@passioncode-ai/passioncode 0.1.45 → 0.1.47

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/estate-record.md

@@ -43,12 +43,16 @@ It checks, in the order of the ER table:
    parent, and no revocation dropped.
 5. **The signer.** The signing passkey must be among the trusted ones and not revoked by the parent. A revision may
    revoke its own signer: that is rotation.
-6. **The assertion.**
+6. **The assertion.** The passkey is a signing credential (DEC-0063): an RP ID that is not a dedicated signing RP,
+   `sign.<domain>` in lower case, is `wrong-rp` before the assertion is read, and an origin outside the RP ID is not
+   pinned, so a ceremony that ran there is `wrong-origin`.
    - Client data: type, challenge, origin, no cross-origin use.
    - The RP ID hash, and the user-presence and user-verification flags.
    - The signature: ES256 or EdDSA, under a key validated first (a valid P-256 point; an Ed25519 key of full order).
-7. **The window.** At most 30 days.
-8. **The record's own rules.** A violation is `rule-violation` with its `codes`.
+7. **The window.** At most 30 days. A revision may be issued up to 60 s ahead of the verifier's clock (DEC-0066,
+   `CLOCK_SKEW_SECONDS`); earlier than that it is `not-yet-valid`.
+8. **The record's own rules.** A violation is `rule-violation` with its `codes`, `FAC-SEM-072…076` and `FAC-SEM-092`
+   (each passkey the record lists is a signing credential, its origins within its RP ID).
 
 Dates are strict RFC 3339: a `T`, an offset, and a day that exists. `:60` and a space are refused. Passkey JWK `x`
 and `y` must be canonical base64url. The Python kit verifies ES256 in pure Python (P-256, strict DER), and the Node
@@ -56,22 +60,35 @@ kit through `node:crypto`.
 
 ## Trusting a delegation key
 
-A delegation verifier that reads the estate record trusts a token's `kid` only while a current revision certifies it
-for a machine and does not revoke it (DL-14, contract CT-20). Give the gate the current verified revision, or a
-function that returns it:
+A delegation verifier that reads the estate record trusts a token's `kid` only while the revision it reads certifies
+it (DL-14, contract DEC-0060): exactly one machine's `hubKey` has that `kid` and the published key's `x`, the clock is
+inside the revision's window (from 60 s before `issuedAt`, DEC-0066, to `validUntil`), and neither the revision nor the
+revocation delta's entries applied since it revoke `hub-key <kid>` or `machine <id>`. It is checked right after the
+signature (DL-13 row 4a). Give the gate the current verified revision, or a function that returns it, the highest
+revision the machine applied, and the delta's revocations:
 
 ```python
-gate = fd.delegation_gate(audience=..., jwks=keys, issuer=..., effects=..., estate=lambda: current)
+gate = fd.delegation_gate(audience=..., jwks=keys, issuer=..., effects=..., estate=lambda: current,
+                          estate_applied={"revision": applied_number, "digest": applied_digest},
+                          estate_revocations=lambda: delta_entries)
 ```
 
-- A `kid` the record does not certify is refused like an unknown key: `unauthenticated` (for an approval,
-  `approval-invalid`) with detail `kid-not-certified`. The same holds when the record names another key under that
-  kid, revokes it, or is outside its window.
-- A record that cannot be read certifies nothing: `issuer-unavailable` with detail `estate-unreadable`.
-- **What you pass in.** Pass only a revision that `verify_estate_record` accepted, and the highest revision the
-  machine has applied. The rule trusts the record it is given. A record nobody verified, or an older revision still
-  inside its window, would certify a key the current revision revoked (a rollback).
-- `hub_key_certified(record, kid, x, at)` / `hubKeyCertified(...)` answers the question on its own.
+- **The token's fault** — no such certification, another key under that `kid`, a `kid` on two machines, a revoked hub
+  key or machine — is `unauthenticated` (for an approval, `approval-invalid`) with detail `kid-not-certified`.
+- **The trust source's fault** is `issuer-unavailable`: `estate-unreadable` (a source that throws or answers nothing
+  readable, a revision without a number or digest, a window of zero or over 30 days, dates read strictly, `machines` or
+  `revocations` not arrays), `estate-outside-window`, `estate-rolled-back` (lower than the applied revision) and
+  `estate-forked` (the applied number with another digest). A caller cannot cure these by minting again.
+- An unreadable clock — not a finite number of seconds a `Date` can hold — is refused `unknown-state` `no-clock`
+  before row 1, in every verifier.
+- Only an absent `estate` skips the check. In the Node kit `null` is an unreadable source; in Python, where `None` is
+  the absent value, pass a function returning `None` for a source that has nothing.
+- **What you pass in.** Pass only a revision that `verify_estate_record` accepted and whose number is not lower than
+  the highest the machine applied; a higher one only when you verified its chain from the applied revision.
+- `hub_key_certified(record, kid, x, at, applied, extra_revocations)` /
+  `hubKeyCertified(record, kid, x, at, applied, {extraRevocations})` answers the question on its own:
+  `{certified: true, machine, revision}` or `{certified: false, fault, detail}`. Both kits are held to the contract's
+  `fixtures/vectors/hub-key.json` (`test/fixtures/contract/hub-key-vectors.json`).
 
 ## Checking a record you produce
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -73,12 +73,36 @@ operator's real jobs.
 ## One copy under a supervisor
 
 Started by hand, a copy that finds `service.lock` held prints one sentence naming the
-holder and exits 75 at once. Under launchd that exit is a respawn every `ThrottleInterval`
-(10 s), forever, and under systemd one every `RestartSec`. So a copy whose plist or unit
-carries `FABRIC_SERVICE_SUPERVISOR=launchd` (or `systemd`) backs off in-process — 0.5 s doubling to 30 s, 300 s in all — takes over if the holder leaves,
-and exits 75 only when the wait runs out: a few starts an hour instead of 360. It touches
-nothing while it waits. Two installs sharing one data directory are still the defect to
-remove; the back-off only stops the loop from costing the machine.
+holder (or saying the holder is unknown, when its pid cannot be read) and exits 75 at once.
+Under launchd that exit is a respawn every `ThrottleInterval` (10 s), forever, and under
+systemd one every `RestartSec`. So a copy its supervisor started, and that says so with the
+**supervisor marker**, backs off in-process — 0.5 s doubling to 30 s, 300 s in all — takes over
+if the holder leaves, and exits 75 only when the wait runs out: a few starts an hour instead of
+360. It touches nothing while it waits. Two installs sharing one data directory are still the
+defect to remove; the back-off only stops the loop from costing the machine.
+
+The marker (contract DEC-0057, CT-01) is the variable `FABRIC_SERVICE_SUPERVISOR=<manager>` or
+the argument `--fabric-supervisor <manager>` (also `--fabric-supervisor=<manager>`), after the
+executable and before any `--`; `<manager>` is `launchd`, `systemd`, `task-scheduler` or `node`
+(Project Observatory's node, which supervises the services it starts). The writer of the
+supervisor file writes it: `launchd_plist` and `systemd_unit` / `systemdUnit` set the variable,
+always; `task_xml` / `taskXml` put the argument in the task's `Arguments`, because a task's action
+carries no environment. Each writer refuses a marker already in the program arguments. A copy
+never infers supervision from its parent process.
+
+- `supervisor_marker(env, argv)` / `supervisorMarker({env, argv})` reads both forms and answers
+  `supervised` (with the manager), `manual` or `conflict`. Only an empty variable counts as no
+  marker; a bare `--fabric-supervisor` (followed by nothing, by `--` or by another `--…` flag,
+  none of which it consumes) names no manager.
+- Markers that disagree — the variable and the argument with different values, the argument
+  twice, or a bare or empty argument beside the variable — exit 75 at once, before the lock and
+  whether or not it is held, naming both markers.
+- A service's own argument parser accepts the flag in both spellings and ignores it: in Python,
+  `add_supervisor_argument(parser)` (argparse otherwise exits 2 on an unknown flag); the sample
+  service adds it to the parser and to each command.
+- The kits are held to the contract's `fixtures/vectors/service-supervisor.json`, and their
+  starts against a held lock are recorded and read as `FAC-SEM-078` reads them
+  (`test/*supervisors*`).
 
 ## Directories
 
@@ -151,7 +175,7 @@ control character (a line break would end a unit line early).
 **Linux — a systemd user unit.** `systemd_unit(unit, argv, working_directory=…)` /
 `systemdUnit(unit, argv, {workingDirectory})` writes `Restart=always`, `RestartSec=10`,
 `TimeoutStopSec` above the drain (15 s default), `KillMode=mixed`, `WantedBy=default.target`
-and `FABRIC_SERVICE_SUPERVISOR=systemd`, quoting every argument (`%` → `%%`, `$` → `$$`).
+and `FABRIC_SERVICE_SUPERVISOR=systemd` (always, whatever the caller passed), quoting every argument (`%` → `%%`, `$` → `$$`).
 `WorkingDirectory=` is written unquoted: systemd reads it as the rest of the line, so quotes would
 become part of the path and the unit would be refused (`systemd-analyze verify` checks it in CI). The
 descriptor says `"lifecycle": {"manager": "systemd", "unit": "<id>.<instance>.service"}`.
@@ -179,9 +203,10 @@ CI job has the real `schtasks` create, read back and delete such a task. The des
 | stop, keep off | `schtasks /End /TN <task>`, then `schtasks /Change /TN <task> /DISABLE` |
 | uninstall | `task_uninstall` / `taskUninstall`: `/End`, then `/Delete /F` |
 
-A task cannot set an environment variable, so a copy Task Scheduler restarts does not back off
-in-process; `IgnoreNew` keeps the scheduler from starting a second copy, and a hand-started copy
-holding the lock makes the scheduled one exit 75 once a minute until it leaves.
+A task cannot set an environment variable, so `task_xml` / `taskXml` write the marker as an
+argument, `--fabric-supervisor task-scheduler`, before any `--`: a copy the Task Scheduler starts
+backs off in-process like one under launchd or systemd. `IgnoreNew` keeps the scheduler from
+starting a second copy.
 
 **One copy on each system.** The Python kit takes `flock` (Linux) or a locked byte
 (Windows); the Node kit cannot, so it holds a name instead — an abstract unix socket on Linux,
@@ -192,7 +217,14 @@ holds the same name beside its file lock, so the two kits exclude each other eve
 
 **Token files on Windows.** The privacy of `service.token` is its ACL (service.md *Windows
 token files*): the kits write a protected list — the user, SYSTEM and Administrators, set before the
-token's bytes go in, any entry already there dropped — and refuse
-on read a link, a file outside the profile, another owner, or any other granted SID, naming the
-SID. The Node kit reads the list with Windows PowerShell 5.1 (.NET, no modules) and writes it
-with `icacls`; the path goes through the environment, never a command line.
+token's bytes go in, any entry already there dropped. On read, `windows_token_acl_problem` /
+`windowsTokenAclProblem` decide over what was read — the file's flags, its owner SID and each ACE
+as `{type, sid, mask}` (DEC-0057, `FAC-SEM-079`, held to the contract's
+`fixtures/vectors/windows-token.json`): a reparse point, a directory, a real path outside the
+profile, another owner, an allow ACE with a non-zero mask for any other SID, an ACE of another type
+than allow or deny (an object or callback ACE), or anything unreadable is refused, naming the SID;
+deny ACEs and an allow with an empty mask grant nothing; SIDs compare case-insensitively. The Python
+kit reads the ACEs from the file's SDDL (`acl_from_sddl`); the Node kit reads them with Windows
+PowerShell 5.1 (.NET's raw descriptor, no modules), converting .NET's signed mask to the unsigned
+one, and writes the list with `icacls`; the path goes through the environment, never a command line.
+An inherit-only ACE applies to children, not to the file, and is not read.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,11 +1,13 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `b291bf09e0a9f9fd3c16cf540832cd021203b7d1`
+Pinned to `fabric-agent-contract` commit `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
 canonical forms DEC-0043; `degraded[].setup` and `run.mcp.stdio.scope` DEC-0044; delegation sealed and trust tiers
-DEC-0045; runner and model profiles DEC-0046). The contract's schemas are normative;
+DEC-0045; runner and model profiles DEC-0046; the estate record DEC-0055; one copy under any supervisor and its marker,
+the Windows token-file reader DEC-0057; the hub key the estate certifies DEC-0060; signing credentials DEC-0063; the
+estate record's 60 s skew DEC-0066). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -172,8 +172,11 @@ class Probe:
         self.add("descriptor.valid", "FAIL" if problems else "PASS", "; ".join(problems) or str(self.path))
         if fs.WINDOWS:
             # DEC-0032: on Windows the file's ACL is its privacy.
-            owner, granting = fs.windows_acl(self.path)
-            problem = fs.token_acl_problem(self.path, owner, granting, fs.windows_user_sid())
+            owner, aces = fs.windows_acl(self.path)
+            info = os.lstat(self.path)
+            problem = fs.windows_token_acl_problem({"isRegularFile": stat.S_ISREG(info.st_mode), "isReparsePoint": stat.S_ISLNK(info.st_mode),
+                                                    "realPathInProfile": True, "ownerSid": owner, "aces": aces}, fs.windows_user_sid())
+            problem = problem and problem["message"]
             self.add("descriptor.private", "FAIL" if problem else "PASS", problem or "owner-only ACL")
         else:
             mode = stat.S_IMODE(os.stat(self.path).st_mode)

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-delegation.mjs

@@ -139,7 +139,7 @@ function keyFor(jwks, kid) {
   if (raw.length !== 32) return { problem: 'unusable-key' };
   if (isSmallOrderKey(raw)) return { problem: 'small-order-key' }; // before any verification (DEC-0045, CT-29)
   try {
-    return { key: crypto.createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: jwk.x }, format: 'jwk' }), raw };
+    return { key: crypto.createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: jwk.x }, format: 'jwk' }), raw, x: jwk.x };
   } catch {
     return { problem: 'unusable-key' };
   }
@@ -175,7 +175,7 @@ function authentic(token, jwks, typ) {
   // Only an unknown kid is the token's fault; a published key that cannot be used is the issuer's (DL-13 row 3).
   if ('problem' in found) return found.problem === 'unknown-key' ? { problem: found.problem } : { problem: found.problem, issuer: true };
   if (compact.signature.length !== 64 || isSmallOrderKey(found.raw) || !crypto.verify(null, compact.signingInput, found.key, compact.signature)) return { problem: 'bad-signature' };
-  return { compact, kid };
+  return { compact, kid, x: found.x };
 }
 
 /** Depth of an actor chain; Infinity for a chain that is not one (a missing or non-string sub at any level). */
@@ -249,33 +249,47 @@ function approvalShape(payload) {
   return payload;
 }
 
+/** ECMAScript's time range in seconds (±8.64e15 ms): a NumericDate outside it is no instant a Date can hold. */
+const MAX_CLOCK_SECONDS = 8.64e12;
+/** A clock the time rows can compare (DEC-0060): a finite number of seconds within a Date's range. NaN or a string would pass every row. */
+const readableClock = (now) => typeof now === 'number' && Number.isFinite(now) && Math.abs(now) <= MAX_CLOCK_SECONDS;
+
 /**
- * DL-13, in its fixed order: nothing about a token is believed before its signature is. `now` is seconds since
- * the epoch. Answers {ok: true, claims, principal, caller, chain, kid} or {ok: false, code, detail}.
- */
-/**
- * DL-14 with DEC-0055: a verifier that reads the estate record trusts a kid only while a current revision certifies it
- * for a machine and does not revoke it. `estate` is a revision the caller verified (fabric-estate.mjs
- * verifyEstateRecord) or a function returning the current one; undefined skips the rule. `[kind, detail]` or null.
+ * DL-14 row 4a (DEC-0055, DEC-0060), right after the signature: when the callee reads the estate record, the token's
+ * `kid` and the published key must be certified by that revision. `estate` is a revision the caller verified
+ * (fabric-estate.mjs verifyEstateRecord) and its machine applied, or a function returning it; only an absent `estate`
+ * skips the rule (null is an unreadable source). `estateApplied` is the highest revision the machine applied,
+ * `estateRevocations` the revocation delta's entries since (an array or a function). A source that throws is
+ * unreadable, never a pass. `[kind, detail]` or null.
  */
-function estateProblem(estate, jwks, kid, now) {
-  if (estate === undefined || estate === null) return null;
+function estateProblem({ estate, estateApplied, estateRevocations }, kid, x, now) {
+  if (estate === undefined) return null;
   let record;
+  let extra;
   try {
     record = typeof estate === 'function' ? estate() : estate;
+    extra = typeof estateRevocations === 'function' ? estateRevocations() : estateRevocations;
   } catch {
-    return ['issuer', 'estate-unreadable']; // an unreadable record certifies nothing; it is never a pass
+    return ['issuer', 'estate-unreadable'];
   }
-  const jwk = jwks.keys.find((candidate) => isObject(candidate) && candidate.kid === kid) ?? {};
-  return hubKeyCertified(record, kid, jwk.x, now) ? null : ['token', 'kid-not-certified'];
+  const verdict = hubKeyCertified(record, kid, x, now, estateApplied, extra === undefined ? undefined : { extraRevocations: extra });
+  // The clock was refused before row 1, so a verdict here is the token's or the trust source's.
+  return verdict.certified ? null : [verdict.fault === 'token' ? 'token' : 'issuer', verdict.detail];
 }
 
-export function verifyDelegation(token, { audience, jwks, now, capability, effect, issuer, readOnly, estate } = {}) {
+/**
+ * DL-13, in its fixed order: nothing about a token is believed before its signature is. `now` is seconds since
+ * the epoch; a clock that is not one is refused `unknown-state` `no-clock` before row 1. Answers {ok: true, claims,
+ * principal, caller, chain, kid} or {ok: false, code, detail}.
+ */
+export function verifyDelegation(token, { audience, jwks, now, capability, effect, issuer, readOnly, estate, estateApplied, estateRevocations } = {}) {
+  // Before row 1: every time row compares against the clock, and a comparison with NaN is always false.
+  if (!readableClock(now)) return refuse('unknown-state', 'no-clock');
   if (!isString(issuer)) return refuse('issuer-unavailable', 'no-trusted-issuer');
   if (!hasKeys(jwks)) return refuse('issuer-unavailable', 'no-published-keys');
   const checked = authentic(token, jwks, DELEGATION_TYP);
   if ('problem' in checked) return refuse(checked.issuer ? 'issuer-unavailable' : 'unauthenticated', checked.problem);
-  const uncertified = estateProblem(estate, jwks, checked.kid, now);
+  const uncertified = estateProblem({ estate, estateApplied, estateRevocations }, checked.kid, checked.x, now);
   if (uncertified) return refuse(uncertified[0] === 'issuer' ? 'issuer-unavailable' : 'unauthenticated', uncertified[1]);
   const shaped = delegationShape(checked.compact.payload);
   if ('problem' in shaped) return refuse('unauthenticated', shaped.problem);
@@ -295,14 +309,15 @@ export function verifyDelegation(token, { audience, jwks, now, capability, effec
 }
 
 /** DL-18: approval-required carries the digest; any fault is approval-invalid; the jti is consumed last. */
-export function verifyApproval(approval, { audience, jwks, now, actionDigest: expected, issuer, jtiStore, estate } = {}) {
+export function verifyApproval(approval, { audience, jwks, now, actionDigest: expected, issuer, jtiStore, estate, estateApplied, estateRevocations } = {}) {
   if (approval === undefined || approval === null || approval === '') return refuse('approval-required', 'no-approval', { actionDigest: expected });
   if (!isObject(jtiStore) || typeof jtiStore.consume !== 'function') return refuse('unknown-state', 'no-jti-store');
+  if (!readableClock(now)) return refuse('unknown-state', 'no-clock');
   if (!isString(issuer)) return refuse('issuer-unavailable', 'no-trusted-issuer');
   if (!hasKeys(jwks)) return refuse('issuer-unavailable', 'no-published-keys');
   const checked = authentic(approval, jwks, APPROVAL_TYP);
   if ('problem' in checked) return refuse(checked.issuer ? 'issuer-unavailable' : 'approval-invalid', checked.problem);
-  const uncertified = estateProblem(estate, jwks, checked.kid, now);
+  const uncertified = estateProblem({ estate, estateApplied, estateRevocations }, checked.kid, checked.x, now);
   if (uncertified) return refuse(uncertified[0] === 'issuer' ? 'issuer-unavailable' : 'approval-invalid', uncertified[1]);
   const claims = approvalShape(checked.compact.payload);
   if (!claims) return refuse('approval-invalid', 'malformed-claims');
@@ -469,7 +484,7 @@ export const TIERS = Object.freeze(['T0', 'T1', 'T2']);
  * relayed from off the machine). A T0 or T1 caller is never required to present a token: with none, the call passes
  * with no delegation. A present token is verified at every tier. `issuer` (auth.delegation.issuer) is required.
  */
-export function delegationGate({ audience, jwks, effects, issuer, readOnly = false, clock = () => Date.now() / 1000, estate }) {
+export function delegationGate({ audience, jwks, effects, issuer, readOnly = false, clock = () => Date.now() / 1000, estate, estateApplied, estateRevocations }) {
   if (!isString(issuer)) throw new Error('the gate needs the issuer it trusts (auth.delegation.issuer)');
   return async (tool, headers, tier = 'T2') => {
     const effect = effects?.[tool];
@@ -480,7 +495,7 @@ export function delegationGate({ audience, jwks, effects, issuer, readOnly = fal
       return refuse('unauthenticated', 'no-token');
     }
     const keys = jwks instanceof JwksCache ? await jwks.get(kidOf(carried.token)) : jwks;
-    const verdict = verifyDelegation(carried.token, { audience, jwks: keys, now: clock(), capability: tool, effect, readOnly, issuer, estate });
+    const verdict = verifyDelegation(carried.token, { audience, jwks: keys, now: clock(), capability: tool, effect, readOnly, issuer, estate, estateApplied, estateRevocations });
     if (verdict.ok) verdict.tier = TIERS.includes(tier) ? tier : 'T2';
     return verdict;
   };

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-estate.mjs

@@ -17,6 +17,8 @@ import { secretValue } from './fabric-secrets.mjs';
 export const ESTATE_RECORD_SCHEMA = 'estate-record/1';
 export const ESTATE_CHALLENGE_TYPE = 'estate-revision/1';
 export const MAX_VALIDITY_SECONDS = 30 * 24 * 60 * 60;
+/** How far ahead of the verifier's clock a signed `issuedAt` may be before it is `not-yet-valid` (DEC-0066). */
+export const CLOCK_SKEW_SECONDS = 60;
 export const ASSERTION_ALGORITHMS = Object.freeze(['ES256', 'EdDSA']);
 export const FLAGS = Object.freeze({ UP: 0x01, UV: 0x04, BE: 0x08, BS: 0x10, AT: 0x40, ED: 0x80 });
 
@@ -153,6 +155,34 @@ export function estateTime(value) {
   if (date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day || hour > 23 || minute > 59 || second > 59) return Number.NaN;
   return Date.parse(value);
 }
+const LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+/** `sign.` and at least two more labels, lower case: a signing RP ID is never a bare `sign.<tld>` (DEC-0063). */
+const SIGNING_RP = new RegExp(`^sign(?:\\.${LABEL}){2,}$`);
+
+/**
+ * Whether an RP ID is a dedicated signing RP (v4 §7, DEC-0063): first label `sign`, then the organization's or
+ * PassionCode's domain, lower case. A credential under any other RP ID is a sign-in credential and never signs.
+ */
+export const isSigningRpId = (rpId) => isString(rpId) && rpId.length <= 253 && SIGNING_RP.test(rpId);
+
+/** Whether a pinned origin may run a signing ceremony for `rpId`: https, no port, no path, the RP ID or a host under it. */
+export function originWithin(origin, rpId) {
+  const host = isString(origin) ? /^https:\/\/([a-z0-9.-]{1,253})$/.exec(origin)?.[1] : undefined;
+  return host !== undefined && (host === rpId || host.endsWith(`.${rpId}`));
+}
+
+/** FAC-SEM-092 on one signing credential: a signing RP ID, and every pinned origin within it. */
+function signingCredential(credential, path, flag) {
+  const value = isObject(credential) ? credential : {};
+  if (!isSigningRpId(value.rpId)) {
+    flag(`${path}/rpId`, 'a passkey signs only under a dedicated signing RP, sign.<domain>, never under the RP ID it signs in with');
+    return;
+  }
+  (Array.isArray(value.origins) ? value.origins : []).forEach((origin, index) => {
+    if (!originWithin(origin, value.rpId)) flag(`${path}/origins/${index}`, `a signing ceremony runs only on ${value.rpId} or a host under it, over https without a port`);
+  });
+}
+
 const revocationKey = (entry) => `${String(entry.kind)} ${String(entry.ref)}`;
 const clockOf = (at) => (at instanceof Date ? at.getTime() : (typeof at === 'number' && Number.isFinite(at) ? at * 1000 : Number.NaN));
 
@@ -206,13 +236,18 @@ export function verifyEstateRecord(record, trust) {
     credentialId: String(authority.credentialId), alg: String(authority.alg), publicKey: isObject(authority.publicKey) ? authority.publicKey : {},
     rpId: String(authority.rpId), origins: Array.isArray(authority.origins) ? authority.origins.filter(isString) : [],
   };
+  // DEC-0063: the estate passkey is a signing credential. An RP ID that is not sign.<domain> is wrong-rp before the
+  // assertion is read; an origin outside the RP ID is not pinned, so a ceremony that ran there is wrong-origin.
+  if (!isSigningRpId(authority.rpId)) return { ok: false, problem: 'wrong-rp' };
+  credential.origins = credential.origins.filter((origin) => originWithin(origin, credential.rpId));
   const assertion = verifyAssertion(signature, credential, estateChallenge(digest));
   if (!assertion.ok) return { ok: false, problem: assertion.problem };
 
   const issuedAt = estateTime(record.issuedAt);
   const validUntil = estateTime(record.validUntil);
   if (!Number.isFinite(issuedAt) || !Number.isFinite(validUntil) || validUntil <= issuedAt || validUntil - issuedAt > MAX_VALIDITY_SECONDS * 1000) return { ok: false, problem: 'too-long-lived' };
-  if (at < issuedAt) return { ok: false, problem: 'not-yet-valid' };
+  // A revision issued a moment ahead of this clock is admitted within the skew every relay time allows (DEC-0066).
+  if (at < issuedAt - CLOCK_SKEW_SECONDS * 1000) return { ok: false, problem: 'not-yet-valid' };
   if (at > validUntil) return { ok: false, problem: 'expired' };
   const codes = [...new Set(recordFindings(record).map((finding) => finding.code))];
   if (codes.length > 0) return { ok: false, problem: 'rule-violation', codes };
@@ -227,19 +262,50 @@ export function placementTrust(record, machineId, agentRef) {
   return { publisher: list(record.publisherKeys).filter((key) => key.kid === placement.publisherKid) };
 }
 
+const MAX_WINDOW_MS = MAX_VALIDITY_SECONDS * 1000;
+const isRevision = (value) => Number.isSafeInteger(value) && value >= 1;
+const refused = (fault, detail) => ({ certified: false, fault, detail });
+
 /**
- * DL-14 with DEC-0055: trust a token's `kid` only while a current revision certifies it for a machine and does not revoke
- * it. `record` is a revision the caller verified; `x` the key the published key set gives for `kid`; `at` the clock.
+ * DL-14 (DEC-0055, DEC-0060): whether `record` certifies the delegation key `kid` with the published key's `x` at `at`
+ * (a Date or epoch seconds), for a verifier whose machine applied `applied` (`{revision, digest?}`). `extraRevocations`
+ * are the revocation delta's entries applied since the revision (DEC-0054). The contract's `hubKeyCertified`, in its
+ * order; never throws. Answers `{certified: true, machine, revision}` or `{certified: false, fault, detail}`: fault
+ * `token` (`kid-not-certified`), `estate` (`estate-unreadable`, `estate-outside-window`, `estate-rolled-back`,
+ * `estate-forked`) or `clock` (`no-clock`).
  */
-export function hubKeyCertified(record, kid, x, at) {
+export function hubKeyCertified(record, kid, x, at, applied, options) {
   const now = clockOf(at);
-  if (!isObject(record) || !Number.isFinite(now)) return false;
+  if (Number.isNaN(now)) return refused('clock', 'no-clock');
+  if (!isObject(record) || !isRevision(record.revision) || !isString(record.digest) || !Array.isArray(record.machines)) return refused('estate', 'estate-unreadable');
+  if (record.revocations !== undefined && !Array.isArray(record.revocations)) return refused('estate', 'estate-unreadable');
+  const extra = options?.extraRevocations;
+  if (extra !== undefined && !Array.isArray(extra)) return refused('estate', 'estate-unreadable');
   const issuedAt = estateTime(record.issuedAt);
   const validUntil = estateTime(record.validUntil);
-  if (!(Number.isFinite(issuedAt) && Number.isFinite(validUntil) && issuedAt <= now && now <= validUntil)) return false;
-  const revoked = new Set(list(record.revocations).map(revocationKey));
-  return list(record.machines).some((machine) => isObject(machine.hubKey) && machine.hubKey.kid === kid && machine.hubKey.x === x
-    && !revoked.has(`hub-key ${kid}`) && !revoked.has(`machine ${String(machine.id)}`));
+  // A window that is not a time, not positive or longer than 30 days is no window: NaN fails every comparison below.
+  if (Number.isNaN(issuedAt) || Number.isNaN(validUntil) || validUntil <= issuedAt || validUntil - issuedAt > MAX_WINDOW_MS) return refused('estate', 'estate-unreadable');
+  if (applied !== undefined) {
+    if (!isObject(applied) || !isRevision(applied.revision) || (applied.digest !== undefined && !isString(applied.digest))) return refused('estate', 'estate-unreadable');
+    // An older revision may still be inside its window and list a key the applied one revokes (a rollback).
+    if (record.revision < applied.revision) return refused('estate', 'estate-rolled-back');
+    if (record.revision === applied.revision && applied.digest !== undefined && record.digest !== applied.digest) return refused('estate', 'estate-forked');
+  }
+  // The window verifyEstateRecord admits the revision in: from 60 s before issuedAt to validUntil (DEC-0066).
+  if (now < issuedAt - CLOCK_SKEW_SECONDS * 1000 || now > validUntil) return refused('estate', 'estate-outside-window');
+
+  const revocations = [...(record.revocations ?? []), ...(extra ?? [])];
+  // A ref is compared exactly, never as a string conversion.
+  const revokes = (kind, ref) => revocations.some((entry) => isObject(entry) && entry.kind === kind && entry.ref === ref);
+  if (!isString(kid) || revokes('hub-key', kid)) return refused('token', 'kid-not-certified');
+  const holders = record.machines.filter((machine) => isObject(machine) && isObject(machine.hubKey) && machine.hubKey.kid === kid);
+  // Two machines under one kid break FAC-SEM-073; such a revision certifies neither.
+  if (holders.length !== 1) return refused('token', 'kid-not-certified');
+  const [machine] = holders;
+  // A missing x never equals a missing x: the published key must be the certified one.
+  if (!isString(x) || machine.hubKey.x !== x) return refused('token', 'kid-not-certified');
+  if (revokes('machine', machine.id)) return refused('token', 'kid-not-certified');
+  return { certified: true, machine: String(machine.id), revision: record.revision };
 }
 
 // ---- FAC-SEM-072…076 ----
@@ -396,6 +462,8 @@ function recordFindings(value) {
   placements(value, flagger(findings, 'FAC-SEM-074'));
   secretReferences(value, flagger(findings, 'FAC-SEM-075'));
   grantsAndRevocations(value, flagger(findings, 'FAC-SEM-076'));
+  // FAC-SEM-092 (DEC-0063) on each passkey the record lists.
+  list(value.authorities).forEach((authority, index) => signingCredential(authority, `/authorities/${index}`, flagger(findings, 'FAC-SEM-092')));
   return findings;
 }