@passioncode-ai/passioncode 0.1.48 → 0.1.50

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.50 - 2026-10-13
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.26.0`** (it was `v0.25.0`). Fabric Agent Adapter 0.26.0 (FAA-35, FAA-37): a service's feed events can carry machine-readable data next to their sentence. That data is refused if it holds a credential. A service can also list the protocol revisions it accepts, and refuses any other revision with `schema-unsupported`. The contract pin stays a046f57.
+
+## 0.1.49 - 2026-10-13
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.25.0`** (it was `v0.24.0`). Fabric Agent Adapter 0.25.0 (FAA-39): both service kits treat two spellings of one identifier as the same identifier, by its normal form (contract DEC-0076). This covers routes, bindings, route events, estate share grants and their revocations, and a provider entry's provider id. The kits also write the identifiers they create in that normal form. The adapter now pins contract a046f57.
+
 ## 0.1.48 - 2026-10-13
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.24.0",
+      "ref": "v0.26.0",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.24.0",
+      "version": "0.26.0",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.48",
+      "version": "0.1.50",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.24.0",
-      "commit": "20c0f9ef9bf5fe859b83201b1d854b68325671a7",
-      "version": "0.24.0",
+      "ref": "v0.26.0",
+      "commit": "65c17516ca978ef971b827643972279fd7686ef6",
+      "version": "0.26.0",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -23,7 +23,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:41fd37dbc69a876cf56d4fd33d27dfaa6129fa89c6d9df417337d4093427a171",
+      "contentHash": "sha256:53352740e9aae397dbaf501da9b4489fddcb527f052c342e318bb967bf65ced8",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -62,16 +62,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.48",
+      "ref": "v0.1.50",
       "commit": null,
-      "version": "0.1.48",
+      "version": "0.1.50",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:6f5b09de32403aaf89a6c8e820efd64b9b9a535e6c5be102c7c638635bb89165",
+      "contentHash": "sha256:80f227523e23d6538de76409a9b7c3ea57cf10ff16fd9a2a8578134567d573b5",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.24.0"
+  version: "0.26.0"
   contract-version: "0.1.0"
-  contract-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
+  contract-commit: "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`.
+- commit `a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -21,10 +21,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
+CONTRACT_COMMIT = "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"
@@ -47,6 +47,15 @@ class AdaptationError(Exception):
     """Expected user-facing adaptation error."""
 
 
+
+def _normal_identifier(value: str) -> str:
+    """DEC-0076's normal form, from fabric_identifiers.py beside this file (byte-identical to the service kit's)."""
+    import importlib.util
+    spec = importlib.util.spec_from_file_location("fabric_identifiers", Path(__file__).resolve().parent / "fabric_identifiers.py")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module.normal_identifier(value)
+
 def _read_text(path: Path, limit: int = 262_144) -> str:
     try:
         if path.stat().st_size > limit:
@@ -237,24 +246,27 @@ def _generated_files(args: argparse.Namespace) -> Dict[str, str]:
             raise AdaptationError("a runtime argument carries a credential; argv is visible to every process (LC-21): read it from a secret reference instead")
 
     created_at = dt.datetime.now(dt.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+    # DEC-0076: a writer emits identifiers in their normal form, so every reader finds them under one spelling.
+    provider_id = _normal_identifier(args.provider_id)
+    capability_id = _normal_identifier(args.capability_id)
     manifest = {
         "contractVersion": CONTRACT_VERSION,
         "provider": {
-            "id": args.provider_id,
+            "id": provider_id,
             "revision": 1,
             "contentHash": "sha256:" + ("0" * 64),
             "createdAt": created_at,
             "createdBy": "urn:fabric:adapter:author",
             "name": args.provider_name,
             "identity": {
-                "subject": args.provider_id,
+                "subject": provider_id,
                 "method": "local-install" if args.profile == "local-runner" or (args.profile == "mcp" and args.mcp_mode == "stdio") else "tls",
             },
             "supportedContractVersions": [CONTRACT_VERSION],
         },
         "capabilities": [
             {
-                "id": args.capability_id,
+                "id": capability_id,
                 "name": args.capability_name,
                 "inputSchema": _schema_uri(args.schema_base, "schemas/capability-input.schema.json"),
                 "outputSchema": _schema_uri(args.schema_base, "schemas/capability-output.schema.json"),

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_identifiers.py

@@ -0,0 +1,182 @@
+"""Identifier equality (contract DEC-0076): two identifiers are the same when their normal forms are equal.
+
+A port of the contract's `src/identifiers.ts`, held to its `fixtures/vectors/identifiers.json`. The normal form of a URI
+is RFC 3986 §6.2.2 syntax-based normalization: the scheme and the host lower-cased and percent-encoding hex upper-cased
+(§6.2.2.1), percent-encoded unreserved characters decoded (§6.2.2.2), dot segments removed from a hierarchical path
+(§6.2.2.3), and only the leading ones from a rootless path; nothing scheme-based (§6.2.3). A `urn:` URI follows RFC 8141
+§3.1 instead: the scheme and the NID lower-cased, percent-encoding hex upper-cased, nothing decoded, the NSS's case kept,
+the r-, q- and f-components ignored. A string that is not a URI by RFC 3986's `URI` production is its own normal form.
+Nothing here raises. Standard library only; this file is byte-identical in both skills' `scripts/`."""
+from __future__ import annotations
+
+import re
+from typing import Any, Optional, Tuple
+
+_UNRESERVED = r"A-Za-z0-9\-._~"
+_SUB_DELIMS = r"!$&'()*+,;="
+_PCT = r"%[0-9A-Fa-f]{2}"
+
+
+def _run(chars: str) -> "re.Pattern[str]":
+    """`*( <chars> / pct-encoded )`, linear: one character class beside one fixed triplet."""
+    return re.compile(r"(?:[%s]|%s)*" % (chars, _PCT), re.ASCII)
+
+
+_USERINFO = _run(_UNRESERVED + _SUB_DELIMS + ":")
+_REG_NAME = _run(_UNRESERVED + _SUB_DELIMS)
+_PATH = _run(_UNRESERVED + _SUB_DELIMS + ":@/")
+_QUERY = _run(_UNRESERVED + _SUB_DELIMS + ":@/?")
+_PORT = re.compile(r"[0-9]*", re.ASCII)
+_SCHEME = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*", re.ASCII)
+
+# RFC 3986 §3.2.2: IP-literal = "[" ( IPv6address / IPvFuture ) "]".
+_H16 = "[0-9A-Fa-f]{1,4}"
+_DEC_OCTET = "(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])"
+_IPV4 = r"%s(?:\.%s){3}" % (_DEC_OCTET, _DEC_OCTET)
+_LS32 = "(?:%s:%s|%s)" % (_H16, _H16, _IPV4)
+_IPV6 = "|".join([
+    "(?:%s:){6}%s" % (_H16, _LS32),
+    "::(?:%s:){5}%s" % (_H16, _LS32),
+    "(?:%s)?::(?:%s:){4}%s" % (_H16, _H16, _LS32),
+    "(?:(?:%s:){0,1}%s)?::(?:%s:){3}%s" % (_H16, _H16, _H16, _LS32),
+    "(?:(?:%s:){0,2}%s)?::(?:%s:){2}%s" % (_H16, _H16, _H16, _LS32),
+    "(?:(?:%s:){0,3}%s)?::%s:%s" % (_H16, _H16, _H16, _LS32),
+    "(?:(?:%s:){0,4}%s)?::%s" % (_H16, _H16, _LS32),
+    "(?:(?:%s:){0,5}%s)?::%s" % (_H16, _H16, _H16),
+    "(?:(?:%s:){0,6}%s)?::" % (_H16, _H16),
+])
+_IP_LITERAL = re.compile(r"\[(?:%s|[Vv][0-9A-Fa-f]+\.[%s%s:]+)\]" % (_IPV6, _UNRESERVED, _SUB_DELIMS), re.ASCII)
+
+# RFC 8141 §2: NID = (alphanum) 0*30(ldh) (alphanum), then ":" and a non-empty NSS.
+_URN_NAME = re.compile(r"([A-Za-z0-9][A-Za-z0-9-]{0,30}[A-Za-z0-9]):(.+)", re.ASCII | re.DOTALL)
+_SPLIT = re.compile(r"([^:/?#]+):(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?", re.DOTALL)
+_TRIPLET = re.compile(r"%([0-9A-Fa-f]{2})")
+_UNRESERVED_CHAR = re.compile(r"[A-Za-z0-9\-._~]", re.ASCII)
+
+
+def _percent(text: str, keep_encoded: bool = False) -> str:
+    """Percent-encoding hex upper-cased (§6.2.2.1), and unreserved characters decoded unless ``keep_encoded``."""
+    def one(match: "re.Match[str]") -> str:
+        char = chr(int(match.group(1), 16))
+        return char if not keep_encoded and _UNRESERVED_CHAR.fullmatch(char) else "%" + match.group(1).upper()
+    return _TRIPLET.sub(one, text)
+
+
+def _strip_leading_dots(path: str) -> str:
+    """A rootless path loses its leading "./" and "../" segments while what is left stays rootless (DEC-0076)."""
+    start = 0
+    while path.startswith("./", start) or path.startswith("../", start):
+        start += 2 if path.startswith("./", start) else 3
+    rest = path[start:]
+    return path if rest == "" or rest.startswith("/") else rest
+
+
+def _remove_dot_segments(path: str) -> str:
+    """RFC 3986 §5.2.4 remove_dot_segments over a path whose "." and ".." are already decoded."""
+    absolute = path.startswith("/")
+    segments = (path[1:] if absolute else path).split("/")
+    output = []
+    for index, segment in enumerate(segments):
+        last = index == len(segments) - 1
+        if segment in (".", ".."):
+            if segment == ".." and output:
+                output.pop()
+            if last:  # a dot segment that ends the path leaves it ending in "/"
+                output.append("")
+            continue
+        output.append(segment)
+    return ("/" if absolute else "") + "/".join(output)
+
+
+def _authority_parts(authority: str) -> Optional[Tuple[Optional[str], str, Optional[str]]]:
+    at = authority.rfind("@")
+    userinfo = None if at == -1 else authority[:at]
+    host_port = authority if at == -1 else authority[at + 1:]
+    bracket = host_port.find("]") if host_port.startswith("[") else -1
+    colon = host_port.find(":", 0 if bracket == -1 else bracket)
+    host = host_port if colon == -1 else host_port[:colon]
+    port = None if colon == -1 else host_port[colon + 1:]
+    if userinfo is not None and not _USERINFO.fullmatch(userinfo):
+        return None
+    if port is not None and not _PORT.fullmatch(port):
+        return None
+    if not (_IP_LITERAL.fullmatch(host) if host.startswith("[") else _REG_NAME.fullmatch(host)):
+        return None
+    return userinfo, host, port
+
+
+def _parse(text: str) -> Optional[Tuple[str, Optional[str], str, Optional[str], Optional[str]]]:
+    """RFC 3986 Appendix B's split, then each component checked against its §3 production; None when one fails."""
+    match = _SPLIT.fullmatch(text)
+    if not match:
+        return None
+    scheme, authority, path, query, fragment = match.groups()
+    path = path or ""
+    if not _SCHEME.fullmatch(scheme) or not _PATH.fullmatch(path):
+        return None
+    if query is not None and not _QUERY.fullmatch(query):
+        return None
+    if fragment is not None and not _QUERY.fullmatch(fragment):
+        return None
+    if authority is not None and _authority_parts(authority) is None:
+        return None
+    if authority is None and path == "":
+        return None
+    return scheme, authority, path, query, fragment
+
+
+def _urn_form(authority: Optional[str], path: str, query: Optional[str]) -> str:
+    name = _URN_NAME.fullmatch(path)
+    path = "%s:%s" % (name.group(1).lower(), _percent(name.group(2), True)) if name else _percent(path, True)
+    # A "?" not followed by "+" or "=" is no URN component (RFC 8141 §2): it is kept, never dropped unread.
+    kept = "?" + _percent(query, True) if query is not None and not re.match(r"[+=]", query) else ""
+    auth = "//" + _percent(authority, True) if authority is not None else ""
+    return "urn:%s%s%s" % (auth, path, kept)
+
+
+def _generic_form(scheme: str, authority: Optional[str], path: str, query: Optional[str], fragment: Optional[str]) -> str:
+    auth = ""
+    if authority is not None:
+        userinfo, host, port = _authority_parts(authority)  # type: ignore[misc]
+        # The host is case-insensitive (§3.2.2); its remaining percent triplets keep upper-case hex.
+        lowered = re.sub(r"%[0-9a-f]{2}", lambda m: m.group(0).upper(), _percent(host).lower())
+        auth = "//%s%s%s" % ("" if userinfo is None else _percent(userinfo) + "@", lowered, "" if port is None else ":" + port)
+    decoded = _percent(path)
+    hierarchical = authority is not None or decoded.startswith("/")
+    out = _remove_dot_segments(decoded) if hierarchical else _strip_leading_dots(decoded)
+    if authority is None and out.startswith("//"):  # it would read as an authority: keep the decoded path
+        out = decoded
+    q = "" if query is None else "?" + _percent(query)
+    f = "" if fragment is None else "#" + _percent(fragment)
+    return "%s:%s%s%s%s" % (scheme.lower(), auth, out, q, f)
+
+
+def normal_identifier(value: Any) -> Optional[str]:
+    """The normal form of an identifier: a URI's syntax-normalized form (RFC 3986 §6.2.2; RFC 8141 §3.1 for `urn:`),
+    any other string as it is, None for a value that is not a string. The contract's `normalIdentifier`."""
+    if not isinstance(value, str):
+        return None
+    parts = _parse(value)
+    if parts is None:
+        return value
+    scheme, authority, path, query, fragment = parts
+    return _urn_form(authority, path, query) if scheme.lower() == "urn" else _generic_form(scheme, authority, path, query, fragment)
+
+
+def _strict_equal(a: Any, b: Any) -> bool:
+    """JavaScript's === on parsed JSON: numbers by value, booleans only with booleans, objects by identity."""
+    if isinstance(a, bool) or isinstance(b, bool):
+        return isinstance(a, bool) and isinstance(b, bool) and a == b
+    if isinstance(a, (int, float)) and isinstance(b, (int, float)):
+        return a == b
+    if isinstance(a, (dict, list)) or isinstance(b, (dict, list)):
+        return a is b
+    return type(a) is type(b) and a == b
+
+
+def same_identifier(a: Any, b: Any) -> bool:
+    """Two identifiers are the same when their normal forms are equal (DEC-0076). A value that is not a string is no
+    identifier and is compared as it is (JavaScript's ===). The contract's `sameIdentifier`."""
+    if not isinstance(a, str) or not isinstance(b, str):
+        return _strict_equal(a, b)
+    return normal_identifier(a) == normal_identifier(b)

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_provider.py

@@ -142,7 +142,8 @@ def _run_problems(run: Any) -> List[str]:
 
 
 def manifest_problems(entry: Dict[str, Any]) -> List[str]:
-    """FAC-SEM-014 (DEC-0017), URI half: the manifest resolves and its provider.id equals providerId."""
+    """FAC-SEM-014 (DEC-0017), URI half: the manifest resolves and its provider.id equals providerId, compared by normal
+    form (DEC-0076)."""
     try:
         manifest = json.loads(Path(os.path.expanduser(str(entry["manifest"]))).read_text(encoding="utf-8"))
     except (OSError, ValueError):
@@ -150,7 +151,8 @@ def manifest_problems(entry: Dict[str, Any]) -> List[str]:
     provider = manifest.get("provider") if isinstance(manifest, dict) else None
     if not isinstance(provider, dict) or not isinstance(manifest.get("capabilities"), list):
         return ["%s is not a provider manifest (FAC-SEM-014)" % entry["manifest"]]
-    if provider.get("id") != entry["providerId"]:
+    import fabric_identifiers  # noqa: E402 - beside this file; DEC-0076: URIs compared by normal form
+    if not fabric_identifiers.same_identifier(provider.get("id"), entry["providerId"]):
         return ["providerId %s is not the manifest's provider.id %s (FAC-SEM-014)" % (entry["providerId"], provider.get("id"))]
     return []
 
@@ -195,6 +197,9 @@ def write_provider_entry(entry: Dict[str, Any], directory: Optional[Path] = None
     clash = _service_ids(services or services_dir()).get(entry["id"])
     if clash:
         raise ProviderError("%s is already a service (%s); an id is a service or a provider, never both (FAC-SEM-013)." % (entry["id"], clash))
+    import fabric_identifiers  # noqa: E402 - beside this file
+    # DEC-0076: written in its normal form, so a reader that looks it up finds one spelling.
+    entry = dict(entry, providerId=fabric_identifiers.normal_identifier(entry["providerId"]))
     target = (directory or providers_dir()) / ("%s.json" % entry["id"])
     _atomic_write(target, (json.dumps(entry, indent=2, ensure_ascii=False) + "\n").encode())
     return target

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.24.0"
+  version: "0.26.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0"
+  extension-commit: "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b"
 ---
 
 # Building Fabric services

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,13 +1,14 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0`
+Pinned to `fabric-agent-contract` commit `a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
 canonical forms DEC-0043; `degraded[].setup` and `run.mcp.stdio.scope` DEC-0044; delegation sealed and trust tiers
 DEC-0045; runner and model profiles DEC-0046; the estate record DEC-0055; one copy under any supervisor and its marker,
 the Windows token-file reader DEC-0057; the hub key the estate certifies DEC-0060; signing credentials DEC-0063; the
-estate record's 60 s skew DEC-0066). The contract's schemas are normative;
+estate record's 60 s skew DEC-0066; an app's own descriptor DEC-0069; the descriptor for listings DEC-0061; identifier equality
+by normal form DEC-0076). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
@@ -41,6 +42,17 @@ File `<id>.<instance>.json`, mode 0600 (on Windows a protected ACL), atomic.
 | `runner` | optional `{kind?, credentialKind}` (DEC-0061): `credentialKind` `subscription`, `key`, `platform-metered` or `none` — a kind, never a credential (`FAC-SEM-086` refuses a credential-shaped value here or in `installedBy`); a subscription names its vendor's runner (`claude-code`, `kimi-code`, `codex`) |
 | `peer` | optional `{endpoint, custody, residency, maxDataClass}` (DEC-0061): the service is offered to others. `endpoint` `https://<dns-name>[:<port>][/<path>]`, never a reserved name (`FAC-SEM-085`); `custody` `organization-managed` or `personal`; `residency` 1–32 ISO 3166-1 alpha-2 codes, `EU` admitted, user-assigned codes refused; `maxDataClass` `public` < `internal` < `confidential` < `restricted`. An offer needs `runner` and never runs on a subscription. A host sends a request from anyone but the operator only when `peer_refusal` / `peerRefusal` answers null (`FAC-SEM-088`); usage rows may take `route: "platform-metered"` |
 
+## Identifier equality (DEC-0076)
+
+Two identifiers are the same when their normal forms are equal. `normal_identifier` / `normalIdentifier` and
+`same_identifier` / `sameIdentifier` (`fabric_identifiers.py`, `fabric-identifiers.mjs`, ports of the contract's
+`src/identifiers.ts`, held to its `identifiers.json`) apply RFC 3986 §6.2.2 to a URI: scheme and host lower-cased,
+percent-encoding hex upper-cased, unreserved characters decoded, dot segments removed. A `urn:` follows RFC 8141 §3.1
+instead: `urn` and the NID lower-cased, nothing decoded, the NSS's case kept. Any other string is its own normal form,
+and a value that is not a string is compared as it is. The kits compare by it in FAC-SEM-030/032/034 (routes, bindings,
+events), FAC-SEM-076 (estate grants and their revocations) and FAC-SEM-014 (a provider entry's `providerId`), and they
+write the identifiers they scaffold in normal form.
+
 ## Well-known document — `GET /.well-known/fabric-service`
 
 No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
@@ -104,6 +116,24 @@ empty, or `null` for an empty log. Retain at least seven days or 1000 events.
 path on the service origin, never an absolute URL. Optional SSE stream at
 `surfaces.events.stream` carrying the same objects.
 
+**Machine-readable `data` (DEC-0070).** An event may carry `data {schema, value}` beside its sentence: `schema` is the
+absolute URI of a payload schema the service publishes; `value` is an object of at most 32 members, each a scalar (a
+string of at most 500 characters, a number, a boolean, null), a list of at most 32 scalars, or an object of at most 32
+scalar members. `text` stays the event: a host that ignores `data` loses nothing, and one that does not know the schema
+treats `value` as opaque. No string in `value` sits under a credential's name or has a credential's shape
+(`FAC-SEM-101`); personal data is the service's own duty. `make_event` / `makeEvent` (and `JsonlEventLog.append`) take
+`data=` and refuse one that breaks either rule, naming the place, never the value; `check_service.py` checks the feed it
+fetches (`events.data`). A host pinned before DEC-0070 that validates events against a closed copy refuses the member.
+
+**Protocol revisions (DEC-0067).** The well-known document may list `protocols`, the revisions the service accepts: at
+most N and N−1 per protocol, consecutive in the contract's register, each `<name>/<revision>` once, 1 to 64 entries
+(`FAC-SEM-099`). `build_well_known` / `buildWellKnown` take `protocols=` and check it; list them only once your hosts
+are pinned at or after DEC-0067, because the document is closed for an older reader. A service that receives a document
+in a revision it does not read answers `negotiate_revision` / `negotiateRevision`'s `schema-unsupported` refusal before
+reading it further (HTTP 400, or an MCP `isError` result's `structuredContent`); a receiver that accepts none answers its
+own fault `no-accepted-revisions`. `PROTOCOL_REVISIONS` is the contract's register; `check_service.py` reads
+`well-known.protocols`.
+
 ## Login code and the operator session — `POST /fabric/v1/login-code`
 
 Token required → `{ "url": "/fabric/v1/login?code=<16–256 url-safe chars>", "expiresAt": "…" }`,

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -260,6 +260,11 @@ class Probe:
         if "events" not in (wk.get("surfaces") or {}):
             problems.append("surfaces.events missing")
         self.add("well-known.shape", "FAIL" if problems else "PASS", "; ".join(problems) or "protocol, build, status, degraded, surfaces")
+        if "protocols" in wk:
+            # DEC-0067, FAC-SEM-099: the revisions it accepts, N and N−1 per protocol, each once.
+            findings = fs.protocols_findings(wk["protocols"])
+            self.add("well-known.protocols", "FAIL" if findings else "PASS",
+                     "; ".join("%s %s" % (f["instancePath"], f["message"]) for f in findings) or ", ".join(wk["protocols"]))
         self.configuration_rule()
         svc = wk.get("service") or {}
         answered = "%s.%s" % (svc.get("id"), svc.get("instance"))
@@ -346,6 +351,11 @@ class Probe:
                 bad.append("%s (text is not a sentence)" % e.get("id"))
         self.add("events.page", "FAIL" if bad else "PASS",
                  ("bad events: " + ", ".join(bad)) if bad else "%d event(s), cursor %r" % (len(events), page["cursor"]))
+        # DEC-0070, FAC-SEM-101: an event's data never carries a credential; the finding names the place, never the value.
+        leaks = fs.feed_data_findings(page)
+        if any(isinstance(e, dict) and "data" in e for e in events) or leaks:
+            self.add("events.data", "FAIL" if leaks else "PASS",
+                     "; ".join("%s: %s" % (f["instancePath"], f["message"]) for f in leaks) or "every event's data is free of credentials")
 
     def usage_rules(self) -> None:
         """DEC-0021: a declared usage report requires the token and adds up (FAC-SEM-025)."""

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-estate.mjs

@@ -12,6 +12,7 @@
 
 import crypto from 'node:crypto';
 import { jcs } from './fabric-delegation.mjs';
+import { normalIdentifier } from './fabric-identifiers.mjs';
 import { secretValue } from './fabric-secrets.mjs';
 
 export const ESTATE_RECORD_SCHEMA = 'estate-record/1';
@@ -428,12 +429,14 @@ function secretReferences(value, flag) {
 }
 
 function grantsAndRevocations(value, flag) {
+  // A grant's id is a URI, so grants and their revocations are keyed by its normal form (DEC-0076).
+  const grantKey = (id) => (typeof id === 'string' ? normalIdentifier(id) : id);
   const grantIds = new Set();
   list(value.shareGrants).forEach((grant, index) => {
     if (grant.principalKind !== 'external') flag(`/shareGrants/${index}/principalKind`, 'a share grant is to a principal outside the estate: principalKind external');
     const id = isObject(grant.meta) ? grant.meta.id : undefined;
-    if (grantIds.has(id)) flag(`/shareGrants/${index}/meta/id`, `grant ${String(id)} is listed twice`);
-    grantIds.add(id);
+    if (grantIds.has(grantKey(id))) flag(`/shareGrants/${index}/meta/id`, `grant ${String(id)} is listed twice`);
+    grantIds.add(grantKey(id));
   });
   const machines = list(value.machines);
   // A Map, so a kind such as `constructor` or `__proto__` reads nothing from Object.prototype.
@@ -448,10 +451,11 @@ function grantsAndRevocations(value, flag) {
   }));
   const seen = new Set();
   list(value.revocations).forEach((revocation, index) => {
-    const key = `${String(revocation.kind)} ${String(revocation.ref)}`;
+    const ref = revocation.kind === 'grant' ? grantKey(revocation.ref) : revocation.ref;
+    const key = `${String(revocation.kind)} ${String(ref)}`;
     if (seen.has(key)) flag(`/revocations/${index}`, `the ${String(revocation.kind)} ${String(revocation.ref)} is revoked twice`);
     seen.add(key);
-    if (listed.get(String(revocation.kind))?.has(revocation.ref)) flag(`/revocations/${index}/ref`, `the record still lists the ${String(revocation.kind)} it revokes: revocation outranks addition`);
+    if (listed.get(String(revocation.kind))?.has(ref)) flag(`/revocations/${index}/ref`, `the record still lists the ${String(revocation.kind)} it revokes: revocation outranks addition`);
   });
 }