@passioncode-ai/passioncode 0.1.34 → 0.1.36

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.1.36 - 2026-10-12
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.12.0`** (it was `v0.11.1`). The kit follows Fabric Agent Contract up to
+  DEC-0045. The delegation verifiers are sealed as the contract specifies: the trusted issuer is required, a
+  small-order key is refused as the issuer's fault, and claims are typed strictly. The operator's own machines need no
+  token (trust tiers). The canonical JSON vectors are shared with the contract, and a provider entry may say where its
+  stdio server starts (never once per session). The contract pin is `2eb91c0`.
+
+## 0.1.35 - 2026-10-12
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.11.1`** (it was `v0.10.0`). A service built with the kit can now check a
+  delegation token and an operator's approval offline, in Python and Node, with the same answers as the Fabric Agent
+  Contract's own verifier (DEC-0039). It can put a gate in front of its MCP tools, so each call names the person it
+  is for, the calling agent and the chain, and an approval is used once. The Node kit refuses small-order Ed25519
+  keys itself (Node 20 and 22 accepted a forged signature under one). The contract pin is unchanged at `8e49fbd`.
+
 ## 0.1.34 - 2026-10-11
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.10.0",
+      "ref": "v0.12.0",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.10.0",
+      "version": "0.12.0",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.34",
+      "version": "0.1.36",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.10.0",
-      "commit": "2226d197a5d60cafc6dfb71b1ff91c4fcec4909e",
-      "version": "0.10.0",
+      "ref": "v0.12.0",
+      "commit": "6f07268b0008c53ffa07132c2cde9fde31ad24ad",
+      "version": "0.12.0",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -22,7 +22,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:69faa1f800cfd79d53e1fab195a981de64e1b72fac9d52f522e593646350a999",
+      "contentHash": "sha256:426674360744d0c59e5f51341a46ddf1fad97fea9914050e8804141c1c931637",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.34",
+      "ref": "v0.1.36",
       "commit": null,
-      "version": "0.1.34",
+      "version": "0.1.36",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:8af19415de312c6bc641c003d691351e43bab07cb7fbef81c53e8fd3b5e24d25",
+      "contentHash": "sha256:9064a45fd8f155d8808bce22aa2ca225838ee85332a0b660d6b4ce3e516949fc",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.10.0"
+  version: "0.12.0"
   contract-version: "0.1.0"
-  contract-commit: "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
+  contract-commit: "2eb91c00e852d9c31d804310d38fad91589fcbac"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`.
+- commit `2eb91c00e852d9c31d804310d38fad91589fcbac`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/provider-entry.md

@@ -32,7 +32,10 @@ python3 scripts/fabric_provider.py validate ~/Library/Application\ Support/ai.pa
 python3 scripts/fabric_provider.py remove example-agent      # the uninstaller
 ```
 
-`--stdio` takes the rest of the line as the argument array; there is no shell string.
+`--stdio` takes the rest of the line as the argument array; there is no shell string. An entry may carry
+`run.mcp.stdio.scope` (DEC-0044): `project` (started for the sessions of a project that binds it) or `on-demand`;
+`session` — a server in every coding session — is refused (FAC-SEM-056, LC-19). The validator accepts the field; the
+writer does not set it until Fabric reads it.
 
 It refuses, with one sentence that never quotes a value:
 

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -16,10 +16,10 @@ from urllib.parse import urlparse
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
+CONTRACT_COMMIT = "2eb91c00e852d9c31d804310d38fad91589fcbac"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_provider.py

@@ -116,8 +116,11 @@ def _run_problems(run: Any) -> List[str]:
         return [] if match and 1 <= int(match.group(1)) <= 65535 else ["run.mcp.url is http://127.0.0.1:<port>/mcp"]
     stdio = mcp["stdio"]
     problems: List[str] = []
-    if not isinstance(stdio, dict) or not set(stdio) <= {"command", "env"} or "command" not in stdio:
-        return ["run.mcp.stdio is {command, env?}"]
+    if not isinstance(stdio, dict) or not set(stdio) <= {"command", "env", "scope"} or "command" not in stdio:
+        return ["run.mcp.stdio is {command, env?, scope?}"]
+    # DEC-0044, LC-19: where a host starts the server. A server started in every session is refused (FAC-SEM-056).
+    if "scope" in stdio and stdio["scope"] not in ("project", "on-demand"):
+        problems.append("run.mcp.stdio.scope is project or on-demand; a stdio server started in every session is refused (FAC-SEM-056, LC-19)")
     command = stdio["command"]
     if not isinstance(command, list) or not 1 <= len(command) <= 32 or not all(isinstance(a, str) and a for a in command):
         problems.append("run.mcp.stdio.command is an argument array, never a shell string")

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.10.0"
+  version: "0.12.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5"
+  extension-commit: "2eb91c00e852d9c31d804310d38fad91589fcbac"
 ---
 
 # Building Fabric services
@@ -80,7 +80,10 @@ each manifest capability is the tool of its name, long work is a job with a stab
 a question for a person is an elicitation, and every call carries one trace. Read
 [the interop reference](references/interop.md) before writing an MCP tool; the helpers
 are in [`scripts/fabric_interop.py`](scripts/fabric_interop.py) and
-[`scripts/fabric-interop.mjs`](scripts/fabric-interop.mjs).
+[`scripts/fabric-interop.mjs`](scripts/fabric-interop.mjs). When the callers are agents of the estate, the
+service checks each call's delegation token (DEC-0039): read [the delegation reference](references/delegation.md);
+the verifier is [`scripts/fabric_delegation.py`](scripts/fabric_delegation.py) /
+[`scripts/fabric-delegation.mjs`](scripts/fabric-delegation.mjs).
 
 ## Step 2 — the non-negotiables
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -0,0 +1,98 @@
+# Delegation — checking who acts for whom (DEC-0039)
+
+A service that other agents of the estate call checks each call offline with the kit's verifier: the estate hub
+signs a delegation token naming the person (`sub`), the actor chain (`act`), this service (`aud`), the
+capabilities (`scope`) and the effect ceiling (`effect`); the service checks the signature against the estate's
+published keys and answers `ok` or one refusal code. Contract: `docs/specification/delegation.md` (DL-1…DL-19)
+at the pin. Python: [`scripts/fabric_delegation.py`](../scripts/fabric_delegation.py); Node:
+[`scripts/fabric-delegation.mjs`](../scripts/fabric-delegation.mjs). Both answer the shared vectors exactly as the
+contract's own verifier does.
+
+## Contents
+
+- Declaring it
+- Wiring the gate
+- Who must present a token
+- Approvals
+- What a refusal looks like
+- Keys and the cache
+- What the kit does not do
+
+## Declaring it
+
+In the well-known document: `surfaces.mcp.auth: "delegation"` (only delegation tokens) and
+`auth.delegation: {issuer, jwks}` — the `iss` you trust (`urn:fabric:estate:<id>`) and where the key set is read.
+The descriptor's token stays the host's: it is never a caller's credential on `/mcp` (DL-12). The probe checks
+the declaration (`auth.delegation-declared`) and that `/mcp` refuses the descriptor token.
+
+## Wiring the gate
+
+```python
+import fabric_delegation as fd, fabric_interop as fi
+keys = fd.JwksCache(well_known["auth"]["delegation"]["jwks"])          # https, loopback http, or a file
+gate = fd.delegation_gate(audience="example-agent", jwks=keys, issuer=well_known["auth"]["delegation"]["issuer"],  # required
+                          effects={"example.write": "draft", "example.publish": "publish"})   # each tool's manifest effect
+server = fi.McpToolServer("example-agent", VERSION, authorize=gate)    # pass the request headers to handle()
+# in a handler: ctx.delegation["principal"], ["caller"], ["chain"] — record the chain with the work
+```
+
+```js
+import { JwksCache, delegationGate, refusalToolResult } from './fabric-delegation.mjs';
+const gate = delegationGate({ audience: 'example-agent', jwks: new JwksCache(wk.auth.delegation.jwks), issuer: wk.auth.delegation.issuer,
+  effects: { 'example.write': 'draft' } });
+const verdict = await gate(params.name, req.headers);
+if (!verdict.ok) return refusalToolResult(verdict);
+```
+
+## Who must present a token
+
+DL-25 places each caller in a tier by its origin: **T0** a loopback caller under the owner's account that the
+service's own local floor (the descriptor token, the Host guard) has authenticated; **T1** an enrolled machine of
+the same owner; **T2** everyone else, and any call relayed onto loopback from off the machine (a tunnel, a proxy, the
+hub forwarding a T2 caller). DL-26: a T0 or T1 caller is never required to present a token — pass the tier,
+`gate(tool, headers, tier="T0")` or `server.handle(message, headers, tier="T0")`, and the call passes with no
+delegation. A token such a caller presents is still verified and refused when invalid. A T2 caller takes the whole
+profile. Money limits and human gates bind at every tier.
+
+The token is read from `Fabric-Delegation` first (a forwarded call; present but empty is refused, never skipped),
+then from `Authorization: Bearer` when the bearer is a delegation JWT (DL-9, DL-10). A tool with no declared
+effect is refused (`unknown-state`), never guessed. The checks run in the DL-13 order; nothing about a token is
+believed before its signature. The built-in job tools (`fabric.job.get`, `fabric.job.cancel`) are gated too: by the
+job's own capability and effect, and only for the principal and caller that started the job (another caller is
+`scope-not-granted`); `on_input` gets the checked delegation on its context. Start jobs with `ctx.start_job()` so the
+job records who started it.
+
+## Approvals
+
+An action with an external effect may need the operator's approval (DL-17, DL-18). The order is fixed: the token,
+then the grant check where there is one, then `verify_approval` / `verifyApproval`, which consumes the approval's
+`jti` last, then the action. Without an approval, answer `approval-required` with
+`action_digest(action)` / `actionDigest(action)` — the SHA-256 of the action's RFC 8785 form (`jcs`) — so the caller
+can ask the hub. When the meter denies a grant check, answer `refusal_from_denial(denial)` /
+`refusalFromDenial(denial)`: the meter's code unchanged, its window and level in `error.data` (DL-21 step 6). Keep consumed ids in `FileJtiStore` (0600, survives a restart); `MemoryJtiStore` is for tests
+and `UNSAFE_NO_JTI_STORE` exists only by name. No store at all, or a store file that cannot be read, is
+`unknown-state` — never a pass.
+
+## What a refusal looks like
+
+DL-19: an MCP tool answers `refusal_tool_result(r)` / `refusalToolResult(r)` — `isError: true` and
+`structuredContent: {error: {code, message, data: {detail}}}`; an HTTP route answers `refusal_http(r)` /
+`refusalHttp(r)` with the code's status (401 for `unauthenticated`, `token-expired`, `principal-unproven`, with
+`WWW-Authenticate: Bearer error="invalid_token"`; 503 for `issuer-unavailable` and `unknown-state`; 403 for the
+rest). A published key the service cannot use — of small order, for another use, or published twice — is the
+issuer's fault, `issuer-unavailable` (DEC-0045); a gate without a trusted issuer refuses everything as
+`no-trusted-issuer`. `detail` is a short machine word; the token, the approval and the keys never appear in a result or a log.
+
+## Keys and the cache
+
+`JwksCache` holds the estate's key set at most 10 minutes and, on a `kid` it does not hold, re-reads at most once
+a minute (DL-15), and waits 10 s after a failed read before trying again; after 10 minutes without a successful read it answers nothing, and the verifier says
+`issuer-unavailable`. It reads https, http on loopback only, or a file; a URL with credentials is refused. The
+Python kit verifies Ed25519 itself (RFC 8032, standard library only, strict as OpenSSL: `S` below the group order,
+canonical points, no small-order key); it follows no redirect when it reads the key set; the Node kit uses `node:crypto` and refuses small-order keys
+itself (`isSmallOrderKey`), because Node before 26 lets OpenSSL accept a signature under one.
+
+## What the kit does not do
+
+It does not mint tokens, check attenuation against a parent (the issuer's rule, DL-5), check a grant or a spend
+window (the meter's, DL-21), or decide which actions need an approval — the service decides that.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,9 +1,11 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5`
+Pinned to `fabric-agent-contract` commit `2eb91c00e852d9c31d804310d38fad91589fcbac`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
-delegation and the operator session's lifetime DEC-0039). The contract's schemas are normative;
+delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
+canonical forms DEC-0043; `degraded[].setup` and `run.mcp.stdio.scope` DEC-0044; delegation sealed and trust tiers
+DEC-0045). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
@@ -56,6 +58,9 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
 ```
 
 - `status`: `starting | ready | degraded | stopping`. No answer means `down`.
+- A `degraded[]` entry may carry `setup: true` (DEC-0044): the source waits for a person to finish setting it up
+  (a key not entered, a model not chosen). It is not an outage, and a watcher does not alert on it. The kits pass
+  entries through unchanged.
 - `build` needs `commit` or `digest` (`sha256:<64 hex>`).
 - `summary`: at most six tiles; `attention: true` counts toward the host's badge.
 - `surfaces.events` is required; `dashboard` and `mcp` when the service has them; `usage`
@@ -72,7 +77,7 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   the MCP surface takes only the estate's delegation tokens, and the top-level
   `auth.delegation {issuer, jwks}` is then required. With `own` or `delegation` the descriptor's
   token is not an MCP credential: a host and the probe never call `/mcp` with it as a caller.
-  The kits do not verify delegation tokens yet (a later FAA-20 release).
+  The kits verify them with `fabric_delegation` / `fabric-delegation.mjs` ([delegation](delegation.md)).
 
 ## Events page — `GET /fabric/v1/events?after=<cursor>&limit=<n>`
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/surfaces-and-auth.md

@@ -15,8 +15,8 @@
 - **Delegation (DEC-0039, DL-16).** `surfaces.mcp.auth: "delegation"` means `/mcp` takes only
   the estate's delegation tokens; declare `auth.delegation {issuer, jwks}` in the well-known
   document. The probe treats it like `own` and checks the declaration
-  (`auth.delegation-declared`). The kits do not verify the tokens yet; until they do, name what
-  checks them.
+  (`auth.delegation-declared`). The kits verify the tokens: put `delegation_gate` /
+  `delegationGate` in front of the tools — see [the delegation reference](delegation.md).
 - Register it into a client config with the service's own command
   (`<tool> mcp-register`), which writes `{"type":"http","url":"http://127.0.0.1:<port>/mcp","headers":{...}}`
   atomically, aborts if the file changed meanwhile, and keeps one 0600 backup. The token