@passioncode-ai/passioncode 0.2.42 → 0.2.44

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-link.mjs

@@ -83,6 +83,7 @@ export class BoardSession {
 export class Checkpoint {
   constructor(file) {
     this.file = file;
+    this.slots = {}; // the responder's own record of each slot it held: {project, generation, moved?} (FAA-155)
     this.entries = this.#load();
   }
   #load() {
@@ -100,13 +101,16 @@ export class Checkpoint {
       doc = null;
     }
     if (!isObj(doc) || doc.version !== 1 || !isObj(doc.requests)) throw new BoardError('checkpoint', `The board checkpoint ${this.file} is not one this kit writes.`);
+    // a record that is not an object is ignored, as a file without one is
+    this.slots = isObj(doc.slots) ? Object.fromEntries(Object.entries(doc.slots).filter(([, v]) => isObj(v))) : {};
     return doc.requests;
   }
-  #write(entries) {
+  #write(entries, slots = this.slots) {
     try {
       ensurePrivateDir(path.dirname(this.file));
-      const sorted = Object.fromEntries(Object.keys(entries).sort().map((k) => [k, entries[k]]));
-      atomicWrite(this.file, `${JSON.stringify({ requests: sorted, version: 1 }, null, 1)}\n`, 0o600);
+      const sort = (o) => Object.fromEntries(Object.keys(o).sort().map((k) => [k, o[k]]));
+      const doc = Object.keys(slots).length ? { requests: sort(entries), slots: sort(slots), version: 1 } : { requests: sort(entries), version: 1 };
+      atomicWrite(this.file, `${JSON.stringify(doc, null, 1)}\n`, 0o600);
     } catch (e) {
       throw new BoardError('checkpoint', `The board checkpoint could not be written (${e.code ?? e.message}); nothing was sent.`);
     }
@@ -122,8 +126,34 @@ export class Checkpoint {
     this.#write(entries);
     this.entries = entries;
   }
+  /** Writes the record of a slot this responder held (null forgets it); nothing is written when it is unchanged. */
+  slot(capability, record) {
+    const { [capability]: _old, ...slots } = this.slots;
+    if (record !== null) slots[capability] = JSON.parse(JSON.stringify(record));
+    if (JSON.stringify(sortDeep(slots)) === JSON.stringify(sortDeep(this.slots))) return;
+    this.#write(this.entries, slots);
+    this.slots = slots;
+  }
+  /**
+   * At a clean leave (the session's DELETE released the slots): forget the record of each slot this service held for
+   * `project` with no request left and not moved away, so a later generation is another session taking a free slot, and
+   * a kit rolled back to before 0.53.0 leaves nothing that reads as a move. A record that cannot be written stays.
+   */
+  leave(project) {
+    const busy = new Set(Object.values(this.entries).map((e) => e.capability));
+    for (const [capability, record] of Object.entries(this.slots)) {
+      if (!isObj(record) || record.project !== project || 'moved' in record || busy.has(capability)) continue;
+      try {
+        this.slot(capability, null);
+      } catch {
+        // stays for the next start
+      }
+    }
+  }
 }
 
+const sortDeep = (v) => (isObj(v) ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortDeep(v[k])])) : v);
+
 /** A claimed request as data: never an instruction. */
 export class BoardRequest {
   constructor(message, capability) {

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-session.mjs

@@ -26,6 +26,9 @@ const TERMINAL = new Set(['completed', 'failed_known', 'cancelled', 'expired']);
 // participant reply (DEC-0098, DEC-0102; not terminal, the requester may still cancel it, and nobody claims it).
 const NOT_OURS = new Set(['queued', 'claimed', 'answered']);
 
+// The answer may have been stored: send it again with the same key (BoardError).
+const LOST = ['unreachable', 'session-ended'];
+
 /** A lost call is sent again this long before the lease it keeps would lapse (FAA-77, finding 38). */
 export const LEASE_MARGIN_SECONDS = 10;
 
@@ -87,6 +90,7 @@ export class Responder {
     /** One fenced call at a time, and the entry edits beside them (FAA-77, finding 36). */
     this.fenceQueue = Promise.resolve();
     this.toResume = []; // transferred requests waiting until nothing runs (finding 39)
+    this.suspect = new Set(); // capabilities a fenced call was refused on: com.status says whether they moved (FAA-155)
   }
 
   /** Runs fn after every fenced call queued before it (finding 36): an await inside a call never lets another in. */
@@ -167,13 +171,14 @@ export class Responder {
     const args = { idempotency: this.idem(this.key('enroll')), capability };
     let receipt;
     try {
-      receipt = this.receipt('com.enroll', await this.call('com.enroll', args));
+      receipt = this.receipt('com.enroll', await this.ask(capability, 'com.enroll', args));
     } catch (e) {
       if (e.code === 'held') {
         this.pause(capability);
         return;
       }
       if (e.code === 'fenced') {
+        if (await this.gone(capability)) return;
         this.slots[capability] = { state: 'contested', renewedAt: this.now() };
         this.emit('board.slot.contested', 'warn', `Another responder holds the ${capability} slot on this Project; this service waits for it to lapse and never takes it over by itself.`, { notify: true, episode: capability, capability });
         return;
@@ -181,6 +186,7 @@ export class Responder {
       throw e;
     }
     this.slots[capability] = { state: 'held', generation: receipt.slot.generation, renewedAt: this.now() };
+    this.heldAt(capability, receipt.slot.generation);
     delete this.said['board.slot.contested'];
     this.lifted(capability);
   }
@@ -205,6 +211,118 @@ export class Responder {
     this.emit('board.slot.released', 'info', `The operator's hold on ${capability} was lifted; the service takes new work again.`, { capability });
   }
 
+  // -- a slot moved to another session (FAA-155, DEC-0140 PR-2) --
+  /** The generation this responder holds the slot at, kept beside its checkpoint; a failed write is retried at the next receipt. */
+  heldAt(capability, generation) {
+    this.note(capability, { project: this.project, generation });
+  }
+
+  /** The slot record, best effort: one that cannot be written now is written at the next receipt. */
+  note(capability, record) {
+    try {
+      this.checkpoint.slot(capability, record);
+    } catch {
+      // the request steps fail closed on their own
+    }
+  }
+
+  /**
+   * An enroll or replace is recorded with its key before it is sent, so a lost answer is never read as a move; a refusal
+   * drops the record, a receipt replaces it (heldAt), a record that cannot be written is skipped.
+   */
+  async ask(capability, op, args) {
+    let held = this.checkpoint.slots[capability] ?? {};
+    if (held.project !== this.project) return this.call(op, args); // no record: nothing a lost answer could be mistaken for
+    const slot = this.slots[capability] ?? {};
+    if (op === 'com.enroll' && slot.state === 'held' && slot.generation === held.generation
+      && this.now() - (slot.renewedAt ?? 0) < LEASE_SECONDS - LEASE_MARGIN_SECONDS && !('asking' in held)) {
+      return this.call(op, args); // a live holder's renew cannot change its generation: nothing to record
+    }
+    if (isObj(held.asking)) {
+      // An earlier lost ask is settled first; it may show the slot moved.
+      if (await this.gone(capability)) throw new BoardError('fenced', `The ${capability} slot moved to another session.`, false, op);
+      held = this.checkpoint.slots[capability] ?? {};
+    }
+    try {
+      this.checkpoint.slot(capability, { ...held, asking: { op, args } });
+    } catch {
+      return this.call(op, args);
+    }
+    try {
+      return await this.call(op, args);
+    } catch (e) {
+      if (!LOST.includes(e.code)) this.note(capability, held);
+      throw e;
+    }
+  }
+
+  /**
+   * Asks a lost enroll or replace again under its key. `repeated: true`: it landed, the generation is ours. Else it ran
+   * only now: if the slot had moved past the record (`before`), the record stays and the move is read (the slot just
+   * taken lapses unused). A refusal or an odd receipt drops the record; a lost answer keeps it.
+   */
+  async replay(capability, held, before) {
+    const { asking, ...rest } = held;
+    let record = rest;
+    if (isObj(asking) && ['com.enroll', 'com.responder_replace'].includes(asking.op)) {
+      try {
+        const answer = this.receipt(asking.op, await this.call(asking.op, asking.args));
+        const generation = answer.slot?.generation;
+        const moved = isInt(before, 1) && isInt(rest.generation, 1) && before > rest.generation;
+        if (isInt(generation, 1) && (answer.repeated === true || !moved)) record = { project: this.project, generation };
+      } catch (e) {
+        if (LOST.includes(e.code)) throw e;
+        if (e.code === 'idempotency_window_expired') record = {}; // a retired epoch: unknown, so a first start, no move
+      }
+    }
+    this.note(capability, Object.keys(record).length ? record : null);
+    return record;
+  }
+
+  /**
+   * True when com.status shows the slot's generation past the one recorded held: the operator or another session moved
+   * it. The slot is left `moved`. No record, another Project's, an odd value or no later generation: false.
+   */
+  async gone(capability, status = null) {
+    let held = this.checkpoint.slots[capability] ?? {};
+    if (held.project !== this.project || (!isInt(held.generation, 1) && !('asking' in held))) return false;
+    let now = ((status ?? await this.status()).responders ?? []).find((r) => isObj(r) && r.capability === capability)?.generation;
+    if ('asking' in held) held = await this.replay(capability, held, now); // its own lost ask first
+    if (isInt(held.moved, 1) /* a recorded move stays until takeBack */ && !(isInt(now, 1) && now > (held.generation ?? now))) now = held.moved;
+    if (!isInt(now, 1) || !isInt(held.generation, 1) || now <= held.generation) return false;
+    if (this.current?.entry.capability === capability) {
+      this.current.ctx.stopped = true;
+      this.current = null;
+    }
+    for (const entry of Object.values(this.checkpoint.entries).filter((e) => e.capability === capability).map((e) => ({ ...e }))) {
+      if (entry.step === 'claimed') this.checkpoint.drop(entry.request); // the move returned the claim to the queue
+      else if (!['unknown', 'lapsed'].includes(entry.step)) {
+        // Begun: outcome_unknown, which the slot's holder reconciles. Accepted: held on the board, continued only by a
+        // transfer if the slot is this service's again; never a com.responder_replace on its own.
+        entry.step = entry.effect ? 'unknown' : 'lapsed';
+        this.checkpoint.put(entry);
+      }
+    }
+    this.toResume = this.toResume.filter((r) => this.checkpoint.entries[r]?.capability !== capability);
+    this.slots[capability] = { state: 'moved', generation: now, renewedAt: this.now() };
+    if (!('moved' in held)) { // once, even across restarts
+      this.emit('board.slot.moved', 'warn', `The ${capability} slot on this Project was moved to another session. This service stopped answering it there, left its accepted work held (work already begun is the new holder's to settle) and does not take the slot back by itself. Its take-back action brings it back once the other session lets it go; without one, ask its maintainer.`, { notify: true, episode: capability, capability, generation: now, held: held.generation });
+      this.note(capability, { ...held, moved: now }); // said again at the next start if it cannot be written
+    }
+    return true;
+  }
+
+  /**
+   * The operator's act, never the kit's: forget that a capability's slot moved away. In the same board session the next
+   * tick enrolls once the slot is free; a reconnect with held work takes it back at once by a transfer (FAA-155).
+   */
+  takeBack(capability) {
+    if (!this.capabilities.includes(capability)) throw new BoardError('invalid_arguments', `This responder does not answer ${capability}.`);
+    this.checkpoint.slot(capability, null);
+    if (this.slots[capability]?.state === 'moved') this.slots[capability] = { state: 'contested', renewedAt: 0 };
+    delete this.said['board.slot.moved'];
+  }
+
   // -- restart: reconcile and transfer --
   async readState(entry) {
     const message = await this.call('com.get', { message: entry.message });
@@ -237,13 +355,18 @@ export class Responder {
     const generations = Object.fromEntries(responders.map((r) => [r.capability, r.generation ?? 0]));
     const onHold = new Set(responders.filter((r) => r.held === true).map((r) => r.capability)); // DEC-0079
     for (const capability of capabilities) {
+      const was = this.checkpoint.slots[capability]?.generation;
+      if (await this.gone(capability, status)) continue; // moved away: never replaced at recovery (FAA-155)
       if (onHold.has(capability)) {
         for (const entry of transfer[capability] ?? []) {
           entry.step = 'lapsed'; // taken back by a transfer once the hold is lifted
           this.checkpoint.put(entry);
         }
         this.pause(capability);
-      } else if (transfer[capability]?.length) await this.replace(capability, transfer[capability], generations[capability] ?? 0);
+      } else if (transfer[capability]?.length) { // at the generation a replay just recorded, else com.status's
+        const mine = this.checkpoint.slots[capability]?.generation;
+        await this.replace(capability, transfer[capability], isInt(mine, 1) && mine !== was ? mine : generations[capability] ?? 0);
+      }
       else await this.enroll(capability);
     }
     for (const entry of reconcile) {
@@ -260,8 +383,10 @@ export class Responder {
     if (entries.length) args.transfer = { requests: entries.map((e) => e.request).slice(0, 64), checkpoint: { summary: 'Resumed by the same service after a restart; no effect had begun.' } };
     let receipt;
     try {
-      receipt = this.receipt('com.responder_replace', await this.call('com.responder_replace', args));
+      receipt = this.receipt('com.responder_replace', await this.ask(capability, 'com.responder_replace', args));
     } catch (e) {
+      // An earlier lost ask showed the slot moved: said once as board.slot.moved, no outage.
+      if (e.code === 'fenced' && this.slots[capability]?.state === 'moved') return;
       if (e.code !== 'held') throw e;
       for (const entry of entries) {
         entry.step = 'lapsed'; // nothing moved: taken back by a transfer once the hold is lifted
@@ -271,6 +396,7 @@ export class Responder {
       return;
     }
     this.slots[capability] = { state: 'held', generation: receipt.slot.generation, renewedAt: this.now() };
+    this.heldAt(capability, receipt.slot.generation);
     this.lifted(capability);
     const moved = new Map((receipt.transferred ?? []).map((item) => [item.request, item]));
     for (const entry of entries) {
@@ -418,6 +544,7 @@ export class Responder {
 
   async fault(e) {
     const code = e.code ?? 'unreachable';
+    const connecting = this.state === 'connecting' && !Object.values(this.slots).some((s) => s?.state === 'held');
     let wait = this.backoff.next();
     const left = this.leaseLeft() - LEASE_MARGIN_SECONDS;
     const keep = code === 'unreachable' && left > 0; // finding 38: the lease holds, so the session and the work stay
@@ -437,7 +564,8 @@ export class Responder {
       this.emit('board.blocked', 'error', `The responder stopped answering requests: ${e.message}`, { notify: true, episode: code, reason: code });
     } else {
       this.state = 'down';
-      if (['session-ended', 'unreachable', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol'].includes(code) && !keep) await this.dropSession();
+      // A refusal in recovery that left no slot held reconnects (seam 6); one that left some held serves them (seam 7).
+      if ((connecting || ['session-ended', 'unreachable', 'not-running', 'not-a-hub', 'hub-unavailable', 'protocol'].includes(code)) && !keep) await this.dropSession();
       this.emit('board.down', 'warn', 'Fabric\'s board cannot be reached; the responder tries again with a growing pause.', { episode: 'down', reason: code });
     }
     return wait;
@@ -470,7 +598,12 @@ export class Responder {
       else await this.renew(work);
     }
     const heldByWork = work && this.current ? work.entry.capability : null;
+    for (const capability of [...this.suspect]) { // kept until com.status answered, so it is asked before any enroll
+      await this.gone(capability);
+      this.suspect.delete(capability);
+    }
     for (const [capability, slot] of Object.entries(this.slots)) {
+      if (slot.state === 'moved') continue; // never enrolled again on its own, even when the new holder's lease lapses (FAA-155)
       if (slot.state === 'paused') {
         // still held: a longer pause; lifted: the slot is ours again
         if (capability !== heldByWork && this.now() >= (slot.retryAt ?? 0)) await this.enroll(capability);
@@ -521,6 +654,7 @@ export class Responder {
         answer = this.receipt('com.claim', await this.call('com.claim', { idempotency: this.idem(this.claimKeys[capability]), capability }));
       } catch (e) {
         if (e.code === 'lease_expired') {
+          this.slots[capability].renewedAt = -Infinity; // lapsed: this enroll may move the generation, so it is recorded
           await this.enroll(capability);
           continue;
         }
@@ -530,7 +664,7 @@ export class Responder {
           continue;
         }
         if (e.code === 'fenced') {
-          this.slots[capability] = { state: 'contested', renewedAt: this.now() };
+          if (!(await this.gone(capability))) this.slots[capability] = { state: 'contested', renewedAt: this.now() };
           continue;
         }
         if (e.code === 'held') {
@@ -648,6 +782,7 @@ export class Responder {
           continue;
         }
         if (STOP_CODES.has(e.code) || ['revision_conflict', 'invalid_transition', 'digest_conflict'].includes(e.code)) {
+          if (e.code === 'fenced') this.suspect.add(entry.capability); // the next tick asks com.status whether the slot moved
           this.lose(entry, e.code);
           if (e.code === 'authority_changed') throw e;
           return null;
@@ -663,10 +798,13 @@ export class Responder {
       entry.step = 'unknown';
       this.checkpoint.put(entry);
       this.emit('board.reconcile.needed', 'warn', 'The attempt was lost after its effect began; the outcome stays unknown until this service observes what happened.', { notify: true, episode: entry.request, request: entry.request, capability: entry.capability, reason: code });
-    } else if (code === 'lease_expired' && !['claimed', 'accepting'].includes(entry.step)) {
+    } else if (!['claimed', 'accepting'].includes(entry.step) && (code === 'lease_expired' || (code === 'fenced' && entry.capability in this.checkpoint.slots))) {
+      // Accepted work whose lease lapsed, or fenced off a slot this responder held (moved, FAA-155): the board holds it
+      // (C4). It continues only by a checkpoint transfer to this responder while it holds the slot.
       entry.step = 'lapsed';
       this.checkpoint.put(entry);
-      this.emit('board.attempt.lost', 'warn', 'This service\'s lease on an accepted request lapsed; it stopped working on it and takes it back by a transfer.', { request: entry.request, capability: entry.capability, reason: code });
+      this.emit('board.attempt.lost', 'warn', code === 'lease_expired' ? 'This service\'s lease on an accepted request lapsed; it stopped working on it and takes it back by a transfer.'
+        : 'The board fenced an accepted request away from this service; it stopped working on it, and nothing had been done outside it.', { request: entry.request, capability: entry.capability, reason: code });
     } else {
       this.checkpoint.drop(entry.request);
       this.emit('board.attempt.lost', 'warn', `The board took a request back from this service (${code}); it stopped working on it, and nothing had been done outside the service.`, { request: entry.request, capability: entry.capability, reason: code });
@@ -854,6 +992,7 @@ export class Responder {
     if (this.session) {
       await this.session.close();
       this.session = null;
+      this.checkpoint.leave(this.project); // the slots were released: no record of them can read as a move
     }
     this.state = 'stopped';
   }

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-delegation.mjs

@@ -506,11 +506,16 @@ export function refusalFromDenial(denial) {
  * DL-19 (DEC-0121): the refusal a service answers for an action call that fabric-actions.mjs's actionDecision refused,
  * or undefined when it took the call. operator-decision-required, decision-invalid and approval-required carry their
  * detail; human-step-required carries humanStep and url (AP-4). A `fault` is the service's own and is never sent: the
- * caller reads unknown-state with the detail service-fault, as for anything else that is not an answer.
+ * caller reads unknown-state with the detail service-fault, as for anything else that is not an answer; but
+ * mandate-capability-missing (DEC-0141 MJ-1), a job's step no mandate can be read for, is answered as
+ * operator-decision-required with that detail, so the job stays input_required.
  */
 export function refusalFromAction(answer) {
   const isRecord = answer !== null && typeof answer === 'object' && !Array.isArray(answer);
   if (isRecord && answer.ok === true) return undefined;
+  if (isRecord && answer.fault === 'mandate-capability-missing') {
+    return refuse('operator-decision-required', ACTION_DETAILS.get('operator-decision-required'), { detail: 'mandate-capability-missing' });
+  }
   const code = isRecord && answer.ok === false && typeof answer.code === 'string' ? answer.code : undefined;
   if (code === undefined || !ACTION_DETAILS.has(code)) return refuse('unknown-state', 'service-fault');
   const data = answer.data !== null && typeof answer.data === 'object' && !Array.isArray(answer.data) && Object.keys(answer.data).length ? { ...answer.data } : undefined;

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-interop-rules.mjs

@@ -6,7 +6,7 @@
 import crypto from 'node:crypto';
 import { ServiceError } from './fabric-base.mjs';
 import { jcs, refusalFromAction, refusalToolResult } from './fabric-delegation.mjs';
-import { actionDecision, decisionShape } from './fabric-actions.mjs'; // DEC-0121
+import { actionDecision, decisionShape, jobCapability } from './fabric-actions.mjs'; // DEC-0121
 import { EFFECT_CLASSES, OPERATOR_SOURCE_PROTOCOL, mandateCovers, mandateProblem, withoutSource } from './fabric-mandate.mjs'; // DEC-0125, DEC-0126
 import { isString } from './fabric-jsvalue.mjs'; // the core's (FAA-65)
 import { isObject } from './fabric-jsvalue.mjs'; // the core's (FAA-65)
@@ -218,6 +218,8 @@ export function requestMeta(traceparent, { decision, mandate, targetProtocols }
   return meta;
 }
 
+const UNREADABLE_JOB_CAPABILITY = "The operator's mandate cannot be read for this step (mandate-capability-missing): answer it, or call fabric.job.get with a decision in _meta.decision.";
+
 /**
  * A job's own approval step under the mandate its start call carried (interop C3.3, DEC-0125 MD-3, MD-4; conformance:
  * "a job's approval step included"): the step is the call {capability: the job's, action: the input request's `key`,
@@ -225,7 +227,8 @@ export function requestMeta(traceparent, { decision, mandate, targetProtocols }
  * agent id it authenticated for the start call. Answers {covered: true, record} (the step goes on as the operator's
  * decision, no input request; `record` is mandateCovers' recordAs, `source` included when the mandate carries one);
  * {covered: false, message, detail} (the step waits input_required, `message` its statusMessage naming the part not
- * covered, or saying the mandate expired or cannot be read; never the operator's words or `source`); or {covered: false,
+ * covered, or saying the mandate expired or cannot be read; never the operator's words or `source`; with `fault`
+ * mandate-capability-missing beside it when the job's capability cannot read the step, MJ-1); or {covered: false,
  * message: null} with no mandate or a T2 caller's (MD-5), with `fault` when the service's own clock does not read.
  */
 export function jobStep({ mandate, tier, now, self, capability, key, effect, callerAgent, spendUsd, project } = {}) {
@@ -237,8 +240,10 @@ export function jobStep({ mandate, tier, now, self, capability, key, effect, cal
   const covers = { mandate, tier, now, self, call };
   if (typeof callerAgent === 'string' && callerAgent.length > 0) covers.callerAgent = callerAgent;
   const answer = mandateCovers(covers);
-  if (answer.ok === true) return { covered: true, record: answer.recordAs };
+  // A T2 caller's mandate changes nothing (MD-5), first; then MJ-1: read alike at the start and at the answer (actionGate).
   if ('ignored' in answer || 'fault' in answer) return { covered: false, message: null, ...('fault' in answer ? { fault: answer.fault } : {}) };
+  if (!jobCapability(capability)) return { covered: false, detail: 'mandate-capability-missing', fault: 'mandate-capability-missing', message: UNREADABLE_JOB_CAPABILITY };
+  if (answer.ok === true) return { covered: true, record: answer.recordAs };
   const { detail } = answer.data;
   const said = detail === 'mandate-expired' ? "The operator's mandate for this task expired before this step"
     : detail.startsWith('outside-mandate') ? `The operator's mandate does not cover this step (${detail})`
@@ -253,7 +258,8 @@ export function jobStep({ mandate, tier, now, self, capability, key, effect, cal
  * elicitation), `approval` (verifyApproval's accepted outcome), `actionDigest`, `humanStepUrl` and `now` (RFC 3339).
  * Answers {ok: true, record, decision}, `decision` being the one taken as the operator's (null otherwise), or {ok: false,
  * refusal} in the DL-19 form (refusalToolResult sends it); a service's own fault is the refusal unknown-state with
- * `fault` beside it for the service's log.
+ * `fault` beside it for the service's log, but for mandate-capability-missing (MJ-1): operator-decision-required naming
+ * it in data.detail, `fault` still beside it.
  *
  * DEC-0125: a service that names its own agent id (`self`) reads the call's `_meta.mandate` when it carries no
  * decision, given `effect` (the action's effect class, required: without it the call is the service's fault
@@ -262,8 +268,8 @@ export function jobStep({ mandate, tier, now, self, capability, key, effect, cal
  * {ok: true, record: {by: 'operator', via: 'mandate', task, chain, caller}, decision: null, mandate}; without `self` the
  * mandate is not read and the call is answered as before it existed.
  *
- * mandateCapability: a job's kept step's capability the mandate is read under, not the action's tool (the kit's
- * input; the service's own, never a caller's).
+ * mandateCapability: a job's kept step's capability the mandate is read under (DEC-0141 MJ-1; the service's own input,
+ * never a caller's); unusable, the refusal is operator-decision-required.
  */
 export function actionGate({ action, tier, caller, meta, target, elicited = false, approval, actionDigest, humanStepUrl, now, self, effect, callerAgent, spendUsd, project, mandateCapability } = {}) {
   const inputs = { action, tier, caller, elicited: elicited === true, now };
@@ -285,6 +291,8 @@ export function actionGate({ action, tier, caller, meta, target, elicited = fals
     if (isObject(record) && record.via === 'mandate') out.mandate = inputs.mandate;
     return out;
   }
+  // MJ-1 (DEC-0141): refusalFromAction answers mandate-capability-missing as operator-decision-required; nothing is
+  // applied, so the job stays input_required.
   const out = { ok: false, refusal: refusalFromAction(answer) };
   if ('fault' in answer) out.fault = answer.fault;
   return out;

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_actions.py

@@ -3,7 +3,10 @@ extensions/actions/0.1 (DEC-0121, FAC-SEM-142). Part of the service kit (layer L
 
 - ``action_decision(inputs)``: whether a service takes a call of one declared action and as whose act it records it,
   exactly as the contract's ``actionDecision`` answers (AP-2, AP-4; DL-17, DL-18, DL-25). A ``fault`` is the
-  service's own and is never sent to a caller.
+  service's own and is never sent to a caller as such; ``action_gate`` answers ``mandate-capability-missing`` as
+  operator-decision-required (DEC-0141 MJ-1).
+- ``JOB_STEP_TOOL`` and ``job_capability(value)``: the tool a job's answer comes through, and whether a job's
+  capability can read its step under a mandate (a capability name other than ``fabric.job.get``).
 - ``decision_shape(value)``: a decision as ``decision.schema.json`` reads it, ``at`` read strictly (the contract's
   ``strictTime``).
 - ``actions_view(well_known)``: the host reader of the declaration, as the contract's ``actionsView``.
@@ -166,14 +169,12 @@ def action_decision(inputs: Any) -> Dict[str, Any]:
       the service authenticated), `effect` (the action's effect class, the service's own knowledge), `spendUsd` (its
       own estimate) and `project`: covered, `{by: operator, via: mandate, task, chain, source?, caller}`; otherwise
       `operator-decision-required` or `decision-invalid` with `data.detail`.
+    - DEC-0141 MJ-1: a job's input request (tool `fabric.job.get`) under a mandate is read under `mandateCapability`,
+      the job's own capability (the tool its start call named), its action the request key; any other action reads
+      its own tool.
     - `{"fault": ...}` (action-invalid, caller-missing, now-unreadable, digest-missing, url-missing, effect-missing,
-      self-missing) is the service's
-      own: an input it owes is missing or unreadable. It is never sent to a caller.
-    
-
-    Kit input beside the contract's: `mandateCapability`, a job's kept step's capability, read by the mandate in
-    place of the action's tool (the contract's actionDecision does not take it; the service's own input, never a
-    caller's)."""
+      self-missing, mandate-capability-missing) is the service's own: an input it owes is missing or unreadable. It is
+      never sent to a caller (action_gate answers mandate-capability-missing as operator-decision-required)."""
     action = get(inputs, "action")
     if not readable_action(action):
         return {"fault": "action-invalid"}
@@ -219,6 +220,15 @@ def action_decision(inputs: Any) -> Dict[str, Any]:
     return {"ok": True, "recordAs": record}
 
 
+#: The tool of a job's input request (interop C3.3, AP-2): the call that answers it is fabric.job.get (DEC-0141 MJ-1).
+JOB_STEP_TOOL = "fabric.job.get"
+
+
+def job_capability(value: Any) -> bool:
+    """A job's capability a mandate can read a step under (MJ-1): a capability name, never fabric.job.get itself."""
+    return isinstance(value, str) and _CAPABILITY.fullmatch(value) is not None and value != JOB_STEP_TOOL
+
+
 def _by_mandate(inputs: Any, action: Dict[str, Any], caller: str) -> Dict[str, Any]:
     """A relayed action's call that carries a mandate and no decision (DEC-0125 MD-3): the mandate decides, as the
     contract's byMandate reads it: the service's own `effect` and agent id `self` are required (else a fault), its
@@ -228,11 +238,11 @@ def _by_mandate(inputs: Any, action: Dict[str, Any], caller: str) -> Dict[str, A
         return {"fault": "effect-missing"}
     if not isinstance(me, str):
         return {"fault": "self-missing"}
-    # A job's kept step is read under the job's own capability, as job_step read it at the start (`mandateCapability`,
-    # the kit's input; the action itself stays fabric.job.get).
-    capability = get(inputs, "mandateCapability")
-    call: Dict[str, Any] = {"capability": capability if isinstance(capability, str) else action["tool"],
-                            "action": action["id"], "effect": effect}
+    # MJ-1: a job's step is read under the job's capability, never under the transport fabric.job.get itself.
+    capability = get(inputs, "mandateCapability") if action["tool"] == JOB_STEP_TOOL else action["tool"]
+    if not job_capability(capability):
+        return {"fault": "mandate-capability-missing"}
+    call: Dict[str, Any] = {"capability": capability, "action": action["id"], "effect": effect}
     spend, project = get(inputs, "spendUsd"), get(inputs, "project")
     if is_number(spend):
         call["spendUsd"] = spend

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_board_link.py

@@ -97,11 +97,14 @@ class BoardSession:
 class Checkpoint:
     """The responder's own journal: one JSON file (0600) holding every request it has claimed and not yet settled, each
     with its fence and the idempotency key of the step in flight. Written atomically and fsynced BEFORE the step it
-    announces is sent; a write that fails raises `BoardError("checkpoint")` and the step is not taken."""
+    announces is sent; a write that fails raises `BoardError("checkpoint")` and the step is not taken. Beside the
+    requests, `slots` keeps the responder's own record of each slot it held (`{project, generation, moved?}`, FAA-155);
+    a record that is not an object is ignored, as a file without one is."""
 
     def __init__(self, path: Path):
         self.path = Path(path)
         self._lock = threading.Lock()
+        self.slots: Dict[str, Dict[str, Any]] = {}
         self.entries: Dict[str, Dict[str, Any]] = self._load()
 
     def _load(self) -> Dict[str, Dict[str, Any]]:
@@ -115,12 +118,16 @@ class Checkpoint:
         entries = doc.get("requests") if isinstance(doc, dict) and doc.get("version") == 1 else None
         if not isinstance(entries, dict):
             raise BoardError("checkpoint", "The board checkpoint %s is not one this kit writes." % self.path)
+        slots = doc.get("slots")
+        self.slots = {k: v for k, v in slots.items() if isinstance(v, dict)} if isinstance(slots, dict) else {}
         return entries
 
-    def _write(self, entries: Dict[str, Dict[str, Any]]) -> None:
+    def _write(self, entries: Dict[str, Dict[str, Any]], slots: Optional[Dict[str, Dict[str, Any]]] = None) -> None:
+        slots = self.slots if slots is None else slots
+        doc: Dict[str, Any] = {"version": 1, "requests": entries, **({"slots": slots} if slots else {})}
         try:
             _fs.ensure_private_dir(self.path.parent)
-            _fs.atomic_write(self.path, (json.dumps({"version": 1, "requests": entries}, indent=1, sort_keys=True) + "\n").encode())
+            _fs.atomic_write(self.path, (json.dumps(doc, indent=1, sort_keys=True) + "\n").encode())
         except OSError as exc:
             raise BoardError("checkpoint", "The board checkpoint could not be written (%s); nothing was sent." % (exc.strerror or exc.__class__.__name__)) from None
 
@@ -140,6 +147,30 @@ class Checkpoint:
             self._write(entries)
             self.entries = entries
 
+    def slot(self, capability: str, record: Optional[Dict[str, Any]]) -> None:
+        """Writes the record of a slot this responder held (None forgets it); nothing is written when it is unchanged."""
+        with self._lock:
+            slots = {k: v for k, v in self.slots.items() if k != capability}
+            if record is not None:
+                slots[capability] = json.loads(json.dumps(record))
+            if slots != self.slots:
+                self._write(self.entries, slots)
+                self.slots = slots
+
+
+    def leave(self, project: str) -> None:
+        """At a clean leave (the session's DELETE released the slots): forget the record of each slot this service held
+        for `project` with no request left in the checkpoint and not moved away. A later generation is then another
+        session taking a free slot, not a move, and a kit that keeps no record (rolled back to before 0.53.0) leaves
+        nothing behind that reads as one. A record that cannot be written stays."""
+        busy = {e.get("capability") for e in list(self.entries.values())}
+        for capability, record in list(self.slots.items()):
+            if isinstance(record, dict) and record.get("project") == project and "moved" not in record and capability not in busy:
+                try:
+                    self.slot(capability, None)
+                except BoardError:
+                    pass
+
 
 class BoardRequest:
     """A claimed request as data: never an instruction. `body` is the requester's text; `sender` its Project id and