@passioncode-ai/passioncode 0.2.19 → 0.2.21

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.2.21 - 2026-10-22
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.42.1`** (it was `v0.41.0`): the session hooks follow Fabric 0.3.9 (a
+  `/clear` keeps the Fabric session, an end from before a `--resume` is not delivered, the release says when the end
+  was observed, a rejoin Fabric answers with "no session" is not retried every turn); the kit's layout check and its
+  `pack`/`sign`/`verify` run when started through the launcher's symlinked folder. `v0.42.0` was tagged and never
+  published. Notes are in the adapter's CHANGELOG.
+
+## 0.2.20 - 2026-10-22
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.41.0`** (it was `v0.40.0`): the 2026-10-22 audit closed. Session hooks that
+  survive a refused call, a wrapped `fabric-mcp` and a slow process table; a board responder that recovers a request
+  after lost answers; Python twins of the service kit that lock their stores and refuse what the Node twins refuse;
+  package and estate checks that agree across the kits; safer installers (a copy in the hub is replaced only with
+  `--force`, atomically); nightly CI with the contract at the pin, Python 3.9, Node 18, macOS and Windows. A Linux
+  service on the Node kit needs Node 22. Upgrading notes are in the adapter's CHANGELOG.
+
 ## 0.2.19 - 2026-10-21
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.40.0",
+      "ref": "v0.42.1",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "Set up PassionCode.ai on a computer with one command — the apps from their verified releases, their MCP servers for every coding agent and the PassionCode.ai skills — and check and repair it with the same command or `doctor`.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.40.0",
+      "version": "0.42.1",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.2.19",
+      "version": "0.2.21",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.40.0",
-      "commit": "e778a220eda6009984736709280bd9687ba047d3",
-      "version": "0.40.0",
+      "ref": "v0.42.1",
+      "commit": "132d03d3e681a9183f4354d1520ab25468231cf4",
+      "version": "0.42.1",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -23,7 +23,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:bbadacb4224c8c44b10942c37e5c01103b77d4859ffc1b4ddf1403b624487e26",
+      "contentHash": "sha256:1ac326b0358f00a1ab91b848ae1c2385277f7530449436f72017c16ec33b15e3",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -62,9 +62,9 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.2.19",
+      "ref": "v0.2.21",
       "commit": null,
-      "version": "0.2.19",
+      "version": "0.2.21",
       "via": "this repository",
       "skills": [
         "setting-up-passioncode",
@@ -72,7 +72,7 @@
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:9e2aa1e3aefc2f32d5cb522af8d539e5f606df4b870c70d3e845184a04da002c",
+      "contentHash": "sha256:93677f6b0cf601389cbe224d4fe90f1e11dfabee369c45eb13416b0ad845518b",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.40.0",
+  "version": "0.42.1",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: adapting-projects-to-fabric
-description: Use when adapting an existing agent, MCP server, A2A peer, HTTP service, or terminal CLI to the Fabric Agent Contract (choosing MCP/A2A/local-runner, scaffolding a provider bundle, or checking Fabric compatibility); also for «подключить проект к Fabric» or «сделать агента совместимым с Fabric». NOT for building the Fabric host/orchestrator, configuring an MCP client, or a brand-new agent (that is creating-fabric-agents).
+description: Use when adapting an existing agent, MCP server, A2A peer, HTTP service, or terminal CLI to the Fabric Agent Contract (choosing MCP/A2A/local-runner, scaffolding a provider bundle, or checking Fabric compatibility); also for «подключить проект к Fabric» or «сделать агента совместимым с Fabric». NOT for building the Fabric host/orchestrator, configuring an MCP client, a brand-new agent (creating-fabric-agents), running an agent as a local or online Fabric service with a dashboard (building-fabric-services), or a coding session working through Fabric, its board or claims, «подключись к Fabric» (working-with-fabric).
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.40.0"
+  version: "0.42.1"
   contract-version: "0.1.0"
   contract-commit: "c55f2d5a11c9a0197e958e87212fca7ae1154769"
 ---
@@ -25,7 +25,11 @@ Use this skill to adapt or assess a provider project. Do not use it to:
 - answer wire-level MCP or A2A questions (transports, sessions, auth handshakes, task
   states on the wire): that is `agent-interop` (agent-stack); the pinned contract stays
   normative for what Fabric requires;
-- design a new agent from scratch: that is the sibling skill creating-fabric-agents;
+- design a new agent from scratch: that is the sibling skill `creating-fabric-agents`;
+- run the agent as a resident service with a dashboard, a descriptor and launchd: that is
+  `building-fabric-services`;
+- work in a project through Fabric from a coding session (registering `fabric-mcp`, the board,
+  claims): that is `working-with-fabric`;
 - claim admission merely because generated files or a valid manifest exist.
 
 If the project has only a browser interface and no stable API, MCP/A2A surface, or CLI,
@@ -57,7 +61,9 @@ python3 <skill-dir>/scripts/adapt_project.py inspect <project-root> --json
 ```
 
 The inspector samples repository files but does not execute the project. Verify its
-evidence manually. Existing runtime documentation and code outrank filename heuristics.
+evidence manually. Existing runtime documentation and code outrank filename heuristics. A
+client configuration (`.mcp.json`, an `mcpServers` block) lists servers the project calls, not one
+it serves: inspect reports it as `mcp-client-config` and asks instead of choosing `mcp`.
 
 If the inspector returns `undetermined`, answer its lifecycle question before creating
 files. A repository can expose multiple surfaces; choose a profile per capability, not
@@ -110,12 +116,18 @@ target paths. It refuses any collision.
 `charge`, `delete`, `merge`, `deploy`, `change-policy`), read from what the code does or asked of the author. Choose
 `--idempotency required|supported|none` for an external effect on purpose. When a run's cost varies, give the
 launcher fixed options (DEC-0037): `--cost-preset ID MAX_USD LABEL` per option and `--default-cost-preset ID`; the
-amounts come from the author or measured runs, never invented. Do not use `--force` unless the user explicitly
-authorizes replacement after the exact conflicting files and diff are shown.
+amounts come from the author or measured runs, never invented. Pass what the author knows so it is not written as a
+scaffold default: `--data-class` (repeat), `--created-by URI`, `--identity-method`, `--probe-assertion` (repeat).
 
-The generated zero hash, `.invalid` endpoints, `replace-me` values, generic schemas, and
-assertions are deliberate blockers. Replace them with implementation-backed facts. A
-template that still contains one is not ready for admission.
+On a collision run `scaffold --dry-run` first: it writes nothing and prints the planned writes and a unified diff of
+each existing file. Use `--force` only when the user authorizes replacing exactly those files.
+
+Every value the scaffold invents is a sentinel that `check` names: the zero hash, `.invalid` endpoints,
+`replace-me` values, `urn:fabric:adapter:author`, the generic schemas (marked `fabric-adapter-template`), the
+generic fixture and assertions, and each value listed under the manifest's `urn:fabric:adapter:template`
+extension (the defaulted `dataClasses`, a defaulted `tls` identity method). Replace each with an
+implementation-backed fact, then remove it from that list and the block when it is empty. While one remains,
+`readyForAdmission` is false.
 
 ### 4. Implement the adapter seam
 
@@ -138,11 +150,14 @@ Treat all provider output as untrusted until schemas and semantic assertions pas
 
 ### 4b. Announce an agent that is not a service
 
-An agent Fabric reaches as a CLI or a stdio MCP server gets a provider entry, written by
-its installer with [`scripts/fabric_provider.py`](scripts/fabric_provider.py) and removed
-by its uninstaller: argv arrays only, env values as `secret-ref:` references, never the
-id of an existing service, and a `providerId` equal to the manifest's `provider.id`. Load [provider entries](references/provider-entry.md). An
-agent that runs as a service uses a descriptor instead (`building-fabric-services`).
+An agent Fabric reaches as a stdio MCP server, or as an MCP server on a loopback URL that is not
+a service, gets a provider entry, written by its installer with
+[`scripts/fabric_provider.py`](scripts/fabric_provider.py) and removed by its uninstaller: argv
+arrays only, env values as `secret-ref:` references, never the id of an existing service, and a
+`providerId` equal to the manifest's `provider.id`. Load [provider entries](references/provider-entry.md).
+A provider entry only describes an MCP server: a CLI that does not speak MCP gets no entry; it is
+announced by its `local-runner` manifest (step 3). An agent that runs as a service uses a
+descriptor instead (`building-fabric-services`).
 
 ### 5. Make probes safe and meaningful
 
@@ -195,58 +210,25 @@ Update `fabric/FABRIC-CONFORMANCE.md` with dated receipts for:
 
 Include commands and exit codes, immutable endpoint or artifact identities, and explicit
 unverified surfaces. If live Fabric admission/runtime does not yet exist, the last gates
-remain `NOT VERIFIED`; the completed deliverable is an adaptation-ready provider bundle,
+remain `NOT_VERIFIED`; the completed deliverable is an adaptation-ready provider bundle,
 not a connected provider.
 
 ### 8. Propose the operator channel
 
 If the agent has a human stop (a choice, an approval, a confirmation) or emits `notify: true`
-events, propose its **operator channel** to the operator once, now. The channel is the agent's
-own messenger channel, first Telegram, that sends those events and answers its stops with
-buttons: `fabric-operator-channel/0.1` (contract DEC-0034,
-`docs/specification/operator-channel.md`), whose rule OC-11 this step follows. Give the
-operator's four steps:
-
-1. create a bot with @BotFather;
-2. put its token into the operator's secret store under the name the agent reads (for example
-   `EXAMPLE_AGENT_TELEGRAM_BOT_TOKEN`), never into a chat, a file or the bundle;
-3. run the agent's link command;
-4. type the code it shows in the chat with the bot.
-
-In a group shared with other bots the channel follows OC-14…OC-17 (DEC-0035): it stays silent
-unless addressed (`/command@ThisBot`, a reply to its own message or a press of its own button; a
-bare `/command` in a group is not addressed), and a channel nobody receives on is `degraded`
-(`receiver-missing`). Say so in the proposal when the operator means to bind a shared group.
-
-Record the answer (`accepted`, `declined` or `later`) in the agent's state and the
-conformance report, and do not ask again; an agent that serves `surfaces.operatorChannel` also
-shows it as `proposal` in its status document. Creating the bot, storing the token and enabling the
-channel are the operator's action: never create the bot, ask for or store the token's value, or
-enable the channel yourself. The default pin carries DEC-0034 and DEC-0035: a served status document is checked
-against the pinned `schemas/operator-channel-status.schema.json`; the channel's runtime rules have
-no probe rule here yet, so report them `NOT_RUN`. An agent with neither stops nor notify
-events skips this step.
+events, propose its operator channel (`fabric-operator-channel/0.1`, OC-11) to the operator once,
+now, as [the operator channel and the repository standard](references/operator-channel-and-repository.md)
+describes: the operator's four steps, the answer recorded and never asked again, and the bot, the
+token and enabling the channel left to the operator. An agent with neither stops nor notify events
+skips this step.
 
 ## The repository around the provider
 
 **For a PassionCode.ai repository**, the adapted project's repository follows the organization's
-[repository standard](https://github.com/passioncode-ai/fabric-workspace/blob/main/knowledge/repository-standard.md) (`knowledge/repository-standard.md`
-in the organization's knowledge base; a clone has it at `fabric-workspace/knowledge/`) from its
-first commit:
-
-- `LICENSE`, `COMMERCIAL-LICENSE.md` and `CLA.md` copied byte for byte from the knowledge base's
-  `templates/`, and `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial` in every manifest and
-  every SKILL.md `license:`; `SECURITY.md` when the repository is public;
-- a README whose first heading is the full name, with `## Quick start for a new teammate`
-  (Install; Configure, key names only; MCP, the registration command and one proving tool call,
-  verified with a real client in a temporary config; Develop) and `## License`;
-- an `AGENTS.md` that opens with the template's *Read first* block and closes with *After work*,
-  and a `CLAUDE.md` whose first line is `@AGENTS.md`.
-
-org-index `scripts/check_format.py` reports 0 findings for it before it is called done. **An agent
-someone builds for themselves is not a PassionCode.ai repository:** its licence is its owner's
-choice, nothing about it is published or listed by the organization, and none of these files is
-required of it, though the verified MCP quick start is still how anyone learns to drive it.
+repository standard (`knowledge/repository-standard.md`) from its first commit: the licence files,
+the README quick start verified with a real client, `AGENTS.md` and `CLAUDE.md`, listed in the
+shared reference above. An agent someone builds for themselves is not a PassionCode.ai repository:
+its licence is its owner's choice and none of those files is required of it.
 
 ## Completion format
 
@@ -265,12 +247,6 @@ passed against a real provider and the project binding is valid.
 
 ## Dashboard handoff: also for consumers
 
-When handing a registered service dashboard to a person, or writing the generated
-agent's completion/notification instructions, read and apply
-[dashboard links](references/dashboard-links.md): use the host's `open_link`,
-check the target device and host, and run the bundled output gate before delivery.
-An installed host failure never means browser fallback. This applies in Claude
-Code, Codex and other providers; it needs no host-specific hook. MCP unavailable:
-report the unresolved capability or use an approved project resolver; no automatic
-client configuration. Python unavailable: perform the reference's manual checks
-and report the executable gate NOT_RUN. Headless agents need no dashboard.
+When handing a registered service dashboard to a person, or writing the generated agent's
+completion or notification instructions, read and apply [dashboard links](references/dashboard-links.md)
+and run its output gate before delivery, in any host. Headless agents need no dashboard.

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/dashboard-links.md

@@ -83,8 +83,10 @@ or instructions alone do not prove all final answers from every agent are filter
   path is required. Skills must be activated/loaded; install does not intercept every answer.
 - MCP absent: report unresolved host capability once, use the project's approved
   resolver/CLI if available. Do not write machine or agent MCP config automatically.
-- Python absent: perform the comparisons above manually; mark the executable gate
-  NOT_RUN. Do not label the output mechanically validated.
+- Python absent: perform the comparisons above manually, including the gate's own rules (a
+  path with a `.` or `..` segment, an encoded or backslash separator, or a query or fragment
+  name or value that reads as a credential, such as `code`, `key`, `auth` or `api_key`, is
+  refused); mark the executable gate NOT_RUN. Do not label the output mechanically validated.
 
 Syntax is owned by Fabric Dashboards and `@passioncode-ai/fabric-service-host`:
 [ADR-0005](https://github.com/passioncode-ai/fabric-dashboards/blob/51a7a80acf42781d7bec304cc87c655d48cc309b/docs/adr/0005-service-links.md).

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/operator-channel-and-repository.md

@@ -0,0 +1,55 @@
+# The operator channel and the repository standard
+
+Shared by `adapting-projects-to-fabric` and `creating-fabric-agents`; the two copies are byte-identical
+(`test/test_shared_references.py`). "The agent" is the provider being adapted or created.
+
+## The operator channel
+
+If the agent has a human stop (a choice, an approval, a confirmation) or emits `notify: true`
+events, propose its **operator channel** to the operator once, at the step that links here. The
+channel is the agent's own messenger channel, first Telegram, that sends those events and answers
+its stops with buttons: `fabric-operator-channel/0.1` (contract DEC-0034,
+`docs/specification/operator-channel.md`), whose rule OC-11 this follows. Give the operator's four
+steps:
+
+1. create a bot with @BotFather;
+2. put its token into the operator's secret store (Project Observatory where it is installed) under
+   the name the agent reads (for example `EXAMPLE_AGENT_TELEGRAM_BOT_TOKEN`), never into a chat, a
+   file or the bundle;
+3. run the agent's link command;
+4. type the code it shows in the chat with the bot.
+
+In a group shared with other bots the channel follows OC-14 to OC-17 (DEC-0035): it stays silent
+unless addressed (`/command@ThisBot`, a reply to its own message or a press of its own button; a
+bare `/command` in a group is not addressed), and a channel nobody receives on is `degraded`
+(`receiver-missing`). Say so in the proposal when the operator means to bind a shared group.
+
+Record the answer (`accepted`, `declined` or `later`) in the agent's state and in its conformance
+report, and do not ask again; an agent that serves `surfaces.operatorChannel` also shows it as
+`proposal` in its status document. Creating the bot, storing the token and enabling the channel
+are the operator's action: never create the bot, ask for or store the token's value, or enable the
+channel yourself. The default pin carries DEC-0034 and DEC-0035: a served status document is
+checked against the pinned `schemas/operator-channel-status.schema.json`; the channel's runtime
+rules have no probe rule here yet, so report them `NOT_RUN`. An agent with neither stops nor notify
+events skips this.
+
+## The repository standard
+
+For a PassionCode.ai repository, the agent's repository follows the organization's
+[repository standard](https://github.com/passioncode-ai/fabric-workspace/blob/main/knowledge/repository-standard.md)
+(`knowledge/repository-standard.md` in the organization's knowledge base; a clone has it at
+`fabric-workspace/knowledge/`) from its first commit:
+
+- `LICENSE`, `COMMERCIAL-LICENSE.md` and `CLA.md` copied byte for byte from the knowledge base's
+  `templates/`, and `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial` in every manifest and
+  every SKILL.md `license:`; `SECURITY.md` when the repository is public;
+- a README whose first heading is the full name, with `## Quick start for a new teammate`
+  (Install; Configure, key names only; MCP, the registration command and one proving tool call,
+  verified with a real client in a temporary config; Develop) and `## License`;
+- an `AGENTS.md` that opens with the template's *Read first* block and closes with *After work*,
+  and a `CLAUDE.md` whose first line is `@AGENTS.md`.
+
+org-index `scripts/check_format.py` reports 0 findings for it before it is called done. An agent
+someone builds for themselves is not a PassionCode.ai repository: its licence is its owner's
+choice, nothing about it is published or listed by the organization, and none of these files is
+required of it, though the verified MCP quick start is still how anyone learns to drive it.

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/provider-entry.md

@@ -32,7 +32,9 @@ python3 scripts/fabric_provider.py validate ~/Library/Application\ Support/ai.pa
 python3 scripts/fabric_provider.py remove example-agent      # the uninstaller
 ```
 
-`--stdio` takes the rest of the line as the argument array; there is no shell string. An entry may carry
+`--stdio` comes last and takes the rest of the line as the argument array; there is no shell string. A writer
+option after it (`--env`, `--name`, ...) is refused rather than swallowed into argv; write `--stdio -- EXECUTABLE ...`
+when the server itself takes an option of that name. `--env` belongs to a stdio server and is refused with `--url`. An entry may carry
 `run.mcp.stdio.scope` (DEC-0044): `project` (started for the sessions of a project that binds it) or `on-demand`;
 `session` (a server in every coding session) is refused (FAC-SEM-056, LC-19). The validator accepts the field; the
 writer does not set it until Fabric reads it. An argument that carries a credential is refused
@@ -46,8 +48,12 @@ It refuses, with one sentence that never quotes a value:
 - an env value that is not `secret-ref:<name>`, or a reference that has the shape of a
   credential itself: a token prefix, a private key, a JWT (FAC-SEM-015: a value is
   checked by its form; name patterns apply to names);
-- a URL other than `http://127.0.0.1:<port>/mcp`, a manifest path that is not an
-  absolute or `~/` path to `fabric-agent.json`, a shell-string command, unknown fields.
+- what the pinned `provider.schema.json` refuses: a URL other than `http://127.0.0.1:<port>/mcp` with a port from 100
+  to 65535, a manifest path that is not an absolute or `~/` path to `fabric-agent.json` (or is a network share, or over
+  1024 characters), a shell-string command, more than 32 arguments or one over 1024 characters, more than 64 env
+  names, a `source.repository` that is not an absolute URI, an `installedAt` that is not an RFC 3339 date-time,
+  unknown fields. The patterns are the schema's, copied (`test_provider.SchemaParityTests` compares them with a
+  contract checkout at the pin when `FABRIC_CONTRACT_NEW` names one).
 
 `validate` also checks that the file is named `<id>.json` (FAC-SEM-014, slug half).
 From Python: `write_provider_entry(entry)`, `remove_provider_entry(id)`,

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/verification.md

@@ -18,6 +18,21 @@ Use only `PASS`, `FAIL`, `NOT_RUN`, and `NOT_VERIFIED`:
 - `NOT_VERIFIED`: no implemented verifier/runtime currently exists for the claim.
 - Never relabel either as a warning-level pass.
 
+## Template sentinels
+
+`check` lists every value the scaffold invented as a warning, and `readyForAdmission` stays false
+while one remains: `placeholder:` for a fixed sentinel (the zero content hash, `replace-me`,
+`.invalid`, `urn:fabric:adapter:author`, the generic probe assertion, a generated file still marked
+`fabric-adapter-template` or still in the generic request/summary shape, the generic fixture) and
+`template-default:` for each JSON pointer listed under the manifest's `urn:fabric:adapter:template`
+extension (a legal value the author did not choose, such as `dataClasses: ["public"]`). A warning
+is cleared by replacing the value with an implementation-backed fact and removing the pointer from
+that list; deleting the block without confirming its values is a false receipt.
+
+`check --contract` runs the checkout's own `node_modules/.bin/tsx`, never `pnpm exec`, so it cannot
+reinstall or purge the contract checkout. A manifest that is not UTF-8 or not JSON is an
+`invalid-json:` receipt, not a crash.
+
 ## Receipts
 
 A receipt names what ran and what identity was tested: