@passioncode-ai/passioncode 0.1.33 → 0.1.35

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.1.35 - 2026-10-12
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.11.1`** (it was `v0.10.0`). A service built with the kit can now check a
+  delegation token and an operator's approval offline, in Python and Node, with the same answers as the Fabric Agent
+  Contract's own verifier (DEC-0039). It can put a gate in front of its MCP tools, so each call names the person it
+  is for, the calling agent and the chain, and an approval is used once. The Node kit refuses small-order Ed25519
+  keys itself (Node 20 and 22 accepted a forged signature under one). The contract pin is unchanged at `8e49fbd`.
+
+## 0.1.34 - 2026-10-11
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.10.0`** (it was `v0.9.0`). A security fix from Fabric Agent Contract
+  DEC-0039: a service built with the kit now ends an operator's dashboard session on the server. A session
+  ends 12 h after it was last used, 7 days after sign-in, on logout, or when the service token rotates.
+  Before, it lasted as long as a 30-day cookie, and the server checked only its signature. Operators sign in once more after a
+  service upgrades; the host does it on the page's 401. The conformance probe treats `surfaces.mcp.auth:
+  "delegation"` like `own` (DL-16) and checks the session cookie's lifetime. The default contract pin moves to
+  `8e49fbd`; bundles issued under the earlier revisions stay valid.
+
 ## 0.1.33 - 2026-10-11
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.9.0",
+      "ref": "v0.11.1",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.9.0",
+      "version": "0.11.1",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.33",
+      "version": "0.1.35",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.9.0",
-      "commit": "7e45e6be5f17e0a638acf41e3a6b499aa410127a",
-      "version": "0.9.0",
+      "ref": "v0.11.1",
+      "commit": "ea7efbea9a6eba6615881103035cf1a0bdec8db8",
+      "version": "0.11.1",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -22,7 +22,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:991de28ab45fdcf9ee364ccbaefa9e7b147608b5928aae5d239e478244e078f4",
+      "contentHash": "sha256:71ec7cc98186f74e36dc82839fe8dea7b95454bca70f41e8f66cd7f8aaa9aaf7",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.33",
+      "ref": "v0.1.35",
       "commit": null,
-      "version": "0.1.33",
+      "version": "0.1.35",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:3fed1a8d8775dc09826ff7e4edefb10a99827b97dd6cd0fe8345388b7e501a0d",
+      "contentHash": "sha256:afeca4f36bf8ce531b78d77f071a7e3ade1944eba31869916d711c9a191d1580",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.9.0",
+  "version": "0.11.1",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.9.0"
+  version: "0.11.1"
   contract-version: "0.1.0"
-  contract-commit: "a83bec6b47776af688402c18efec507143061f68"
+  contract-commit: "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `a83bec6b47776af688402c18efec507143061f68`.
+- commit `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -16,10 +16,10 @@ from urllib.parse import urlparse
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "a83bec6b47776af688402c18efec507143061f68"
+CONTRACT_COMMIT = "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.9.0"
+  version: "0.11.1"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "a83bec6b47776af688402c18efec507143061f68"
+  extension-commit: "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
 ---
 
 # Building Fabric services
@@ -80,7 +80,10 @@ each manifest capability is the tool of its name, long work is a job with a stab
 a question for a person is an elicitation, and every call carries one trace. Read
 [the interop reference](references/interop.md) before writing an MCP tool; the helpers
 are in [`scripts/fabric_interop.py`](scripts/fabric_interop.py) and
-[`scripts/fabric-interop.mjs`](scripts/fabric-interop.mjs).
+[`scripts/fabric-interop.mjs`](scripts/fabric-interop.mjs). When the callers are agents of the estate, the
+service checks each call's delegation token (DEC-0039): read [the delegation reference](references/delegation.md);
+the verifier is [`scripts/fabric_delegation.py`](scripts/fabric_delegation.py) /
+[`scripts/fabric-delegation.mjs`](scripts/fabric-delegation.mjs).
 
 ## Step 2 — the non-negotiables
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -0,0 +1,84 @@
+# Delegation — checking who acts for whom (DEC-0039)
+
+A service that other agents of the estate call checks each call offline with the kit's verifier: the estate hub
+signs a delegation token naming the person (`sub`), the actor chain (`act`), this service (`aud`), the
+capabilities (`scope`) and the effect ceiling (`effect`); the service checks the signature against the estate's
+published keys and answers `ok` or one refusal code. Contract: `docs/specification/delegation.md` (DL-1…DL-19)
+at the pin. Python: [`scripts/fabric_delegation.py`](../scripts/fabric_delegation.py); Node:
+[`scripts/fabric-delegation.mjs`](../scripts/fabric-delegation.mjs). Both answer the shared vectors exactly as the
+contract's own verifier does.
+
+## Contents
+
+- Declaring it
+- Wiring the gate
+- Approvals
+- What a refusal looks like
+- Keys and the cache
+- What the kit does not do
+
+## Declaring it
+
+In the well-known document: `surfaces.mcp.auth: "delegation"` (only delegation tokens) and
+`auth.delegation: {issuer, jwks}` — the `iss` you trust (`urn:fabric:estate:<id>`) and where the key set is read.
+The descriptor's token stays the host's: it is never a caller's credential on `/mcp` (DL-12). The probe checks
+the declaration (`auth.delegation-declared`) and that `/mcp` refuses the descriptor token.
+
+## Wiring the gate
+
+```python
+import fabric_delegation as fd, fabric_interop as fi
+keys = fd.JwksCache(well_known["auth"]["delegation"]["jwks"])          # https, loopback http, or a file
+gate = fd.delegation_gate(audience="example-agent", jwks=keys, issuer=well_known["auth"]["delegation"]["issuer"],
+                          effects={"example.write": "draft", "example.publish": "publish"})   # each tool's manifest effect
+server = fi.McpToolServer("example-agent", VERSION, authorize=gate)    # pass the request headers to handle()
+# in a handler: ctx.delegation["principal"], ["caller"], ["chain"] — record the chain with the work
+```
+
+```js
+import { JwksCache, delegationGate, refusalToolResult } from './fabric-delegation.mjs';
+const gate = delegationGate({ audience: 'example-agent', jwks: new JwksCache(wk.auth.delegation.jwks), issuer: wk.auth.delegation.issuer,
+  effects: { 'example.write': 'draft' } });
+const verdict = await gate(params.name, req.headers);
+if (!verdict.ok) return refusalToolResult(verdict);
+```
+
+The token is read from `Fabric-Delegation` first (a forwarded call; present but empty is refused, never skipped),
+then from `Authorization: Bearer` when the bearer is a delegation JWT (DL-9, DL-10). A tool with no declared
+effect is refused (`unknown-state`), never guessed. The checks run in the DL-13 order; nothing about a token is
+believed before its signature. The built-in job tools (`fabric.job.get`, `fabric.job.cancel`) are gated too: by the
+job's own capability and effect, and only for the principal and caller that started the job (another caller is
+`scope-not-granted`); `on_input` gets the checked delegation on its context. Start jobs with `ctx.start_job()` so the
+job records who started it.
+
+## Approvals
+
+An action with an external effect may need the operator's approval (DL-17, DL-18). The order is fixed: the token,
+then the grant check where there is one, then `verify_approval` / `verifyApproval`, which consumes the approval's
+`jti` last, then the action. Without an approval, answer `approval-required` with
+`action_digest(action)` / `actionDigest(action)` — the SHA-256 of the action's RFC 8785 form (`jcs`) — so the caller
+can ask the hub. Keep consumed ids in `FileJtiStore` (0600, survives a restart); `MemoryJtiStore` is for tests
+and `UNSAFE_NO_JTI_STORE` exists only by name. No store at all, or a store file that cannot be read, is
+`unknown-state` — never a pass.
+
+## What a refusal looks like
+
+DL-19: an MCP tool answers `refusal_tool_result(r)` / `refusalToolResult(r)` — `isError: true` and
+`structuredContent: {error: {code, message, data: {detail}}}`; an HTTP route answers `refusal_http(r)` /
+`refusalHttp(r)` with the code's status (401 for `unauthenticated`, `token-expired`, `principal-unproven`, with
+`WWW-Authenticate: Bearer error="invalid_token"`; 503 for `issuer-unavailable` and `unknown-state`; 403 for the
+rest). `detail` is a short machine word; the token, the approval and the keys never appear in a result or a log.
+
+## Keys and the cache
+
+`JwksCache` holds the estate's key set at most 10 minutes and, on a `kid` it does not hold, re-reads at most once
+a minute (DL-15), and waits 10 s after a failed read before trying again; after 10 minutes without a successful read it answers nothing, and the verifier says
+`issuer-unavailable`. It reads https, http on loopback only, or a file; a URL with credentials is refused. The
+Python kit verifies Ed25519 itself (RFC 8032, standard library only, strict as OpenSSL: `S` below the group order,
+canonical points, no small-order key); it follows no redirect when it reads the key set; the Node kit uses `node:crypto` and refuses small-order keys
+itself (`isSmallOrderKey`), because Node before 26 lets OpenSSL accept a signature under one.
+
+## What the kit does not do
+
+It does not mint tokens, check attenuation against a parent (the issuer's rule, DL-5), check a grant or a spend
+window (the meter's, DL-21), or decide which actions need an approval — the service decides that.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,11 +1,20 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `a83bec6b47776af688402c18efec507143061f68`
+Pinned to `fabric-agent-contract` commit `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
-DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036). The contract's schemas are normative;
+DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
+delegation and the operator session's lifetime DEC-0039). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
+## Contents
+
+- Descriptor — written by the installer
+- Well-known document
+- Events page
+- Login code and the operator session
+- Semantic rules a host applies
+
 ## Descriptor — written by the installer
 
 Directory: macOS `~/Library/Application Support/ai.passioncode.fabric/services/`,
@@ -59,6 +68,11 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   ED-9): `minWidth` 360…1280 (required), `appearance` ⊆ `scheme`, `theme`, `themes`, `kit`
   (`name@semver`), nothing else. The kits build it with `dashboard_extension()` /
   `dashboardExtension()`; see [the dashboard kit reference](dashboard-kit.md).
+- `surfaces.mcp.auth`: `descriptor` (default), `own` (DEC-0024) or `delegation` (DEC-0039, DL-16):
+  the MCP surface takes only the estate's delegation tokens, and the top-level
+  `auth.delegation {issuer, jwks}` is then required. With `own` or `delegation` the descriptor's
+  token is not an MCP credential: a host and the probe never call `/mcp` with it as a caller.
+  The kits verify them with `fabric_delegation` / `fabric-delegation.mjs` ([delegation](delegation.md)).
 
 ## Events page — `GET /fabric/v1/events?after=<cursor>&limit=<n>`
 
@@ -78,11 +92,14 @@ empty, or `null` for an empty log. Retain at least seven days or 1000 events.
 path on the service origin, never an absolute URL. Optional SSE stream at
 `surfaces.events.stream` carrying the same objects.
 
-## Login code — `POST /fabric/v1/login-code`
+## Login code and the operator session — `POST /fabric/v1/login-code`
 
 Token required → `{ "url": "/fabric/v1/login?code=<16–256 url-safe chars>", "expiresAt": "…" }`,
 single use, at most 120 s, recorded as used before it is honoured. `GET` that URL →
 `Set-Cookie` `HttpOnly; SameSite=Strict`, `302` to `surfaces.dashboard.path`.
+The session it starts ends 12 h after its last use, 7 days after sign-in, on logout and when the
+descriptor token rotates (DEC-0039); a service may shorten either bound, never lengthen one. An
+ended session answers `401` on the dashboard page.
 
 ## Semantic rules a host applies
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/remote-placement.md

@@ -36,9 +36,11 @@ same objects — well-known document, events feed, login code — at the same pa
 - **Token**: a random value of at least 16 characters (32 bytes recommended), set as a secret;
   the same value is written on the operator's computer by `registerRemote`. Compare in constant
   time (`tokenMatches`).
-- **Session key**: 32 random bytes, a separate secret. With it, sessions survive a deploy; without
-  it, every deploy signs the operator out.
-- **Codes**: `MemoryCodeStore` — a restart forgets every outstanding code, so none can be replayed.
+- **Session key**: 32 random bytes, a separate secret; rotating it signs every operator out.
+- **Codes and sessions**: `MemoryCodeStore` — a restart forgets every outstanding code, so none
+  can be replayed, and every session record, so a deploy signs the operator out (DEC-0039: the
+  server keeps each session's last use and logout). The host signs in again on the page's `401`.
+  To keep sessions across a deploy, pass a durable store (any object with `load()` and `save()`).
   Several processes behind one origin need a shared store (a database row with the same
   "used before honoured" write); memory works for one process.
 - **Behind a router**: check the platform-set forwarded scheme; `Host` is preserved by common
@@ -68,4 +70,5 @@ reach the service, and still need its own `403`.
 
 Rotate the token by setting the new value on the platform and re-running `registerRemote` on the
 operator's computer with it; the old token stops working the moment the platform restarts with the
-new value. Rotate the session key on the platform to sign every operator out.
+new value, and so does every session begun under it when `LoginCodes` has `token=`. Rotate the
+session key on the platform to sign every operator out.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/surfaces-and-auth.md

@@ -12,6 +12,11 @@
   for agents, `host.token` named by the descriptor), declare `surfaces.mcp.auth: "own"`, and
   make `/mcp` refuse the host's token. `check_service.py` then checks only that refusal
   (`interop.mcp-own-auth`) and leaves the caller rules NOT_RUN.
+- **Delegation (DEC-0039, DL-16).** `surfaces.mcp.auth: "delegation"` means `/mcp` takes only
+  the estate's delegation tokens; declare `auth.delegation {issuer, jwks}` in the well-known
+  document. The probe treats it like `own` and checks the declaration
+  (`auth.delegation-declared`). The kits verify the tokens: put `delegation_gate` /
+  `delegationGate` in front of the tools — see [the delegation reference](delegation.md).
 - Register it into a client config with the service's own command
   (`<tool> mcp-register`), which writes `{"type":"http","url":"http://127.0.0.1:<port>/mcp","headers":{...}}`
   atomically, aborts if the file changed meanwhile, and keeps one 0600 backup. The token
@@ -50,8 +55,20 @@ else will notice it expire.
 - `POST /fabric/v1/login-code` (token) → single-use code, at most 120 s, persisted as
   used before it is honoured, burned even when expired.
 - `GET /fabric/v1/login?code=` → `HttpOnly; SameSite=Strict` cookie, 302 to the
-  dashboard. Sessions are HMAC-signed; `revoke_all` rotates the key and ends every
-  session at once.
+  dashboard. `revoke_all` rotates the session key and ends every session at once.
+- **The session's lifetime (DEC-0039).** A session ends 12 h after its last use, 7 days after
+  the code was redeemed however often it is used, on logout, and when the descriptor token
+  rotates. The server enforces all four, not the cookie: `LoginCodes` signs a claim (session
+  id, sign-in time, token revision) into the cookie and keeps a record per session (last use,
+  logout) in its code store; `session_valid` refuses a session past either bound and refreshes
+  the 12 hours on use (at most one write a minute). Pass `token=` (the descriptor token, or a
+  callable returning the current one), or a rotation goes unseen. `idle_seconds` and
+  `max_seconds` may shorten the bounds; longer values are clamped. The cookie headers default to
+  `Max-Age` 7 days, and the probe's `login.session-lifetime` fails a longer one.
+- **Logout** is the service's own route and a browser write (the custom header below):
+  `codes.logout(cookie)` ends the session for every copy of the cookie, and
+  `expired_session_cookie_header()` (`expiredSessionCookieHeader()`) clears the browser's copy.
+- An ended session answers `401` on the dashboard page itself, so the host can sign in again.
 - Browser writes need the cookie **and** a custom header such as `X-<Tool>-Request: 1`,
   which forces a preflight the service never answers.
 - A dashboard that is deliberately read-open to local pages declares

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -24,6 +24,7 @@ exist. They never call a capability.
 from __future__ import annotations
 
 import argparse
+import email.utils
 import errno
 import http.client
 import json
@@ -416,6 +417,12 @@ class Probe:
                      "the session cookie is __Host-, Secure, Path=/, no Domain" if host_bound else "cookie: %s" % cookie.split(";", 1)[0].split("=")[0])
         self.add("login.single-use", "PASS" if ok else "FAIL",
                  "first redeem HTTP %d (%s), second HTTP %d" % (status1, "cookie ok" if "HttpOnly" in cookie else "no HttpOnly cookie", status2))
+        if cookie:
+            problem = session_lifetime_problem(cookie)
+            self.add("login.session-lifetime", "FAIL" if problem else "PASS",
+                     problem or "the session cookie lives at most 7 days (DEC-0039); the server's own bounds are not observable from here")
+        else:
+            self.add("login.session-lifetime", "NOT_RUN", "no session cookie was set")
 
     # interop (fabric-interop/0.1) ----------------------------------------------------
     # #region probe-interop — docs: plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md#what-the-probe-checks
@@ -479,21 +486,25 @@ class Probe:
             extra = sorted(set(listed) - names)
             self.add("interop.well-known-capabilities", "FAIL" if extra else "PASS",
                      ("listed but not in the manifest: " + ", ".join(extra)) if extra else "%d listed, all in the manifest" % len(listed))
-        own = bool(mcp_surface) and mcp_surface.get("auth") == "own"
+        auth = (mcp_surface or {}).get("auth")
+        # DEC-0024 own, and DEC-0039 DL-16 delegation: the descriptor's token is not an MCP credential.
+        own = bool(mcp_surface) and auth in ("own", "delegation")
+        why = "DL-16, DEC-0039" if auth == "delegation" else "DEC-0024"
+        self.delegation_declared_rule(mcp_surface)
         if own and self.token:
-            # DEC-0024: the MCP surface has credentials of its own and must refuse the host's token.
+            # The MCP surface has credentials of its own and must refuse the host's token.
             try:
                 self.mcp_call("tools/list", {})
-                self.add("interop.mcp-own-auth", "FAIL", "surfaces.mcp.auth is own, yet the MCP surface accepted the descriptor's token")
+                self.add("interop.mcp-own-auth", "FAIL", "surfaces.mcp.auth is %s, yet the MCP surface accepted the descriptor's token (%s)" % (auth, why))
             except OSError as exc:
                 refused = any(code in str(exc) for code in ("HTTP 401", "HTTP 403"))
                 self.add("interop.mcp-own-auth", "PASS" if refused else "NOT_RUN",
-                         ("the MCP surface refuses the host's token (%s), as auth: own says" % exc) if refused else str(exc))
+                         ("the MCP surface refuses the host's token (%s), as auth: %s says (%s)" % (exc, auth, why)) if refused else str(exc))
             except ValueError as exc:
                 self.add("interop.mcp-own-auth", "NOT_RUN", str(exc))
         if not mcp_surface or not self.token or own:
             reason = ("no MCP surface" if not mcp_surface
-                      else "surfaces.mcp.auth is own: the MCP surface takes its callers' credentials, not the host's token (DEC-0024)" if own
+                      else "surfaces.mcp.auth is %s: the MCP surface takes its callers' credentials, not the host's token (%s)" % (auth, why) if own
                       else "no readable token")
             for rule in ("interop.output-schema-object", "interop.tools-match", "interop.job-tools", "interop.unknown-job", "interop.trace-propagation"):
                 self.add(rule, "NOT_RUN", reason)
@@ -513,6 +524,23 @@ class Probe:
                 self.trace_rule(listing, sent)
         self.events_trace_rule(self.events)
 
+    def delegation_declared_rule(self, mcp_surface: Optional[Dict[str, Any]]) -> None:
+        """DL-16 (DEC-0039): a service that accepts delegation tokens names the issuer it trusts and its JWKS
+        in auth.delegation; with surfaces.mcp.auth delegation that declaration is required."""
+        auth = (self.wk or {}).get("auth")
+        declared = auth.get("delegation") if isinstance(auth, dict) else None
+        required = bool(mcp_surface) and mcp_surface.get("auth") == "delegation"
+        if declared is None and not required:
+            self.add("auth.delegation-declared", "NOT_RUN", "the service declares no delegation")
+            return
+        if not isinstance(declared, dict):
+            self.add("auth.delegation-declared", "FAIL", "surfaces.mcp.auth is delegation, yet auth.delegation is missing (DL-16)")
+            return
+        missing = [k for k in ("issuer", "jwks") if not isinstance(declared.get(k), str) or not declared.get(k)]
+        self.add("auth.delegation-declared", "FAIL" if missing else "PASS",
+                 ("auth.delegation lacks %s (DL-16)" % ", ".join(missing)) if missing
+                 else "auth.delegation names its issuer and JWKS (DL-16)")
+
     def object_root_rule(self, tools: Dict[str, Any]) -> None:
         """FAC-SEM-023 (DEC-0018): every listed tool's outputSchema, when present, has root type object —
         a client may refuse the whole tools/list otherwise, whatever the SDK in the tests accepted."""
@@ -728,6 +756,30 @@ class Probe:
         return self.results
 
 
+def session_lifetime_problem(set_cookie: str, now: Optional[float] = None) -> Optional[str]:
+    """DEC-0039: a session cookie set at sign-in lives at most 7 days. Max-Age wins over Expires (RFC 6265
+    §5.3); a cookie with neither ends with the browser session. None when it is within the bound."""
+    attrs = {}
+    for part in set_cookie.split(";")[1:]:
+        name, _, value = part.strip().partition("=")
+        attrs[name.strip().lower()] = value.strip()
+    bound = fs.OPERATOR_SESSION_MAX_SECONDS
+    if "max-age" in attrs:
+        if not re.fullmatch(r"-?\d+", attrs["max-age"]):
+            return "the session cookie's Max-Age %r is not a number" % attrs["max-age"]
+        if int(attrs["max-age"]) > bound:
+            return "the session cookie's Max-Age %s outlives 7 days (%d s, DEC-0039)" % (attrs["max-age"], bound)
+        return None
+    if "expires" in attrs:
+        try:
+            at = email.utils.parsedate_to_datetime(attrs["expires"]).timestamp()
+        except (TypeError, ValueError, IndexError, OverflowError):
+            return "the session cookie's Expires %r is not a date" % attrs["expires"]
+        if at - (time.time() if now is None else now) > bound:
+            return "the session cookie's Expires %s outlives 7 days (DEC-0039)" % attrs["expires"]
+    return None
+
+
 def _semver(text: str) -> Tuple[int, int, int]:
     m = re.match(r"^(\d+)\.(\d+)\.(\d+)", text or "")
     return (int(m.group(1)), int(m.group(2)), int(m.group(3))) if m else (0, 0, 0)