@passioncode-ai/passioncode 0.2.39 → 0.2.40

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.40 - 2026-10-26
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.51.1`** (it was `v0.50.0`): the contract release `v0.1.0+2026-10-26.2` with
+  the operator's mandate (one approval carried with a call, refused outside its scope with the order to follow), page
+  links handed over as Fabric Dashboards links, and the A2A surface. Notes are in the adapter's CHANGELOG.
+
 ## 0.2.39 - 2026-10-26
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.50.0",
+      "ref": "v0.51.1",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.2.39",
+  "version": "0.2.40",
   "description": "Set up PassionCode.ai on a computer with one command — the apps from their verified releases, their MCP servers for every coding agent and the PassionCode.ai skills — and check and repair it with the same command or `doctor`.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.50.0",
+      "version": "0.51.1",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.2.39",
+      "version": "0.2.40",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.2.39",
+  "version": "0.2.40",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.50.0",
-      "commit": "d813a4e07a7b721619bd98b80f7dd9920d896ba0",
-      "version": "0.50.0",
+      "ref": "v0.51.1",
+      "commit": "37a3dee395a5cfbcc86b8523bcfcbb50111d82d4",
+      "version": "0.51.1",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -23,7 +23,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:d2577bec959c6231e91deb459bd70fbd613914bd1a08dd4c479c21bef516d2e9",
+      "contentHash": "sha256:73fca6258f066f80776eae0a3abc2cd23c09e2de77ba0d47d24681ac25e7b0e5",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -62,9 +62,9 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.2.39",
+      "ref": "v0.2.40",
       "commit": null,
-      "version": "0.2.39",
+      "version": "0.2.40",
       "via": "this repository",
       "skills": [
         "setting-up-passioncode",
@@ -72,7 +72,7 @@
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:9d3b6b75814363291607bf77221b1b5f0326cf65139f5ce68fef96d67df010cd",
+      "contentHash": "sha256:8528f506d1851ce653316227bfa9d25db9cffa54a8e0b4ebccb2eb272338eaf2",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.50.0",
+  "version": "0.51.1",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.50.0"
+  version: "0.51.1"
   contract-version: "0.1.0"
-  contract-commit: "52c7d798b9f4eb784eb4e29e717038a8912c759d"
+  contract-commit: "e6c4fc16b415eec3190dd34d924d269405359dc9"
 ---
 
 # Adapting projects to Fabric
@@ -76,7 +76,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `52c7d798b9f4eb784eb4e29e717038a8912c759d`.
+- commit `e6c4fc16b415eec3190dd34d924d269405359dc9`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/dashboard-links.md

@@ -140,5 +140,8 @@ or instructions alone do not prove all final answers from every agent are filter
 
 Syntax is owned by Fabric Dashboards and `@passioncode-ai/fabric-service-host`:
 [ADR-0005](https://github.com/passioncode-ai/fabric-dashboards/blob/51a7a80acf42781d7bec304cc87c655d48cc309b/docs/adr/0005-service-links.md).
-The gate accepts canonical links and the legacy `open?service=` form returned by
-older hosts; it does not generate either dialect or redefine the Fabric wire contract.
+The gate accepts only the service form, `fabric-dashboards://service/SERVICE_ID.INSTANCE`
+with at most one `path`; since 0.51.0 it refuses the legacy `open?service=` form, as contract
+DEC-0123 (PL-1, checker rule `FAC-SEM-143`) and its vectors do. A host that still returns the
+legacy form fails the gate: report it as an installed host that did not open the page. The gate
+does not generate links or redefine the Fabric wire contract.

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -22,10 +22,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "52c7d798b9f4eb784eb4e29e717038a8912c759d"
+CONTRACT_COMMIT = "e6c4fc16b415eec3190dd34d924d269405359dc9"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "2f020a696453ae299b123517f14957f6a1354379", "87d384ffce2757081b7ab227e5dad3dddd08328f", "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e", "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "a3a66eb0052043847f6556348e37d34ca873a629", "52c7d798b9f4eb784eb4e29e717038a8912c759d", "2f020a696453ae299b123517f14957f6a1354379", "87d384ffce2757081b7ab227e5dad3dddd08328f", "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e", "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/check_dashboard_link.py

@@ -74,7 +74,9 @@ def login_path(path):
 
 def safe_path(path):
     return (isinstance(path, str) and path.startswith('/') and not path.startswith('//')
-            and len(path) <= 2048 and not re.search(r'[\\\x00-\x1f\x7f]', path))
+            and len(path) <= 2048 and not re.search(r'[\\\x00-\x1f\x7f]', path)
+            # JavaScript's whitespace (\s), which the contract's parseDashboardsLink refuses in a page (DEC-0123)
+            and not re.search('[ \u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]', path))
 
 
 def check(data):
@@ -87,11 +89,11 @@ def check(data):
     require(not re.search(r'[\\\x00-\x20\x7f]', native + http), 'unsafe_url')
     deep, plain = urlsplit(native), urlsplit(http)
     require(deep.scheme == 'fabric-dashboards' and not deep.username and not deep.password and not deep.port and not deep.fragment, 'invalid_deep_link')
-    query = parse_qs(deep.query, keep_blank_values=True, strict_parsing=True)
-    if deep.netloc == 'service':
-        require(deep.path in ('/' + service, '/' + service + '/') and set(query) <= {'path'}, 'wrong_service_or_parameter')
-    else:
-        require(deep.netloc == 'open' and deep.path in ('', '/') and query.get('service') == [service] and set(query) <= {'service', 'path'}, 'invalid_legacy_link')
+    # An empty query is no fields: Python 3.9's strict parse_qs raises on '' where 3.11 and later answer {}.
+    query = parse_qs(deep.query, keep_blank_values=True, strict_parsing=True) if deep.query else {}
+    # DEC-0123 PL-1: only the service form; the legacy open?service= link is refused (FAC-SEM-143, since 0.51.0).
+    require(deep.netloc == 'service', 'not_service_link')
+    require(deep.path in ('/' + service, '/' + service + '/') and set(query) <= {'path'}, 'wrong_service_or_parameter')
     require('path' not in query or len(query['path']) == 1, 'duplicate_path')
     page = query.get('path', [None])[0]
     require(page is None or safe_path(page), 'unsafe_path')

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,10 +14,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.50.0"
+  version: "0.51.1"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "52c7d798b9f4eb784eb4e29e717038a8912c759d"
+  extension-commit: "e6c4fc16b415eec3190dd34d924d269405359dc9"
 ---
 
 # Building Fabric services
@@ -72,6 +72,7 @@ Answer before writing code, and record the answers in the project README:
 | Another agent on this machine | MCP `2026-07-28`, `streamable-http`, at `/mcp` on the service origin, token in a header | one process serves every session; stdio-per-session once left twenty stray servers on this machine |
 | The operator or a script | a CLI: `<tool> service status\|start\|stop\|restart`, `<tool> dashboard` (opens only in Fabric Dashboards, below), `<tool> doctor --json` | every verb delegates to launchd and the well-known document, never to its own process table |
 | A remote agent | A2A `1.0` over HTTPS, or MCP behind an authenticated gateway | loopback reachability is not authorization |
+| An A2A peer on this computer | `surfaces.a2a` names a public Agent Card, served without the token; its interface URLs are loopback (DEC-0122); the kits read it, serving one is FAA-10 | the card carries no credential, process member or required Fabric extension |
 | The dashboard page | same-origin REST under `/api`, session cookie plus a custom request header; every button on it also a tool on the MCP surface (Step 5) | the CSRF defence all four existing dashboards use |
 
 Read [the surfaces and auth reference](references/surfaces-and-auth.md) when wiring
@@ -298,7 +299,9 @@ launchd pid equals answering pid, `dashboard.declared` (ED-9), `well-known.actio
 opener aimed at the service's pages in its checkout; `--repo PATH` names the checkout, and a service installed
 from a release folder needs it), and the `interop.*` rules:
 manifest link, capability list, tools equal to the manifest, job tools, unknown job, trace
-propagation, event trace pairs, `interop.action-tools` (every declared action's tool is served), and
+propagation, event trace pairs, `interop.action-tools` (every declared action's tool is served), `well-known.a2a` and
+`a2a.card` (DEC-0122: the card is fetched without the token and its interfaces are never called; the surfaces
+reference's *A2A for remote agents* section), and
 `board.responder` for a service that declares the project board) and exits 1 on any `FAIL`. A `NOT_RUN` is not a pass;
 name it in the report. A service with a dashboard also runs the layout probe,
 `node <skill-dir>/scripts/check_dashboard_layout.mjs --service <id>` (WebKit at 360, 480, 768

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/recipes/support-agent/README.md

@@ -101,7 +101,9 @@ version is still read and never written; delete it once its messages are past th
 - Replace the example knowledge with the product's own, and run real past questions through it ([practices](../../../creating-fabric-agents/references/practices.md#judges-and-evals), *Judges
   and evals*): count handoffs and read a sample of replies.
 - Show spend: `fabric_usage.usage_report` over the ledger, or `fabric_openrouter.totals`.
-- One decision per message id holds in one process; a service runs one instance per context under its instance lock.
-  Each process reads `decisions.jsonl` once and keeps the index in memory, so a second process writing the same
-  state folder is not seen.
+- One decision per message id holds in one process. Each process reads `decisions.jsonl` once and keeps the index in
+  memory, so a second process writing the same state folder is not seen: a service runs one instance per context with
+  `fabric_context.hold_context_instance` (Node: `holdContextInstance`) and points `stateDir` at that instance's data
+  folder, so a second copy for the same context exits 75 and an organization's copy keeps its own folder
+  ([one instance per context](../../references/estate-record.md#one-instance-per-context-the-helper)).
 - Set the outbox's retention and schedule `prune`.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/board.md

@@ -86,7 +86,9 @@ from `leaseExpiresAt`.
 why not; a refusal accepts the request and completes it `failed_known` with that sentence, so the requester learns it
 and the request does not bounce. A redacted body is refused the same way. The kit never hands a body to a model, a
 shell or a tool; what the handler does with an admitted body (and the checks it needs before a model, a tool or a
-spend sees it) is the service's own responsibility. A message never carries an approval.
+spend sees it) is the service's own responsibility. The kit's responder reads no approval or mandate from a message in
+0.51.0: a request from the operator's own Project may carry `mandate/1` (DEC-0125 MD-3), and a handler acts on it only
+once the kit reads it (FAA-135).
 
 ## Effects, observation, evidence and the reply
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-links.md

@@ -140,5 +140,8 @@ or instructions alone do not prove all final answers from every agent are filter
 
 Syntax is owned by Fabric Dashboards and `@passioncode-ai/fabric-service-host`:
 [ADR-0005](https://github.com/passioncode-ai/fabric-dashboards/blob/51a7a80acf42781d7bec304cc87c655d48cc309b/docs/adr/0005-service-links.md).
-The gate accepts canonical links and the legacy `open?service=` form returned by
-older hosts; it does not generate either dialect or redefine the Fabric wire contract.
+The gate accepts only the service form, `fabric-dashboards://service/SERVICE_ID.INSTANCE`
+with at most one `path`; since 0.51.0 it refuses the legacy `open?service=` form, as contract
+DEC-0123 (PL-1, checker rule `FAC-SEM-143`) and its vectors do. A host that still returns the
+legacy form fails the gate: report it as an installed host that did not open the page. The gate
+does not generate links or redefine the Fabric wire contract.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -100,7 +100,10 @@ operator's decision), `decision-invalid` (a decision for another action or objec
 and `human-step-required`, which carries `data.humanStep` (`sign-in`, `consent`, `payment`, `secret`,
 `spend-above-limit`, `passkey`) and `data.url` (an https URL or a path on the service's origin) beside `detail`.
 `refusal_from_action` / `refusalFromAction` turn an action decision into that refusal; a service's own fault never
-reaches the caller and reads as `unknown-state`. The gate that answers them is in
+reaches the caller and reads as `unknown-state`. Since 0.51.0 the `operator-decision-required` message (free text in
+DL-19, at most 500 characters) also names, in order, the routes for a client that cannot set `_meta`: Fabric's
+`agent.call` with `call.decision` once the hub forwards it (CT-125), the service's own elicitation, else the action's
+page as Fabric Dashboards' `open_link`; both kits carry the same sentence. The gate that answers them is in
 [the interop reference](interop.md#actions).
 
 ## Keys and the cache

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/estate-record.md

@@ -21,6 +21,7 @@ derived from its own digest. Python: [`scripts/fabric_estate.py`](../scripts/fab
 - Applying a revision
 - Trusting a delegation key
 - Contexts: one agent for you and for an organization
+- One instance per context: the helper
 - Machine profiles: full, member, view
 - The delta anchor
 - The estate ceremonies
@@ -133,6 +134,65 @@ Every rule is total on hostile JSON, as the contract's are: an `instancePath` na
 non-object before it does not shift it), and a value whose own `toString` member is data is shown as its JSON. Both kits
 answer the contract's contexts fixtures and variants of them (`test/fixtures/contract/estate-vectors.json`).
 
+## One instance per context: the helper
+
+A service that runs for the person and for an organization runs once per context on a machine (contract
+`contexts.md`, *One instance per context on a machine*; FAA-125). `fabric_context` / `fabric-context.mjs` turns the
+context it is started for into that context's one instance. It is not in the facade: install it with
+`fabric_kit.py install <dir> --module fabric_context` (Node: `--lang node --module fabric-context`), so a service that
+does not run per context keeps the estate reader out of its closure.
+
+```python
+import fabric_context as fc
+info, lock = fc.hold_context_instance("example-agent", "org:acme-rehearsal", record=applied_revision,
+                                      machine_id="machine-a", agent_ref="urn:agent:example-agent")
+serve(data=info["dirs"]["data"], instance=info["instance"])        # org-acme-rehearsal; lock held until exit
+```
+
+```js
+import { holdContextInstance } from './fabric-context.mjs';
+const { dirs, instance, lock } = await holdContextInstance('example-agent', 'org:acme-rehearsal', { record, machineId, agentRef });
+```
+
+- **The instance name.** `personal` is `default` (`personal_instance` / `personalInstance`), so an existing install
+  keeps its descriptor `<id>.default.json`, its folders and its lock. `org:<orgId>` is `org-<orgId>` when the id is
+  lower-case words joined by single hyphens, at most 28 characters, and does not end in a hyphen and 10 hex digits
+  (`org:acme-rehearsal` is `org-acme-rehearsal`); any other id is `org-<slug>-<first 10 hex digits of sha256(orgId)>`
+  (`org:Acme` is `org-acme-37036cd8f9`). `context_instance_name` / `contextInstanceName` answer it alone.
+- **Its folders.** `instance_dirs(id, instance)` / `instanceDirs(id, instance, platform)`: `default` is
+  `service_dirs`; any other is a sibling named as its descriptor, `<id>.<instance>` (on macOS
+  `~/Library/Application Support/<id>.<instance>`, `~/Library/Logs/<id>.<instance>`, `~/Library/Caches/<id>.<instance>`),
+  never inside the personal tree. `launchd_uninstall(..., purge=True, service_id=..., instance=...)` /
+  `launchdUninstall(..., {purge, serviceId, instance})` purge only that instance's folders.
+- **What it checks, before anything is created.** `context_instance` / `contextInstance` is pure and answers
+  `{context, kind, org?, instance, key, dirs, descriptorPath, grant?}`, never the record. An organization's instance
+  needs the estate record revision this machine applied (verified with `verify_estate_record`; the helper verifies no
+  signature), the machine id and the agentRef, all passed by whoever installed the instance. It finds this machine's
+  placement of that agent in that context, as written (FAC-SEM-074), runs FAC-SEM-111 on it
+  (`placement_grant_findings` / `placementGrantFindings`), and refuses outside the grant's window (`startsAt` <= now <
+  `expiresAt`); `instance_share_grant` / `instanceShareGrant` answers the three alone. A personal instance needs no
+  record; given one, a personal placement that names a grant is refused.
+- **What it holds.** `hold_context_instance` / `holdContextInstance` then takes the instance lock on the instance's
+  data folder (`hold_single_instance`: a second copy for the same context exits 75, a supervised one waits first),
+  then the marker `<data>/fabric-context.json` (`{service, instance, context}`, 0600): absent, it is written; equal,
+  kept; another context or instance, or unreadable, releases the lock and refuses. The folder never changes context.
+
+A refusal is one sentence on stderr naming the code and the context, never a record or grant value, and exit 78
+(`EXIT_CONTEXT_REFUSED`, EX_CONFIG; 75 stays "already running"). `ContextRefused` carries the code:
+
+| Code | When |
+|---|---|
+| `context-invalid` | the context is neither `personal` nor `org:<orgId>` as written (`Personal`, `ORG:x`) |
+| `record-required` | an organization's context with no record, machine id or agentRef (fail closed) |
+| `placement-missing` | the record places no such agent on this machine in that context |
+| `grant-refused` | the placement names no share grant of the record for that context, or a revoked one (FAC-SEM-111); a personal placement names one |
+| `grant-window` | now is before the grant's `startsAt`, at or after its `expiresAt`, or an instant cannot be read |
+| `context-mismatch` | the data folder's `fabric-context.json` names another context or instance, or cannot be read |
+
+Under launchd's `KeepAlive` a refused instance is started again every 10 s until the node's next revision removes it;
+a revoked grant stops calls at once at the hub and the meter (DL-24), not here: the helper reads revisions only.
+Tests: `test/test_fabric_context.py`, `test/fabric-context.test.mjs` over `test/fixtures/kit-context-cases.json`.
+
 ## Machine profiles: full, member, view
 
 DEC-0106 gives a machine an optional `profile`. It says what the machine may be when other machines of the estate call

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md

@@ -12,7 +12,7 @@ A service that other agents (and Fabric) call does five things. Each has one hel
 | C3.1 capability = tool | serves each `mcp` capability of its manifest as the MCP tool of the same name, with the manifest's input schema unchanged, its output schema unchanged (or, for a job, wrapped as `oneOf[result envelope, job handle]`) and annotations from the effect | `tool_for_capability` / `toolForCapability`, `job_tool_output_schema`, `expected_annotations` |
 | C3.2 long work = job | a capability whose work can outlive one request declares `"job": true` in its interop block, returns `{"job": {"id", "status": "working"}}`, and serves `fabric.job.get` and `fabric.job.cancel` | `JobStore`, `McpToolServer` (Python), `unknown_job_result` |
 | C3.2 result | a completed job carries the full result envelope, the shape a synchronous call returns: `id`, `contractVersion`, `outcome`, `done`, `proof`, `scope`, `notVerified`, `artifacts`, `createdAt`, `producer`, `output`, `usage`, and its `trace` | `result_envelope` / `resultEnvelope` |
-| C3.3 a person decides | the job goes `input_required` with an elicitation: a titled single-select in form mode, and URL mode for anything secret | `choice_request`, `form_request`, `url_request` |
+| C3.3 a person decides | the job goes `input_required` with an elicitation: a titled single-select in form mode, and URL mode for anything secret. A URL-mode request is an `https` URL or, for a page of this service, its Fabric Dashboards open_link (DEC-0123 PL-4): `url_request` refuses a raw loopback address (`http://127.0.0.1:4100/x`, `http://127.1/`, `http://[::1]/`, `http://localhost/` in any spelling) and a `fabric-dashboards:` link outside the grammar when the request is built, and `request_input` refuses a hand-built request either way (FAC-SEM-143). A tool answer that hands a person a page is `page_answer`'s `{open_link, http_url?}`; `http_url` is a diagnostic | `choice_request`, `form_request`, `url_request`, `page_answer` / `pageAnswer`; the rules in `fabric_page_links` / `fabric-page-links.mjs` |
 | C3.4 trace | every call runs as a child span of the caller's `_meta.traceparent`; outgoing calls carry the same trace; the result envelope records it; events about traced work carry `traceId` and `spanId`, events about untraced work none | `child_traceparent`, `trace_ids`, `make_event(..., trace_id=, span_id=)` |
 
 The interop block sits in the manifest under the capability's `extensions`:
@@ -28,6 +28,7 @@ That key has one spelling (the contract's `src/extensions.ts`); copy it, never r
 - [The kit](#the-kit)
 - [Limits and uncertain effects](#limits-and-uncertain-effects)
 - [Actions: every button has a tool](#actions)
+- [The operator's mandate](#the-operators-mandate)
 - [What the probe checks](#what-the-probe-checks)
 
 ## The kit
@@ -228,6 +229,64 @@ The probe reads the declaration (`well-known.actions`), checks that `tools/list`
 (`interop.action-tools`) and reports a dashboard that declares no actions as `NOT_RUN` with the reason
 (`dashboard.actions-declared`): absence does not prove a page-only button.
 
+<a id="the-operators-mandate"></a>
+
+## The operator's mandate
+
+Contract DEC-0125 (`mandate/1`, rule `FAC-SEM-144`, `docs/specification/delegation.md#the-operators-mandate`, MD-1 to
+MD-6): the operator's instruction for one task travels with the task, narrowed at each hand-over, so a service the
+task reaches takes a call the mandate covers as his decision without asking him again. It is the machine form of his
+rule of 2026-10-26: one approval he gives in the chat of any of his agents binds all his agents (working-with-fabric,
+Step 5). Both kits carry the reference in `fabric_mandate` / `fabric-mandate.mjs` and answer the contract's
+`mandate.json` vectors case for case.
+
+**As a service.** Name your own agent id and each relayed action's effect class; the gate then reads the call's
+`_meta.mandate` when it carries no decision:
+
+```python
+server = fi.McpToolServer("example-agent", "1.0.0", jobs=jobs, authorize=gate, agent_id="example-agent")
+server.add_tool(approve_tool, approve_reply, action=reply_action, target="reply_id", effect="reply",
+                spend=lambda arguments: estimate_usd(arguments), project="example-site")
+```
+
+- `McpToolServer(agent_id=)` is this service's agent id (a lower-case id, optionally `.instance`). Without it a mandate
+  is not read and every call is answered as before DEC-0125.
+- A `spend` or `project` function that raises, or a spend that is not a finite number, fails closed: the call is
+  answered, and a mandate with a `perCallMaxUsd` ceiling or a `projects` list refuses it (`outside-mandate: spend` or
+  `outside-mandate: project`); the estimate is read as a double, so an integer past the float range is infinite and
+  refused under a ceiling, and a project function that answers anything but a string or `None` names no project a
+  mandate can list. A refusal outside a mandate
+  tells the caller the MD-4 order: call again within its own mandate, else pass the refusal up; only the leading agent
+  asks the operator.
+- `add_tool(tool, handler, action=, effect=, spend=, project=)`: on a server with `agent_id`, a `relayed` action names
+  its `effect` (governance's class: `none`, `draft`, `publish`, `send`, `reply`, `charge`, `delete`, `merge`, `deploy`,
+  `change-policy`) or `add_tool` refuses it; `spend` is the service's own estimate of a call's USD (a number, or a
+  function of the arguments), read against the mandate's `perCallMaxUsd`; `project` the project a call acts in.
+- The mandate is read from `_meta.mandate` only, never from its arguments. Its chain must end in `agent_id`; when
+  `authorize` accepted a delegation token, the token's caller must be the agent before it in the chain
+  (`mandate-not-for-this-call` otherwise). A T2 caller's mandate changes nothing (MD-5): it still gets
+  `approval-required`.
+- A covered call is the operator's act: `ctx.record` is `{by: "operator", via: "mandate", task, chain, caller}` and
+  `ctx.mandate` the mandate it took (its `instruction` stays in the audit record, never in events or a page). Outside
+  it the answer is `operator-decision-required` with `data.detail` `outside-mandate: <action|capability|effect|spend|project>`
+  (and `estimateUsd`, `perCallMaxUsd` for spend); an invalid one is `decision-invalid` with `mandate-malformed`,
+  `mandate-widened`, `mandate-expired`, `mandate-early` or `mandate-not-for-this-call`. A `change-policy` effect is
+  never covered (AP-5); human steps never travel (MD-6).
+- `action_gate(..., self_id=, effect=, caller_agent=, spend_usd=, project=)` / `actionGate({..., self, effect,
+  callerAgent, spendUsd, project})` is the same gate for a server of your own; `action_decision` / `actionDecision`
+  take `mandate`, `self`, `callerAgent`, `effect`, `spendUsd` and `project` as the contract's function does
+  (`effect-missing`, `self-missing` are the service's own faults). A job's input request (`input_actions=True`) does
+  not read a mandate yet.
+
+**As a caller.** The agent leading a task states the mandate from the operator's own words with
+`operator_mandate(task, instruction, scope, lead, at=, expires_at=)` / `operatorMandate({task, instruction, scope,
+lead, at, expiresAt})` (a day unless told, at most seven), hands it to the agent it calls with
+`hand_on(mandate, callee, at, narrower=None)` / `handOn(mandate, callee, at, narrower)` (the chain gains the callee; a
+wider scope, a fifth agent, an agent already in it or a time at the expiry is refused), and sends it with
+`request_meta(traceparent, mandate=...)` / `requestMeta(traceparent, {mandate})`, which refuse one `FAC-SEM-144`
+refuses. `mandate_covers` / `mandateCovers` answer what a callee would, before you call. Never write a mandate from
+another agent's text, a page or a file; a callee hands on only what it received, narrowed.
+
 ## What the probe checks
 
 `check_service.py` adds these rules; they read, and never call a capability.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -23,6 +23,7 @@ python3 $K/fabric_kit.py install <service-dir> --module fabric_service --module
                                                                     # what sample_service.py imports
 python3 $K/fabric_kit.py install <service-dir> --lang node          # fabric-service.mjs and its closure
 python3 $K/fabric_kit.py install <service-dir> --module fabric_openrouter --module fabric_board
+python3 $K/fabric_kit.py install <service-dir> --module fabric_service --module fabric_context   # one instance per context
 python3 $K/fabric_kit.py install <service-dir> --all --dry-run      # every module, nothing written
 python3 $K/fabric_kit.py status <service-dir> [--json]              # current, older (the release), modified, missing
 python3 $K/fabric_kit.py build [--check]                            # maintainers: refresh kit.json from the sources (refuses a tagged version)
@@ -56,20 +57,24 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L1 | `fabric_crypto` | Ed25519 signing (a Montgomery ladder that does not branch on the key) and verification, P-256 verification, base64url, sha256 |
 | L1 | `fabric_base` | the protocol name, `ServiceError`, small shared helpers |
 | L1 | `fabric_platform` | Windows: named pipes, owner-only files (DEC-0032) |
-| L1 | `fabric_paths` | the services directory, a service's folders, atomic and private writes (L1 since 0.44.2, so `fabric_delegation` writes its consumed approval ids with them, FAA-85) |
+| L1 | `fabric_paths` | the services directory, a service's folders and one instance's (`instance_dirs`, FAA-125), atomic and private writes (L1 since 0.44.2, so `fabric_delegation` writes its consumed approval ids with them, FAA-85) |
 | L2 | `fabric_estate` | `estate-record/1` revisions and their rules (DEC-0055) |
+| L2 | `fabric_mandate` | the operator's mandate `mandate/1`: what a callee takes under it (`mandate_covers`), FAC-SEM-144, stating and handing it on narrowed (DEC-0125); the effect closure, defined here once |
 | L2 | `fabric_delegation` | the callee's side of `fabric-delegation/0.1` (DEC-0039) |
-| L2 | `fabric_share` | share grants and registrations (DEC-0086) |
+| L2 | `fabric_share` | share grants and registrations (DEC-0086); whether an organization's instance may run under its grant (`instance_share_grant`, FAA-125) |
 | L2 | `fabric_ceremonies` | the headless join token (DEC-0084) |
 | L2 | `fabric_package_schema` | the reading of `fabric-package.schema.json` with JavaScript's pattern and format semantics (FAA-92) |
 | L2 | `fabric_package` | `fabric-package/1`: pack, sign, verify; re-exports `schema_problems` (DEC-0050, DEC-0051) |
 | L3 | `fabric_protocols` | protocol revisions (DEC-0067) and feed data (DEC-0070) |
 | L3 | `fabric_actions` | every action a person has and its agent tool, `fabric-actions/0.1`: the gate a tool runs (`action_decision`), the reader and FAC-SEM-142, the declaration (DEC-0121) |
 | L3 | `fabric_connections` | what an agent uses, `fabric-connections/0.1`: the reference reading and the declaration (DEC-0096, FAC-SEM-127) |
+| L3 | `fabric_a2a` | the reading side of an A2A Agent Card: `surfaces.a2a` as the schema reads it, and what a public card must not carry (DEC-0122) |
+| L3 | `fabric_page_links` | a service's pages as Fabric Dashboards' open_link: build and read it, a raw local address, FAC-SEM-143 on a link and on a URL-mode input request (DEC-0123); the Python twin reads URLs as WHATWG does by hand |
 | L3 | `fabric_lock` | the instance lock and the supervisor marker (LC-01, DEC-0057) |
 | L3 | `fabric_usage` | usage receipts, the ledger, the usage report, attribution, spending limits ([usage](usage.md)) |
 | L3 | `fabric_backups` | settings backups (DEC-0025) |
 | L3 | `fabric_descriptor` | the descriptor, peers, app descriptors, the well-known document |
+| L3 | `fabric_context` | one instance per context (FAA-125, N-11): a context's instance, folders, descriptor, lock and marker; not in the facade, installed with `--module fabric_context` ([contexts](estate-record.md#one-instance-per-context-the-helper)) |
 | L3 | `fabric_auth` | the token, the network guard, login codes |
 | L3 | `fabric_events` | events, paging, the JSONL event log (DEC-0029) |
 | L3 | `fabric_logs` | rotating logs, the stop signal and the drain (LC-12) |

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md

@@ -121,8 +121,10 @@ PA-03).
 
 - **ES256.** It waits for Fabric's decision D2; until then a verifier refuses it as `unknown-algorithm` (FAA-29).
 - **Hub signing for the person's own machines, and the passkey.** Stage 3 of target architecture v4.
-- **The organization's countersignature as a passkey assertion.** It waits for `org-countersign/1` and
-  `org-authority/1`; this version's countersignature is a detached Ed25519 signature.
+- **The organization's countersignature as a passkey assertion.** It waits for the decision that defines the
+  `org-countersign/1` verifier (contract `docs/specification/package.md`, "Signatures" and "Not decided here"; its
+  challenge type is registered with DEC-0063). DEC-0129 decided `org-authority/1` only as the organization's member
+  list for relay admission. This version's countersignature is a detached Ed25519 signature.
 - **Fabric recording packages by `agentRef`.** It waits for the ADR-0138 D2b amendment.
 - **`publish --to org`** (FAA-28; an organization cloud's import API is FAA-63, under FAA-28's rule that publishing to
   an organization is the person's own act).

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1: wire reference
 
-Pinned to `fabric-agent-contract` commit `52c7d798b9f4eb784eb4e29e717038a8912c759d`
+Pinned to `fabric-agent-contract` commit `e6c4fc16b415eec3190dd34d924d269405359dc9`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
@@ -17,7 +17,9 @@ no-token `401` DEC-0109; money apart from a subscription's estimate DEC-0110; th
 protocols of DEC-0111 in the register; a check-in's credential members DEC-0112, a revocation that names its request
 DEC-0113, a node summary against the certificate DEC-0114, key windows read strictly DEC-0115 and DEC-0119, which list
 gates each credential member DEC-0116 to DEC-0118, a pin of four members and `profile` DEC-0120; every action a person
-has as an agent tool, `fabric-actions/0.1` and the operator's relayed decision DEC-0121). The contract's schemas are normative;
+has as an agent tool, `fabric-actions/0.1` and the operator's relayed decision DEC-0121; `surfaces.a2a` and the public A2A
+Agent Card DEC-0122, a service's pages as Fabric Dashboards' `open_link` DEC-0123, Fabric's button in the page's language
+DEC-0124; the operator's mandate `mandate/1`, handed on narrowed with a task DEC-0125). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 
@@ -96,6 +98,13 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   `operatorChannel.path` (DEC-0034) when the service has an operator channel; its status
   document follows the contract's `operator-channel-status.schema.json` and is token-protected
   like the events feed. The kits do not serve it yet.
+- `surfaces.a2a` (DEC-0122) SHOULD name the public A2A Agent Card of a service that serves one: `{path,
+  protocolVersion}`, `path` a path on the service origin (normally `/.well-known/agent-card.json`), `protocolVersion`
+  `"1.0"`, nothing else; the card itself names its interfaces, bindings and security schemes. A reader pinned before
+  DEC-0122 refuses the member. The kits build it with `a2a_surface()` / `a2aSurface()` (`fabric_a2a`), read it with
+  `a2a_view` / `a2aView`, and `build_well_known(a2a=...)` / `buildWellKnown({a2a})` refuse one that is not the
+  schema's, passed either way; `agent_card_findings` / `agentCardFindings` say what a public card must not carry
+  ([surfaces and auth](surfaces-and-auth.md#a2a-for-remote-agents)). The kits do not serve a card yet (FAA-10).
 - `extensions` MAY carry the embedded dashboard declaration under
   `https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1` (`fabric-dashboard/0.1`,
   ED-9): `minWidth` 360…1280 (required), `appearance` ⊆ `scheme`, `theme`, `themes`, `kit`

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/surfaces-and-auth.md

@@ -1,5 +1,14 @@
 # Surfaces and auth
 
+## Contents
+
+- [MCP for agents](#mcp-for-agents)
+- [CLI for people and scripts](#cli-for-people-and-scripts)
+- [A2A for remote agents](#a2a-for-remote-agents)
+- [Token](#token)
+- [Dashboard session](#dashboard-session)
+- [Headers every response carries](#headers-every-response-carries)
+
 ## MCP for agents
 
 - One server inside the service process, `streamable-http`, at `/mcp` on the service
@@ -45,6 +54,32 @@ MCP, never by binding a LAN address. A tunnel (Tailscale Serve and the like) is
 outward surface with its own token lifetime; watch it like a service, because nothing
 else will notice it expire.
 
+A service that answers A2A peers names its public Agent Card in the well-known document's `surfaces.a2a`
+(DEC-0122; [the wire reference](protocol.md)). What that card may say:
+
+- On a local placement the public card answers without the token (Host and Origin checks still apply) and its
+  interface URLs are on the service's loopback origin, for peers on this computer; on a remote placement they are
+  `https`, and a card that is not open is gated by the service's own credentials or an identity proxy.
+- An A2A peer is never given the descriptor's token: no interface accepts it and no `securitySchemes` entry names
+  it. A2A callers bring the service's own credentials or the estate's delegation tokens; the extended card needs
+  one of them.
+- The public card carries no secret and none of the well-known document's process members (`build`, `process`,
+  `pid`, `status`, `summary`, `degraded`). An extension it declares for a Fabric fact (`uri` under
+  `https://fabric.passioncode.ai/`) carries `required: false`; the probe also accepts it absent, which A2A reads as
+  false (a protobuf-written card drops a false default), and flags `required: true` or a non-boolean.
+
+`agent_card_findings(card, origin=, remote=, descriptor_header=)` / `agentCardFindings(card, {origin, remote,
+descriptorHeader})` report each of these by `code` and place, never the value. The probe runs two rules:
+
+| Rule | PASS when | NOT_RUN when |
+|---|---|---|
+| `well-known.a2a` | `surfaces.a2a` is the schema's (`FAIL` names each schema error's place and keyword) | no `surfaces.a2a` |
+| `a2a.card` | the card at `surfaces.a2a.path`, asked with no `Authorization` header and never the descriptor's token, answers 200 with JSON that has no finding; on a local placement any other answer is a `FAIL` | no member, an unreadable one, or a remote card that answers 401 or 403 (a card that is not open; a refusal is not nonconformance) |
+
+A probe cannot see whether an interface would take the descriptor's token without sending it, which DEC-0122
+forbids, so it reads the card only and never calls an interface: an API-key scheme in the descriptor's own
+`auth.header` is a finding, and with `Authorization` (the default) the card cannot show it.
+
 ## Token
 
 - Created once with `ensure_token` at first start, after the instance lock.