@passioncode-ai/passioncode 0.2.37 → 0.2.39

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -50,7 +50,7 @@ REFUSAL_CODES = (
     "unauthenticated", "token-expired", "wrong-audience", "scope-not-granted", "effect-above-ceiling", "no-grant",
     "grant-expired", "grant-revoked", "limit-reached", "approval-required", "approval-invalid", "approval-reused",
     "principal-unproven", "credential-source-refused", "chain-too-deep", "profile-forbids", "issuer-unavailable",
-    "unknown-state",
+    "unknown-state", "operator-decision-required", "decision-invalid", "human-step-required",
 )
 EFFECT_CLASSES = ("none", "draft", "publish", "send", "reply", "charge", "delete", "merge", "deploy", "change-policy")
 DELEGATION_HEADER = "Fabric-Delegation"
@@ -92,7 +92,14 @@ REFUSAL_MESSAGES = {
     "profile-forbids": "The caller's or the target's machine profile does not allow this call.",
     "issuer-unavailable": "The estate's published keys cannot be read.",
     "unknown-state": "The state cannot be established, so the call is refused.",
+    # DEC-0121 (AP-2, AP-4): the refusals of an action call; each answers 403.
+    "operator-decision-required": "This action is the operator's decision; ask the operator and call again with it in _meta.decision.",
+    "decision-invalid": "The call's decision is not valid for this action, object or time.",
+    "human-step-required": "This step is the person's own; hand them the link in error.data.url.",
 }
+# The detail each action-call refusal carries in error.data (the schema requires one, 1..80 characters).
+_ACTION_DETAILS = {"operator-decision-required": "no-decision", "decision-invalid": "invalid-decision",
+                   "human-step-required": "human-step", "approval-required": "no-approval"}
 
 _B64URL = re.compile(r"^[A-Za-z0-9_-]+\Z")
 # DL-2's grammar, as the contract's verifier types the claims (DEC-0045): an agent id, an opaque session or task id,
@@ -801,6 +808,20 @@ def refusal_from_denial(denial: Dict[str, Any]) -> Dict[str, Any]:
     return {"error": error}
 
 
+def refusal_from_action(answer: Any) -> Optional[Dict[str, Any]]:
+    """DL-19 (DEC-0121): the refusal a service answers for an action call that fabric_actions.action_decision refused,
+    or None when it took the call. operator-decision-required, decision-invalid and approval-required carry their
+    detail; human-step-required carries `humanStep` and `url` (AP-4). A `fault` is the service's own and is never
+    sent: the caller reads unknown-state with the detail `service-fault`, as for anything else that is not an answer."""
+    if isinstance(answer, dict) and answer.get("ok") is True:
+        return None
+    code = answer.get("code") if isinstance(answer, dict) and answer.get("ok") is False else None
+    if not isinstance(code, str) or code not in _ACTION_DETAILS:
+        return _refuse("unknown-state", "service-fault")
+    data = answer.get("data")
+    return _refuse(code, _ACTION_DETAILS[code], dict(data) if isinstance(data, dict) and data else None)
+
+
 def refusal_error(refusal: Dict[str, Any]) -> Dict[str, Any]:
     """The DL-19 body: {error: {code, message, data: {detail, ...}}}; never a token or a key."""
     data = {"detail": refusal["detail"]}

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_descriptor.py

@@ -36,6 +36,7 @@ from fabric_protocols import (
     protocols_findings,
 )
 from fabric_connections import CONNECTIONS_EXTENSION_KEY, connections_view  # noqa: E402 - the kit (FAA-62)
+from fabric_actions import ACTIONS_EXTENSION_KEY, actions_extension, actions_extension_rules  # noqa: E402 - DEC-0121
 from fabric_usage import (
     ROUTES,
 )
@@ -46,7 +47,7 @@ from fabric_usage import (
 DASHBOARD_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1"
 
 
-DASHBOARD_KIT = "fabric-dashboard-kit@1.1.3"
+DASHBOARD_KIT = "fabric-dashboard-kit@1.1.5"
 
 
 REFERENCE_THEMES = ("graphite", "fabric", "paper", "forest", "ocean", "ember", "contrast")
@@ -217,6 +218,16 @@ SUBSCRIPTION_RUNNERS = {"claude-code": "claude", "kimi-code": "kimi", "codex": "
 _PEER_ENDPOINT = re.compile(r"^https://(?P<host>([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?\Z", re.ASCII)
 
 
+# FAA-120: source.repository is the schema's common `uri`: RFC 3986 characters only (unreserved, reserved and %HH),
+# the same in both twins; an authority, when there is one, names a host and a port of digits up to 65535, as Fabric's
+# `new URL` reads it. A user:password@ in it is a credential, never the name of a repository.
+_SOURCE_URI = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:(?:[A-Za-z0-9._~:/?#@!$&'()*+,;=-]|%[0-9A-Fa-f]{2})+\Z")
+# Brackets belong to an IP-literal host only (RFC 3986 3.2.2); the literal is set aside before the character check.
+_IP_LITERAL = re.compile(r"^([A-Za-z][A-Za-z0-9+.-]*://(?:[^/?#@\[\]]*@)?)\[[0-9A-Fa-f:.vV]+\]")
+_URI_AUTHORITY = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://(?:[^/?#@]*@)?(?P<host>\[[^\]]*\]|[^/?#:]*)(?::(?P<port>[^/?#]*))?")
+_URI_PASSWORD = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]*:[^/?#@]*@")
+
+
 _RESIDENCY = re.compile(r"^(A[B-Z]|[B-PR-WY][A-Z]|Q[A-L]|Z[A-Y])\Z", re.ASCII)
 
 
@@ -232,8 +243,16 @@ def _text(value: Any, low: int = 1, high: int = 200) -> bool:
     return isinstance(value, str) and low <= len(value) <= high
 
 
+def _authority_ok(uri: str) -> bool:
+    m = _URI_AUTHORITY.match(uri)
+    if not m:
+        return True
+    port = m.group("port")
+    return bool(m.group("host")) and (port is None or port == "" or (port.isdigit() and len(port) <= 5 and int(port) <= 65535))
+
+
 def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
-    """DEC-0061 and DEC-0069 on a descriptor's `installedBy`, `runner` and `peer`, as the schema shapes them, with
+    """DEC-0061 and DEC-0069 on a descriptor's `installedBy`, `runner` and `peer`, and `source` (FAA-120), as the schema shapes them, with
     FAC-SEM-085 (a peer on a reserved name) and FAC-SEM-086 (a credential-shaped value in `runner` or `installedBy`,
     named by its place, never its value)."""
     import fabric_secrets  # noqa: E402 - beside this file; the contract's detector (DEC-0044)
@@ -273,6 +292,21 @@ def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
         if runner.get("credentialKind") == "subscription" and runner.get("kind") not in SUBSCRIPTION_RUNNERS:
             problems.append("a subscription runs only in its vendor's runner: runner.kind claude-code, kimi-code or codex")
         places += [("/runner/%s" % _pointer(k), v) for k, v in runner.items()]
+    if "source" in descriptor:
+        source = descriptor.get("source")
+        if not isinstance(source, dict):
+            problems.append("source is {repository?}")
+            source = {}
+        problems += ["source has no member %s" % k for k in source if k != "repository"]
+        if "repository" in source:
+            repository = source["repository"]
+            if not (isinstance(repository, str) and _SOURCE_URI.match(_IP_LITERAL.sub(r"\1h", repository, count=1))):
+                problems.append("source.repository is a URI (RFC 3986), such as https://github.com/owner/name")
+            elif not _authority_ok(repository):
+                problems.append("source.repository names a host, and a port of digits up to 65535 when it has one")
+            elif _URI_PASSWORD.match(repository):
+                problems.append("source.repository carries no password: it names the repository, never a credential")
+            places.append(("/source/repository", repository))
     if "peer" in descriptor:
         peer = descriptor.get("peer")
         if not isinstance(peer, dict):
@@ -299,7 +333,8 @@ def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
             problems.append("a service offered to others never runs on a subscription (DEC-0061)")
     for place, value in places:
         if isinstance(value, str) and fabric_secrets.secret_argument(value):
-            problems.append("FAC-SEM-086: %s holds a value shaped like a credential; it names a kind, a role or an installer" % place)
+            problems.append("FAC-SEM-086: %s holds a value shaped like a credential; it names %s" % (
+                place, "a repository" if place.startswith("/source/") else "a kind, a role or an installer"))
     return problems
 
 
@@ -543,11 +578,16 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
                      update_available: Optional[str] = None, pid: Optional[int] = None,
                      extensions: Optional[Dict[str, Any]] = None,
                      configuration: Optional[Dict[str, Any]] = None,
-                     protocols: Optional[Sequence[str]] = None) -> Dict[str, Any]:
+                     protocols: Optional[Sequence[str]] = None,
+                     actions: Optional[Sequence[Dict[str, Any]]] = None) -> Dict[str, Any]:
     """The unauthenticated identity answer. `degraded` is always present; ready means empty.
     `configuration` (DEC-0046) says what the operator can configure and what applies now; fabric_profiles builds it.
     `extensions` is kept as given (a reader ignores keys it does not know); a dashboard declaration
-    in it must be valid (dashboard_extension builds one)."""
+    in it must be valid (dashboard_extension builds one).
+    `actions` (DEC-0121 AP-1) is the service's action table, every button its dashboard, app or page offers with the
+    tool that performs it and its gate; it is written under extensions/actions/0.1 by fabric_actions.actions_extension.
+    A declaration FAC-SEM-142 finds, passed either way, is refused: one that is not its schema's, an id named twice, a
+    humanStep that disagrees with the gate, or a tool `surfaces.mcp.capabilities` does not list."""
     if status not in STATUSES:
         raise ServiceError("status must be one of %s." % ", ".join(STATUSES))
     degraded = list(degraded)
@@ -566,6 +606,12 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
     }
     if summary:
         doc["summary"] = list(summary)[:6]
+    if actions is not None:
+        if extensions and ACTIONS_EXTENSION_KEY in extensions:
+            raise ServiceError("Actions declaration: pass the action table or a ready declaration, not both.")
+        mcp = surfaces.get("mcp")
+        capabilities = mcp.get("capabilities") if isinstance(mcp, dict) else None
+        extensions = dict(extensions or {}, **actions_extension(actions, capabilities if isinstance(capabilities, list) else None))
     if extensions:
         if DASHBOARD_EXTENSION_KEY in extensions:
             problems = dashboard_extension_problems(extensions[DASHBOARD_EXTENSION_KEY])
@@ -576,6 +622,13 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
             view = connections_view({"extensions": {CONNECTIONS_EXTENSION_KEY: extensions[CONNECTIONS_EXTENSION_KEY]}})
             if view["reported"]:
                 raise ServiceError("Connections declaration: %s." % "; ".join(view["errors"]))
+        if ACTIONS_EXTENSION_KEY in extensions:
+            # DEC-0121 AP-1: a host reports an invalid declaration (FAC-SEM-142); a service never publishes one. The
+            # tools are compared with the capabilities this document's MCP surface lists.
+            findings = actions_extension_rules({"extensions": {ACTIONS_EXTENSION_KEY: extensions[ACTIONS_EXTENSION_KEY]},
+                                                "surfaces": surfaces})
+            if findings:
+                raise ServiceError("Actions declaration: %s." % "; ".join(f["message"] for f in findings))
         doc["extensions"] = dict(extensions)
     if configuration is not None:
         problems = configuration_problems(configuration)

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_interop.py

@@ -24,11 +24,14 @@ from pathlib import Path
 import re
 import secrets
 import sys
+import time
 from typing import Any, Callable, Dict, List, Optional
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import fabric_service as _fs  # noqa: E402
 from fabric_base import store_lock  # noqa: E402 - one lock per store path (R3)
+from fabric_actions import action_caller, readable_action  # noqa: E402 - DEC-0121
+from fabric_time import format_rfc3339  # noqa: E402 - the core's (FAA-65)
 
 from fabric_interop_rules import (  # noqa: E402,F401 - the rule layer (FAA-92)
     _days_from_civil,
@@ -77,6 +80,8 @@ from fabric_interop_rules import (  # noqa: E402,F401 - the rule layer (FAA-92)
     intent_idempotency_key,
     reads_null_usage,
     request_meta,
+    action_gate,
+    action_refusal_tool_result,
     usage_findings,
     usage_toward,
     _job_findings,
@@ -430,16 +435,26 @@ class JobStore:
 # --- a minimal MCP tool server (streamable HTTP, JSON responses) ------------------------
 
 class CallContext:
-    """What a tool handler gets: the child span it runs in, and a way to start a job."""
+    """What a tool handler gets: the child span it runs in, and a way to start a job.
+
+    DEC-0121: `tier` is the caller's (DL-25), `caller` the identity the service authenticated (decision D9), `meta`
+    the request's `_meta`. For a tool registered with an action, `record` is action_decision's recordAs: "caller"
+    (the caller's own act) or {by, via, caller}, the act to put in the service's audit record, and `decision` the
+    operator's decision it took (its `instruction` stays in that record, never in events or a page another party
+    reads), else None. `input_records` maps each answered input request to its record when input_actions is on."""
 
     def __init__(self, server: "McpToolServer", tool: str, arguments: Any, traceparent: str,
-                 delegation: Optional[Dict[str, Any]] = None):
+                 delegation: Optional[Dict[str, Any]] = None, *, tier: Optional[str] = None, caller: Optional[str] = None,
+                 meta: Optional[Dict[str, Any]] = None, record: Any = None, decision: Optional[Dict[str, Any]] = None,
+                 input_records: Optional[Dict[str, Any]] = None):
         self.server = server
         self.tool = tool
         self.arguments = arguments
         self.traceparent = traceparent
         # DEC-0039: the accepted delegation (principal, caller, chain, claims) when the server has a gate.
         self.delegation = delegation
+        self.tier, self.caller, self.meta = tier, caller, {} if meta is None else meta
+        self.record, self.decision, self.input_records = record, decision, input_records
 
     def start_job(self, poll_interval_ms: Optional[int] = None) -> Dict[str, Any]:
         if self.server.jobs is None:
@@ -547,11 +562,26 @@ class McpToolServer:
     def __init__(self, name: str, version: str, jobs: Optional[JobStore] = None,
                  on_job_started: Optional[Callable[[str, CallContext], None]] = None,
                  on_input: Optional[OnInput] = None,
-                 authorize: Optional[Callable[[str, Any], Dict[str, Any]]] = None):
+                 authorize: Optional[Callable[[str, Any], Dict[str, Any]]] = None, *,
+                 identify: Optional[Callable[[Any, str], Optional[str]]] = None,
+                 approve: Optional[Callable[[str, Dict[str, Any], Any, str], Optional[Dict[str, Any]]]] = None,
+                 elicited: Optional[Callable[[str, Dict[str, Any], Optional[str]], bool]] = None,
+                 input_actions: bool = False, clock: Callable[[], float] = time.time,
+                 on_fault: Optional[Callable[[str, str], None]] = None):
         # authorize(tool, headers, tier=) runs before every handler (fabric_delegation.delegation_gate, DEC-0039):
         # a refusal is answered in the DL-19 shape and the handler never runs. The built-in job tools are
         # gated by the job's own capability, and answered only for the principal and caller that started it.
+        # DEC-0121: a tool added with an action runs action_gate after authorize and before its handler.
+        # identify(headers, tier) names the caller the service authenticated when no delegation did (D9; else
+        # local:T0 / local:T1); approve(tool, arguments, headers, digest) answers verify_approval's outcome for an
+        # approval the call presented, or None; elicited(tool, arguments, caller) is True only on the service's own
+        # record of an accepted elicitation. input_actions=True gates each answered input request as an action (D8).
+        # on_fault(tool, fault) hears a service fault the caller only sees as unknown-state (e.g. caller-missing: an
+        # action-gated server needs a tier, identify or authorize that names who calls).
         self._authorize = authorize
+        self._identify, self._approve, self._elicited = identify, approve, elicited
+        self.input_actions, self._clock, self._on_fault = input_actions is True, clock, on_fault
+        self.actions: Dict[str, Dict[str, Any]] = {}
         self.info = {"name": name, "version": version}
         self.jobs = jobs
         self.tools: List[Dict[str, Any]] = []
@@ -559,14 +589,101 @@ class McpToolServer:
         self._on_job_started = on_job_started
         self._on_input = on_input
 
-    def add_tool(self, tool: Dict[str, Any], handler: Handler) -> None:
+    def add_tool(self, tool: Dict[str, Any], handler: Handler, action: Optional[Dict[str, Any]] = None, *,
+                 target: Any = None, human_step_url: Optional[str] = None) -> None:
+        """Serve a tool. `action` (DEC-0121 AP-1) is the declared action this tool performs, {id, title, tool, gate,
+        humanStep?}, its `tool` this tool's name: the server runs action_gate before the handler. `target` names the
+        object a call acts on: an argument's name, or a function of the arguments; `human_step_url` is the link of a
+        `human` action's step (an https URL or a path on the service's origin, AP-4)."""
         if tool["name"] in self.handlers:
             raise InteropError("Tool %s is served twice." % tool["name"])
         if "outputSchema" in tool:
             require_object_root(tool["name"], tool["outputSchema"])
+        if action is not None:
+            if not readable_action(action) or action["tool"] != tool["name"]:
+                raise InteropError("Tool %s: its action is not a declared action of this tool (DEC-0121)." % tool["name"])
+            if action["id"] in {a["action"]["id"] for a in self.actions.values()}:
+                raise InteropError("Action %s is declared twice." % action["id"])
+            if action["gate"] == "human" and not (isinstance(human_step_url, str) and re.match(r"https://|/", human_step_url)):
+                raise InteropError("Tool %s: a human step needs its link, an https URL or a path (DEC-0121 AP-4)." % tool["name"])
+            if not (target is None or isinstance(target, str) or callable(target)):
+                raise InteropError("Tool %s: target is an argument's name or a function of the arguments." % tool["name"])
+            self.actions[tool["name"]] = {"action": dict(action), "target": target, "url": human_step_url}
         self.tools.append(tool)
         self.handlers[tool["name"]] = handler
 
+    def action_table(self) -> List[Dict[str, Any]]:
+        """The declared actions in the order they were added: build_well_known(actions=) writes them (DEC-0121 AP-1)."""
+        return [dict(entry["action"]) for entry in self.actions.values()]
+
+    def _caller(self, headers: Any, tier: str, verdict: Optional[Dict[str, Any]]) -> Optional[str]:
+        """D9: the delegation's caller when a gate accepted a token, else identify(headers, tier), else the local floor."""
+        authenticated = (verdict or {}).get("caller")
+        if not authenticated and self._identify is not None:
+            authenticated = self._identify(headers, tier)
+        return action_caller(tier, authenticated)
+
+    def _gate_action(self, action: Dict[str, Any], name: str, arguments: Dict[str, Any], target: Any, url: Any,
+                     headers: Any, tier: str, meta: Dict[str, Any], caller: Optional[str]) -> Dict[str, Any]:
+        """action_gate for one call: the approval the call presented, the digest of {tool, arguments}, the clock."""
+        digest, approval = None, None
+        if action["gate"] == "relayed":
+            import fabric_delegation as _fd  # noqa: E402 - only an action-gated server needs it
+            try:
+                digest = _fd.action_digest({"tool": name, "arguments": arguments})
+            except (TypeError, ValueError, RecursionError):  # no canonical form (a lone surrogate, a non-finite number,
+                # nesting past the recursion limit), as intent_digest reads it: no digest to bind
+                return {"ok": False, "invalid": "Invalid params: the arguments have no canonical form."}
+            outcome = self._approve(name, arguments, headers, digest) if self._approve is not None else None
+            if isinstance(outcome, dict) and outcome.get("ok") is True:
+                approval = outcome
+            elif isinstance(outcome, dict) and outcome.get("code") not in (None, "approval-required"):
+                # DL-18: the presented approval's own refusal; an outcome that is not verify_approval's is the service's.
+                readable = outcome.get("code") in _fd.REFUSAL_CODES and isinstance(outcome.get("detail"), str) and outcome["detail"]
+                if readable:
+                    return {"ok": False, "refusal": outcome}
+                return {"ok": False, "refusal": {"ok": False, "code": "unknown-state", "detail": "service-fault"},
+                        "fault": "approval-outcome-unreadable"}
+        elicited = action["gate"] == "relayed" and self._elicited is not None and self._elicited(name, arguments, caller) is True
+        return action_gate(action, tier=tier, caller=caller, meta=meta, target=target, elicited=elicited, approval=approval,
+                           action_digest=digest, human_step_url=url, now=format_rfc3339(self._clock() * 1000))
+
+    def _gate_inputs(self, arguments: Dict[str, Any], headers: Any, tier: str, meta: Dict[str, Any],
+                     caller: Optional[str]) -> Dict[str, Any]:
+        """D8: each input request an answer would take is an action (id its key, tool fabric.job.get, gate relayed),
+        one decision per call; the first refusal refuses the call and nothing is applied."""
+        job_id = str(arguments.get("id", ""))
+        job = self.jobs.get(job_id)
+        asked = job.get("inputRequests", {}) if job["status"] == "input_required" else {}
+        records: Dict[str, Any] = {}
+        for key, value in arguments["inputResponses"].items():
+            if key not in asked or not isinstance(value, dict) or value.get("action") not in ("accept", "decline", "cancel"):
+                continue
+            action = {"id": key, "title": "Answer %s" % key, "tool": "fabric.job.get", "gate": "relayed"}
+            gated = self._gate_action(action, "fabric.job.get", {"id": job_id, "inputResponses": {key: value}}, None, None,
+                                      headers, tier, meta, caller)
+            if not gated["ok"]:
+                return gated
+            records[key] = gated["record"]
+        return {"ok": True, "records": records}
+
+    def _fault(self, tool: str, gated: Dict[str, Any]) -> None:
+        """Hand a service fault to on_fault; the caller saw only unknown-state. A hook that raises is the service's."""
+        if gated.get("fault") and self._on_fault is not None:
+            try:
+                self._on_fault(tool, str(gated["fault"]))
+            except Exception:  # noqa: BLE001 - logging must not change the answer
+                pass
+
+    @staticmethod
+    def _target(target: Any, arguments: Dict[str, Any]) -> Optional[str]:
+        """The object a call acts on: the named argument, or what the service's function answers; a string or None."""
+        try:
+            value = target(arguments) if callable(target) else arguments.get(target) if isinstance(target, str) else None
+        except Exception:  # noqa: BLE001 - a function that cannot read this call names no object
+            return None
+        return value if isinstance(value, str) else None
+
     def job_started(self, job_id: str, ctx: CallContext) -> None:
         if self._on_job_started:
             self._on_job_started(job_id, ctx)
@@ -641,7 +758,21 @@ class McpToolServer:
                 if not verdict.get("ok"):
                     import fabric_delegation as _fd  # noqa: E402 - only a gated server needs it
                     return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(verdict, traceparent=span)}
-            return {"jsonrpc": "2.0", "id": rid, "result": self._job_call(name, arguments, span, verdict)}
+            caller, inputs = self._caller(headers, tier, verdict), None
+            responses = arguments.get("inputResponses")
+            if name == "fabric.job.get" and self.input_actions and isinstance(responses, dict) and responses:
+                try:
+                    inputs = self._gate_inputs(arguments, headers, tier, meta, caller)
+                except UnknownJob:
+                    return {"jsonrpc": "2.0", "id": rid, "result": unknown_job_result(str(arguments.get("id", "")), traceparent=span)}
+                if not inputs["ok"] and "invalid" in inputs:
+                    return self._error(rid, -32602, inputs["invalid"])
+                if not inputs["ok"]:
+                    self._fault(name, inputs)
+                    import fabric_delegation as _fd  # noqa: E402 - DL-19
+                    return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(inputs["refusal"], traceparent=span)}
+            context = {"tier": tier, "caller": caller, "meta": meta, "input_records": inputs["records"] if inputs else None}
+            return {"jsonrpc": "2.0", "id": rid, "result": self._job_call(name, arguments, span, verdict, context)}
         handler = self.handlers.get(name)
         if handler is None:
             return self._error(rid, -32602, "Unknown tool: %s." % name)
@@ -652,14 +783,26 @@ class McpToolServer:
                 import fabric_delegation as _fd  # noqa: E402 - only a gated server needs it
                 return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(verdict, traceparent=span)}
             delegation = verdict
+        caller, gated, entry = self._caller(headers, tier, delegation), {"record": None, "decision": None}, self.actions.get(name)
+        if entry is not None:  # DEC-0121: after the authorize gate, before the handler
+            gated = self._gate_action(entry["action"], name, arguments, self._target(entry["target"], arguments), entry["url"],
+                                      headers, tier, meta, caller)
+            if not gated["ok"] and "invalid" in gated:
+                return self._error(rid, -32602, gated["invalid"])
+            if not gated["ok"]:
+                self._fault(name, gated)
+                import fabric_delegation as _fd  # noqa: E402 - DL-19
+                return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(gated["refusal"], traceparent=span)}
+        context = CallContext(self, name, arguments, span, delegation, tier=tier, caller=caller, meta=meta,
+                              record=gated["record"], decision=gated["decision"])
         try:
-            structured = handler(arguments, CallContext(self, name, arguments, span, delegation))
+            structured = handler(arguments, context)
         except InteropError as exc:
             return {"jsonrpc": "2.0", "id": rid, "result": tool_result({"error": {"code": "tool-error", "message": str(exc)}}, is_error=True, traceparent=span)}
         return {"jsonrpc": "2.0", "id": rid, "result": tool_result(structured, traceparent=span)}
 
     def _job_call(self, name: str, arguments: Dict[str, Any], span: str,
-                  delegation: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+                  delegation: Optional[Dict[str, Any]] = None, context: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
         job_id = str(arguments.get("id", ""))
         try:
             job_span = self.jobs.traceparent(job_id) or span
@@ -674,11 +817,14 @@ class McpToolServer:
                         state = self.jobs.get(job_id)
                 return tool_result({"job": state}, traceparent=job_span)
             responses = arguments.get("inputResponses")
+            context = context or {}
+            if responses and context.get("input_records") is not None:  # D8: only the keys the action gate took
+                responses = {key: responses[key] for key in context["input_records"]}
             if responses:
                 matched = self.jobs.answer(job_id, responses)
                 if matched and self._on_input:
                     private = self.jobs.private(job_id)
-                    self._on_input(job_id, matched, CallContext(self, private["capability"], private["input"], job_span, delegation))
+                    self._on_input(job_id, matched, CallContext(self, private["capability"], private["input"], job_span, delegation, **context))
             return tool_result({"job": self.jobs.get(job_id)}, traceparent=job_span)
         except UnknownJob:
             return unknown_job_result(job_id, traceparent=span)

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_interop_rules.py

@@ -17,6 +17,7 @@ if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from
     _sys.path.insert(0, str(_Path(__file__).resolve().parent))
 
 from fabric_base import ServiceError  # noqa: E402
+from fabric_actions import action_decision, decision_shape  # noqa: E402 - DEC-0121
 
 PROTOCOL = "fabric-interop/0.1"
 EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
@@ -288,14 +289,56 @@ def reads_null_usage(request_meta: Any) -> bool:
     return isinstance(protocols, list) and INTEROP_NULL_USAGE in protocols
 
 
-def request_meta(traceparent: Optional[str] = None) -> Dict[str, Any]:
-    """A request's `_meta` from this kit as a caller: its trace, and the interop revisions it reads (DEC-0087)."""
+def request_meta(traceparent: Optional[str] = None, decision: Any = None) -> Dict[str, Any]:
+    """A request's `_meta` from this kit as a caller: its trace, the interop revisions it reads (DEC-0087) and, for a
+    relayed action, the operator's decision (DEC-0121 AP-2; build one with fabric_actions.operator_decision). A
+    decision travels here only, never in a tool's arguments; one decision.schema.json refuses raises InteropError."""
     meta: Dict[str, Any] = {"protocols": list(PROTOCOLS_READ)}
     if parse_traceparent(traceparent):
         meta["traceparent"] = traceparent
+    if decision is not None:
+        if not decision_shape(decision):
+            raise InteropError("The decision is not one decision.schema.json reads; it is not sent.")
+        meta["decision"] = dict(decision)
     return meta
 
 
+def action_gate(action: Any, *, tier: Any, caller: Any, meta: Any = None, target: Optional[str] = None,
+                elicited: bool = False, approval: Any = None, action_digest: Optional[str] = None,
+                human_step_url: Optional[str] = None, now: Any = None) -> Dict[str, Any]:
+    """One call of a declared action, before its handler runs (DEC-0121 AP-2, AP-4): fabric_actions.action_decision over
+    the call's `_meta.decision` (read from `meta` only, never from arguments, decision D11), the service's authenticated
+    `caller` (fabric_actions.action_caller), `target` (the object the call acts on), `elicited` (the service's own
+    record of an accepted elicitation), `approval` (verify_approval's accepted outcome), `action_digest`,
+    `human_step_url` and `now` (RFC 3339). Answers {ok: True, record, decision}, `decision` being the one taken as the
+    operator's (None otherwise), or {ok: False, refusal} in the DL-19 form (fabric_delegation.refusal_tool_result
+    sends it); a service's own fault is the refusal unknown-state with `fault` beside it for the service's log."""
+    import fabric_delegation as _fd  # noqa: E402 - beside this file: DL-19
+    inputs: Dict[str, Any] = {"action": action, "tier": tier, "caller": caller, "elicited": elicited is True, "now": now}
+    if isinstance(meta, dict) and "decision" in meta:
+        inputs["decision"] = meta["decision"]
+    for name, value in (("target", target), ("approval", approval), ("actionDigest", action_digest), ("humanStepUrl", human_step_url)):
+        if value is not None:
+            inputs[name] = value
+    answer = action_decision(inputs)
+    if answer.get("ok") is True:
+        record = answer["recordAs"]
+        taken = isinstance(record, dict) and record.get("via") == "relayed-instruction"
+        return {"ok": True, "record": record, "decision": inputs["decision"] if taken else None}
+    out: Dict[str, Any] = {"ok": False, "refusal": _fd.refusal_from_action(answer)}
+    if "fault" in answer:
+        out["fault"] = answer["fault"]
+    return out
+
+
+def action_refusal_tool_result(answer: Any, traceparent: Optional[str] = None) -> Optional[Dict[str, Any]]:
+    """The tools/call result a service's own MCP server answers for an action_decision answer: None when the action
+    takes the call, else DL-19's refusal as structuredContent with isError true (DEC-0121)."""
+    import fabric_delegation as _fd  # noqa: E402 - beside this file: DL-19
+    refusal = _fd.refusal_from_action(answer)
+    return None if refusal is None else _fd.refusal_tool_result(refusal, traceparent=traceparent)
+
+
 def usage_findings(usage: Any, at: str) -> List[Dict[str, str]]:
     """FAC-SEM-119 on a usage: partial false asserts every number known, so it stands beside no null."""
     if not isinstance(usage, dict) or usage.get("partial", _ABSENT) is not False:

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_protocols.py

@@ -15,7 +15,7 @@ if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from
 PROTOCOL_REVISIONS: Dict[str, Tuple[str, ...]] = {
     "access-log": ("1",), "approval": ("1",), "activity-summary": ("1",), "agent-directory": ("1",), "call-record": ("1",), "coding-agents": ("1",), "credential-decision": ("1",), "credential-request": ("1",), "credential-revocation": ("1",), "enroll-token": ("1",), "entitlement": ("1",),
     "entitlement-key-set": ("1",), "estate-record": ("1",), "execution-packet": ("1",),
-    "fabric-activity": ("0.1",), "fabric-agent-call": ("1",), "fabric-connections": ("0.1",), "fabric-credential-envelope": ("1",), "fabric-load": ("0.1",), "fabric-dashboard": ("0.1",), "fabric-delegation": ("0.1",), "fabric-device": ("0.1",),
+    "fabric-actions": ("0.1",), "fabric-activity": ("0.1",), "fabric-agent-call": ("1",), "fabric-connections": ("0.1",), "fabric-credential-envelope": ("1",), "fabric-load": ("0.1",), "fabric-dashboard": ("0.1",), "fabric-delegation": ("0.1",), "fabric-device": ("0.1",),
     "fabric-interop": ("0.1", "0.2"), "fabric-local-channel": ("0.1",), "fabric-local-runner": ("0.1",),
     "fabric-operator-channel": ("0.1",), "fabric-package": ("1",), "fabric-project-comms": ("0.1",), "fabric-proposal": ("1",),
     "fabric-provider": ("0.1",), "fabric-relay": ("0.1",), "fabric-secret-envelope": ("1",), "fabric-service": ("0.1",),

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -181,6 +181,15 @@ from fabric_backups import (  # noqa: F401
     newest_intact_backup,
     restore_plan,
 )
+from fabric_actions import (  # noqa: F401
+    ACTIONS_EXTENSION_KEY,
+    action_decision,
+    action_rules,
+    actions_extension,
+    actions_extension_rules,
+    actions_view,
+    decision_shape,
+)
 from fabric_connections import (  # noqa: F401
     CONNECTIONS_EXTENSION_KEY,
     connections_extension,