@passioncode-ai/passioncode 0.2.38 → 0.2.40

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_descriptor.py

@@ -36,6 +36,8 @@ from fabric_protocols import (
     protocols_findings,
 )
 from fabric_connections import CONNECTIONS_EXTENSION_KEY, connections_view  # noqa: E402 - the kit (FAA-62)
+from fabric_actions import ACTIONS_EXTENSION_KEY, actions_extension, actions_extension_rules  # noqa: E402 - DEC-0121
+from fabric_a2a import a2a_surface_problems  # noqa: E402 - DEC-0122
 from fabric_usage import (
     ROUTES,
 )
@@ -46,7 +48,7 @@ from fabric_usage import (
 DASHBOARD_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1"
 
 
-DASHBOARD_KIT = "fabric-dashboard-kit@1.1.4"
+DASHBOARD_KIT = "fabric-dashboard-kit@1.1.5"
 
 
 REFERENCE_THEMES = ("graphite", "fabric", "paper", "forest", "ocean", "ember", "contrast")
@@ -577,11 +579,20 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
                      update_available: Optional[str] = None, pid: Optional[int] = None,
                      extensions: Optional[Dict[str, Any]] = None,
                      configuration: Optional[Dict[str, Any]] = None,
-                     protocols: Optional[Sequence[str]] = None) -> Dict[str, Any]:
+                     protocols: Optional[Sequence[str]] = None,
+                     actions: Optional[Sequence[Dict[str, Any]]] = None,
+                     a2a: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     """The unauthenticated identity answer. `degraded` is always present; ready means empty.
     `configuration` (DEC-0046) says what the operator can configure and what applies now; fabric_profiles builds it.
     `extensions` is kept as given (a reader ignores keys it does not know); a dashboard declaration
-    in it must be valid (dashboard_extension builds one)."""
+    in it must be valid (dashboard_extension builds one).
+    `actions` (DEC-0121 AP-1) is the service's action table, every button its dashboard, app or page offers with the
+    tool that performs it and its gate; it is written under extensions/actions/0.1 by fabric_actions.actions_extension.
+    A declaration FAC-SEM-142 finds, passed either way, is refused: one that is not its schema's, an id named twice, a
+    humanStep that disagrees with the gate, or a tool `surfaces.mcp.capabilities` does not list.
+    `a2a` (DEC-0122) is `surfaces.a2a`, where the service serves its public Agent Card (fabric_a2a.a2a_surface builds
+    one); passed here or in `surfaces`, never both, and refused when it is not the schema's. A reader pinned before
+    DEC-0122 refuses the member, so a service carries it only once its readers are pinned at or after it."""
     if status not in STATUSES:
         raise ServiceError("status must be one of %s." % ", ".join(STATUSES))
     degraded = list(degraded)
@@ -589,6 +600,15 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
         status = "degraded"
     if "events" not in surfaces:
         raise ServiceError("surfaces.events is required.")
+    if a2a is not None:
+        if "a2a" in surfaces:
+            raise ServiceError("surfaces.a2a: pass it in surfaces or as a2a, not both.")
+        surfaces = dict(surfaces, a2a=a2a)
+    if "a2a" in surfaces:
+        # DEC-0122: a host reads the member by the schema; a service never publishes one it would refuse.
+        problems = a2a_surface_problems(surfaces["a2a"])
+        if problems:
+            raise ServiceError("surfaces.a2a: %s." % "; ".join(problems))
     doc: Dict[str, Any] = {
         "protocol": PROTOCOL,
         "service": {"id": service_id, "instance": instance, "name": name, "version": version, "build": build},
@@ -600,6 +620,12 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
     }
     if summary:
         doc["summary"] = list(summary)[:6]
+    if actions is not None:
+        if extensions and ACTIONS_EXTENSION_KEY in extensions:
+            raise ServiceError("Actions declaration: pass the action table or a ready declaration, not both.")
+        mcp = surfaces.get("mcp")
+        capabilities = mcp.get("capabilities") if isinstance(mcp, dict) else None
+        extensions = dict(extensions or {}, **actions_extension(actions, capabilities if isinstance(capabilities, list) else None))
     if extensions:
         if DASHBOARD_EXTENSION_KEY in extensions:
             problems = dashboard_extension_problems(extensions[DASHBOARD_EXTENSION_KEY])
@@ -610,6 +636,13 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
             view = connections_view({"extensions": {CONNECTIONS_EXTENSION_KEY: extensions[CONNECTIONS_EXTENSION_KEY]}})
             if view["reported"]:
                 raise ServiceError("Connections declaration: %s." % "; ".join(view["errors"]))
+        if ACTIONS_EXTENSION_KEY in extensions:
+            # DEC-0121 AP-1: a host reports an invalid declaration (FAC-SEM-142); a service never publishes one. The
+            # tools are compared with the capabilities this document's MCP surface lists.
+            findings = actions_extension_rules({"extensions": {ACTIONS_EXTENSION_KEY: extensions[ACTIONS_EXTENSION_KEY]},
+                                                "surfaces": surfaces})
+            if findings:
+                raise ServiceError("Actions declaration: %s." % "; ".join(f["message"] for f in findings))
         doc["extensions"] = dict(extensions)
     if configuration is not None:
         problems = configuration_problems(configuration)

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_estate.py

@@ -776,6 +776,13 @@ def _placement_grant_problems(record: Dict[str, Any], placement: Dict[str, Any])
     return problems
 
 
+def placement_grant_findings(record: Any, placement: Any) -> List[Dict[str, str]]:
+    """FAC-SEM-111 for one placement of ``record``, as findings (``instancePath`` relative to the placement). Answers,
+    never raises: a record or placement that is no object reads as an empty one (FAA-125)."""
+    record, placement = (v if isinstance(v, dict) else {} for v in (record, placement))
+    return [{"code": "FAC-SEM-111", "instancePath": at, "message": m} for at, m in _placement_grant_problems(record, placement)]
+
+
 def _placement_grants(value: Dict[str, Any], flag) -> None:
     for machine, m in _indexed(_get(value, "machines")):
         for placement, p in _indexed(_get(machine, "packages")):

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_interop.py

@@ -20,15 +20,22 @@ from __future__ import annotations
 import base64
 import hashlib
 import json
+import math
 from pathlib import Path
 import re
 import secrets
 import sys
+import time
 from typing import Any, Callable, Dict, List, Optional
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import fabric_service as _fs  # noqa: E402
 from fabric_base import store_lock  # noqa: E402 - one lock per store path (R3)
+from fabric_actions import action_caller, readable_action  # noqa: E402 - DEC-0121
+from fabric_mandate import EFFECT_CLASSES, is_agent_id  # noqa: E402 - DEC-0125
+from fabric_time import format_rfc3339  # noqa: E402 - the core's (FAA-65)
+from fabric_page_links import (  # noqa: E402 - DEC-0123
+    PageLinkError, dashboards_link, input_request_link_findings, page_link_findings, parse_dashboards_link)
 
 from fabric_interop_rules import (  # noqa: E402,F401 - the rule layer (FAA-92)
     _days_from_civil,
@@ -77,6 +84,8 @@ from fabric_interop_rules import (  # noqa: E402,F401 - the rule layer (FAA-92)
     intent_idempotency_key,
     reads_null_usage,
     request_meta,
+    action_gate,
+    action_refusal_tool_result,
     usage_findings,
     usage_toward,
     _job_findings,
@@ -214,12 +223,32 @@ def choice_request(message: str, field: str, options: List[Any], title: Optional
 
 
 def url_request(message: str, url: str) -> Dict[str, Any]:
-    """URL mode: the person opens `url` out of band; for credentials and payments. Put nothing sensitive in the URL."""
-    if not url.startswith(("https://", "http://127.0.0.1", "http://localhost")):
-        raise InteropError("A URL-mode request needs an https URL (or this machine's loopback).")
+    """URL mode: the person opens `url` out of band; for credentials and payments. Put nothing sensitive in the URL.
+    A page of this service goes as its open_link (`page_answer`, DEC-0123 PL-4); a raw loopback address and a
+    `fabric-dashboards:` link outside the grammar are refused here, when the request is built (FAC-SEM-143)."""
+    if not isinstance(url, str):
+        raise InteropError("A URL-mode request needs an https URL or Fabric Dashboards' open_link (DEC-0123 PL-4).")
+    findings = page_link_findings(url, "/params/url", "the URL-mode request")
+    if findings:
+        raise InteropError(findings[0]["message"])
+    if not url.startswith("https://") and not parse_dashboards_link(url)["ok"]:
+        raise InteropError("A URL-mode request needs an https URL or Fabric Dashboards' open_link (DEC-0123 PL-4).")
     return {"method": "elicitation/create", "params": {"mode": "url", "message": message, "url": url}}
 
 
+def page_answer(service: str, instance: str, path: Optional[str] = None, http_url: Optional[str] = None) -> Dict[str, Any]:
+    """A tool answer that hands a person one of this service's pages (DEC-0123 PL-4): `{"open_link"}`, the page's
+    Fabric Dashboards link, and `http_url`, its raw address, only as a diagnostic beside it (never judged as the
+    action). Raises InteropError for an id, instance or path the open_link grammar refuses."""
+    try:
+        answer: Dict[str, Any] = {"open_link": dashboards_link(service, instance, path)}
+    except PageLinkError as refused:
+        raise InteropError("No open_link for %s.%s: %s (DEC-0123 PL-1)." % (service, instance, refused)) from None
+    if http_url is not None:
+        answer["http_url"] = http_url
+    return answer
+
+
 # --- C3.2 jobs ---------------------------------------------------------------------
 
 _SURROGATE = re.compile("[\ud800-\udfff]")
@@ -361,6 +390,8 @@ class JobStore:
         for key, request in input_requests.items():
             if not _KEY.match(key) or request.get("method") != "elicitation/create":
                 raise InteropError("Input request %r must be a keyed elicitation/create request." % key)
+        for finding in input_request_link_findings({"inputRequests": input_requests}):  # FAC-SEM-143 (D12)
+            raise InteropError("%s: %s" % (finding["instancePath"], finding["message"]))
         return self._transition(job_id, "input_required", inputRequests=input_requests, statusMessage=message)
 
     def answer(self, job_id: str, input_responses: Dict[str, Any]) -> Dict[str, Any]:
@@ -430,16 +461,28 @@ class JobStore:
 # --- a minimal MCP tool server (streamable HTTP, JSON responses) ------------------------
 
 class CallContext:
-    """What a tool handler gets: the child span it runs in, and a way to start a job."""
+    """What a tool handler gets: the child span it runs in, and a way to start a job.
+
+    DEC-0121: `tier` is the caller's (DL-25), `caller` the identity the service authenticated (decision D9), `meta`
+    the request's `_meta`. For a tool registered with an action, `record` is action_decision's recordAs: "caller"
+    (the caller's own act) or {by, via, caller}, the act to put in the service's audit record, and `decision` the
+    operator's decision it took (its `instruction` stays in that record, never in events or a page another party
+    reads), else None. `input_records` maps each answered input request to its record when input_actions is on.
+    DEC-0125: `mandate` is the operator's mandate the call was taken under (record `via: mandate`), else None."""
 
     def __init__(self, server: "McpToolServer", tool: str, arguments: Any, traceparent: str,
-                 delegation: Optional[Dict[str, Any]] = None):
+                 delegation: Optional[Dict[str, Any]] = None, *, tier: Optional[str] = None, caller: Optional[str] = None,
+                 meta: Optional[Dict[str, Any]] = None, record: Any = None, decision: Optional[Dict[str, Any]] = None,
+                 input_records: Optional[Dict[str, Any]] = None, mandate: Optional[Dict[str, Any]] = None):
         self.server = server
         self.tool = tool
         self.arguments = arguments
         self.traceparent = traceparent
         # DEC-0039: the accepted delegation (principal, caller, chain, claims) when the server has a gate.
         self.delegation = delegation
+        self.tier, self.caller, self.meta = tier, caller, {} if meta is None else meta
+        self.record, self.decision, self.input_records = record, decision, input_records
+        self.mandate = mandate
 
     def start_job(self, poll_interval_ms: Optional[int] = None) -> Dict[str, Any]:
         if self.server.jobs is None:
@@ -535,6 +578,10 @@ def mcp_request_headers(method: str, params: Dict[str, Any]) -> Dict[str, str]:
     return out
 
 
+_UNREADABLE = object()  # what a service's spend or project function answers when it raised
+_UNREADABLE_PROJECT = "\x00unreadable"  # never a member of a mandate's projects, so a scoped mandate refuses
+
+
 class McpToolServer:
     """tools/list and tools/call for an MCP 2026-07-28 server, with fabric.job.get/cancel built in.
 
@@ -547,11 +594,32 @@ class McpToolServer:
     def __init__(self, name: str, version: str, jobs: Optional[JobStore] = None,
                  on_job_started: Optional[Callable[[str, CallContext], None]] = None,
                  on_input: Optional[OnInput] = None,
-                 authorize: Optional[Callable[[str, Any], Dict[str, Any]]] = None):
+                 authorize: Optional[Callable[[str, Any], Dict[str, Any]]] = None, *,
+                 identify: Optional[Callable[[Any, str], Optional[str]]] = None,
+                 approve: Optional[Callable[[str, Dict[str, Any], Any, str], Optional[Dict[str, Any]]]] = None,
+                 elicited: Optional[Callable[[str, Dict[str, Any], Optional[str]], bool]] = None,
+                 input_actions: bool = False, clock: Callable[[], float] = time.time,
+                 on_fault: Optional[Callable[[str, str], None]] = None, agent_id: Optional[str] = None):
         # authorize(tool, headers, tier=) runs before every handler (fabric_delegation.delegation_gate, DEC-0039):
         # a refusal is answered in the DL-19 shape and the handler never runs. The built-in job tools are
         # gated by the job's own capability, and answered only for the principal and caller that started it.
+        # DEC-0121: a tool added with an action runs action_gate after authorize and before its handler.
+        # identify(headers, tier) names the caller the service authenticated when no delegation did (D9; else
+        # local:T0 / local:T1); approve(tool, arguments, headers, digest) answers verify_approval's outcome for an
+        # approval the call presented, or None; elicited(tool, arguments, caller) is True only on the service's own
+        # record of an accepted elicitation. input_actions=True gates each answered input request as an action (D8).
+        # on_fault(tool, fault) hears a service fault the caller only sees as unknown-state (e.g. caller-missing: an
+        # action-gated server needs a tier, identify or authorize that names who calls).
+        # DEC-0125: agent_id is this service's own agent id; with it the server reads a call's _meta.mandate for a
+        # relayed action added with its effect (the chain must end in agent_id, and in the delegation's caller before
+        # it when authorize accepted a token); without it a mandate is not read, as before.
+        if agent_id is not None and not is_agent_id(agent_id):
+            raise InteropError("agent_id is this service's agent id (a lower-case id, optionally .instance; DEC-0125).")
+        self.agent_id = agent_id
         self._authorize = authorize
+        self._identify, self._approve, self._elicited = identify, approve, elicited
+        self.input_actions, self._clock, self._on_fault = input_actions is True, clock, on_fault
+        self.actions: Dict[str, Dict[str, Any]] = {}
         self.info = {"name": name, "version": version}
         self.jobs = jobs
         self.tools: List[Dict[str, Any]] = []
@@ -559,14 +627,148 @@ class McpToolServer:
         self._on_job_started = on_job_started
         self._on_input = on_input
 
-    def add_tool(self, tool: Dict[str, Any], handler: Handler) -> None:
+    def add_tool(self, tool: Dict[str, Any], handler: Handler, action: Optional[Dict[str, Any]] = None, *,
+                 target: Any = None, human_step_url: Optional[str] = None, effect: Optional[str] = None,
+                 spend: Any = None, project: Any = None) -> None:
+        """Serve a tool. `action` (DEC-0121 AP-1) is the declared action this tool performs, {id, title, tool, gate,
+        humanStep?}, its `tool` this tool's name: the server runs action_gate before the handler. `target` names the
+        object a call acts on: an argument's name, or a function of the arguments; `human_step_url` is the link of a
+        `human` action's step (an https URL or a path on the service's origin, AP-4).
+
+        DEC-0125, on a server with agent_id: `effect` is the action's effect class (governance's vocabulary), required
+        for a relayed action, since a mandate covers a call by its effect; `spend` the service's own estimate of what a
+        call spends, USD (a number, or a function of the arguments answering a number or None); `project` the project a
+        call acts in (a name, or a function of the arguments)."""
         if tool["name"] in self.handlers:
             raise InteropError("Tool %s is served twice." % tool["name"])
         if "outputSchema" in tool:
             require_object_root(tool["name"], tool["outputSchema"])
+        if action is not None:
+            if not readable_action(action) or action["tool"] != tool["name"]:
+                raise InteropError("Tool %s: its action is not a declared action of this tool (DEC-0121)." % tool["name"])
+            if action["id"] in {a["action"]["id"] for a in self.actions.values()}:
+                raise InteropError("Action %s is declared twice." % action["id"])
+            if action["gate"] == "human" and not (isinstance(human_step_url, str) and re.match(r"https://|/", human_step_url)):
+                raise InteropError("Tool %s: a human step needs its link, an https URL or a path (DEC-0121 AP-4)." % tool["name"])
+            if not (target is None or isinstance(target, str) or callable(target)):
+                raise InteropError("Tool %s: target is an argument's name or a function of the arguments." % tool["name"])
+            if self.agent_id is not None and action["gate"] == "relayed" and not (isinstance(effect, str) and effect in EFFECT_CLASSES):
+                raise InteropError("Tool %s: a relayed action on a server that reads mandates names its effect class (DEC-0125)." % tool["name"])
+            if effect is not None and not (isinstance(effect, str) and effect in EFFECT_CLASSES):
+                raise InteropError("Tool %s: effect is one of %s." % (tool["name"], ", ".join(EFFECT_CLASSES)))
+            if not (spend is None or callable(spend) or (isinstance(spend, (int, float)) and not isinstance(spend, bool))):
+                raise InteropError("Tool %s: spend is a number of USD or a function of the arguments." % tool["name"])
+            if not (project is None or isinstance(project, str) or callable(project)):
+                raise InteropError("Tool %s: project is a name or a function of the arguments." % tool["name"])
+            self.actions[tool["name"]] = {"action": dict(action), "target": target, "url": human_step_url,
+                                          "effect": effect, "spend": spend, "project": project}
         self.tools.append(tool)
         self.handlers[tool["name"]] = handler
 
+    def action_table(self) -> List[Dict[str, Any]]:
+        """The declared actions in the order they were added: build_well_known(actions=) writes them (DEC-0121 AP-1)."""
+        return [dict(entry["action"]) for entry in self.actions.values()]
+
+    def _caller(self, headers: Any, tier: str, verdict: Optional[Dict[str, Any]]) -> Optional[str]:
+        """D9: the delegation's caller when a gate accepted a token, else identify(headers, tier), else the local floor."""
+        authenticated = (verdict or {}).get("caller")
+        if not authenticated and self._identify is not None:
+            authenticated = self._identify(headers, tier)
+        return action_caller(tier, authenticated)
+
+    def _gate_action(self, action: Dict[str, Any], name: str, arguments: Dict[str, Any], target: Any, url: Any,
+                     headers: Any, tier: str, meta: Dict[str, Any], caller: Optional[str],
+                     mandate: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+        """action_gate for one call: the approval the call presented, the digest of {tool, arguments}, the clock, and
+        under DEC-0125 what a mandate is read with (`mandate`: self_id, effect, caller_agent, spend_usd, project)."""
+        digest, approval = None, None
+        if action["gate"] == "relayed":
+            import fabric_delegation as _fd  # noqa: E402 - only an action-gated server needs it
+            try:
+                digest = _fd.action_digest({"tool": name, "arguments": arguments})
+            except (TypeError, ValueError, RecursionError):  # no canonical form (a lone surrogate, a non-finite number,
+                # nesting past the recursion limit), as intent_digest reads it: no digest to bind
+                return {"ok": False, "invalid": "Invalid params: the arguments have no canonical form."}
+            outcome = self._approve(name, arguments, headers, digest) if self._approve is not None else None
+            if isinstance(outcome, dict) and outcome.get("ok") is True:
+                approval = outcome
+            elif isinstance(outcome, dict) and outcome.get("code") not in (None, "approval-required"):
+                # DL-18: the presented approval's own refusal; an outcome that is not verify_approval's is the service's.
+                readable = outcome.get("code") in _fd.REFUSAL_CODES and isinstance(outcome.get("detail"), str) and outcome["detail"]
+                if readable:
+                    return {"ok": False, "refusal": outcome}
+                return {"ok": False, "refusal": {"ok": False, "code": "unknown-state", "detail": "service-fault"},
+                        "fault": "approval-outcome-unreadable"}
+        elicited = action["gate"] == "relayed" and self._elicited is not None and self._elicited(name, arguments, caller) is True
+        return action_gate(action, tier=tier, caller=caller, meta=meta, target=target, elicited=elicited, approval=approval,
+                           action_digest=digest, human_step_url=url, now=format_rfc3339(self._clock() * 1000), **(mandate or {}))
+
+    def _mandate_inputs(self, entry: Dict[str, Any], arguments: Dict[str, Any], verdict: Optional[Dict[str, Any]]) -> Dict[str, Any]:
+        """DEC-0125: what action_gate reads a mandate with, empty on a server without agent_id. The caller's agent id is
+        the delegation's caller when authorize accepted a token, never a name the call carries."""
+        if self.agent_id is None:
+            return {}
+        spend, project = (self._read(entry.get(k), arguments) for k in ("spend", "project"))
+        caller_agent = (verdict or {}).get("caller")
+        # The estimate is read as a double, as the contract does: an int past the float range is infinite, and an
+        # estimate that is not a finite number reads as none, which a mandate's ceiling refuses (fail closed).
+        try:
+            double = float(spend) if isinstance(spend, (int, float)) and not isinstance(spend, bool) else math.nan
+        except OverflowError:
+            double = math.inf
+        finite = math.isfinite(double)  # the service's own number goes on when it is finite (25 stays 25)
+        if project is _UNREADABLE or not (project is None or isinstance(project, str)):
+            project = _UNREADABLE_PROJECT  # a function that raised or named no string: a scoped mandate refuses
+        return {"self_id": self.agent_id, "effect": entry.get("effect"),
+                "caller_agent": caller_agent if isinstance(caller_agent, str) and caller_agent else None,
+                # an estimate that raised or is not finite is none: a mandate with a ceiling then refuses (fail closed)
+                "spend_usd": spend if finite else None,
+                "project": project if isinstance(project, str) else None}
+
+    @staticmethod
+    def _read(value: Any, arguments: Dict[str, Any]) -> Any:
+        """A spend or project the service gave, or what its function answers; a function that raises answers _UNREADABLE."""
+        try:
+            return value(arguments) if callable(value) else value
+        except Exception:  # noqa: BLE001 - the service's own code; the call is still answered
+            return _UNREADABLE
+
+    def _gate_inputs(self, arguments: Dict[str, Any], headers: Any, tier: str, meta: Dict[str, Any],
+                     caller: Optional[str]) -> Dict[str, Any]:
+        """D8: each input request an answer would take is an action (id its key, tool fabric.job.get, gate relayed),
+        one decision per call; the first refusal refuses the call and nothing is applied."""
+        job_id = str(arguments.get("id", ""))
+        job = self.jobs.get(job_id)
+        asked = job.get("inputRequests", {}) if job["status"] == "input_required" else {}
+        records: Dict[str, Any] = {}
+        for key, value in arguments["inputResponses"].items():
+            if key not in asked or not isinstance(value, dict) or value.get("action") not in ("accept", "decline", "cancel"):
+                continue
+            action = {"id": key, "title": "Answer %s" % key, "tool": "fabric.job.get", "gate": "relayed"}
+            gated = self._gate_action(action, "fabric.job.get", {"id": job_id, "inputResponses": {key: value}}, None, None,
+                                      headers, tier, meta, caller)
+            if not gated["ok"]:
+                return gated
+            records[key] = gated["record"]
+        return {"ok": True, "records": records}
+
+    def _fault(self, tool: str, gated: Dict[str, Any]) -> None:
+        """Hand a service fault to on_fault; the caller saw only unknown-state. A hook that raises is the service's."""
+        if gated.get("fault") and self._on_fault is not None:
+            try:
+                self._on_fault(tool, str(gated["fault"]))
+            except Exception:  # noqa: BLE001 - logging must not change the answer
+                pass
+
+    @staticmethod
+    def _target(target: Any, arguments: Dict[str, Any]) -> Optional[str]:
+        """The object a call acts on: the named argument, or what the service's function answers; a string or None."""
+        try:
+            value = target(arguments) if callable(target) else arguments.get(target) if isinstance(target, str) else None
+        except Exception:  # noqa: BLE001 - a function that cannot read this call names no object
+            return None
+        return value if isinstance(value, str) else None
+
     def job_started(self, job_id: str, ctx: CallContext) -> None:
         if self._on_job_started:
             self._on_job_started(job_id, ctx)
@@ -641,7 +843,21 @@ class McpToolServer:
                 if not verdict.get("ok"):
                     import fabric_delegation as _fd  # noqa: E402 - only a gated server needs it
                     return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(verdict, traceparent=span)}
-            return {"jsonrpc": "2.0", "id": rid, "result": self._job_call(name, arguments, span, verdict)}
+            caller, inputs = self._caller(headers, tier, verdict), None
+            responses = arguments.get("inputResponses")
+            if name == "fabric.job.get" and self.input_actions and isinstance(responses, dict) and responses:
+                try:
+                    inputs = self._gate_inputs(arguments, headers, tier, meta, caller)
+                except UnknownJob:
+                    return {"jsonrpc": "2.0", "id": rid, "result": unknown_job_result(str(arguments.get("id", "")), traceparent=span)}
+                if not inputs["ok"] and "invalid" in inputs:
+                    return self._error(rid, -32602, inputs["invalid"])
+                if not inputs["ok"]:
+                    self._fault(name, inputs)
+                    import fabric_delegation as _fd  # noqa: E402 - DL-19
+                    return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(inputs["refusal"], traceparent=span)}
+            context = {"tier": tier, "caller": caller, "meta": meta, "input_records": inputs["records"] if inputs else None}
+            return {"jsonrpc": "2.0", "id": rid, "result": self._job_call(name, arguments, span, verdict, context)}
         handler = self.handlers.get(name)
         if handler is None:
             return self._error(rid, -32602, "Unknown tool: %s." % name)
@@ -652,14 +868,26 @@ class McpToolServer:
                 import fabric_delegation as _fd  # noqa: E402 - only a gated server needs it
                 return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(verdict, traceparent=span)}
             delegation = verdict
+        caller, gated, entry = self._caller(headers, tier, delegation), {"record": None, "decision": None}, self.actions.get(name)
+        if entry is not None:  # DEC-0121: after the authorize gate, before the handler
+            gated = self._gate_action(entry["action"], name, arguments, self._target(entry["target"], arguments), entry["url"],
+                                      headers, tier, meta, caller, self._mandate_inputs(entry, arguments, delegation))
+            if not gated["ok"] and "invalid" in gated:
+                return self._error(rid, -32602, gated["invalid"])
+            if not gated["ok"]:
+                self._fault(name, gated)
+                import fabric_delegation as _fd  # noqa: E402 - DL-19
+                return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(gated["refusal"], traceparent=span)}
+        context = CallContext(self, name, arguments, span, delegation, tier=tier, caller=caller, meta=meta,
+                              record=gated["record"], decision=gated["decision"], mandate=gated.get("mandate"))
         try:
-            structured = handler(arguments, CallContext(self, name, arguments, span, delegation))
+            structured = handler(arguments, context)
         except InteropError as exc:
             return {"jsonrpc": "2.0", "id": rid, "result": tool_result({"error": {"code": "tool-error", "message": str(exc)}}, is_error=True, traceparent=span)}
         return {"jsonrpc": "2.0", "id": rid, "result": tool_result(structured, traceparent=span)}
 
     def _job_call(self, name: str, arguments: Dict[str, Any], span: str,
-                  delegation: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+                  delegation: Optional[Dict[str, Any]] = None, context: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
         job_id = str(arguments.get("id", ""))
         try:
             job_span = self.jobs.traceparent(job_id) or span
@@ -674,11 +902,14 @@ class McpToolServer:
                         state = self.jobs.get(job_id)
                 return tool_result({"job": state}, traceparent=job_span)
             responses = arguments.get("inputResponses")
+            context = context or {}
+            if responses and context.get("input_records") is not None:  # D8: only the keys the action gate took
+                responses = {key: responses[key] for key in context["input_records"]}
             if responses:
                 matched = self.jobs.answer(job_id, responses)
                 if matched and self._on_input:
                     private = self.jobs.private(job_id)
-                    self._on_input(job_id, matched, CallContext(self, private["capability"], private["input"], job_span, delegation))
+                    self._on_input(job_id, matched, CallContext(self, private["capability"], private["input"], job_span, delegation, **context))
             return tool_result({"job": self.jobs.get(job_id)}, traceparent=job_span)
         except UnknownJob:
             return unknown_job_result(job_id, traceparent=span)

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_interop_rules.py

@@ -17,6 +17,8 @@ if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from
     _sys.path.insert(0, str(_Path(__file__).resolve().parent))
 
 from fabric_base import ServiceError  # noqa: E402
+from fabric_actions import action_decision, decision_shape  # noqa: E402 - DEC-0121
+from fabric_mandate import mandate_problem  # noqa: E402 - DEC-0125
 
 PROTOCOL = "fabric-interop/0.1"
 EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
@@ -288,14 +290,80 @@ def reads_null_usage(request_meta: Any) -> bool:
     return isinstance(protocols, list) and INTEROP_NULL_USAGE in protocols
 
 
-def request_meta(traceparent: Optional[str] = None) -> Dict[str, Any]:
-    """A request's `_meta` from this kit as a caller: its trace, and the interop revisions it reads (DEC-0087)."""
+def request_meta(traceparent: Optional[str] = None, decision: Any = None, mandate: Any = None) -> Dict[str, Any]:
+    """A request's `_meta` from this kit as a caller: its trace, the interop revisions it reads (DEC-0087), for a
+    relayed action the operator's decision (DEC-0121 AP-2; build one with fabric_actions.operator_decision), and the
+    operator's mandate for the task the call serves (DEC-0125 MD-3; state it with fabric_mandate.operator_mandate and
+    hand it on to the callee with fabric_mandate.hand_on before you send it). Both travel here only, never in a tool's
+    arguments; a decision decision.schema.json refuses or a mandate FAC-SEM-144 refuses raises InteropError."""
     meta: Dict[str, Any] = {"protocols": list(PROTOCOLS_READ)}
     if parse_traceparent(traceparent):
         meta["traceparent"] = traceparent
+    if decision is not None:
+        if not decision_shape(decision):
+            raise InteropError("The decision is not one decision.schema.json reads; it is not sent.")
+        meta["decision"] = dict(decision)
+    if mandate is not None:
+        problem = mandate_problem(mandate)
+        if problem:
+            raise InteropError("The mandate is not one FAC-SEM-144 reads (%s); it is not sent." % problem)
+        meta["mandate"] = json.loads(json.dumps(mandate))
     return meta
 
 
+def action_gate(action: Any, *, tier: Any, caller: Any, meta: Any = None, target: Optional[str] = None,
+                elicited: bool = False, approval: Any = None, action_digest: Optional[str] = None,
+                human_step_url: Optional[str] = None, now: Any = None, self_id: Optional[str] = None,
+                effect: Optional[str] = None, caller_agent: Optional[str] = None, spend_usd: Any = None,
+                project: Optional[str] = None) -> Dict[str, Any]:
+    """One call of a declared action, before its handler runs (DEC-0121 AP-2, AP-4): fabric_actions.action_decision over
+    the call's `_meta.decision` (read from `meta` only, never from arguments, decision D11), the service's authenticated
+    `caller` (fabric_actions.action_caller), `target` (the object the call acts on), `elicited` (the service's own
+    record of an accepted elicitation), `approval` (verify_approval's accepted outcome), `action_digest`,
+    `human_step_url` and `now` (RFC 3339). Answers {ok: True, record, decision}, `decision` being the one taken as the
+    operator's (None otherwise), or {ok: False, refusal} in the DL-19 form (fabric_delegation.refusal_tool_result
+    sends it); a service's own fault is the refusal unknown-state with `fault` beside it for the service's log.
+
+    DEC-0125: a service that names its own agent id (`self_id`) reads the call's `_meta.mandate` when it carries no
+    decision, given `effect` (the action's effect class, required: without it the call is the service's fault
+    effect-missing), `caller_agent` (only an agent id the service authenticated: a delegation's caller, its own
+    per-agent credential; never a name the call carries), `spend_usd` (its own estimate) and `project`. A covered call
+    answers {ok: True, record: {by: operator, via: mandate, task, chain, caller}, decision: None, mandate}; without
+    `self_id` the mandate is not read and the call is answered as before it existed."""
+    import fabric_delegation as _fd  # noqa: E402 - beside this file: DL-19
+    inputs: Dict[str, Any] = {"action": action, "tier": tier, "caller": caller, "elicited": elicited is True, "now": now}
+    if isinstance(meta, dict) and "decision" in meta:
+        inputs["decision"] = meta["decision"]
+    for name, value in (("target", target), ("approval", approval), ("actionDigest", action_digest), ("humanStepUrl", human_step_url)):
+        if value is not None:
+            inputs[name] = value
+    if self_id is not None and isinstance(meta, dict) and "mandate" in meta:
+        inputs.update({"mandate": meta["mandate"], "self": self_id})
+        for name, value in (("effect", effect), ("callerAgent", caller_agent), ("spendUsd", spend_usd), ("project", project)):
+            if value is not None:
+                inputs[name] = value
+    answer = action_decision(inputs)
+    if answer.get("ok") is True:
+        record = answer["recordAs"]
+        taken = isinstance(record, dict) and record.get("via") == "relayed-instruction"
+        out = {"ok": True, "record": record, "decision": inputs["decision"] if taken else None}
+        if isinstance(record, dict) and record.get("via") == "mandate":
+            out["mandate"] = inputs["mandate"]
+        return out
+    out: Dict[str, Any] = {"ok": False, "refusal": _fd.refusal_from_action(answer)}
+    if "fault" in answer:
+        out["fault"] = answer["fault"]
+    return out
+
+
+def action_refusal_tool_result(answer: Any, traceparent: Optional[str] = None) -> Optional[Dict[str, Any]]:
+    """The tools/call result a service's own MCP server answers for an action_decision answer: None when the action
+    takes the call, else DL-19's refusal as structuredContent with isError true (DEC-0121)."""
+    import fabric_delegation as _fd  # noqa: E402 - beside this file: DL-19
+    refusal = _fd.refusal_from_action(answer)
+    return None if refusal is None else _fd.refusal_tool_result(refusal, traceparent=traceparent)
+
+
 def usage_findings(usage: Any, at: str) -> List[Dict[str, str]]:
     """FAC-SEM-119 on a usage: partial false asserts every number known, so it stands beside no null."""
     if not isinstance(usage, dict) or usage.get("partial", _ABSENT) is not False: