.manager must be launchd or none")
     if life.get("manager") == "launchd" and not (life.get("label") and str(life.get("plist", "")).endswith(".plist")):
         problems.append("a launchd service declares label and plist")
+    if remote:
+        if life.get("manager") != "none":
+            problems.append("a remote service is supervised by its platform: lifecycle.manager must be none")
+        for field in ("label", "plist"):
+            if field in life:
+                problems.append("a remote service has no launchd %s" % field)
+        if "update" in (descriptor.get("commands") or {}):
+            problems.append("a remote service declares no update command")
     for name, argv in (descriptor.get("commands") or {}).items():
         if name not in ("doctor", "update"):
             problems.append("unknown command %s" % name)
@@ -311,6 +331,23 @@ def validate_descriptor(descriptor: Dict[str, Any]) -> List[str]:
     return problems
 
 
+def placement_of(descriptor: Dict[str, Any]) -> str:
+    """DEC-0019: ``local`` unless the descriptor says ``remote``."""
+    return "remote" if (descriptor or {}).get("placement") == "remote" else "local"
+
+
+def remote_origin_problems(origin: Any) -> List[str]:
+    """Problems with a remote origin: https, a public DNS name, an optional port, nothing else."""
+    match = _REMOTE_ORIGIN.match(str(origin or ""))
+    if not match:
+        return ["a remote origin must be https://<dns-name>[:<port>] with no path, query or IP literal"]
+    if _RESERVED_HOST.search(match.group(1)):
+        return ["a remote service cannot live on the reserved name %s" % match.group(1)]
+    if match.group(2) is not None and not 1 <= int(match.group(2)) <= 65535:
+        return ["the origin port is out of range"]
+    return []
+
+
 def port_of(origin: str) -> int:
     match = _ORIGIN.match(origin)
     if not match:
@@ -325,10 +362,11 @@ def write_descriptor(descriptor: Dict[str, Any], directory: Optional[Path] = Non
         raise ServiceError("Descriptor is invalid: %s." % "; ".join(problems))
     root = directory or services_dir()
     me = "%s.%s" % (descriptor["id"], descriptor["instance"])
-    port = port_of(descriptor["origin"])
+    # DEC-0019: only a local placement claims a port on this computer.
+    port = None if placement_of(descriptor) == "remote" else port_of(descriptor["origin"])
     for path, other in read_descriptors(root):
         key = "%s.%s" % (other.get("id"), other.get("instance", "default"))
-        if key == me:
+        if key == me or port is None:  # a remote origin's port is another computer's
             continue
         try:
             other_port = port_of(str(other.get("origin", "")))
@@ -501,18 +539,33 @@ class LoginCodes:
     """Single-use login codes (<=120 s), recorded as used BEFORE they are honoured,
     and HMAC-signed session cookies revoked by rotating the key."""
 
-    def __init__(self, state_dir: Path, ttl: int = LOGIN_CODE_TTL_SECONDS):
-        self.dir = ensure_private_dir(Path(state_dir))
+    def __init__(self, state_dir: Optional[Path], ttl: int = LOGIN_CODE_TTL_SECONDS, *,
+                 store: Optional["MemoryCodeStore"] = None, key: Optional[bytes] = None):
+        # A local service keeps codes and the key in files. An online one (DEC-0019) usually has no
+        # durable disk: pass state_dir=None with store=MemoryCodeStore() (a restart forgets every
+        # code, so none can be replayed) and key= bytes from a platform secret (sessions survive a deploy).
         self.ttl = min(ttl, LOGIN_CODE_TTL_SECONDS)
-        self._key_path = self.dir / "session.key"
-        self._codes_path = self.dir / "login-codes.json"
+        self._store = store
+        self._fixed_key = key
+        if state_dir is not None:
+            self.dir = ensure_private_dir(Path(state_dir))
+            self._key_path = self.dir / "session.key"
+            self._codes_path = self.dir / "login-codes.json"
+        elif store is None or key is None:
+            raise ServiceError("LoginCodes without a state directory needs store= and key=.")
+        if key is not None and len(key) < 32:
+            raise ServiceError("the session key must be at least 32 bytes.")
 
     def _key(self) -> bytes:
+        if self._fixed_key is not None:
+            return bytes(self._fixed_key)
         if not self._key_path.exists():
             atomic_write(self._key_path, secrets.token_bytes(32), 0o600)
         return self._key_path.read_bytes()
 
     def _load(self) -> Dict[str, Any]:
+        if self._store is not None:
+            return self._store.load()
         try:
             return json.loads(self._codes_path.read_text())
         except (OSError, ValueError):
@@ -521,6 +574,9 @@ class LoginCodes:
     def _save(self, codes: Dict[str, Any]) -> None:
         horizon = time.time() - 3600
         codes = {k: v for k, v in codes.items() if v.get("expires", 0) > horizon}
+        if self._store is not None:
+            self._store.save(codes)
+            return
         atomic_write(self._codes_path, json.dumps(codes).encode(), 0o600)
 
     def issue(self) -> Dict[str, str]:
@@ -559,16 +615,89 @@ class LoginCodes:
         return hmac.compare_digest(mac, expected)
 
     def revoke_all(self) -> None:
+        if self._fixed_key is not None:
+            raise ServiceError("a platform-held session key is rotated on the platform, not here.")
         atomic_write(self._key_path, secrets.token_bytes(32), 0o600)
 
 
+class MemoryCodeStore:
+    """DEC-0019: a login-code store held in memory — for an online service with no durable disk."""
+
+    def __init__(self) -> None:
+        self._codes: Dict[str, Any] = {}
+
+    def load(self) -> Dict[str, Any]:
+        return json.loads(json.dumps(self._codes))
+
+    def save(self, codes: Dict[str, Any]) -> None:
+        self._codes = json.loads(json.dumps(codes))
+
+
 SESSION_COOKIE = "fabric_session"
+REMOTE_SESSION_COOKIE = "__Host-fabric_session"
 
 
 def session_cookie_header(value: str, max_age: int = 30 * 86400) -> str:
     return "%s=%s; Path=/; HttpOnly; SameSite=Strict; Max-Age=%d" % (SESSION_COOKIE, value, max_age)
 
 
+def remote_session_cookie_header(value: str, max_age: int = 30 * 86400) -> str:
+    """DEC-0019: the remote cookie — __Host- name, Secure, no Domain, Path=/."""
+    return "%s=%s; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=%d" % (REMOTE_SESSION_COOKIE, value, max_age)
+
+
+def check_remote_request(origin: str, host: Optional[str], request_origin: Optional[str] = None,
+                         sec_fetch_site: Optional[str] = None, forwarded_proto: Optional[str] = None) -> Optional[str]:
+    """DEC-0019: the request guard of an online service; returns the refusal sentence or None.
+    ``forwarded_proto`` is the platform-set scheme where TLS ends before the process; pass None
+    when the process terminates TLS itself."""
+    own = urllib.parse.urlsplit(origin)
+    own_host = own.netloc.lower()
+    if str(host or "").lower() != own_host:
+        return "Host %s is not this service." % host
+    if forwarded_proto is not None and str(forwarded_proto).split(",")[0].strip() != "https":
+        return "This service answers over https only."
+    if request_origin is not None and request_origin != "%s://%s" % (own.scheme, own_host):
+        return "Origin %s is not this service." % request_origin
+    if sec_fetch_site == "cross-site":
+        return "Cross-site requests are refused."
+    return None
+
+
+def well_known_allowed(placement: str, authorization: Optional[str], token: str, scheme: str = "Bearer") -> bool:
+    """DEC-0019: a local service answers anyone (the loopback guard already ran); a remote one only
+    the bearer of the service token. False is a 401 with an EMPTY body."""
+    return placement != "remote" or token_matches(authorization, token, scheme)
+
+
+def remote_token_file(service_id: str, instance: str = "default", directory: Optional[Path] = None) -> Path:
+    return (directory or services_dir()).parent / "tokens" / ("%s.%s.token" % (service_id, instance))
+
+
+def register_remote(*, service_id: str, name: str, origin: str, token: str, instance: str = "default",
+                    summary: Optional[str] = None, doctor: Optional[List[str]] = None,
+                    directory: Optional[Path] = None, installed_by: str = "fabric-service register-remote") -> Path:
+    """DEC-0019, installer side: register an online service on THIS computer — the token file
+    (0600, never printed) and the descriptor. The same token is set on the platform as a secret."""
+    if not token or len(token.strip()) < 16:
+        raise ServiceError("the service token must be at least 16 characters.")
+    root = directory or services_dir()
+    token_file = remote_token_file(service_id, instance, root)
+    descriptor: Dict[str, Any] = {"protocol": PROTOCOL, "id": service_id, "instance": instance, "name": name,
+                                  "placement": "remote", "origin": origin, "auth": {"tokenFile": str(token_file)},
+                                  "lifecycle": {"manager": "none"}, "installedAt": now_iso(), "installedBy": installed_by}
+    if summary:
+        descriptor["summary"] = summary
+    if doctor:
+        descriptor["commands"] = {"doctor": list(doctor)}
+    problems = validate_descriptor(descriptor)
+    if problems:
+        raise ServiceError("Descriptor is invalid: %s." % "; ".join(problems))
+    ensure_private_dir(token_file.parent)
+    atomic_write(token_file, token.strip().encode(), 0o600)
+    return write_descriptor(descriptor, root)
+
+
 def cookie_value(cookie_header: Optional[str], name: str = SESSION_COOKIE) -> Optional[str]:
     for part in (cookie_header or "").split(";"):
         key, _, value = part.strip().partition("=")

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/sample-remote-service.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+// A complete ONLINE Fabric service (fabric-service/0.1, remote placement — DEC-0019): the four
+// protocol routes and a dashboard page, Node.js 20+, no dependencies beside the kit.
+//
+// It runs two ways, the two an online service meets in practice:
+//   - terminating TLS itself:   --tls-cert cert.pem --tls-key key.pem
+//   - behind a platform router that ends TLS (a PaaS): no TLS flags; the router's
+//     `x-forwarded-proto` must say https or the request is refused.
+//
+//   node sample-remote-service.mjs --origin https://agent.example.com --port 8443 \
+//     --token-file token --session-key-file session.key [--tls-cert c.pem --tls-key k.pem]
+//
+// Secrets come from files (or from the platform as FABRIC_SERVICE_TOKEN / FABRIC_SESSION_KEY),
+// never from an argument vector.
+
+import fs from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+import * as k from './fabric-service.mjs';
+
+const args = Object.fromEntries(process.argv.slice(2).reduce((acc, a, i, all) => (a.startsWith('--') ? [...acc, [a.slice(2), all[i + 1]]] : acc), []));
+const origin = args.origin ?? process.env.FABRIC_SERVICE_ORIGIN;
+const port = Number(args.port ?? process.env.PORT ?? 8443);
+const token = args['token-file'] ? fs.readFileSync(args['token-file'], 'utf8').trim() : String(process.env.FABRIC_SERVICE_TOKEN ?? '').trim();
+const key = args['session-key-file'] ? fs.readFileSync(args['session-key-file']) : Buffer.from(String(process.env.FABRIC_SESSION_KEY ?? ''), 'base64');
+if (!origin || k.remoteOriginProblems(origin).length) { console.error(`origin: ${k.remoteOriginProblems(origin).join('; ') || 'missing'}`); process.exit(2); }
+if (token.length < 16) { console.error('the service token is missing or shorter than 16 characters'); process.exit(2); }
+
+const startedAt = k.nowIso();
+const codes = new k.LoginCodes(null, 120, { store: new k.MemoryCodeStore(), key });
+const events = [k.makeEvent('1', startedAt, 'service.started', 'info', 'The example agent started.')];
+const tlsSelf = Boolean(args['tls-cert']);
+
+function send(res, status, body, headers = {}) {
+  const payload = body === null ? '' : (typeof body === 'string' ? body : JSON.stringify(body));
+  res.writeHead(status, { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', ...(body === null || typeof body === 'string' ? {} : { 'Content-Type': 'application/json' }), ...headers });
+  res.end(payload);
+}
+
+function handler(req, res) {
+  const url = new URL(req.url, origin);
+  const refusal = k.checkRemoteRequest(origin, req.headers.host, req.headers.origin, req.headers['sec-fetch-site'], tlsSelf ? undefined : (req.headers['x-forwarded-proto'] ?? 'http'));
+  if (refusal) return send(res, 403, refusal, { 'Content-Type': 'text/plain; charset=utf-8' });
+  const authorized = k.tokenMatches(req.headers.authorization, token);
+
+  if (req.method === 'GET' && url.pathname === '/.well-known/fabric-service') {
+    if (!k.wellKnownAllowed('remote', req.headers.authorization, token)) return send(res, 401, null);
+    return send(res, 200, k.buildWellKnown({
+      id: 'example-agent', instance: 'default', name: 'Example Agent', version: '0.1.0', build: { commit: '0000000' },
+      startedAt, status: 'ready', degraded: [],
+      surfaces: { dashboard: { path: '/', login: true }, events: { path: '/fabric/v1/events' } },
+      summary: [{ label: 'Jobs today', value: events.length }],
+    }));
+  }
+  if (req.method === 'GET' && url.pathname === '/fabric/v1/events') {
+    if (!authorized) return send(res, 401, null);
+    return k.eventsPage(async (after, limit) => events.filter((e) => after === null || Number(e.id) > Number(after)).slice(-limit), url.searchParams.get('after'), k.parseLimit(url.searchParams.get('limit'))).then((page) => send(res, 200, page));
+  }
+  if (req.method === 'POST' && url.pathname === '/fabric/v1/login-code') {
+    if (!authorized) return send(res, 401, null);
+    return send(res, 200, codes.issue());
+  }
+  if (req.method === 'GET' && url.pathname === '/fabric/v1/login') {
+    const session = codes.redeem(url.searchParams.get('code'));
+    if (!session) return send(res, 403, 'This login link has expired or was used. Open the dashboard from Fabric again.', { 'Content-Type': 'text/plain; charset=utf-8' });
+    return send(res, 302, null, { Location: '/', 'Set-Cookie': k.remoteSessionCookieHeader(session) });
+  }
+  if (req.method === 'GET' && url.pathname === '/') {
+    if (!codes.sessionValid(k.cookieValue(req.headers.cookie, k.REMOTE_SESSION_COOKIE))) return send(res, 401, 'Sign in from Fabric Dashboards.', { 'Content-Type': 'text/plain; charset=utf-8' });
+    return send(res, 200, '<!doctype html><meta charset="utf-8"><title>Example Agent</title><h1>Example Agent</h1>', { 'Content-Type': 'text/html; charset=utf-8', 'Content-Security-Policy': "default-src 'none'" });
+  }
+  return send(res, 404, null);
+}
+
+const server = tlsSelf
+  ? https.createServer({ cert: fs.readFileSync(args['tls-cert']), key: fs.readFileSync(args['tls-key']) }, handler)
+  : http.createServer(handler);
+server.listen(port, tlsSelf ? '127.0.0.1' : '0.0.0.0', () => console.log(`example agent on ${origin} (listening on ${port}${tlsSelf ? ', TLS' : ', behind a TLS router'})`));
+for (const sig of ['SIGTERM', 'SIGINT']) process.on(sig, () => server.close(() => process.exit(0)));

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.5.7"
+  version: "0.6.1"
   contract-version: "0.1.0"
-  contract-commit: "74d3852f122f5ca5cbc4138a201483531dfa5006"
+  contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---
 
 # Creating Fabric-compatible agents
@@ -112,7 +112,7 @@ python3 <plugin-dir>/skills/adapting-projects-to-fabric/scripts/adapt_project.py
   --schema-base <immutable-base-uri>
 ```
 
-Pin exactly contract `0.1.0` at commit `74d3852f122f5ca5cbc4138a201483531dfa5006` and
+Pin exactly contract `0.1.0` at commit `2ce392291c6668598d12cd38327e24696b5ca15c` and
 read the pinned guide before implementing protocol details. If this skill is installed
 without its sibling, the scaffolder is absent: create the bundle by hand from the pinned
 contract's `docs/guides/connecting-compatible-agents.md` and mark the structural check

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",