@passioncode-ai/passioncode 0.1.22 → 0.1.24

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.1.24 - 2026-10-03
+
+### Changed
+
+- **`working-in-passioncode` carries the release-signing rule** (knowledge rules §11):
+  - a published build is signed only in CI, in the repository's `release` environment, through
+    `passioncode-ai/.github@v1`;
+  - it is approved by `release-approvers` but not by the tag's author;
+  - no release key lives on a laptop;
+  - an agent never approves a release it started;
+  - a published release is never rewritten.
+
+  The engine line now names its CI release.
+
+## 0.1.23 - 2026-10-03
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.6.2`** (it was `v0.6.1`). `building-fabric-services`
+  now says how a product behaves under a host lifecycle broker — the always-on per-user service
+  agents ask to start, stop and restart products: quit through both the platform's quit and
+  `SIGTERM`, stay in the background when opened non-activating, keep the designated requirement
+  stable, expose honest readiness.
+
 ## 0.1.22 - 2026-10-03
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.6.1",
+      "ref": "v0.6.2",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.6.1",
+      "version": "0.6.2",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.22",
+      "version": "0.1.24",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.6.1",
-      "commit": "d3a4c67262e242b0a4422ecdcf99a7d892db6caa",
-      "version": "0.6.1",
+      "ref": "v0.6.2",
+      "commit": "4b435baac85e343b530af86d56f8b75ac406bc43",
+      "version": "0.6.2",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -22,7 +22,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:654511f4332892aa9a709e1946566d017179edc294e136fbe5c6466c5c32b5c8",
+      "contentHash": "sha256:95fab0fdf3ee1f9171fc7c07edd60313cf52ddb68bb2eb456caf1df8afde36cb",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.22",
+      "ref": "v0.1.24",
       "commit": null,
-      "version": "0.1.22",
+      "version": "0.1.24",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:41d5e5549a6fb2ace8f68766c3fad8fc2c72197b2896a8ae934b1a2029eba0ec",
+      "contentHash": "sha256:e754ad6eab6581d2fba7c887b903c4676239a85ceed74010ccec87b631586816",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.6.1"
+  version: "0.6.2"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -15,7 +15,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.6.1"
+  version: "0.6.2"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
@@ -176,7 +176,8 @@ The installer, not the service, owns the plist and the descriptor. Sequence:
 
 Code runs from an immutable release directory; an upgrade writes a new release,
 rewrites the plist and restarts. Read [the lifecycle reference](references/lifecycle.md)
-for the plist fields, the release layout, log rotation and the Linux case.
+for the plist fields, the release layout, log rotation, behaving under a host lifecycle broker
+and the Linux case.
 
 ## Step 5 — the dashboard and the events
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -56,6 +56,27 @@ On `SIGTERM`: stop accepting new work, append a `service.stopping` event, drain
 in-flight work until `ExitTimeOut` minus a margin, persist what was interrupted so the
 next start resumes it, release the lock, exit 0.
 
+## Being managed by a host lifecycle broker
+
+A host may run a lifecycle broker: one always-on per-user service that agents ask to start,
+stop and restart products, instead of launching or killing them themselves. A product it manages
+has to survive being driven from outside:
+
+- **Quit reaches exit through both doors.** A broker asks the platform's own quit first — on
+  macOS `NSRunningApplication.terminate()`, the path Cmd+Q and the Dock take — and `SIGTERM` a few
+  seconds later. Handle both and exit inside the deadline (fabric-workspace LC-01). A desktop app
+  that answers `SIGTERM` by closing its window and staying alive is stopped late or not at all.
+- **A background launch stays in the background.** A broker opens the app non-activating
+  (`NSWorkspace.OpenConfiguration.activates = false`); do not call `app.focus()`, `show()` on a
+  focused window, or activate on `ready` when nobody asked for a window. Taking focus from the
+  person is the one side effect they always notice.
+- **Identity is the designated requirement.** A broker pins the app by team + bundle id, so an
+  update signed by the same team keeps working and anything else is refused (LC-05). Never ship an
+  ad-hoc or differently signed build to a machine that pins you.
+- **Starting is not ready.** Expose readiness the broker can probe without a person — the
+  well-known document for a service, a process-level answer for a plain app — and keep it honest
+  while the app is still starting.
+
 ## Linux
 
 Until a systemd adapter exists, declare `lifecycle.manager: "none"`. A `systemd --user`

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.6.1"
+  version: "0.6.2"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",

package/payload/plugins/passioncode/skills/working-in-passioncode/SKILL.md

@@ -208,9 +208,17 @@ to a public surface.
   `release.yml` publish when the repository variables `RELEASE_ENABLED` and
   `PUBLISH_NPMJS` are `true`. Check `gh variable list -R passioncode-ai/<repo>` before
   pushing a tag; publishing is a release decision, not a side effect.
-- **Engine** (`project-observatory-dashboard`): contributors send PRs; releases are cut
-  with the maintainer's release tooling, which is maintainer-only. Machines then run
-  `project-observatory full update --check` and `--apply`.
+- **Signing (knowledge rules §11).** A published build is signed only in CI, in the
+  repository's protected `release` environment, through `passioncode-ai/.github@v1`
+  (`apple-signing`, `notarize`, `sign-sums`, `release-publish`). A member of
+  `release-approvers` who is not the tag's author approves it. No release key lives on a
+  laptop, and a locally signed build is a debug build: never attach it. You act as the person
+  whose account you use, so never approve a release you started; start it and say whose
+  approval is pending. A published release is never rewritten. Rehearse on `vX.Y.Z-rc.N` with
+  `publish=false`.
+- **Engine** (`project-observatory-dashboard`): contributors send PRs. A `vX.Y.Z` tag on the
+  reviewed release commit runs its `release.yml`, which signs and publishes in CI. Machines then
+  run `project-observatory full update --check` and `--apply`.
 - **Launcher** (`passioncode`): members are tagged first, `family.json` refs point at
   those tags, the payload is vendored from tags only.
 - **Contract pins.** `fabric-agent-contract` consumers carry explicit commit pins;