@passioncode-ai/passioncode 0.1.44 → 0.1.45

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.45 - 2026-10-12
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.21.0`** (it was `v0.20.0`). Fabric Agent Adapter 0.21.0 (FAA-31): both service kits verify the operator's signed estate record (estate-record/1, contract DEC-0055) — the chain of revisions, the passkey's WebAuthn assertion checked offline, the 30-day window and the record's rules — and a delegation gate given the current record trusts a token's key only while that record certifies it. The adapter now pins contract b291bf0.
+
 ## 0.1.44 - 2026-10-12
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.20.0",
+      "ref": "v0.21.0",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.44",
+  "version": "0.1.45",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.20.0",
+      "version": "0.21.0",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.44",
+      "version": "0.1.45",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.1.44",
+  "version": "0.1.45",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.20.0",
-      "commit": "925d052d682572dc4ba60a7e1dea3da5a77a4de7",
-      "version": "0.20.0",
+      "ref": "v0.21.0",
+      "commit": "7dfbb0a7af36dc1a28e266c0ef248168dabc904f",
+      "version": "0.21.0",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -22,7 +22,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:9ae4b03e68e22f96174fff64430c47a7d575471efc5d0303560c4eed9adec038",
+      "contentHash": "sha256:c849515947a8e3ccb28b9bcc570e5cb7a3b417eb5c61e5ab9e1d2a7e656c78ef",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.44",
+      "ref": "v0.1.45",
       "commit": null,
-      "version": "0.1.44",
+      "version": "0.1.45",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:209f32cdc3656684b3622173cfc630add724f38d50bb9d9c3d80d57f926f6981",
+      "contentHash": "sha256:9cca65f79d5971661e6593ae604ab184e1aef8de06c60fbc05b00240cabd84ac",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.20.0"
+  version: "0.21.0"
   contract-version: "0.1.0"
-  contract-commit: "0cacd08b0e95b6abf131eae1206b60792138bc3c"
+  contract-commit: "b291bf09e0a9f9fd3c16cf540832cd021203b7d1"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `0cacd08b0e95b6abf131eae1206b60792138bc3c`.
+- commit `b291bf09e0a9f9fd3c16cf540832cd021203b7d1`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -21,10 +21,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "0cacd08b0e95b6abf131eae1206b60792138bc3c"
+CONTRACT_COMMIT = "b291bf09e0a9f9fd3c16cf540832cd021203b7d1"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.20.0"
+  version: "0.21.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "0cacd08b0e95b6abf131eae1206b60792138bc3c"
+  extension-commit: "b291bf09e0a9f9fd3c16cf540832cd021203b7d1"
 ---
 
 # Building Fabric services
@@ -83,7 +83,9 @@ are in [`scripts/fabric_interop.py`](scripts/fabric_interop.py) and
 [`scripts/fabric-interop.mjs`](scripts/fabric-interop.mjs). When the callers are agents of the estate, the
 service checks each call's delegation token (DEC-0039): read [the delegation reference](references/delegation.md);
 the verifier is [`scripts/fabric_delegation.py`](scripts/fabric_delegation.py) /
-[`scripts/fabric-delegation.mjs`](scripts/fabric-delegation.mjs). When Fabric chooses the service's runner and models
+[`scripts/fabric-delegation.mjs`](scripts/fabric-delegation.mjs). A service on the operator's machines that
+applies the estate record (DEC-0055) verifies each revision first and trusts only the keys it certifies: read
+[the estate record reference](references/estate-record.md). When Fabric chooses the service's runner and models
 (DEC-0046), or a project routes its work through an ordered list of runners (DEC-0026: the doctor's closed probe
 results, the route checks FAC-SEM-028…034), read [the profiles reference](references/profiles.md).
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -16,6 +16,7 @@ contract's own verifier does.
 - Approvals
 - What a refusal looks like
 - Keys and the cache
+- Keys the estate record certifies
 - What the kit does not do
 
 ## Declaring it
@@ -92,6 +93,19 @@ Python kit verifies Ed25519 itself (RFC 8032, standard library only, strict as O
 canonical points, no small-order key); it follows no redirect when it reads the key set; the Node kit uses `node:crypto` and refuses small-order keys
 itself (`isSmallOrderKey`), because Node before 26 lets OpenSSL accept a signature under one.
 
+## Keys the estate record certifies
+
+A verifier that also reads the estate's record (DEC-0055, [the estate record reference](estate-record.md)) trusts a
+`kid` only while a current revision certifies it for a machine and does not revoke it (DL-14). Pass the current
+verified revision as `estate=` / `{ estate }`, as a value or as a function returning it, to `delegation_gate`,
+`verify_delegation` or `verify_approval`.
+- An uncertified `kid` is refused `unauthenticated` (`approval-invalid` for an approval), with detail
+  `kid-not-certified`.
+- An unreadable record is refused `issuer-unavailable`, with detail `estate-unreadable`.
+- Without `estate`, nothing changes.
+- Pass only a revision `verify_estate_record` accepted, and the highest one the machine has applied. The rule trusts
+  what it is given, so an unverified or older revision would certify a key the current one revoked.
+
 ## What the kit does not do
 
 It does not mint tokens, check attenuation against a parent (the issuer's rule, DL-5), check a grant or a spend

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/estate-record.md

@@ -0,0 +1,90 @@
+# The estate record — what the operator's machines are, signed by their passkey (DEC-0055)
+
+Fabric Agent Contract DEC-0055, `docs/specification/estate-record.md`, schema `schemas/estate-record.schema.json`,
+rules `FAC-SEM-072…076`. One revision of one person's estate lists:
+- the passkeys that sign it;
+- the machines, with their device keys and a certificate of each machine's hub key;
+- the packages placed on each machine;
+- where each secret slot is filled from (by reference only);
+- share grants and revocations.
+
+A revision names its parent's digest and is signed by a passkey assertion (WebAuthn Level 3) over a challenge
+derived from its own digest. Python: [`scripts/fabric_estate.py`](../scripts/fabric_estate.py). Node:
+[`scripts/fabric-estate.mjs`](../scripts/fabric-estate.mjs). Both answer the contract's own vectors.
+
+## Contents
+
+- Applying a revision
+- Trusting a delegation key
+- Checking a record you produce
+- What the kit does not do
+
+## Applying a revision
+
+A machine applies a revision only when it is valid against `estate-record.schema.json` **and** the verifier accepts
+it. The verifier does not check the schema.
+
+```python
+verdict = fe.verify_estate_record(record, at=datetime.now(timezone.utc), parent=current)   # revision 2 and later
+verdict = fe.verify_estate_record(record, at=now, authorities=pinned_passkeys)             # revision 1
+if verdict["ok"]:
+    current = record          # verdict: digest, revision, signedBy, signCount
+```
+
+```js
+const verdict = verifyEstateRecord(record, { at: new Date(), parent: current });
+```
+
+It checks, in the order of the ER table:
+1. **The clock.** An unreadable one is `no-clock`, and it comes first.
+2. **The shape.**
+3. **The digest.** SHA-256 over the RFC 8785 form, without `digest` and `signature`.
+4. **The chain to the parent.** Same estate, the next revision number, the parent's digest, never issued before the
+   parent, and no revocation dropped.
+5. **The signer.** The signing passkey must be among the trusted ones and not revoked by the parent. A revision may
+   revoke its own signer: that is rotation.
+6. **The assertion.**
+   - Client data: type, challenge, origin, no cross-origin use.
+   - The RP ID hash, and the user-presence and user-verification flags.
+   - The signature: ES256 or EdDSA, under a key validated first (a valid P-256 point; an Ed25519 key of full order).
+7. **The window.** At most 30 days.
+8. **The record's own rules.** A violation is `rule-violation` with its `codes`.
+
+Dates are strict RFC 3339: a `T`, an offset, and a day that exists. `:60` and a space are refused. Passkey JWK `x`
+and `y` must be canonical base64url. The Python kit verifies ES256 in pure Python (P-256, strict DER), and the Node
+kit through `node:crypto`.
+
+## Trusting a delegation key
+
+A delegation verifier that reads the estate record trusts a token's `kid` only while a current revision certifies it
+for a machine and does not revoke it (DL-14, contract CT-20). Give the gate the current verified revision, or a
+function that returns it:
+
+```python
+gate = fd.delegation_gate(audience=..., jwks=keys, issuer=..., effects=..., estate=lambda: current)
+```
+
+- A `kid` the record does not certify is refused like an unknown key: `unauthenticated` (for an approval,
+  `approval-invalid`) with detail `kid-not-certified`. The same holds when the record names another key under that
+  kid, revokes it, or is outside its window.
+- A record that cannot be read certifies nothing: `issuer-unavailable` with detail `estate-unreadable`.
+- **What you pass in.** Pass only a revision that `verify_estate_record` accepted, and the highest revision the
+  machine has applied. The rule trusts the record it is given. A record nobody verified, or an older revision still
+  inside its window, would certify a key the current revision revoked (a rollback).
+- `hub_key_certified(record, kid, x, at)` / `hubKeyCertified(...)` answers the question on its own.
+
+## Checking a record you produce
+
+`estate_record_rules(kind, value)` / `estateRecordRules(kind, value)` are the contract's rules, finding for finding:
+- `estate-record` (FAC-SEM-072…076);
+- `estate-record-revision` `{parent, next}` (072);
+- `estate-placement` `{record, machine, package}` (074, 075).
+
+`placement_trust(record, machine, agentRef)` names the publisher keys a package verifier trusts for a placed package.
+
+## What the kit does not do
+
+- It does not sign: it holds no passkey and no private key.
+- It does not check the schema or verify packages.
+- It does not attest the authenticator (an assertion carries no attestation).
+- It does not track the signature counter: passkeys sync between devices.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `0cacd08b0e95b6abf131eae1206b60792138bc3c`
+Pinned to `fabric-agent-contract` commit `b291bf09e0a9f9fd3c16cf540832cd021203b7d1`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-delegation.mjs

@@ -14,6 +14,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import net from 'node:net';
 import path from 'node:path';
+import { hubKeyCertified } from './fabric-estate.mjs';
 
 export const REFUSAL_CODES = Object.freeze([
   'unauthenticated', 'token-expired', 'wrong-audience', 'scope-not-granted', 'effect-above-ceiling', 'no-grant',
@@ -252,11 +253,30 @@ function approvalShape(payload) {
  * DL-13, in its fixed order: nothing about a token is believed before its signature is. `now` is seconds since
  * the epoch. Answers {ok: true, claims, principal, caller, chain, kid} or {ok: false, code, detail}.
  */
-export function verifyDelegation(token, { audience, jwks, now, capability, effect, issuer, readOnly } = {}) {
+/**
+ * DL-14 with DEC-0055: a verifier that reads the estate record trusts a kid only while a current revision certifies it
+ * for a machine and does not revoke it. `estate` is a revision the caller verified (fabric-estate.mjs
+ * verifyEstateRecord) or a function returning the current one; undefined skips the rule. `[kind, detail]` or null.
+ */
+function estateProblem(estate, jwks, kid, now) {
+  if (estate === undefined || estate === null) return null;
+  let record;
+  try {
+    record = typeof estate === 'function' ? estate() : estate;
+  } catch {
+    return ['issuer', 'estate-unreadable']; // an unreadable record certifies nothing; it is never a pass
+  }
+  const jwk = jwks.keys.find((candidate) => isObject(candidate) && candidate.kid === kid) ?? {};
+  return hubKeyCertified(record, kid, jwk.x, now) ? null : ['token', 'kid-not-certified'];
+}
+
+export function verifyDelegation(token, { audience, jwks, now, capability, effect, issuer, readOnly, estate } = {}) {
   if (!isString(issuer)) return refuse('issuer-unavailable', 'no-trusted-issuer');
   if (!hasKeys(jwks)) return refuse('issuer-unavailable', 'no-published-keys');
   const checked = authentic(token, jwks, DELEGATION_TYP);
   if ('problem' in checked) return refuse(checked.issuer ? 'issuer-unavailable' : 'unauthenticated', checked.problem);
+  const uncertified = estateProblem(estate, jwks, checked.kid, now);
+  if (uncertified) return refuse(uncertified[0] === 'issuer' ? 'issuer-unavailable' : 'unauthenticated', uncertified[1]);
   const shaped = delegationShape(checked.compact.payload);
   if ('problem' in shaped) return refuse('unauthenticated', shaped.problem);
   const { claims, depth } = shaped;
@@ -275,13 +295,15 @@ export function verifyDelegation(token, { audience, jwks, now, capability, effec
 }
 
 /** DL-18: approval-required carries the digest; any fault is approval-invalid; the jti is consumed last. */
-export function verifyApproval(approval, { audience, jwks, now, actionDigest: expected, issuer, jtiStore } = {}) {
+export function verifyApproval(approval, { audience, jwks, now, actionDigest: expected, issuer, jtiStore, estate } = {}) {
   if (approval === undefined || approval === null || approval === '') return refuse('approval-required', 'no-approval', { actionDigest: expected });
   if (!isObject(jtiStore) || typeof jtiStore.consume !== 'function') return refuse('unknown-state', 'no-jti-store');
   if (!isString(issuer)) return refuse('issuer-unavailable', 'no-trusted-issuer');
   if (!hasKeys(jwks)) return refuse('issuer-unavailable', 'no-published-keys');
   const checked = authentic(approval, jwks, APPROVAL_TYP);
   if ('problem' in checked) return refuse(checked.issuer ? 'issuer-unavailable' : 'approval-invalid', checked.problem);
+  const uncertified = estateProblem(estate, jwks, checked.kid, now);
+  if (uncertified) return refuse(uncertified[0] === 'issuer' ? 'issuer-unavailable' : 'approval-invalid', uncertified[1]);
   const claims = approvalShape(checked.compact.payload);
   if (!claims) return refuse('approval-invalid', 'malformed-claims');
   if (claims.iss !== issuer) return refuse('approval-invalid', 'wrong-issuer');
@@ -447,7 +469,7 @@ export const TIERS = Object.freeze(['T0', 'T1', 'T2']);
  * relayed from off the machine). A T0 or T1 caller is never required to present a token: with none, the call passes
  * with no delegation. A present token is verified at every tier. `issuer` (auth.delegation.issuer) is required.
  */
-export function delegationGate({ audience, jwks, effects, issuer, readOnly = false, clock = () => Date.now() / 1000 }) {
+export function delegationGate({ audience, jwks, effects, issuer, readOnly = false, clock = () => Date.now() / 1000, estate }) {
   if (!isString(issuer)) throw new Error('the gate needs the issuer it trusts (auth.delegation.issuer)');
   return async (tool, headers, tier = 'T2') => {
     const effect = effects?.[tool];
@@ -458,7 +480,7 @@ export function delegationGate({ audience, jwks, effects, issuer, readOnly = fal
       return refuse('unauthenticated', 'no-token');
     }
     const keys = jwks instanceof JwksCache ? await jwks.get(kidOf(carried.token)) : jwks;
-    const verdict = verifyDelegation(carried.token, { audience, jwks: keys, now: clock(), capability: tool, effect, readOnly, issuer });
+    const verdict = verifyDelegation(carried.token, { audience, jwks: keys, now: clock(), capability: tool, effect, readOnly, issuer, estate });
     if (verdict.ok) verdict.tier = TIERS.includes(tier) ? tier : 'T2';
     return verdict;
   };