@passioncode-ai/passioncode 0.1.26 → 0.1.27

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.27 - 2026-10-04
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.6.3`** (it was `v0.6.2`). `building-fabric-services`
+  and `creating-fabric-agents` say that every credential an agent or service uses comes from
+  Project Observatory, by name: `use_secret.py run --vault-only` for an agent, `use_secret.py
+  serve` for a long-running service, never a `.env` or a key file beside it.
+
 ## 0.1.26 - 2026-10-04
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.6.2",
+      "ref": "v0.6.3",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.6.2",
+      "version": "0.6.3",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.26",
+      "version": "0.1.27",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.6.2",
-      "commit": "4b435baac85e343b530af86d56f8b75ac406bc43",
-      "version": "0.6.2",
+      "ref": "v0.6.3",
+      "commit": "30a1148ba77fe9ed56ea98c218d10ccf2fadf084",
+      "version": "0.6.3",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -22,7 +22,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:95fab0fdf3ee1f9171fc7c07edd60313cf52ddb68bb2eb456caf1df8afde36cb",
+      "contentHash": "sha256:264191fab8632a4f720185c68f79ca74c8fba1a14e50fd2d68957a35303c9c4b",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.26",
+      "ref": "v0.1.27",
       "commit": null,
-      "version": "0.1.26",
+      "version": "0.1.27",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:01035ebeb36b330a3eabad618a5dbd6f8b826b0d008ffc3651db1c9dca932deb",
+      "contentHash": "sha256:91e32c96a96c8c9cecd011b75074f99e90a8df354169a892658ca15931efe434",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.6.2"
+  version: "0.6.3"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -15,7 +15,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.6.2"
+  version: "0.6.3"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
@@ -101,8 +101,12 @@ are in [`scripts/fabric_interop.py`](scripts/fabric_interop.py) and
    digest and the process start time. *(A service ran on stale code after an edit and
    burned budget; nothing showed which build was answering.)*
 5. **State outside code.** Data and config in `~/Library/Application Support/<id>/`,
-   logs in `~/Library/Logs/<id>/`, cache in `~/Library/Caches/<id>/`; secrets in a 0600
-   file. Never inside the service's own code checkout or a release directory; a
+   logs in `~/Library/Logs/<id>/`, cache in `~/Library/Caches/<id>/`; the service's own
+   access token in a 0600 file it generates (principle 6). **Every provider credential the
+   service uses comes from Project Observatory, by name** — the plist starts the service
+   with `use_secret.py serve --consumer <label> <project> <NAME>[,<NAME>] -- <command>`, which
+   reads the vault only and records the consumer so a rotation names it; never a copy of a
+   key in a `.env`, a config file or the plist. Never inside the service's own code checkout or a release directory; a
    repository that versions the data itself is a store and is fine — declare
    `source.repository` so the probe can tell them apart. *(Deleting a checkout left a
    plist launchd retried every 10 s, and the data went with it.)*
@@ -254,7 +258,10 @@ things change and the kits implement each:
    example is [`scripts/sample-remote-service.mjs`](scripts/sample-remote-service.mjs): it runs
    with its own TLS or behind a platform router.
 2. **Secrets live on the platform:** the service token and the session key (32 bytes) are
-   platform secrets, never in the repository, a URL or an argument vector.
+   platform secrets, never in the repository, a URL or an argument vector. A provider key the
+   remote service needs is issued and kept in Project Observatory, pushed to the platform, and
+   the movement recorded with `vault.py moved --at <provider>`, so the platform's copy is
+   known rather than invisible.
 3. **Register it on the operator's computer** — the installer side, run there:
    `registerRemote({ id, name, origin, token })` / `register_remote(...)` writes the token file
    (0600) and the descriptor; pass the token from a file or stdin, never in argv. Public names

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.6.2"
+  version: "0.6.3"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---
@@ -94,6 +94,13 @@ first commit:
 - an `AGENTS.md` that opens with the template's *Read first* block and closes with *After work*,
   and a `CLAUDE.md` whose first line is `@AGENTS.md`.
 
+**Every credential the agent uses comes from Project Observatory, by name**, from its first
+commit: the README's Configure section lists key NAMES; the agent finds them with
+`observatory_credentials` and runs with `use_secret.py run --vault-only` (a long-running
+service: `use_secret.py serve`), with `OBSERVATORY_VAULT_ONLY=1` in its environment. No `.env`
+of its own, no key file beside its data, no value in code, configuration or a commit. A
+workflow names the keys it needs in its checkpoint (`credentials`), never their values.
+
 org-index `scripts/check_format.py` reports 0 findings for it before it is called done. **An agent
 someone builds for themselves is not a PassionCode.ai repository:** its licence is its owner's
 choice, nothing about it is published or listed by the organization, and none of these files is

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",