@passioncode-ai/passioncode 0.1.21 → 0.1.23

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.1.23 - 2026-10-03
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.6.2`** (it was `v0.6.1`). `building-fabric-services`
+  now says how a product behaves under a host lifecycle broker — the always-on per-user service
+  agents ask to start, stop and restart products: quit through both the platform's quit and
+  `SIGTERM`, stay in the background when opened non-activating, keep the designated requirement
+  stable, expose honest readiness.
+
+## 0.1.22 - 2026-10-03
+
+### Changed
+
+- **Observatory Log is pinned at `v0.13.0`** (plugin 0.14.0; it was `v0.10.0`, plugin 0.13.0),
+  the Project Observatory 0.13.0 hook and skills. The hook and the skills hand over the installed
+  engine's commands (`project-observatory full findings`, `full doctor`) instead of source-tree
+  paths, and the skills' own check runs under the interpreter `full agent install` records. In
+  `handling-secrets`, a vault `PROJECT` is the project's folder name and its registry id resolves to
+  the same folder. `use_secret.py run` takes `--env`, and `vault.py remove` deletes a slot or only
+  its retired archives.
+
 ## 0.1.21 - 2026-10-03
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.6.1",
+      "ref": "v0.6.2",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [
@@ -22,7 +22,7 @@
       "name": "observatory-log",
       "displayName": "Observatory Log",
       "repo": "passioncode-ai/project-observatory-dashboard",
-      "ref": "v0.10.0",
+      "ref": "v0.13.0",
       "kind": "plugin",
       "path": "observatory/engine/skill/plugins/observatory-log",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.6.1",
+      "version": "0.6.2",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -23,7 +23,7 @@
       "name": "observatory-log",
       "displayName": "Observatory Log",
       "source": "./plugins/observatory-log",
-      "version": "0.13.0",
+      "version": "0.14.0",
       "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.21",
+      "version": "0.1.23",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.6.1",
-      "commit": "d3a4c67262e242b0a4422ecdcf99a7d892db6caa",
-      "version": "0.6.1",
+      "ref": "v0.6.2",
+      "commit": "4b435baac85e343b530af86d56f8b75ac406bc43",
+      "version": "0.6.2",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -22,7 +22,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:654511f4332892aa9a709e1946566d017179edc294e136fbe5c6466c5c32b5c8",
+      "contentHash": "sha256:95fab0fdf3ee1f9171fc7c07edd60313cf52ddb68bb2eb456caf1df8afde36cb",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -34,9 +34,9 @@
       "name": "observatory-log",
       "displayName": "Observatory Log",
       "repo": "passioncode-ai/project-observatory-dashboard",
-      "ref": "v0.10.0",
-      "commit": "e1e0110f6618b9541f3e204a548c283005cb6fa9",
-      "version": "0.13.0",
+      "ref": "v0.13.0",
+      "commit": "c7a89125edcd5ee1a8141feb55d4aca2c828e834",
+      "version": "0.14.0",
       "via": "clone of https://***@github.com/passioncode-ai/project-observatory-dashboard.git",
       "skills": [
         "explaining-changes",
@@ -49,7 +49,7 @@
       "legacyMarketplaces": [
         "observatory-log"
       ],
-      "contentHash": "sha256:1514d04e995ecd71df0e0518787d76c9320b02f8174824d08c958846b860fd42",
+      "contentHash": "sha256:3e1218586122889649881d94fdf892f6a51782dc748c26127a9969376ecdf1eb",
       "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.21",
+      "ref": "v0.1.23",
       "commit": null,
-      "version": "0.1.21",
+      "version": "0.1.23",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:63c4bc3c353c3e7b3762c4ab20a50e4684504c142a378c988c73d86049892a50",
+      "contentHash": "sha256:bc40957cac6955093ea1d60c431983adfe48caf09bac39519d4a5716c08526a8",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.6.1"
+  version: "0.6.2"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -15,7 +15,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.6.1"
+  version: "0.6.2"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
@@ -176,7 +176,8 @@ The installer, not the service, owns the plist and the descriptor. Sequence:
 
 Code runs from an immutable release directory; an upgrade writes a new release,
 rewrites the plist and restarts. Read [the lifecycle reference](references/lifecycle.md)
-for the plist fields, the release layout, log rotation and the Linux case.
+for the plist fields, the release layout, log rotation, behaving under a host lifecycle broker
+and the Linux case.
 
 ## Step 5 — the dashboard and the events
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -56,6 +56,27 @@ On `SIGTERM`: stop accepting new work, append a `service.stopping` event, drain
 in-flight work until `ExitTimeOut` minus a margin, persist what was interrupted so the
 next start resumes it, release the lock, exit 0.
 
+## Being managed by a host lifecycle broker
+
+A host may run a lifecycle broker: one always-on per-user service that agents ask to start,
+stop and restart products, instead of launching or killing them themselves. A product it manages
+has to survive being driven from outside:
+
+- **Quit reaches exit through both doors.** A broker asks the platform's own quit first — on
+  macOS `NSRunningApplication.terminate()`, the path Cmd+Q and the Dock take — and `SIGTERM` a few
+  seconds later. Handle both and exit inside the deadline (fabric-workspace LC-01). A desktop app
+  that answers `SIGTERM` by closing its window and staying alive is stopped late or not at all.
+- **A background launch stays in the background.** A broker opens the app non-activating
+  (`NSWorkspace.OpenConfiguration.activates = false`); do not call `app.focus()`, `show()` on a
+  focused window, or activate on `ready` when nobody asked for a window. Taking focus from the
+  person is the one side effect they always notice.
+- **Identity is the designated requirement.** A broker pins the app by team + bundle id, so an
+  update signed by the same team keeps working and anything else is refused (LC-05). Never ship an
+  ad-hoc or differently signed build to a machine that pins you.
+- **Starting is not ready.** Expose readiness the broker can probe without a person — the
+  well-known document for a service, a process-level answer for a plain app — and keep it honest
+  while the app is still starting.
+
 ## Linux
 
 Until a systemd adapter exists, declare `lifecycle.manager: "none"`. A `systemd --user`

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.6.1"
+  version: "0.6.2"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---

package/payload/plugins/observatory-log/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "observatory-log",
   "displayName": "Observatory Log",
   "description": "Records what changed in a watched project at the end of every turn, and asks for the one thing a diff cannot contain: why.",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "license": "AGPL-3.0-only OR LicenseRef-PassionCode-Commercial",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/observatory-log/hooks/ask-why.py

@@ -40,7 +40,7 @@ def main() -> int:
                           "Observatory could NOT record this turn: " + reason +
                           "\n\nThe facts of this turn are not in the ledger. "
                           "`store/raw/record-turn.json` holds the same reason, and "
-                          "`./observatory.py findings` raises it.",
+                          "`project-observatory full findings` raises it.",
                           "suppressOutput": True}))
         return 0
     if r.get("hasWhy"):

package/payload/plugins/observatory-log/skills/explaining-changes/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   decision with different evidence.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.13.0"
+  version: "0.14.0"
 compatibility: >-
   Requires an initialized full Project Observatory installation to persist
   records. Uses its MCP server when available in the current host; the bundled

package/payload/plugins/observatory-log/skills/handling-secrets/SKILL.md

@@ -9,7 +9,7 @@ description: >-
   provider permissions or choosing a project's authentication architecture.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.13.0"
+  version: "0.14.0"
 compatibility: >-
   Requires an initialized full Project Observatory installation, Python 3.11+
   and local shell access on macOS or Linux. Provider operations additionally
@@ -27,9 +27,10 @@ names. Never ask the user to paste a credential into the conversation.
    `OBSERVATORY_ROOT`, or obtain its path with `project-observatory full-path`.
    Do not guess a checkout location or inspect another account's files.
 2. Select the user's initialized `OBSERVATORY_HOME`. Run
-   `python3 "$OBSERVATORY_ROOT/observatory.py" doctor`. A missing workspace
+   `project-observatory full doctor`. A missing workspace
    needs the documented onboarding before secret operations.
-3. Run `python3 "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.13.0`.
+3. Run `"$OBSERVATORY_PYTHON" "$OBSERVATORY_ROOT/tools/skill_check.py" handling-secrets 0.14.0`
+   (`full agent install` records that interpreter; the stock macOS `python3` is too old).
    If stale, read the installed skill once and follow its compatible commands.
    Do not turn an unavailable version check into a retry loop.
 4. Inspect names using `tools/use_secret.py names PROJECT` or `tools/vault.py
@@ -37,8 +38,11 @@ names. Never ask the user to paste a credential into the conversation.
    Never read a value file to discover whether it exists.
 
 All commands below are Python scripts under `OBSERVATORY_ROOT/tools`. `PROJECT`,
-`ENV` and `NAME` are placeholders for existing user-selected names. `ENV` is
-`local`, `stage` or `prod`; choose production only when the task calls for it.
+`ENV` and `NAME` are placeholders for existing user-selected names. `PROJECT` is
+the project's folder name; its registry id (`project:<slug>` or the bare slug) is
+accepted and normalised to that folder, and a name two projects claim is refused.
+`ENV` is `local`, `stage` or `prod`; choose production only when the task calls
+for it. A name or note shaped like a credential is refused, never stored.
 
 ## Use the named door
 
@@ -46,13 +50,14 @@ All commands below are Python scripts under `OBSERVATORY_ROOT/tools`. `PROJECT`,
 |---|---|
 | Store a credential supplied locally | `vault.py put PROJECT ENV NAME`, value on stdin |
 | List slots | `vault.py list PROJECT ENV` |
-| Run a command using a slot | `use_secret.py run PROJECT NAME -- COMMAND ARGUMENTS` |
+| Run a command using a slot | `use_secret.py run [--env ENV] PROJECT NAME -- COMMAND ARGUMENTS` (flags before PROJECT) |
 | Receive a value from another local command | `use_secret.py pipe NAME -- COMMAND ARGUMENTS` |
 | Populate a project's ignored environment file | `vault.py inject PROJECT ENV DIRECTORY` |
 | Record an exposure | `vault.py leak PROJECT ENV NAME --where "location and evidence, no value"` |
 | Replace a stored value | `vault.py rotate PROJECT ENV NAME`, replacement on stdin |
 | Close an exposure after revocation and consumer checks | `vault.py settle PROJECT ENV NAME --how "action" --revocation-evidence "receipt" --consumer-evidence "receipt"` |
 | Record an external movement | `vault.py moved PROJECT ENV NAME --at PROVIDER --how "action and evidence"`; add `--settle` with both evidence flags to also close its exposure |
+| Delete a slot, or only the archives a rotation left | `vault.py remove PROJECT ENV NAME` (refused while its exposure is open unless `--force`), or `vault.py remove PROJECT ENV NAME --retired`; both are journalled |
 | Review unresolved exposures or movements | `vault.py leaks` or `vault.py movements PROJECT` |
 
 Use the installed command's `--help` for optional flags. Avoid placing a value
@@ -135,7 +140,8 @@ By default, slots live under the private workspace's `secrets/projects/`.
 An explicitly configured `sources.secret_store` or `OBSERVATORY_VAULT_DIR`
 can select a separate private store. Such external stores are excluded from
 workspace backups and need their own backup procedure. `vault.py backup`
-requires a configured gateway backup script; do not promise encryption,
+requires a configured gateway backup script (`backup-secrets.sh` at
+`sources.gateway_root` or in its `bin/`); do not promise encryption,
 keychain storage or scheduled backups when that integration is absent.
 
 ## When something is unavailable

package/payload/plugins/observatory-log/skills/tracking-resources/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   the repository.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 metadata:
-  version: "0.13.0"
+  version: "0.14.0"
 compatibility: >-
   Requires a full Project Observatory installation with organizations.json
   configured; the observatory MCP server or its local CLI. Creating the resource
@@ -58,7 +58,7 @@ Report each resource with `observatory_propose`:
  "targetId": "project:<slug>",
  "patch": {"resources": [{"kind": "ga4-property",
                           "identifier": "properties/123456789",
-                          "account": "accounts/162941847",
+                          "account": "accounts/123456789",
                           "url": "https://analytics.google.com/…",
                           "note": "web stream for example.com",
                           "added_on": "2026-09-27",

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",