@passioncode-ai/passioncode 0.1.45 → 0.1.47

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.1.47 - 2026-10-13
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.23.0`** (it was `v0.21.0`). It brings two adapter releases.
+  - **0.22.0 (FAA-12a)** adds the fourth skill, `working-with-fabric`, with the plugin's session hooks. A coding agent opened in a terminal can then work in a project through Fabric's project board.
+  - **0.23.0 (FAA-32)** moves the adapter's contract pin to `fe55fc6`:
+    - a service's supervisor can mark itself with an argument as well as the environment. The Task Scheduler and Project Observatory's node are now recognised, and markers that disagree stop the service before it takes its lock;
+    - a delegation key the estate record certifies follows the contract's verdict and refusal codes;
+    - an estate record may be issued up to 60 s ahead of the clock, and its passkey must sign under a `sign.<domain>` RP;
+    - Windows token files are checked against the contract's reader rule.
+
+## 0.1.46 - 2026-10-12
+
+### Added
+
+- **`update` registers the Fabric Dashboards MCP server for every agent that is present**
+  (`fabric-dashboards`, stdio, the app bundle's `bin/fabric-dashboards-mcp`): Claude Code
+  through `claude mcp add --scope user`, Codex CLI as a `["mcp_servers"."fabric-dashboards"]`
+  table appended to `~/.codex/config.toml`, Gemini CLI and Kimi Code in the `mcpServers` of
+  `~/.gemini/settings.json` and `$KIMI_CODE_HOME/mcp.json`. A machine without the app skips
+  the step; an entry that already points at the same command is left alone, and one that
+  points elsewhere, or is declared in a form the launcher does not edit, is reported and
+  kept. Each registration is journalled before the file changes and removed again by
+  `restore` and `uninstall` only while it is still exactly what the launcher wrote
+  ([ADR-0003](docs/adr/0003-fabric-dashboards-mcp-registration.md)).
+
 ## 0.1.45 - 2026-10-12
 
 ### Changed

package/README.md

@@ -55,6 +55,12 @@ out of it, even when they implement Fabric protocols.
   `~/.passioncode/quarantine/` — `npx @passioncode-ai/passioncode@latest restore` puts them back.
 - Each version is an immutable release under `~/.passioncode/releases/<version>`; an update
   keeps the release it replaced for rollback and removes older ones.
+- When the Fabric Dashboards app is installed, `update` also registers its MCP server
+  (`fabric-dashboards`) for every agent that is present — Claude Code (through
+  `claude mcp add --scope user`), Codex CLI (`~/.codex/config.toml`), Gemini CLI
+  (`~/.gemini/settings.json`) and Kimi Code (`~/.kimi-code/mcp.json`). An entry that
+  already points at the same command is left alone; one that points elsewhere is reported
+  and kept. `restore` and `uninstall` remove what the launcher added.
 
 ## Staying current
 

package/SECURITY.md

@@ -11,7 +11,12 @@ that replaces it is verified. For a member's old single-member marketplace
 (`legacyMarketplaces` in `family.json`), once that plugin is verified and nothing else
 installed comes from it, it also moves the `extraKnownMarketplaces` entry out of
 `~/.claude/settings.json` (a copy of the file is kept in the quarantine) and runs
-`claude plugin marketplace remove <name>`. Displaced files are moved rather than
+`claude plugin marketplace remove <name>`. When the Fabric Dashboards app is installed it
+also registers a `fabric-dashboards` MCP entry for every agent that is present: through
+`claude mcp add --scope user` for Claude Code (it never writes `~/.claude.json` itself),
+and in `~/.codex/config.toml`, `~/.gemini/settings.json` and `~/.kimi-code/mcp.json`,
+copying each existing file into the quarantine first; an entry that already exists is
+left alone and reported. Displaced files are moved rather than
 deleted: a recovery record is written before the move in
 `~/.passioncode/quarantine/<run>/moved.json`. `restore` processes the latest batch,
 checkpoints completed entries and refuses to overwrite a conflicting user replacement.

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.21.0",
+      "ref": "v0.23.0",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/lib/launcher.js

@@ -2,8 +2,9 @@
 /**
  * The PassionCode.ai launcher: installs the vendored payload as one release,
  * gives Claude Code the plugins through a local marketplace, gives every other
- * agent the same skills through the ~/.agents/skills hub, and removes what
- * would shadow them — reversibly. Every step is recorded; nothing is deleted.
+ * agent the same skills through the ~/.agents/skills hub, registers the Fabric
+ * Dashboards MCP server for every agent that is present, and removes what would
+ * shadow them — reversibly. Every step is recorded; nothing is deleted.
  *
  * One channel per agent: Claude Code reads plugins, so nothing is written to
  * ~/.claude/skills (a plain copy there shadows the plugin and serves its frozen
@@ -47,6 +48,12 @@ function writeJson(file, value) {
   fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n');
   fs.renameSync(tmp, file);
 }
+function writeText(file, text) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, text);
+  fs.renameSync(tmp, file);
+}
 function lstat(p) { try { return fs.lstatSync(p); } catch (_) { return null; } }
 function linkTarget(p) { try { return fs.readlinkSync(p); } catch (_) { return null; } }
 function pointsTo(at, target) { const link = linkTarget(at); return link !== null && path.resolve(path.dirname(at), link) === target; }
@@ -187,6 +194,103 @@ function marketplaceAddArg(source) {
   return source.url || source.repo || source.path || null;
 }
 
+const MCP_NAME = 'fabric-dashboards';
+const MCP_COMMAND = () => process.env.PASSIONCODE_FABRIC_DASHBOARDS_MCP
+  || '/Applications/Fabric Dashboards.app/Contents/Resources/bin/fabric-dashboards-mcp';
+
+/**
+ * The agents besides Claude Code the Fabric Dashboards MCP server is registered for, and
+ * the file each keeps its MCP configuration in. An agent is present when its directory
+ * is; a missing file under a present agent is created. Claude Code is registered through
+ * its own CLI instead: every running session rewrites ~/.claude.json, so a second writer
+ * there would lose one side's change.
+ */
+function mcpFileTargets(home) {
+  const kimiHome = process.env.KIMI_CODE_HOME || path.join(home, '.kimi-code');
+  return [
+    { agent: 'Codex CLI', dir: path.join(home, '.codex'), file: path.join(home, '.codex', 'config.toml'), kind: 'toml' },
+    { agent: 'Gemini CLI', dir: path.join(home, '.gemini'), file: path.join(home, '.gemini', 'settings.json'), kind: 'json' },
+    { agent: 'Kimi Code', dir: kimiHome, file: path.join(kimiHome, 'mcp.json'), kind: 'json' },
+  ];
+}
+
+/** The line range of the `["mcp_servers"."<name>"]` table in a TOML text, or null. */
+function tomlTableRange(text, name) {
+  const lines = text.split('\n');
+  const header = new RegExp(`^\\s*\\[\\s*["']?mcp_servers["']?\\s*\\.\\s*["']?${name}["']?\\s*\\]\\s*(?:#.*)?$`);
+  for (let i = 0; i < lines.length; i++) {
+    if (!header.test(lines[i])) continue;
+    let end = lines.length;
+    for (let j = i + 1; j < lines.length; j++) {
+      if (/^\s*\[/.test(lines[j])) { end = j; break; }
+    }
+    return { start: i, end, lines };
+  }
+  return null;
+}
+
+/**
+ * Any other way a TOML text can already define the server — a sub-table such as
+ * `[mcp_servers.<name>.env]` or an inline `<name> = { … }` under `[mcp_servers]`.
+ * Appending a table then would declare the key twice and Codex would refuse the file.
+ */
+function tomlMentions(text, name) {
+  return new RegExp(`^\\s*\\[\\s*["']?mcp_servers["']?\\s*\\.\\s*["']?${name}["']?\\s*\\.`, 'm').test(text)
+    || new RegExp(`^\\s*["']?${name}["']?\\s*=`, 'm').test(text);
+}
+
+/** The `command` of a TOML table range: the string, null when absent, undefined when unreadable. */
+function tomlTableCommand(range) {
+  for (let i = range.start + 1; i < range.end; i++) {
+    const m = /^\s*command\s*=\s*("(?:[^"\\]|\\.)*")\s*(?:#.*)?$/.exec(range.lines[i]);
+    if (m) { try { return JSON.parse(m[1]); } catch (_) { return undefined; } }
+  }
+  return null;
+}
+
+function mcpTomlTable(command) {
+  return `["mcp_servers"."${MCP_NAME}"]\ncommand = ${JSON.stringify(command)}\nargs = []\n`;
+}
+
+/** Two MCP entries are the same when their JSON lines up at every depth, key order aside. */
+function sameEntry(a, b) {
+  const canon = (v) => (v && typeof v === 'object' && !Array.isArray(v)
+    ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, canon(v[k])]))
+    : Array.isArray(v) ? v.map(canon) : v);
+  return JSON.stringify(canon(a)) === JSON.stringify(canon(b));
+}
+
+/**
+ * Remove an MCP entry the launcher added, only while it is still exactly that entry.
+ * Returns a note, or null when the entry is already gone. Never deletes the file.
+ */
+function removeMcpRegistration(record, claude) {
+  const kept = (why) => `${record.file}: ${record.name} for ${record.agent} ${why}; kept`;
+  const removed = `${record.name} for ${record.agent} removed from ${record.file}`;
+  if (record.file.endsWith('.toml')) {
+    let text;
+    try { text = fs.readFileSync(record.file, 'utf8'); } catch (_) { return null; }
+    const range = tomlTableRange(text, record.name);
+    if (!range) return null;
+    if (tomlTableCommand(range) !== record.entry.command) return kept('was changed');
+    writeText(record.file, range.lines.slice(0, range.start).concat(range.lines.slice(range.end)).join('\n'));
+    return removed;
+  }
+  let cfg;
+  try { cfg = readSettings(record.file); } catch (error) { return kept(`could not be read (${error.message})`); }
+  const servers = cfg.doc.mcpServers;
+  if (!servers || !Object.prototype.hasOwnProperty.call(servers, record.name)) return null;
+  if (!sameEntry(servers[record.name], record.entry)) return kept('was changed');
+  if (record.via === 'claude') {
+    if (!claude.available()) return kept('is registered with Claude Code, whose CLI was not found');
+    const r = claude.run(['mcp', 'remove', '--scope', 'user', record.name]);
+    return r.code === 0 ? removed : kept(`could not be removed (${r.out || 'claude mcp remove failed'})`);
+  }
+  delete servers[record.name];
+  writeJson(record.file, cfg.doc);
+  return removed;
+}
+
 function payloadManifest(dir = PAYLOAD()) {
   const m = readJson(path.join(dir, 'manifest.json'), null);
   if (!m || !Array.isArray(m.members)) throw new Error(`No payload in ${dir}: the package is incomplete (run scripts/vendor.mjs).`);
@@ -391,7 +495,93 @@ function update({ home, dryRun = false, claude = claudeRunner(), log = () => {}
     }
   }
 
-  // 5. The launcher's own releases: keep this one and the one it replaced, remove the rest.
+  // 5. The Fabric Dashboards MCP server, for every agent that is present. Entries a
+  //    person or another tool set are never rewritten: a matching entry is left, a
+  //    different one is reported. What the launcher adds is journalled before it is
+  //    written, so restore and uninstall can take it out again.
+  const registered = [];
+  const mcpCommand = MCP_COMMAND();
+  const mcpBackup = (file, agent) => {
+    if (!lstat(file)) return null;
+    fs.mkdirSync(quarantineDir, { recursive: true });
+    const backup = path.join(quarantineDir, `${path.basename(file)}.before-mcp-${agent.toLowerCase().replace(/[^a-z0-9]+/g, '-')}`);
+    fs.copyFileSync(file, backup);
+    return backup;
+  };
+  const register = (record, write) => step('mcp', `register ${MCP_NAME} for ${record.agent} in ${record.file}`, () => {
+    recordMove(record);
+    write();
+    registered.push({ agent: record.agent, file: record.file, name: record.name, entry: record.entry, ...(record.via ? { via: record.via } : {}) });
+  });
+  const existingNote = (agent, existing) => existing === mcpCommand
+    ? { kind: 'mcp', detail: `${agent} already runs ${MCP_NAME} from ${mcpCommand}`, outcome: 'skipped' }
+    : { kind: 'mcp', detail: `${agent} has its own ${MCP_NAME} entry (${existing || 'not a stdio server'}); it was kept`, outcome: 'skipped' };
+  if (!lstat(mcpCommand)) {
+    steps.push({ kind: 'mcp', detail: `no Fabric Dashboards MCP at ${mcpCommand}; nothing was registered`, outcome: 'skipped' });
+  } else {
+    const claudeJson = path.join(p.home, '.claude.json');
+    if (!hasClaude) {
+      steps.push({ kind: 'mcp', detail: `Claude Code CLI not found; ${MCP_NAME} was not registered for it`, outcome: 'skipped' });
+    } else {
+      let servers = null;
+      try { servers = readSettings(claudeJson).doc.mcpServers || {}; } catch (error) {
+        steps.push({ kind: 'mcp', detail: `keep ${claudeJson}: it could not be read`, outcome: 'failed', error: error.message });
+      }
+      const existing = servers && servers[MCP_NAME];
+      if (existing) steps.push(existingNote('Claude Code', typeof existing === 'object' ? existing.command || existing.url : null));
+      else if (servers) {
+        const entry = { type: 'stdio', command: mcpCommand, args: [], env: {} };
+        register({ kind: 'mcp', via: 'claude', agent: 'Claude Code', file: claudeJson, name: MCP_NAME, entry, backup: null }, () => {
+          const r = claude.run(['mcp', 'add', '--scope', 'user', MCP_NAME, '--', mcpCommand], { cwd: p.state });
+          if (r.code !== 0) throw new Error(r.out || 'claude mcp add failed');
+          const now = readSettings(claudeJson).doc.mcpServers || {};
+          if (!now[MCP_NAME] || now[MCP_NAME].command !== mcpCommand) throw new Error(`Claude Code did not register ${MCP_NAME} in ${claudeJson}`);
+          // What the CLI wrote is what restore and uninstall compare against.
+          entry.type = now[MCP_NAME].type; entry.args = now[MCP_NAME].args; entry.env = now[MCP_NAME].env;
+        });
+      }
+    }
+    for (const target of mcpFileTargets(p.home)) {
+      if (!isDirectory(target.dir)) {
+        steps.push({ kind: 'mcp', detail: `${target.agent} not found; ${MCP_NAME} was not registered for it`, outcome: 'skipped' });
+        continue;
+      }
+      if (target.kind === 'json') {
+        let cfg;
+        try { cfg = readSettings(target.file); } catch (error) {
+          steps.push({ kind: 'mcp', detail: `keep ${target.file}: it could not be read`, outcome: 'failed', error: error.message });
+          continue;
+        }
+        const existing = (cfg.doc.mcpServers || {})[MCP_NAME];
+        if (existing) { steps.push(existingNote(target.agent, typeof existing === 'object' ? existing.command || existing.url : null)); continue; }
+        const entry = { command: mcpCommand, args: [], env: {} };
+        register({ kind: 'mcp', agent: target.agent, file: target.file, name: MCP_NAME, entry, backup: mcpBackup(target.file, target.agent) }, () => {
+          cfg.doc.mcpServers = { ...(cfg.doc.mcpServers || {}), [MCP_NAME]: entry };
+          writeJson(target.file, cfg.doc);
+        });
+      } else {
+        let text = '';
+        try { text = fs.readFileSync(target.file, 'utf8'); } catch (error) {
+          if (error.code !== 'ENOENT') {
+            steps.push({ kind: 'mcp', detail: `keep ${target.file}: it could not be read`, outcome: 'failed', error: error.message });
+            continue;
+          }
+        }
+        const range = tomlTableRange(text, MCP_NAME);
+        if (range) { const c = tomlTableCommand(range); steps.push(existingNote(target.agent, c == null ? null : c)); continue; }
+        if (tomlMentions(text, MCP_NAME)) {
+          steps.push({ kind: 'mcp', detail: `${target.agent} declares ${MCP_NAME} in ${target.file} in a form the launcher does not edit; it was kept`, outcome: 'skipped' });
+          continue;
+        }
+        const entry = { command: mcpCommand, args: [] };
+        register({ kind: 'mcp', agent: target.agent, file: target.file, name: MCP_NAME, entry, backup: mcpBackup(target.file, target.agent) }, () => {
+          writeText(target.file, text ? `${text.endsWith('\n') ? text : `${text}\n`}\n${mcpTomlTable(mcpCommand)}` : mcpTomlTable(mcpCommand));
+        });
+      }
+    }
+  }
+
+  // 6. The launcher's own releases: keep this one and the one it replaced, remove the rest.
   //    They are its own output, reinstallable from npm — not the person's files, which are
   //    only ever moved to the quarantine.
   const stale = staleReleases(p, version, state.installed || null);
@@ -410,6 +600,9 @@ function update({ home, dryRun = false, claude = claudeRunner(), log = () => {}
     fresh.members = manifest.members.map((m) => ({ name: m.name, version: m.version, ref: m.ref, commit: m.commit }));
     fresh.quarantines = [...new Set([...(fresh.quarantines || []), ...(moved.length ? [quarantineDir] : [])])];
     if (state.legacyRemoved) fresh.legacyRemoved = state.legacyRemoved;
+    if (registered.length) {
+      fresh.mcpRegistrations = [...(fresh.mcpRegistrations || []).filter((r) => !registered.some((n) => n.file === r.file && n.name === r.name)), ...registered];
+    }
     delete fresh.updatingSince;
     writeJson(p.stateFile, fresh);
   }
@@ -430,6 +623,15 @@ function restore({ home, which, claude = claudeRunner() } = {}) {
       if (entry.restoredAt) continue;
       if (entry.kind === 'marketplace') {
         restored.push(restoreMarketplace(p, entry, claude));
+      } else if (entry.kind === 'mcp') {
+        const note = removeMcpRegistration(entry, claude);
+        if (note) restored.push(note);
+        const state = readState(p.stateFile);
+        if (state.mcpRegistrations) {
+          state.mcpRegistrations = state.mcpRegistrations.filter((r) => !(r.file === entry.file && r.name === entry.name));
+          if (!state.mcpRegistrations.length) delete state.mcpRegistrations;
+          writeJson(p.stateFile, state);
+        }
       } else if (lstat(entry.to)) {
         if (lstat(entry.from)) {
           // Old journals did not record the replacement. Only recognise a link
@@ -561,6 +763,13 @@ function uninstall({ home, claude = claudeRunner() } = {}) {
     fs.unlinkSync(p.current);
   }
   const state = readState(p.stateFile);
+  // The MCP registrations this launcher added — only while they are still exactly what
+  // it wrote; an entry a person changed since stays.
+  for (const record of state.mcpRegistrations || []) {
+    const note = removeMcpRegistration(record, claude);
+    if (note) removed.push(note);
+  }
+  delete state.mcpRegistrations;
   state.installed = null;
   state.members = [];
   state.config = { ...(state.config || {}), auto: false };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,8 +11,8 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.21.0",
-      "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
+      "version": "0.23.0",
+      "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
         "url": "https://passioncode.ai/"
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.45",
+      "version": "0.1.47",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,20 +1,21 @@
 {
   "family": "passioncode",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.21.0",
-      "commit": "7dfbb0a7af36dc1a28e266c0ef248168dabc904f",
-      "version": "0.21.0",
+      "ref": "v0.23.0",
+      "commit": "7dec8549cacb1aae600486405abc77508f30c077",
+      "version": "0.23.0",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
         "building-fabric-services",
-        "creating-fabric-agents"
+        "creating-fabric-agents",
+        "working-with-fabric"
       ],
       "legacyPluginIds": [
         "fabric-agent-adapter@fabric-agent-adapter"
@@ -22,8 +23,8 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:c849515947a8e3ccb28b9bcc570e5cb7a3b417eb5c61e5ab9e1d2a7e656c78ef",
-      "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
+      "contentHash": "sha256:f2f2577b3438e3e495a1c9ce076c22398eb8d3ee40bbed19dac0476edb4187c4",
+      "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
         "url": "https://passioncode.ai/"
@@ -61,16 +62,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.45",
+      "ref": "v0.1.47",
       "commit": null,
-      "version": "0.1.45",
+      "version": "0.1.47",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:9cca65f79d5971661e6593ae604ab184e1aef8de06c60fbc05b00240cabd84ac",
+      "contentHash": "sha256:199b4876498ad7cacf1a788ea5aa45013e80c0e7fcd1be33df11d6f7658458ef",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -2,8 +2,8 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
-  "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.21.0",
+  "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
+  "version": "0.23.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "One line at session start in a repository whose Fabric dashboard has no dashboard kit or an older one (fabric-dashboard/0.1, DEC-0036). Silent everywhere else; reads only, never writes, always exits 0.",
+  "description": "Two silent-unless-relevant hook sets. The dashboard-kit notice: one line at session start in a repository whose Fabric dashboard has no kit or an older one (fabric-dashboard/0.1, DEC-0036). The Fabric session hooks (working-with-fabric, COM-04, FAA-12a): at session start the preamble when Claude Code has the MCP server `fabric` (fabric_whoami, then the project board through com.status and com.list, claim and release), and the machine's Fabric-service count; each turn's facts (HEAD, files changed, lines added and removed, never content), the board's unread count and the session's end through Fabric, only when the running Fabric advertises session-hooks/1; at each prompt one line only when the unread count rose. All silent in a session Fabric launched. Every hook reads no token, prints at most one block, always exits 0, and hands any Fabric call to a detached worker with a 10 s deadline.",
   "hooks": {
     "SessionStart": [
       {
@@ -11,6 +11,48 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -S \"${CLAUDE_PLUGIN_ROOT}/skills/working-with-fabric/scripts/fabric_session.py\" hook session-start",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -S \"${CLAUDE_PLUGIN_ROOT}/skills/working-with-fabric/scripts/fabric_session.py\" hook stop",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -S \"${CLAUDE_PLUGIN_ROOT}/skills/working-with-fabric/scripts/fabric_session.py\" hook session-end",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -S \"${CLAUDE_PLUGIN_ROOT}/skills/working-with-fabric/scripts/fabric_session.py\" hook user-prompt-submit",
+            "timeout": 5
+          }
+        ]
       }
     ]
   }

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.21.0"
+  version: "0.23.0"
   contract-version: "0.1.0"
-  contract-commit: "b291bf09e0a9f9fd3c16cf540832cd021203b7d1"
+  contract-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `b291bf09e0a9f9fd3c16cf540832cd021203b7d1`.
+- commit `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -21,10 +21,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "b291bf09e0a9f9fd3c16cf540832cd021203b7d1"
+CONTRACT_COMMIT = "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.21.0"
+  version: "0.23.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "b291bf09e0a9f9fd3c16cf540832cd021203b7d1"
+  extension-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
 ---
 
 # Building Fabric services

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -95,16 +95,19 @@ itself (`isSmallOrderKey`), because Node before 26 lets OpenSSL accept a signatu
 
 ## Keys the estate record certifies
 
-A verifier that also reads the estate's record (DEC-0055, [the estate record reference](estate-record.md)) trusts a
-`kid` only while a current revision certifies it for a machine and does not revoke it (DL-14). Pass the current
-verified revision as `estate=` / `{ estate }`, as a value or as a function returning it, to `delegation_gate`,
+A verifier that also reads the estate's record (DEC-0055, DEC-0060, [the estate record reference](estate-record.md))
+trusts a `kid` only while the revision it reads certifies it (DL-14, row 4a, right after the signature). Pass the
+current verified revision as `estate=` / `{ estate }`, as a value or as a function returning it, with
+`estate_applied` / `estateApplied` and `estate_revocations` / `estateRevocations`, to `delegation_gate`,
 `verify_delegation` or `verify_approval`.
-- An uncertified `kid` is refused `unauthenticated` (`approval-invalid` for an approval), with detail
+- An uncertified `kid` is the token's fault: `unauthenticated` (`approval-invalid` for an approval), detail
   `kid-not-certified`.
-- An unreadable record is refused `issuer-unavailable`, with detail `estate-unreadable`.
+- A revision that cannot be read, is outside its window, is lower than the applied one or forks it is the trust
+  source's fault: `issuer-unavailable`, detail `estate-unreadable`, `estate-outside-window`, `estate-rolled-back` or
+  `estate-forked`.
 - Without `estate`, nothing changes.
-- Pass only a revision `verify_estate_record` accepted, and the highest one the machine has applied. The rule trusts
-  what it is given, so an unverified or older revision would certify a key the current one revoked.
+- Every verifier refuses a clock that is not a number of seconds `unknown-state` `no-clock` before row 1: a NaN clock
+  would make every time row false and pass an expired token.
 
 ## What the kit does not do