@passioncode-ai/passioncode 0.2.17 → 0.2.19

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,4 +1,4 @@
-# fabric-service/0.1 — wire reference
+# fabric-service/0.1: wire reference
 
 Pinned to `fabric-agent-contract` commit `c55f2d5a11c9a0197e958e87212fca7ae1154769`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
@@ -14,13 +14,13 @@ this page is the working summary. Extension key:
 
 ## Contents
 
-- Descriptor — written by the installer
+- Descriptor: written by the installer
 - Well-known document
 - Events page
 - Login code and the operator session
 - Semantic rules a host applies
 
-## Descriptor — written by the installer
+## Descriptor: written by the installer
 
 Directory: macOS `~/Library/Application Support/ai.passioncode.fabric/services/`,
 Linux `${XDG_DATA_HOME:-~/.local/share}/passioncode-fabric/services/`, Windows
@@ -33,13 +33,13 @@ File `<id>.<instance>.json`, mode 0600 (on Windows a protected ACL), atomic.
 | `id`, `instance` | `^[a-z][a-z0-9-]{1,62}$`, `^[a-z][a-z0-9-]{0,31}$` (default `default`); the pair is unique per machine |
 | `name`, `summary` | ≤ 80 and ≤ 200 characters |
 | `origin` | `http://127.0.0.1:<port>`; the port is a machine-wide claim. Optional for an app's descriptor only (`manager: "person"`, DEC-0069): its live origin and process id are in the app's own liveness file, and a descriptor without an origin claims no port (`FAC-SEM-010`) |
-| `auth` | `tokenFile` (0600; on Windows a protected ACL — owner and every granting entry the current user, SYSTEM or Administrators: service.md *Windows token files*, DEC-0032, DEC-0033); `header` default `Authorization` with `scheme` `Bearer`; any other header carries the raw token with `scheme: "none"` |
+| `auth` | `tokenFile` (0600; on Windows a protected ACL: owner and every granting entry the current user, SYSTEM or Administrators: service.md *Windows token files*, DEC-0032, DEC-0033); `header` default `Authorization` with `scheme` `Bearer`; any other header carries the raw token with `scheme: "none"` |
 | `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task), `node` (Project Observatory's node supervises it as its child, with no supervisor file, DEC-0061), `person` (an app a person installs and starts, then `app`, the installed app, DEC-0069) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032), `label` and `plist` beside any but `launchd` (DEC-0057), `app` beside any but `person`. Both kits and the probe accept all six; both kits write the unit and the task (`systemd_unit`, `task_xml` / `systemdUnit`, `taskXml`). An app's descriptor says it is installed, never that it runs: the probe checks `app` is still there (`descriptor.app-installed`) and reads no well-known document; a reader that finds the app gone treats the descriptor as stale (`app_descriptor_stale` / `appDescriptorStale`), and an app that writes its own descriptor rewrites it only when `app_descriptor_action` / `appDescriptorAction` says `write` |
 | `paths` | `data` (required), `logs[]`, optional `config`, `cache` |
-| `commands` | only `doctor` and `update`, argument arrays whose first item is an absolute or `~/` path (Windows: also `C:\…`, `C:/…` or `~\…`, never a network share — DEC-0032) |
+| `commands` | only `doctor` and `update`, argument arrays whose first item is an absolute or `~/` path (Windows: also `C:\…`, `C:/…` or `~\…`, never a network share; DEC-0032) |
 | `source.repository`, `fabricManifest` | optional |
-| `installedAt`, `installedBy` | when, and who installed it: the installer and its version as a string, or `{by, role?, tool}` (DEC-0061) — `by` `person` (with `role` `operator` or `administrator`), `node` or `organization`; `role` for a person only; `tool` the installer and its version. It names a role, never a person. An app's descriptor uses the object form with `by: "person"`. `register_remote` / `registerRemote` and the sample write the object form |
-| `runner` | optional `{kind?, credentialKind}` (DEC-0061): `credentialKind` `subscription`, `key`, `platform-metered` or `none` — a kind, never a credential (`FAC-SEM-086` refuses a credential-shaped value here or in `installedBy`); a subscription names its vendor's runner (`claude-code`, `kimi-code`, `codex`) |
+| `installedAt`, `installedBy` | when, and who installed it: the installer and its version as a string, or `{by, role?, tool}` (DEC-0061): `by` `person` (with `role` `operator` or `administrator`), `node` or `organization`; `role` for a person only; `tool` the installer and its version. It names a role, never a person. An app's descriptor uses the object form with `by: "person"`. `register_remote` / `registerRemote` and the sample write the object form |
+| `runner` | optional `{kind?, credentialKind}` (DEC-0061): `credentialKind` `subscription`, `key`, `platform-metered` or `none`: a kind, never a credential (`FAC-SEM-086` refuses a credential-shaped value here or in `installedBy`); a subscription names its vendor's runner (`claude-code`, `kimi-code`, `codex`) |
 | `peer` | optional `{endpoint, custody, residency, maxDataClass}` (DEC-0061): the service is offered to others. `endpoint` `https://<dns-name>[:<port>][/<path>]`, never a reserved name (`FAC-SEM-085`); `custody` `organization-managed` or `personal`; `residency` 1–32 ISO 3166-1 alpha-2 codes, `EU` admitted, user-assigned codes refused; `maxDataClass` `public` < `internal` < `confidential` < `restricted`. An offer needs `runner` and never runs on a subscription. A host sends a request from anyone but the operator only when `peer_refusal` / `peerRefusal` answers null (`FAC-SEM-088`); usage rows may take `route: "platform-metered"` |
 
 ## Identifier equality (DEC-0076)
@@ -53,7 +53,7 @@ and a value that is not a string is compared as it is. The kits compare by it in
 events), FAC-SEM-076 (estate grants and their revocations) and FAC-SEM-014 (a provider entry's `providerId`), and they
 write the identifiers they scaffold in normal form.
 
-## Well-known document — `GET /.well-known/fabric-service`
+## Well-known document: `GET /.well-known/fabric-service`
 
 No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
 
@@ -83,8 +83,8 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
 - `build` needs `commit` or `digest` (`sha256:<64 hex>`).
 - `summary`: at most six tiles; `attention: true` counts toward the host's badge.
 - `surfaces.events` is required; `dashboard` and `mcp` when the service has them; `usage`
-  (DEC-0021) when the service reports its spend — see [the usage reference](usage.md);
-  `operatorChannel.path` (DEC-0034) when the service has an operator channel — its status
+  (DEC-0021) when the service reports its spend (see [the usage reference](usage.md));
+  `operatorChannel.path` (DEC-0034) when the service has an operator channel; its status
   document follows the contract's `operator-channel-status.schema.json` and is token-protected
   like the events feed. The kits do not serve it yet.
 - `extensions` MAY carry the embedded dashboard declaration under
@@ -98,7 +98,7 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   token is not an MCP credential: a host and the probe never call `/mcp` with it as a caller.
   The kits verify them with `fabric_delegation` / `fabric-delegation.mjs` ([delegation](delegation.md)).
 
-## Events page — `GET /fabric/v1/events?after=<cursor>&limit=<n>`
+## Events page: `GET /fabric/v1/events?after=<cursor>&limit=<n>`
 
 Token required. `limit` default 50, maximum 200. Without `after`: the newest `limit`,
 ascending. `cursor` is the last id returned, or the `after` you sent when the page is
@@ -134,7 +134,7 @@ reading it further (HTTP 400, or an MCP `isError` result's `structuredContent`);
 own fault `no-accepted-revisions`. `PROTOCOL_REVISIONS` is the contract's register; `check_service.py` reads
 `well-known.protocols`.
 
-## Login code and the operator session — `POST /fabric/v1/login-code`
+## Login code and the operator session: `POST /fabric/v1/login-code`
 
 Token required → `{ "url": "/fabric/v1/login?code=<16–256 url-safe chars>", "expiresAt": "…" }`,
 single use, at most 120 s, recorded as used before it is honoured. `GET` that URL →
@@ -151,4 +151,4 @@ ended session answers `401` on the dashboard page.
 | `FAC-SEM-010` | no two descriptors claim one port or one `id.instance` |
 | `FAC-SEM-011` | `ready` carries no degraded source |
 | `FAC-SEM-012` | commands start with an absolute or `~/` executable |
-| `FAC-SEM-025` | a usage report adds up; an all-unpriced row costs `null`, not `0` (DEC-0021) |
+| `FAC-SEM-025` | a usage report adds up; an all-unpriced row costs `null`, not `0` (DEC-0021); unmeasured calls are within calls and a day's are its models' sum (DEC-0091) |

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/remote-placement.md

@@ -1,4 +1,4 @@
-# The remote placement — online agents and dashboards
+# The remote placement: online agents and dashboards
 
 Normative source: `fabric-agent-contract` `docs/specification/service.md` → *Remote placement*,
 DEC-0019, at the commit this skill pins. This page is the how-to.
@@ -7,7 +7,7 @@ DEC-0019, at the commit this skill pins. This page is the how-to.
 
 It is, when it runs outside the operator's computer and the operator wants it in Fabric beside
 the local services: a hosted dashboard, an agent on a server, a bot's web console. It keeps the
-same objects — well-known document, events feed, login code — at the same paths.
+same objects (well-known document, events feed, login code) at the same paths.
 
 ## The descriptor
 
@@ -47,7 +47,7 @@ watch the gate fail.
   the same value is written on the operator's computer by `registerRemote`. Compare in constant
   time (`tokenMatches`).
 - **Session key**: 32 random bytes, a separate secret; rotating it signs every operator out.
-- **Codes and sessions**: `MemoryCodeStore` — a restart forgets every outstanding code, so none
+- **Codes and sessions**: `MemoryCodeStore`: a restart forgets every outstanding code, so none
   can be replayed, and every session record, so a deploy signs the operator out (DEC-0039: the
   server keeps each session's last use and logout). The host signs in again on the page's `401`.
   To keep sessions across a deploy, pass a durable store (any object with `load()` and `save()`).
@@ -68,7 +68,7 @@ reach the service, and still need its own `403`.
 
 | Situation | Host |
 |---|---|
-| `401` on the well-known document | `down` — the service refused the token; never `foreign` |
+| `401` on the well-known document | `down`: the service refused the token; never `foreign` |
 | answer names another `id.instance` | `foreign`; the token is not sent again until the descriptor changes |
 | certificate invalid or for another name | `down`, the reason names TLS |
 | redirect | not followed; `down` |

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/settings-backups.md

@@ -1,8 +1,8 @@
-# Settings backups — what the operator decided survives the data directory (DEC-0025)
+# Settings backups: what the operator decided survives the data directory (DEC-0025)
 
 Fabric Agent Contract DEC-0025, `docs/specification/service.md` → *Settings backup*, schema
 `schemas/settings-backup.schema.json`, rule `FAC-SEM-035`. A service whose store holds what the operator
-decided — which projects it serves, how each is bound, which secret slot each binding uses, their overrides —
+decided (which projects it serves, how each is bound, which secret slot each binding uses, their overrides)
 SHOULD keep settings backups, so a lost, purged or wrongly migrated data directory costs the operator nothing.
 
 ## Where
@@ -61,7 +61,7 @@ plan = fs.restore_plan(doc, {"projects": {"columns": [...], "key": ["id"], "requ
 # plan["tables"]["projects"]: insert, present, droppedColumns, defaultedColumns, missingRequired, refused
 ```
 
-- **Automatic restore** only on a *fresh* database — no domain records **and** the service has never started —
+- **Automatic restore** only on a *fresh* database (no domain records **and** the service has never started),
   so a restart never undoes a deletion. Insert `plan[...]["insert"]` and add every row the database refuses to
   `refused` with its key and reason.
 - **Manual restore** shows the plan first; applying it is the operator's act, never an agent's.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/surfaces-and-auth.md

@@ -16,13 +16,13 @@
   the estate's delegation tokens; declare `auth.delegation {issuer, jwks}` in the well-known
   document. The probe treats it like `own` and checks the declaration
   (`auth.delegation-declared`). The kits verify the tokens: put `delegation_gate` /
-  `delegationGate` in front of the tools — see [the delegation reference](delegation.md).
+  `delegationGate` in front of the tools (see [the delegation reference](delegation.md)).
 - Register it into a client config with the service's own command
   (`<tool> mcp-register`), which writes `{"type":"http","url":"http://127.0.0.1:<port>/mcp","headers":{...}}`
   atomically, aborts if the file changed meanwhile, and keeps one 0600 backup. The token
-  goes in `headers`, never in the URL — every log that records a URL prints its query
+  goes in `headers`, never in the URL: every log that records a URL prints its query
   string. An HTTP registration starts nothing per session: every client session talks to the
-  one resident service (LC-19). A stdio server, by contrast, is a process per session — keep
+  one resident service (LC-19). A stdio server, by contrast, is a process per session; keep
   one only at project scope.
 - Ship server `instructions` that tell a caller where to start and that every answer
   carries `degraded`.
@@ -39,7 +39,7 @@ a sign-in link only when stdout is a terminal.
 ## A2A for remote agents
 
 Remote reach goes through A2A `1.0` over HTTPS or an authenticated gateway in front of
-MCP — never by binding a LAN address. A tunnel (Tailscale Serve and the like) is an
+MCP, never by binding a LAN address. A tunnel (Tailscale Serve and the like) is an
 outward surface with its own token lifetime; watch it like a service, because nothing
 else will notice it expire.
 
@@ -50,7 +50,7 @@ else will notice it expire.
 - Compared in constant time (`token_matches`).
 - Rotation is an operator act: write a new file, restart, re-run `mcp-register`.
 - Same-user processes can read it. The protocol defends against web pages and
-  mistakes, not against hostile code running as the operator — say so in SECURITY.md.
+  mistakes, not against hostile code running as the operator; say so in SECURITY.md.
 
 ## Dashboard session
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/usage.md

@@ -1,4 +1,4 @@
-# Usage report — what the agent spent (DEC-0021)
+# Usage report: what the agent spent (DEC-0021)
 
 Fabric Agent Contract DEC-0021, `docs/specification/service.md` → *Usage report*, schema
 `schemas/service-usage.schema.json`. Optional. A service that calls paid models or tools should
@@ -29,6 +29,8 @@ ledger.record(receipt)                     # fs.JsonlUsageLedger(data / "usage.j
 ledger.record(k.makeUsageReceipt('openrouter', model, { inputTokens, outputTokens, costUsd: usage.cost ?? null }));
 ```
 
+- **OpenRouter through the kit.** `fabric_openrouter.Client` records these receipts itself, one per answered call,
+  and checks a spend ceiling before every attempt ([connectors](connectors.md)).
 - **The provider's own numbers.** Take tokens from the response's usage block, not from a local
   estimate. The cost is `provider` when the provider reported the charge (OpenRouter `usage.cost`,
   a billing API) and `price-list` when you computed it from a published price list.
@@ -39,7 +41,8 @@ ledger.record(k.makeUsageReceipt('openrouter', model, { inputTokens, outputToken
 - **Unknown tokens are named too** (DEC-0091). When the provider gave no token count (a stream cut off, a local
   model without a counter), pass `tokens_measured=False` / `tokensMeasured: false` with the tokens you have (often 0).
   The receipt carries `tokensMeasured: false`, and the report counts the call in `unmeasuredCalls` on its day and model
-  row, never more than `calls`; a host then shows the token totals as a lower bound.
+  row, never more than `calls`; a host then shows the token totals as a lower bound. A job whose usage you send as
+  `null` or `partial` ([interop](interop.md)) is such a call.
 - **No content.** A receipt carries no prompt, output, caller or user id. The kits accept only the
   fields above.
 - If the service already keeps a ledger (a jobs table with token counts), build the receipts from
@@ -63,7 +66,7 @@ left out.
 it, and the host only shows it.
 
 **Every limit (DEC-0027).** Pass `budgets` to list every spending limit the service applies,
-enforced or not, so the spend view shows all of them — the operator asked for that on 2026-10-07:
+enforced or not, so the spend view shows all of them; the operator asked for that on 2026-10-07:
 
 ```python
 ledger.report(service_id=ID, budget={"period": "month", "limitUsd": 100}, budgets=[
@@ -78,7 +81,7 @@ ledger.report(service_id=ID, budget={"period": "month", "limitUsd": 100}, budget
   way `budget` is, so `budget` and its twin in `budgets` never disagree. A per-order limit
   (`per_job`, `approval`) gets `spentUsd: null`. Every other limit states its own spend.
 - `scope` is `machine`, `project`, `pool` or `job`; a `project` or `pool` limit names its
-  `subject`. A limit has at most one window — `period`, `windowSeconds` or `since` — and it agrees
+  `subject`. A limit has at most one window (`period`, `windowSeconds` or `since`), and it agrees
   with the kind (`daily`: the day or 86400 s; `monthly`: the month or 28–31 days; `velocity`: a
   rolling window). `tripped: true` (work stopped by it now) needs `enforced: true`. An unknown
   kind is shown generically, never refused.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -57,74 +57,16 @@ import fabric_interop as fi  # noqa: E402
 Result = Dict[str, str]
 
 
-
-def plist_problems(plist: dict, label: object, token: object = None) -> list:
-    """What makes a service's launchd job unfit to stay up: identity, restart, secrets."""
-    problems = []
-    if plist.get("Label") != label:
-        problems.append("Label %r" % plist.get("Label"))
-    if plist.get("RunAtLoad") is not True:
-        problems.append("RunAtLoad is not true")
-    if plist.get("KeepAlive") is not True:
-        problems.append("KeepAlive is %r, not true" % plist.get("KeepAlive"))
-    for key, value in (plist.get("EnvironmentVariables") or {}).items():
-        if re.search(r"(TOKEN|SECRET|PASSWORD|KEY)$", key) and not key.endswith("_FILE"):
-            problems.append("secret-like variable %s in the plist" % key)
-        if token and token in str(value):
-            problems.append("the service token itself is in the plist")
-    return problems
-
-
-def marker_problem(plist: dict) -> Optional[str]:
-    """What is wrong with the job's supervisor marker (DEC-0057; FAA-05), read the way the copy it starts reads it.
-
-    Without ``FABRIC_SERVICE_SUPERVISOR=launchd`` (or ``--fabric-supervisor launchd``) a copy that finds the
-    lock held exits 75 at once, and KeepAlive starts it again every ThrottleInterval."""
-    env = plist.get("EnvironmentVariables")
-    env = {str(k): str(v) for k, v in env.items()} if isinstance(env, dict) else {}
-    argv = plist.get("ProgramArguments")
-    argv = [str(a) for a in argv] if isinstance(argv, list) else []
-    marker = fs.supervisor_marker(env, argv)
-    if marker["kind"] == "supervised" and marker["manager"] == "launchd":
-        return None
-    fix = ("a copy that finds the lock held exits 75 at once and KeepAlive respawns it every ThrottleInterval; "
-           "regenerate the plist with launchd_plist / launchdPlist and reinstall")
-    if marker["kind"] == "conflict":
-        return "%s — %s" % (fs.marker_conflict_message(marker), fix)
-    if marker["kind"] == "supervised":
-        return "the marker names %s, not launchd — %s" % (marker["manager"], fix)
-    if marker.get("unreadable") is not None:
-        return "the marker %r names no supervisor — %s" % (marker["unreadable"], fix)
-    return "no %s=launchd — %s" % (fs.SUPERVISOR_ENV, fix)
-
-
-def priority_problems(plist: dict) -> list:
-    """A service that answers hosts and agents must not be scheduled as background work."""
-    out = []
-    if plist.get("ProcessType", "Standard") in ("Background", "Adaptive"):
-        out.append("ProcessType is %s" % plist.get("ProcessType"))
-    if isinstance(plist.get("Nice"), int) and plist["Nice"] > 0:
-        out.append("Nice is %d" % plist["Nice"])
-    if plist.get("LowPriorityIO") is True or plist.get("LowPriorityBackgroundIO") is True:
-        out.append("low-priority I/O")
-    return out
-
-
-# A platform router (Heroku, Fly, Render, a CDN) routes by Host, so a request naming a foreign
-# Host never reaches an online service: the router itself answers, typically 404 or 421. That is
-# still a refusal — the service disclosed nothing — so for a remote placement the host check
-# accepts it, as long as the body is not the well-known document. Every other guard request names
-# the right Host, reaches the service, and must be the service's own 403.
-PLATFORM_HOST_REFUSALS = (400, 404, 421)
-
-
-def guard_verdict(rule: str, remote: bool, status: int, body: bytes) -> Tuple[str, str]:
-    if status == 403:
-        return "PASS", "HTTP 403"
-    disclosed = b"fabric-service/" in (body or b"")
-    if rule == "network.host-check" and remote and status in PLATFORM_HOST_REFUSALS and not disclosed:
-        return "PASS", "HTTP %d from the platform router: a foreign Host never reaches the service" % status
-    return "FAIL", "HTTP %d%s" % (status, ", and the body is the well-known document" if disclosed else "")
+from check_service_rules import PLATFORM_HOST_REFUSALS  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import plist_problems  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import marker_problem  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import priority_problems  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import guard_verdict  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import board_responder_verdict  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import session_lifetime_problem  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import _semver  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import usage_problems  # noqa: E402,F401 - moved (FAA-65)
+from check_service_rules import same_repository  # noqa: E402,F401 - moved (FAA-65)
 
 
 class _PinnedHTTPS(http.client.HTTPSConnection):
@@ -729,7 +671,7 @@ class Probe:
                  marker or "%s: %s=launchd, so a copy that finds the lock held backs off" % (plist_path.name, fs.SUPERVISOR_ENV))
         slow = priority_problems(plist)
         self.add("lifecycle.priority", "FAIL" if slow else "PASS",
-                 "; ".join(slow) + " — macOS may starve the service under load and hosts then see an outage; use ProcessType Standard"
+                 "; ".join(slow) + ". macOS may starve the service under load and hosts then see an outage; use ProcessType Standard"
                  if slow else "%s: scheduled as a standard process" % plist_path.name)
         if sys.platform != "darwin" or not shutil.which("launchctl"):
             self.add("lifecycle.one-copy", "NOT_RUN", "launchctl is not available")
@@ -839,146 +781,6 @@ class Probe:
         return self.results
 
 
-def board_responder_verdict(wk: Any, kit: Optional[str] = None) -> Tuple[str, str]:
-    """board.responder: NOT_RUN when the well-known document declares no fabric-project-comms revision; FAIL when it
-    declares one this kit does not read or the kit's fixture conversation finds a problem; PASS otherwise. `kit` is the
-    service's own copy (a .py or .mjs path); by default the kit beside this probe."""
-    protocols = wk.get("protocols") if isinstance(wk, dict) else None
-    declared = [p for p in protocols if isinstance(p, str) and p.startswith("fabric-project-comms/")] if isinstance(protocols, list) else []
-    if not declared:
-        return "NOT_RUN", "the service declares no board participation (no fabric-project-comms revision in protocols)"
-    accepted = fs.accepted_revisions("fabric-project-comms")
-    unread = [p for p in declared if "error" in fs.negotiate_revision(p, accepted)]
-    if unread:
-        return "FAIL", "declares %s, which this kit does not read (it reads %s)" % (", ".join(unread), ", ".join(accepted))
-    try:
-        if kit and kit.endswith(".mjs"):
-            if not shutil.which("node"):
-                return "NOT_RUN", "node is not installed to run %s's fixture conversation" % kit
-            url = Path(kit).resolve().as_uri()
-            out = subprocess.run(["node", "--input-type=module", "-e",
-                                  "import(process.env.FABRIC_BOARD_KIT).then(async (m) => console.log(JSON.stringify(await m.selfCheck())))"],
-                                 env=dict(os.environ, FABRIC_BOARD_KIT=url), capture_output=True, text=True, timeout=60)
-            problems = json.loads(out.stdout.strip().splitlines()[-1]) if out.returncode == 0 and out.stdout.strip() else ["the Node kit did not run: %s" % out.stderr.strip()[:200]]
-        else:
-            import importlib.util
-            path = Path(kit) if kit else Path(__file__).resolve().parent / "fabric_board.py"
-            spec = importlib.util.spec_from_file_location("fabric_board_under_test", str(path))
-            module = importlib.util.module_from_spec(spec)
-            sys.path.insert(0, str(path.resolve().parent))
-            spec.loader.exec_module(module)  # type: ignore[union-attr]
-            problems = module.self_check()
-    except Exception as exc:  # noqa: BLE001 - a kit that cannot run its conversation fails the rule
-        return "FAIL", "the kit's fixture conversation did not run: %s" % exc.__class__.__name__
-    if problems:
-        return "FAIL", "; ".join(problems)
-    return "PASS", "declares %s; the kit%s answers the fixture conversation (whole, fenced, no epoch)" % (
-        ", ".join(declared), " at %s" % kit if kit else " beside this probe")
-
-
-def session_lifetime_problem(set_cookie: str, now: Optional[float] = None) -> Optional[str]:
-    """DEC-0039: a session cookie set at sign-in lives at most 7 days. Max-Age wins over Expires (RFC 6265
-    §5.3); a cookie with neither ends with the browser session. None when it is within the bound."""
-    attrs = {}
-    for part in set_cookie.split(";")[1:]:
-        name, _, value = part.strip().partition("=")
-        attrs[name.strip().lower()] = value.strip()
-    bound = fs.OPERATOR_SESSION_MAX_SECONDS
-    if "max-age" in attrs:
-        if not re.fullmatch(r"-?\d+", attrs["max-age"]):
-            return "the session cookie's Max-Age %r is not a number" % attrs["max-age"]
-        if int(attrs["max-age"]) > bound:
-            return "the session cookie's Max-Age %s outlives 7 days (%d s, DEC-0039)" % (attrs["max-age"], bound)
-        return None
-    if "expires" in attrs:
-        try:
-            at = email.utils.parsedate_to_datetime(attrs["expires"]).timestamp()
-        except (TypeError, ValueError, IndexError, OverflowError):
-            return "the session cookie's Expires %r is not a date" % attrs["expires"]
-        if at - (time.time() if now is None else now) > bound:
-            return "the session cookie's Expires %s outlives 7 days (DEC-0039)" % attrs["expires"]
-    return None
-
-
-def _semver(text: str) -> Tuple[int, int, int]:
-    m = re.match(r"^(\d+)\.(\d+)\.(\d+)", text or "")
-    return (int(m.group(1)), int(m.group(2)), int(m.group(3))) if m else (0, 0, 0)
-
-
-def usage_problems(report: Any, service_id: str, instance: str) -> List[str]:
-    """What makes this not a DEC-0021 usage report of the service: shape, identity and the sums of
-    FAC-SEM-025. An unknown cost must be null; a day's totals are the sums of its models."""
-    if not isinstance(report, dict):
-        return ["not an object"]
-    out: List[str] = []
-    if report.get("protocol") != fs.PROTOCOL:
-        out.append("protocol is %r" % report.get("protocol"))
-    if report.get("service") != {"id": service_id, "instance": instance}:
-        out.append("reports for %r, not %s.%s" % (report.get("service"), service_id, instance))
-    if report.get("currency") != "USD":
-        out.append("currency is not USD")
-    days = report.get("days")
-    if not isinstance(days, list) or len(days) > fs.USAGE_DAYS:
-        return out + ["days is not a list of at most 31"]
-    fields = ("calls", "unpricedCalls", "unmeasuredCalls", "inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens")
-
-    def priced(row: Dict[str, Any], at: str) -> None:
-        calls, unpriced, cost = row.get("calls", 0), row.get("unpricedCalls", 0), row.get("costUsd")
-        if unpriced > calls:
-            out.append("%s: more unpriced calls than calls" % at)
-        if row.get("unmeasuredCalls", 0) > calls:
-            out.append("%s: more calls with unknown tokens than calls (DEC-0091)" % at)
-        if calls and unpriced == calls and cost is not None:
-            out.append("%s: every call is unpriced, so the cost must be null, not %r" % (at, cost))
-        if unpriced < calls and cost is None:
-            out.append("%s: priced calls carry a cost" % at)
-        if cost is not None and (not isinstance(cost, (int, float)) or cost < 0):
-            out.append("%s: costUsd is not a non-negative number" % at)
-
-    previous = ""
-    for i, day in enumerate(days):
-        at = "days[%d]" % i
-        date = str(day.get("date", "")) if isinstance(day, dict) else ""
-        if not re.match(r"^\d{4}-\d{2}-\d{2}$", date) or date <= previous:
-            out.append("%s: dates must run forward" % at)
-        previous = date
-        priced(day, at)
-        models = day.get("byModel") if isinstance(day, dict) else None
-        if not isinstance(models, list):
-            out.append("%s: byModel missing" % at)
-            continue
-        for j, m in enumerate(models):
-            priced(m, "%s.byModel[%d]" % (at, j))
-        for f in fields:
-            if day.get(f, 0) != sum(m.get(f, 0) for m in models):
-                out.append("%s: %s is not the sum of its models" % (at, f))
-        known = sum(m["costUsd"] for m in models if isinstance(m.get("costUsd"), (int, float)))
-        if isinstance(day.get("costUsd"), (int, float)) and abs(day["costUsd"] - known) > 1e-6:
-            out.append("%s: costUsd is not the sum of its models' known costs" % at)
-        for j, m in enumerate(models):
-            # DEC-0046, DEC-0061: a row's route is a login in its vendor's runner, an issued key, or the platform's
-            # own metered models (a listing in the cloud).
-            if "route" in m and m["route"] not in fs.USAGE_ROUTES:
-                out.append("%s.byModel[%d]: route %r is not subscription, key or platform-metered" % (at, j, m["route"]))
-    # DEC-0065: the window and the project attribution, as the contract's usageRules reads them (FAC-SEM-025).
-    for finding in fs.usage_findings(report):
-        path, message = finding["instancePath"], finding["message"]
-        if path.startswith(("/byProject", "/generatedAt")) or "generatedAt" in message or "exists in its month" in message:
-            out.append("%s: %s" % (path or "/", message))
-    return out
-
-
-def same_repository(a: str, b: str) -> bool:
-    """git@github.com:o/r.git, https://github.com/o/r and github.com/o/r are one repository."""
-    def norm(u: str) -> str:
-        u = u.strip().lower()
-        u = re.sub(r"^git@([^:]+):", r"\1/", u)
-        u = re.sub(r"^[a-z+]+://", "", u)
-        u = re.sub(r"^[^@/]+@", "", u)
-        return re.sub(r"\.git$", "", u).rstrip("/")
-    return bool(a and b) and norm(a) == norm(b)
-
-
 def locate(target: Optional[str], descriptor: Optional[str], services_dir: Path) -> Path:
     if descriptor:
         return Path(descriptor).expanduser()