@passioncode-ai/passioncode 0.2.40 → 0.2.42

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.2.42 - 2026-10-26
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.52.0`** (it was `v0.51.2`): the contract release `v0.1.0+2026-10-26.12`,
+  with where the operator said an approval travelling with a call, a hub key per organization context, a job's
+  approval step read under the operator's mandate, and Fabric's rules for checking in every three minutes and for being
+  seen correctly. Notes are in the adapter's CHANGELOG.
+
+## 0.2.41 - 2026-10-26
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.51.2`** (it was `v0.51.1`): the reminders Fabric gives on a turn (from
+  Fabric 0.3.14) reach the agent at its next prompt, once each. Notes are in the adapter's CHANGELOG.
+
 ## 0.2.40 - 2026-10-26
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.51.1",
+      "ref": "v0.52.0",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "description": "Set up PassionCode.ai on a computer with one command — the apps from their verified releases, their MCP servers for every coding agent and the PassionCode.ai skills — and check and repair it with the same command or `doctor`.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.51.1",
+      "version": "0.52.0",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.2.40",
+      "version": "0.2.42",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.51.1",
-      "commit": "37a3dee395a5cfbcc86b8523bcfcbb50111d82d4",
-      "version": "0.51.1",
+      "ref": "v0.52.0",
+      "commit": "25383f4058c70d365fb5903b0ed8cde218cbe385",
+      "version": "0.52.0",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -23,7 +23,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:73fca6258f066f80776eae0a3abc2cd23c09e2de77ba0d47d24681ac25e7b0e5",
+      "contentHash": "sha256:b76014070bb894c2ab421cc774ebc1401e20815908080d932fa36a92c4f16c63",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -62,9 +62,9 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.2.40",
+      "ref": "v0.2.42",
       "commit": null,
-      "version": "0.2.40",
+      "version": "0.2.42",
       "via": "this repository",
       "skills": [
         "setting-up-passioncode",
@@ -72,7 +72,7 @@
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:8528f506d1851ce653316227bfa9d25db9cffa54a8e0b4ebccb2eb272338eaf2",
+      "contentHash": "sha256:0265b4cf8965eace837779cc775f1a8c594463cf923e1acb58961190267ccc76",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.51.1",
+  "version": "0.52.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "Two silent-unless-relevant hook sets. The dashboard-kit notice: one line at session start or /clear in a repository that owns a Fabric service whose dashboard has no kit or an older one (fabric-dashboard/0.1, DEC-0036), phrased as an upgrade the agent may make itself. The Fabric session hooks (working-with-fabric, COM-04, FAA-12a): at session start or /clear, the preamble when Claude Code has the MCP server `fabric` and Fabric runs (fabric_whoami, then the project board through com.status and com.list, claim and release); when Fabric is down, one line, only in a project that uses Fabric (a Fabric contract file, a project-bound registration or a service descriptor naming the repository); nothing on compact or resume; each turn's facts (HEAD, files changed, lines added and removed, never content), the board's unread count and the session's end through Fabric, only when the running Fabric advertises session-hooks/1; at each prompt one line only when the unread count rose. All silent in a session Fabric launched. Every hook reads no token, prints at most one block, always exits 0, and hands any Fabric call to a detached worker with a 10 s deadline.",
+  "description": "Two silent-unless-relevant hook sets. The dashboard-kit notice: one line at session start or /clear in a repository that owns a Fabric service whose dashboard has no kit or an older one (fabric-dashboard/0.1, DEC-0036), phrased as an upgrade the agent may make itself. The Fabric session hooks (working-with-fabric, COM-04, FAA-12a): at session start or /clear, the preamble when Claude Code has the MCP server `fabric` and Fabric runs (fabric_whoami, then the project board through com.status and com.list, claim and release); when Fabric is down, one line, only in a project that uses Fabric (a Fabric contract file, a project-bound registration or a service descriptor naming the repository); nothing on compact or resume; each turn's facts (HEAD, files changed, lines added and removed, never content), the board's unread count and the session's end through Fabric, only when the running Fabric advertises session-hooks/1; at each prompt one line only when the unread count rose, then each nudge a turn's answer carried, once (watch-mail prints those of turns it delivered). All silent in a session Fabric launched. Every hook reads no token, prints at most one block, always exits 0, and hands any Fabric call to a detached worker with a 10 s deadline.",
   "hooks": {
     "SessionStart": [
       {

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.51.1"
+  version: "0.52.0"
   contract-version: "0.1.0"
-  contract-commit: "e6c4fc16b415eec3190dd34d924d269405359dc9"
+  contract-commit: "1197a90dc4b57152cabcc71ad17db7559f35a27f"
 ---
 
 # Adapting projects to Fabric
@@ -76,7 +76,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `e6c4fc16b415eec3190dd34d924d269405359dc9`.
+- commit `1197a90dc4b57152cabcc71ad17db7559f35a27f`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/operator-channel-and-repository.md

@@ -30,7 +30,10 @@ report, and do not ask again; an agent that serves `surfaces.operatorChannel` al
 stay the person's (a `secret` step, contract DEC-0121 AP-4): never create the bot, or ask for or
 store the token's value. Enabling the channel, and removing a webhook found on its token, are the
 operator's decision, taken by them on the agent's page or relayed to its agent in their own words
-with `_meta.decision` (OC-1, OC-2, DEC-0121 AP-2); never enable it on your own account. The default
+with `_meta.decision` (OC-1, OC-2, DEC-0121 AP-2), including a relay from another of their agents
+that carries their words verbatim, when and where they said them and the scope (DEC-0126 OA-2,
+OA-3; its `source` sent only to an agent whose well-known `protocols` list `operator-source/1`,
+OA-7); never enable it on your own account. The default
 pin carries DEC-0034 and DEC-0035: a served status document is
 checked against the pinned `schemas/operator-channel-status.schema.json`; the channel's runtime
 rules have no probe rule here yet, so report them `NOT_RUN`. An agent with neither stops nor notify

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -22,10 +22,10 @@ import fabric_secrets as _secrets  # noqa: E402 - the contract's credential dete
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "e6c4fc16b415eec3190dd34d924d269405359dc9"
+CONTRACT_COMMIT = "1197a90dc4b57152cabcc71ad17db7559f35a27f"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "a3a66eb0052043847f6556348e37d34ca873a629", "52c7d798b9f4eb784eb4e29e717038a8912c759d", "2f020a696453ae299b123517f14957f6a1354379", "87d384ffce2757081b7ab227e5dad3dddd08328f", "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e", "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "e6c4fc16b415eec3190dd34d924d269405359dc9", "a3a66eb0052043847f6556348e37d34ca873a629", "52c7d798b9f4eb784eb4e29e717038a8912c759d", "2f020a696453ae299b123517f14957f6a1354379", "87d384ffce2757081b7ab227e5dad3dddd08328f", "0a4ce773c4b9e6bec40c6387eb3f988af7152c0e", "e742016dc396aa31e5a13a893489e43f15786c69", "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0", "c55f2d5a11c9a0197e958e87212fca7ae1154769", "07042181bfae2a481aa0da1a5651f24c76669c48", "d8146cfb0a1c74fc6432284c4356bb0c864b37b5", "82e163665e156a08aa3b92e4711015582c06162c", "1636fa97262f4a26e2086572d540c2ee701e0010", "f00a7685e3861c27f7899c033fb850a145a1708f", "a046f57cf46ea9e3da57ff8ce6a3ed4d26d8774b", "fe55fc67cba1a9e34a736da7d148d4fe2a8fbfa0", "b291bf09e0a9f9fd3c16cf540832cd021203b7d1", "0cacd08b0e95b6abf131eae1206b60792138bc3c", "2eb91c00e852d9c31d804310d38fad91589fcbac", "8e49fbd5fbbf230e32c1969cd24ac3c22422f0a5", "a83bec6b47776af688402c18efec507143061f68", "52da526d7cc1e063d74c5b520dbc03d0ace15246", "78b2da018d2c4bd9ac1bde1dc3b7f1a110a175f5", "623bf61358c339cb10297807b3f024b5d9f1f327", "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,10 +14,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.51.1"
+  version: "0.52.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "e6c4fc16b415eec3190dd34d924d269405359dc9"
+  extension-commit: "1197a90dc4b57152cabcc71ad17db7559f35a27f"
 ---
 
 # Building Fabric services

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/board.md

@@ -86,8 +86,8 @@ from `leaseExpiresAt`.
 why not; a refusal accepts the request and completes it `failed_known` with that sentence, so the requester learns it
 and the request does not bounce. A redacted body is refused the same way. The kit never hands a body to a model, a
 shell or a tool; what the handler does with an admitted body (and the checks it needs before a model, a tool or a
-spend sees it) is the service's own responsibility. The kit's responder reads no approval or mandate from a message in
-0.51.0: a request from the operator's own Project may carry `mandate/1` (DEC-0125 MD-3), and a handler acts on it only
+spend sees it) is the service's own responsibility. The kit's responder reads no approval or mandate from a message yet
+(0.52.0): a request from the operator's own Project may carry `mandate/1` (DEC-0125 MD-3), and a handler acts on it only
 once the kit reads it (FAA-135).
 
 ## Effects, observation, evidence and the reply
@@ -101,6 +101,7 @@ once the kit reads it (FAA-135).
 - `evidence` is at most 8 references `{id: uri, contentHash: sha256:<hex>, label?}`; `artifact_ref(uri, content=…|path=…)`
   hashes the bytes itself. Two ids with one normal form (DEC-0076) name one artifact and are refused.
 - `reply: {text, format?, artifacts?}` is posted with `com.reply` before the completion. A reply is not a completion.
+  It is a fenced reply, so it carries no `deliverTo` and reaches the requester (DEC-0135 DR-3).
 - A handler that raises before any effect completes the request `failed_known` naming only the exception's class.
 - The handler checks `ctx.stopped` in long work: after a session loss its answer is not sent.
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -55,6 +55,18 @@ hub forwarding a T2 caller). DL-26: a T0 or T1 caller is never required to prese
 delegation. A token such a caller presents is still verified and refused when invalid. A T2 caller takes the whole
 profile. Money limits and human gates bind at every tier.
 
+**The family and the agent network** (DEC-0130, wording settled by DEC-0137). The operator's family is every agent
+placed on a machine of his estate and his own local sessions; a callee recognises it only by placing the caller in T0
+or T1 (DL-27). It is neither a context (`personal` and `org:<orgId>` stay the only ones) nor a tier: it is open to
+what DL-26 opens, everything open to the operator in the call's context, which for a tokenless call is the callee
+instance's own context. No claim of a caller places it in the family: a call relayed onto loopback stays T2 unless the
+relay proves the origin's tier, and a caller under another OS account stays T2 (DL-28). The agent network is every
+agent a caller can reach, the family included; outside the family a caller is T2, with a token per call (DL-29). Money
+limits, human gates, the contexts, the credential source (never another agent's key or vault slot), the machine
+profiles on calls over the relay, and a relayed action's decision or mandate still bind inside the family (DEC-0137).
+Every T0 process of the owner's account counts as the family, one he did not install included, so a product that must
+hold against a hostile local process adds its own approval (FAA-148). The kit's tiers already do this; nothing changes in code.
+
 The token is read from `Fabric-Delegation` first (a forwarded call; present but empty is refused, never skipped),
 then from `Authorization: Bearer` when the bearer is a delegation JWT (DL-9, DL-10). A tool with no declared
 effect is refused (`unknown-state`), never guessed. The checks run in the DL-13 order; nothing about a token is
@@ -131,6 +143,16 @@ current verified revision as `estate=` / `{ estate }`, as a value or as a functi
   applied mark or its revocations is an unreadable source, `estate-unreadable`, in both kits (FAA-78).
 - Every verifier refuses a clock that is not a number of seconds `unknown-state` `no-clock` before row 1: a NaN clock
   would make every time row false and pass an expired token.
+- **Which hub key a token is checked against** (DL-14a, DEC-0128). An organization's tokens are signed by that
+  organization context's own hub key (`machines[].contextHubKeys`), under the context issuer its pin names
+  (`organizations[].iss`, `urn:fabric:context:<opaque>`, never the estate id). An instance that serves an organization
+  passes its context as `estate_context=` / `{ estateContext }` to `delegation_gate` or `verify_delegation`, once the
+  record pins its organization (until then its tokens are refused `kid-not-certified`, brief D5), and that pin's `iss`
+  as `issuer`: the `kid` is then trusted only when one machine lists it for that context with that key and
+  the record pins the organization. Without it, or with `personal`, the personal `hubKey` is read, so a context key
+  never verifies a personal token and the personal key never an organization's; any other value (`Org:x`, a trailing
+  space, a number) certifies nothing. `verify_approval` takes no context (the contract's `VerifyApprovalOptions`
+  declares none at the pin), so it reads the personal keys. Held to `contextCases` and `contextVerifier` in `test/fixtures/contract/hub-key-vectors.json`.
 
 ## What the kit does not do
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/estate-record.md

@@ -14,7 +14,10 @@ One revision of one person's estate lists:
 
 A revision names its parent's digest and is signed by a passkey assertion (WebAuthn Level 3) over a challenge
 derived from its own digest. Python: [`scripts/fabric_estate.py`](../scripts/fabric_estate.py). Node:
-[`scripts/fabric-estate.mjs`](../scripts/fabric-estate.mjs). Both answer the contract's own vectors.
+[`scripts/fabric-estate.mjs`](../scripts/fabric-estate.mjs). Both answer the contract's own vectors. Since 0.52.0 the
+record's rules live in [`fabric_estate_rules.py`](../scripts/fabric_estate_rules.py) and
+[`fabric-estate-rules.mjs`](../scripts/fabric-estate-rules.mjs); the estate modules re-export them, and
+`fabric_kit.py install` copies both.
 
 ## Contents
 
@@ -85,6 +88,21 @@ gate = fd.delegation_gate(audience=..., jwks=keys, issuer=..., effects=..., esta
                           estate_revocations=lambda: delta_entries)
 ```
 
+**Which key: the instance's context** (DL-14a, contract DEC-0128). The personal context's tokens are signed by a
+machine's `hubKey`; an organization's by that context's own key in the same machine's `contextHubKeys`
+(`{context: "org:<orgId>", key}`), under the context issuer its pin in `organizations` names (`iss`,
+`urn:fabric:context:<opaque>`). An instance that serves an organization passes its context and that issuer:
+
+```python
+gate = fd.delegation_gate(audience=..., jwks=keys, issuer=pin["iss"], effects=..., estate=lambda: current,
+                          estate_context="org:acme-rehearsal")     # the context fabric_context started it for
+```
+
+The `kid` is then certified only when exactly one machine lists it for that context with the published key and the
+revision pins the organization; omitted or `personal`, the personal `hubKey` is read. A context key never verifies a
+personal token, the personal key never an organization's, and a context that is neither (`Org:x`, a trailing space, a
+number, `null`) certifies nothing: a misconfigured callee fails closed with `kid-not-certified`.
+
 - **The token's fault** (no such certification, another key under that `kid`, a `kid` on two machines, a revoked hub
   key or machine) is `unauthenticated` (for an approval, `approval-invalid`) with detail `kid-not-certified`.
 - **The trust source's fault** is `issuer-unavailable`: `estate-unreadable` (a source that throws or answers nothing
@@ -97,10 +115,12 @@ gate = fd.delegation_gate(audience=..., jwks=keys, issuer=..., effects=..., esta
   source in both kits, and so is `applied: null`; an omitted `applied` means no revision applied yet (FAA-78).
 - **What you pass in.** Pass only a revision that `verify_estate_record` accepted and whose number is not lower than
   the highest the machine applied; a higher one only when you verified its chain from the applied revision.
-- `hub_key_certified(record, kid, x, at, applied, extra_revocations)` /
-  `hubKeyCertified(record, kid, x, at, applied, {extraRevocations})` answers the question on its own:
+- `hub_key_certified(record, kid, x, at, applied, extra_revocations, context)` /
+  `hubKeyCertified(record, kid, x, at, applied, {extraRevocations, context})` answers the question on its own:
   `{certified: true, machine, revision}` or `{certified: false, fault, detail}`. Both kits are held to the contract's
-  `fixtures/vectors/hub-key.json` (`test/fixtures/contract/hub-key-vectors.json`).
+  `fixtures/vectors/hub-key.json` (`test/fixtures/contract/hub-key-vectors.json`), and to its `contextCases` and
+  `contextVerifier`, generated with the contract's `hubKeyCertified` and `verifyDelegation` over its
+  `estate-record-organizations.json`.
 
 ## Contexts: one agent for you and for an organization
 
@@ -129,6 +149,24 @@ of `[A-Za-z0-9][A-Za-z0-9_-]{0,127}`. Absent is `personal`; `null` is not absent
   finds no rule broken. A service that applies the estate record updates its copy first:
   `fabric_kit.py install <dir> --module fabric_estate` (or `--lang node --module fabric-estate`). Since 0.40.0 the
   estate reader imports the kit's core modules, so the one file alone no longer loads ([kit modules](kit-modules.md)).
+- **The organizations the person admitted** (DEC-0127, DEC-0128). `organizations[]` pins each organization once by
+  its context (`org`), with its server (`issuer`), its context issuer (`iss`) and the root that signs its key sets
+  (`root`). FAC-SEM-147: an organization pinned twice, one `iss` used by two pins, an `iss` whose opaque part contains
+  the estate id (eight characters or more, any case), and a root of small order are findings.
+- **A hub key per organization context** (DEC-0128). `machines[].contextHubKeys[]` (`{context, key}`) certifies the
+  key that signs that context's tokens. FAC-SEM-073: each context once on a machine, a context the record pins, every
+  `kid` and public key unique across all the record's hub keys (personal and per context), no key of small order, and
+  only on the machine that holds the personal `hubKey`; FAC-SEM-134: only a `full` machine; FAC-SEM-076: revoking
+  `hub-key <kid>` while listing it; FAC-SEM-114: a context key dropped, replaced, moved to another context or left on a
+  removed machine is revoked in the same revision.
+- **An organization instance whose context the record does not pin** (decision D5 of 0.52.0). `fabric_context` starts
+  it as before: it checks the placement and its share grant, not the pin. Every token presented to it in that context
+  is then refused `kid-not-certified`, since `hub_key_certified` reads a context's keys only while the record pins it.
+  The start is not refused because the contract lets Fabric write `organizations` only once every reader of the record
+  is pinned at or after DEC-0128, so today's records pin none; a refusal now would stop every organization instance.
+- **A tokenless call runs in the instance's context** (DEC-0137). A T0 or T1 caller presents no token (DL-26), so the
+  call is in the context of the instance it reached: the personal instance for the person, an organization's instance
+  for that organization ([delegation](delegation.md), the family).
 
 Every rule is total on hostile JSON, as the contract's are: an `instancePath` names an item by its index as written (a
 non-object before it does not shift it), and a value whose own `toString` member is data is shown as its JSON. Both kits
@@ -289,8 +327,8 @@ sharer's node's and the organization server's, not this kit's.
 ## Checking a record you produce
 
 `estate_record_rules(kind, value)` / `estateRecordRules(kind, value)` are the contract's rules, finding for finding:
-- `estate-record` (FAC-SEM-072…076, 110, 111, 122);
-- `estate-record-revision` `{parent, next}` (072);
+- `estate-record` (FAC-SEM-072…076, 092, 110, 111, 122, 134, 147);
+- `estate-record-revision` `{parent, next}` (072, 114, 137);
 - `estate-placement` `{record, machine, package, context?}` (074, 075, 111, 122): the package placed on that machine in that
   context, `personal` when `context` is absent.
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md

@@ -237,8 +237,8 @@ Contract DEC-0125 (`mandate/1`, rule `FAC-SEM-144`, `docs/specification/delegati
 MD-6): the operator's instruction for one task travels with the task, narrowed at each hand-over, so a service the
 task reaches takes a call the mandate covers as his decision without asking him again. It is the machine form of his
 rule of 2026-10-26: one approval he gives in the chat of any of his agents binds all his agents (working-with-fabric,
-Step 5). Both kits carry the reference in `fabric_mandate` / `fabric-mandate.mjs` and answer the contract's
-`mandate.json` vectors case for case.
+Step 5), which the contract states as DEC-0126 (OA-1 to OA-7). Both kits carry the reference in `fabric_mandate` /
+`fabric-mandate.mjs` and answer the contract's `mandate.json` vectors case for case, its `handOn` group included.
 
 **As a service.** Name your own agent id and each relayed action's effect class; the gate then reads the call's
 `_meta.mandate` when it carries no decision:
@@ -272,20 +272,58 @@ server.add_tool(approve_tool, approve_reply, action=reply_action, target="reply_
   (and `estimateUsd`, `perCallMaxUsd` for spend); an invalid one is `decision-invalid` with `mandate-malformed`,
   `mandate-widened`, `mandate-expired`, `mandate-early` or `mandate-not-for-this-call`. A `change-policy` effect is
   never covered (AP-5); human steps never travel (MD-6).
+- **Where the operator spoke (DEC-0126).** A mandate or a decision may carry `source` (`{project, session or
+  thread}`), set by the agent that heard the operator's words relayed from another of his agents (OA-2). The kits read
+  it exactly as `mandate.schema.json#/$defs/source` does (an unplaced one is `mandate-malformed` or `decision-invalid`)
+  and return it in the record: `ctx.record`, `input_records` and `job_step`'s record carry `source` (OA-6). Keep it,
+  as `instruction`, in the service's own audit record, never in the events feed, a usage report, a log line or a page
+  another party reads (OA-7).
+- **Listing `operator-source/1`.** A service that reads `source` lists `operator-source/1` in its well-known
+  `protocols` (OA-7): `McpToolServer.well_known_protocols(protocols)` returns your list with it added when the server
+  has `agent_id` or serves a relayed action, for `build_well_known(protocols=server.well_known_protocols([...]))`. A
+  service that builds its own list (a Node server, or one without `McpToolServer`) adds `operator-source/1` itself
+  when it reads `source`; a caller that sees no such entry sends the call without `source`, and it is taken as before.
 - `action_gate(..., self_id=, effect=, caller_agent=, spend_usd=, project=)` / `actionGate({..., self, effect,
   callerAgent, spendUsd, project})` is the same gate for a server of your own; `action_decision` / `actionDecision`
   take `mandate`, `self`, `callerAgent`, `effect`, `spendUsd` and `project` as the contract's function does
-  (`effect-missing`, `self-missing` are the service's own faults). A job's input request (`input_actions=True`) does
-  not read a mandate yet.
+  (`effect-missing`, `self-missing` are the service's own faults), and the kit's own `mandateCapability` (a job's kept
+  step: the capability the mandate is read under), which the contract's function does not take; like `effect`, it is
+  the service's own input, never the caller's.
+- **A job's approval step (interop C3.3).** A job reads the mandate its start call carried at its own approval step:
+  `ctx.approval_step(job_id, key, request, effect=, spend_usd=, project=, message=)` on the start call's context (a
+  server with `agent_id`) answers the record when the mandate covers the step `{capability: the job's, action: key,
+  effect}` and asks nothing, the job going on as the operator's decision; otherwise the job waits `input_required` on
+  `request`, its message naming the part not covered (`outside-mandate: <part>`) or saying the mandate expired, and the
+  step is kept in the job's private part (`request_input(..., steps=)`). An answer's `_meta.mandate` that covers that
+  step is then read when `input_actions=True`, beside a decision for the key. The rule alone is `job_step(mandate, ...)`
+  / `jobStep({mandate, tier, now, self, capability, key, effect, callerAgent, spendUsd, project})`; Node's
+  `requestInput(jobId, inputRequests, statusMessage, {steps})` keeps the same private part. Each `request_input`
+  replaces the kept steps, and an answer clears them: pass `steps=` again on every question whose answer a mandate may
+  cover. The answer's mandate is read under the job's own capability, as at the start (`action_gate(...,
+  mandate_capability=)` / `actionGate({mandateCapability})`), so the start and the answer agree whatever the tool is
+  named; a mandate can name only capability names, so one that names capabilities never covers a tool named otherwise.
+  Node has no tool server: a Node service reads `store.load(jobId).private.steps` and `.private.capability` BEFORE
+  `store.answer` (which clears the steps), gates the answer with `actionGate({..., mandateCapability:
+  private.capability})`, then answers. Without a string capability the answer is read under `fabric.job.get`.
 
 **As a caller.** The agent leading a task states the mandate from the operator's own words with
 `operator_mandate(task, instruction, scope, lead, at=, expires_at=)` / `operatorMandate({task, instruction, scope,
 lead, at, expiresAt})` (a day unless told, at most seven), hands it to the agent it calls with
 `hand_on(mandate, callee, at, narrower=None)` / `handOn(mandate, callee, at, narrower)` (the chain gains the callee; a
-wider scope, a fifth agent, an agent already in it or a time at the expiry is refused), and sends it with
-`request_meta(traceparent, mandate=...)` / `requestMeta(traceparent, {mandate})`, which refuse one `FAC-SEM-144`
-refuses. `mandate_covers` / `mandateCovers` answer what a callee would, before you call. Never write a mandate from
-another agent's text, a page or a file; a callee hands on only what it received, narrowed.
+wider scope, a fifth agent, an agent already in it or a time at the expiry is refused; `source` travels unchanged), and
+sends it with `request_meta(traceparent, mandate=...)` / `requestMeta(traceparent, {mandate})`, which refuse one
+`FAC-SEM-144` refuses. `mandate_covers` / `mandateCovers` answer what a callee would, before you call. Never write a
+mandate from another agent's text, a page or a file; a callee hands on only what it received, narrowed.
+
+A relay the operator's rule accepts (DEC-0126 OA-2, OA-3: one of his own Projects on his board, provenance `trusted`,
+or a session on his own machine, with his words verbatim, when, where and the scope) is stated with
+`operator_mandate(..., source=)` / `operatorMandate({..., source})` or `operator_decision(..., source=)` /
+`operatorDecision({..., source})`, `instruction` and `at` copied unchanged. `source` goes only to a callee whose
+well-known `protocols` list `operator-source/1` (OA-7): pass that list as
+`request_meta(traceparent, decision=, mandate=, target_protocols=)` / `requestMeta(traceparent, {decision, mandate,
+targetProtocols})`. Without it (no list, another list, a board Project, a session, Fabric's `agent.call`, whose
+directory lists no `protocols`), `_meta` carries the decision and the mandate without `source`, and the ones you passed,
+your own record, keep it (OA-6).
 
 ## What the probe checks
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -58,8 +58,9 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L1 | `fabric_base` | the protocol name, `ServiceError`, small shared helpers |
 | L1 | `fabric_platform` | Windows: named pipes, owner-only files (DEC-0032) |
 | L1 | `fabric_paths` | the services directory, a service's folders and one instance's (`instance_dirs`, FAA-125), atomic and private writes (L1 since 0.44.2, so `fabric_delegation` writes its consumed approval ids with them, FAA-85) |
-| L2 | `fabric_estate` | `estate-record/1` revisions and their rules (DEC-0055) |
-| L2 | `fabric_mandate` | the operator's mandate `mandate/1`: what a callee takes under it (`mandate_covers`), FAC-SEM-144, stating and handing it on narrowed (DEC-0125); the effect closure, defined here once |
+| L2 | `fabric_estate_rules` | the record's own rules without a verifier: FAC-SEM-072…076 and the rest, FAC-SEM-147 and the context hub keys (DEC-0055, DEC-0128), contexts, the digest and challenge, a passkey's key; split from `fabric_estate` in 0.52.0 (D8) |
+| L2 | `fabric_estate` | `estate-record/1` revisions: the passkey assertion, the verifier, placement trust, `hub_key_certified` with its context (DL-14a, DEC-0128); re-exports `fabric_estate_rules` (DEC-0055) |
+| L2 | `fabric_mandate` | the operator's mandate `mandate/1`: what a callee takes under it (`mandate_covers`), FAC-SEM-144, stating and handing it on narrowed (DEC-0125); where the operator spoke, `source`, and its withholding from a target that does not list `operator-source/1` (DEC-0126); the effect closure, defined here once |
 | L2 | `fabric_delegation` | the callee's side of `fabric-delegation/0.1` (DEC-0039) |
 | L2 | `fabric_share` | share grants and registrations (DEC-0086); whether an organization's instance may run under its grant (`instance_share_grant`, FAA-125) |
 | L2 | `fabric_ceremonies` | the headless join token (DEC-0084) |
@@ -81,7 +82,7 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L3 | `fabric_supervisors` | launchd, systemd user units, Task Scheduler (DEC-0032, LC-14) |
 | L3 | `fabric_service` | the facade: every name 0.39.1 exported, re-exported from the modules above |
 | L3 | `fabric_profiles` | runner and model profiles ([profiles](profiles.md)) |
-| L3 | `fabric_interop_rules` | `fabric-interop/0.1` rules without a service: constants, `InteropError`, trace context, job limits (DEC-0087; FAA-92) |
+| L3 | `fabric_interop_rules` | `fabric-interop/0.1` rules without a service: constants, `InteropError`, trace context, job limits (DEC-0087; FAA-92), a job's approval step under the mandate (`job_step`, C3.3) |
 | L3 | `fabric_interop` | `fabric-interop/0.1`: jobs, envelopes, MCP tools; re-exports the rule layer ([interop](interop.md)) |
 | L4 | `fabric_hub` | the Fabric hub's door (`fabric-hub/0.1`) |
 | L4 | `fabric_board_shapes` | the project board's wire: constants, refusal codes, shapes |
@@ -103,7 +104,8 @@ public name 0.39.1 had, in both languages (the snapshot is `test/fixtures/kit-ap
 name fails `test_kit_api`), and the Python facade the private names other code reached through it (`_number`,
 `_DAY_MS`, `_utc_date_ms` from the core). `fabric_board` and `fabric-board.mjs` are
 facades the same way, and since 0.44.1 so are `fabric_interop` (over `fabric_interop_rules`) and `fabric_package` (over
-`fabric_package_schema`), with their Node twins: patch the rule or schema module, not the facade. What changed for a service that copies the kit: `fabric_service.py` alone is no longer enough;
+`fabric_package_schema`), and since 0.52.0 `fabric_estate` (over `fabric_estate_rules`, listed just before it, since it
+imports the rules), with their Node twins: patch the rule or schema module, not the facade. What changed for a service that copies the kit: `fabric_service.py` alone is no longer enough;
 install with `fabric_kit.py install` and `status` names what is missing. A test or service that replaced a function
 by assigning it on the facade (`fabric_service.X = ...`) no longer changes what the kit does: the code reads its own
 module's name, so patch the module that defines it (`fabric_lock.X`, `fabric_session_env.X`). A service that imported a module-private

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1: wire reference
 
-Pinned to `fabric-agent-contract` commit `e6c4fc16b415eec3190dd34d924d269405359dc9`
+Pinned to `fabric-agent-contract` commit `1197a90dc4b57152cabcc71ad17db7559f35a27f`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
@@ -19,7 +19,12 @@ DEC-0113, a node summary against the certificate DEC-0114, key windows read stri
 gates each credential member DEC-0116 to DEC-0118, a pin of four members and `profile` DEC-0120; every action a person
 has as an agent tool, `fabric-actions/0.1` and the operator's relayed decision DEC-0121; `surfaces.a2a` and the public A2A
 Agent Card DEC-0122, a service's pages as Fabric Dashboards' `open_link` DEC-0123, Fabric's button in the page's language
-DEC-0124; the operator's mandate `mandate/1`, handed on narrowed with a task DEC-0125). The contract's schemas are normative;
+DEC-0124; the operator's mandate `mandate/1`, handed on narrowed with a task DEC-0125; one approval binds all the
+operator's agents, its `source` on a mandate and a decision DEC-0126; context hub keys and the organizations an estate
+record pins DEC-0127 and DEC-0128; the family and the agent network named DEC-0130 and DEC-0137; a reply delivered to
+the sender it answers, or to whom it names DEC-0135; a hand-over adds no naming list the scope in force leaves out
+DEC-0136. The organization's member list, draft exchange, relay and the machines' report, DEC-0129, DEC-0131 to DEC-0134,
+reach the kit only as protocol register entries). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-actions.mjs

@@ -9,19 +9,22 @@
 // - actionsExtensionRules(wellKnown), actionRules(kind, value): FAC-SEM-142.
 // - actionsExtension(actions, { capabilities }): the `extensions` entry a service declares; it refuses a declaration
 //   FAC-SEM-142 would find, so a service never publishes one.
-// - operatorDecision({action, instruction, at, target}): the decision an agent relays in _meta.decision (AP-2, AP-3),
-//   refused when decision.schema.json would refuse it.
+// - operatorDecision({action, instruction, at, target, source}): the decision an agent relays in _meta.decision (AP-2,
+//   AP-3), refused when decision.schema.json would refuse it.
 // - actionCaller(tier, authenticated): the caller a service records (AP-2): the identity it authenticated, else
 //   local:T0 / local:T1 for a caller its local floor authenticated, never a name the call carries.
 // - DEC-0125: actionDecision reads a call's mandate (_meta.mandate) through fabric-mandate.mjs's mandateCovers when the
 //   call carries no decision.
+// - DEC-0126: a decision may carry `source` (where the operator said the words, OA-2); actionDecision returns it in
+//   recordAs (OA-6). A service that reads it lists operator-source/1 and keeps it, as `instruction`, in its own audit
+//   record only: never an event, a usage report, a log line or a page another party reads (OA-7).
 //
 // The kit has no JSON Schema validator: the two shapes are written here from the schemas, lengths in code points and
 // patterns over the whole string, as the contract's validator reads them. Members are an object's own members (a JSON
 // text has no other kind; an inherited member is not read). Never throws on what it reads. Node 20+, no dependency.
 import { ServiceError } from './fabric-base.mjs';
 import { isObject, jsonEqual } from './fabric-jsvalue.mjs';
-import { mandateCovers } from './fabric-mandate.mjs'; // DEC-0125
+import { mandateCovers, sourceShape } from './fabric-mandate.mjs'; // DEC-0125, DEC-0126
 import { formatRfc3339, parseRfc3339Ms } from './fabric-time.mjs';
 
 export const ACTIONS_EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/actions/0.1';
@@ -43,7 +46,7 @@ const CAPABILITY = /^[a-z][a-z0-9._-]{1,127}$/u; // common.schema.json#/$defs/ca
 const SHA256 = /^sha256:[0-9a-f]{64}$/;
 const STEP_URL = /^(https:\/\/|\/)/;
 const ACTION_MEMBERS = new Set(['id', 'title', 'tool', 'gate', 'humanStep']);
-const DECISION_MEMBERS = new Set(['by', 'via', 'action', 'target', 'instruction', 'at']);
+const DECISION_MEMBERS = new Set(['by', 'via', 'action', 'target', 'instruction', 'at', 'source']);
 const KEY_PATH = `/extensions/${ACTIONS_EXTENSION_KEY.replace(/~/g, '~0').replace(/\//g, '~1')}`;
 
 /** An own member that is not undefined, as the validator reads a member as present. */
@@ -91,15 +94,17 @@ export const readableAction = (action) => actionErrors(action, '').length === 0
 
 /**
  * decision.schema.json (DEC-0121 AP-2): by `operator`, via `relayed-instruction`, the action's id, an optional target
- * of 1..200, the operator's words of 1..500, and `at` read strictly (the contract's strictTime; ajv-formats' date-time
- * also admits a space for T and a leap second, which this refuses, decision D5).
+ * of 1..200, the operator's words of 1..500, `at` read strictly (the contract's strictTime; ajv-formats' date-time also
+ * admits a space for T and a leap second, which this refuses, decision D5), and an optional `source` as
+ * mandate.schema.json#/$defs/source reads it (DEC-0126).
  */
 export function decisionShape(value) {
   if (!isObject(value) || Object.keys(value).some((key) => !DECISION_MEMBERS.has(key))) return false;
   if (['by', 'via', 'action', 'instruction', 'at'].some((key) => !has(value, key))) return false;
   return value.by === 'operator' && value.via === 'relayed-instruction' && matches(REQUEST_KEY, value.action, 64)
     && (!has(value, 'target') || text(value.target, 1, 200)) && text(value.instruction, 1, 500)
-    && typeof value.at === 'string' && !Number.isNaN(parseRfc3339Ms(value.at));
+    && typeof value.at === 'string' && !Number.isNaN(parseRfc3339Ms(value.at))
+    && (!has(value, 'source') || sourceShape(value.source));
 }
 
 const acceptedApproval = (approval) => isObject(approval) && member(approval, 'ok') === true && nonEmpty(member(approval, 'approver'));
@@ -116,12 +121,16 @@ const refuse = (code) => ({ ok: false, code });
  * accepted approval is the approver's; a T2 caller without one gets approval-required with the digest; an accepted
  * elicitation is the operator's; no decision is operator-decision-required; a decision that is not the schema's, is for
  * another action or object, or whose `at` is more than 60 s ahead of `now` or more than 24 h behind it is
- * decision-invalid; otherwise the operator's act, recorded with `caller`. DEC-0125: a call with no decision that carries
+ * decision-invalid; otherwise the operator's act, recorded with `caller` and, when the decision carries one, its `source`
+ * (DEC-0126 OA-6). DEC-0125: a call with no decision that carries
  * `mandate` (its `_meta.mandate`) is answered as mandateCovers answers, given `self` (the service's own agent id),
  * `callerAgent` (only an agent id the service authenticated), `effect` (the action's effect class, the service's own
- * knowledge), `spendUsd` and `project`: covered, {by: 'operator', via: 'mandate', task, chain, caller}. `{fault}`
+ * knowledge), `spendUsd` and `project`: covered, {by: 'operator', via: 'mandate', task, chain, source?, caller}. `{fault}`
  * (action-invalid, caller-missing, now-unreadable, digest-missing, url-missing, effect-missing, self-missing) is the
  * service's own and is never sent to a caller.
+ *
+ * Kit input beside the contract's: mandateCapability, a job's kept step's capability, read by the mandate in place of
+ * the action's tool (the contract's actionDecision does not take it; the service's own input, never a caller's).
  */
 export function actionDecision(inputs) {
   const field = (key) => member(inputs, key);
@@ -153,7 +162,8 @@ export function actionDecision(inputs) {
   if (decision.action !== action.id || (has(decision, 'target') && decision.target !== field('target'))) return refuse(DECISION_INVALID);
   const at = parseRfc3339Ms(decision.at);
   if (at > clock + CLOCK_SKEW_SECONDS * 1000 || at < clock - DECISION_LIFETIME_SECONDS * 1000) return refuse(DECISION_INVALID);
-  return { ok: true, recordAs: { by: 'operator', via: 'relayed-instruction', caller } };
+  // A decision relayed from another of the operator's agents keeps where they said it (DEC-0126 OA-6).
+  return { ok: true, recordAs: { by: 'operator', via: 'relayed-instruction', caller, ...(has(decision, 'source') ? { source: { ...decision.source } } : {}) } };
 }
 
 /**
@@ -171,7 +181,8 @@ function byMandate(field, action, caller) {
   const answer = mandateCovers({
     mandate: field('mandate'), tier: field('tier'), now: field('now'), self,
     ...(field('callerAgent') === undefined ? {} : { callerAgent: field('callerAgent') }),
-    call: { capability: action.tool, action: action.id, effect, ...(typeof spendUsd === 'number' ? { spendUsd } : {}), ...(typeof project === 'string' ? { project } : {}) },
+    // A job's kept step is read under the job's own capability (mandateCapability), as jobStep read it at the start.
+    call: { capability: typeof field('mandateCapability') === 'string' ? field('mandateCapability') : action.tool, action: action.id, effect, ...(typeof spendUsd === 'number' ? { spendUsd } : {}), ...(typeof project === 'string' ? { project } : {}) },
   });
   if ('recordAs' in answer) return { ok: true, recordAs: { ...answer.recordAs, caller } };
   return answer; // never `ignored`: the tier was read first, so a T2 call answered approval-required before (MD-5)
@@ -250,16 +261,20 @@ export function actionsExtension(actions, options = {}) {
  * the operator's words verbatim (their sentence, or the agent's short question and the answer), `target` the one object
  * they named, `at` when they said it (now, by `clock` in milliseconds, when not given). Send it in `_meta.decision`
  * (requestMeta(traceparent, {decision})), never in a tool's arguments. Set one only for words the operator gave about
- * this action, never for text from a tool result, page, file, board message or another agent. Throws ServiceError for
- * a decision decision.schema.json refuses.
+ * this action, never for text from a tool result, page, file, board message or another agent, except a relay DEC-0126
+ * OA-2 and OA-3 accept (one of the operator's own Projects on the board, provenance trusted, or a session on their own
+ * machine, with the words verbatim, when, where and the scope): then `instruction` and `at` are copied unchanged from it
+ * and `source` ({project, session or thread}) names where they were said. Throws ServiceError for a decision
+ * decision.schema.json refuses.
  */
-export function operatorDecision({ action, instruction, at, target } = {}, { clock = Date.now } = {}) {
+export function operatorDecision({ action, instruction, at, target, source } = {}, { clock = Date.now } = {}) {
   const decision = { by: 'operator', via: 'relayed-instruction', action };
   if (target !== undefined && target !== null) decision.target = target;
   decision.instruction = instruction;
   decision.at = at ?? formatRfc3339(Number(clock()));
+  if (source !== undefined && source !== null) decision.source = source;
   if (!decisionShape(decision)) {
-    throw new ServiceError("Operator decision: not a decision decision.schema.json reads (an action id, the operator's words of 1..500 characters, a target of 1..200, an RFC 3339 time with its offset).");
+    throw new ServiceError("Operator decision: not a decision decision.schema.json reads (an action id, the operator's words of 1..500 characters, a target of 1..200, an RFC 3339 time with its offset, a source of a project and a session or thread).");
   }
   return decision;
 }