@passioncode-ai/passioncode 0.2.45 → 0.2.46

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_connections.py

@@ -15,7 +15,9 @@ if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from
     _sys.path.insert(0, str(_Path(__file__).resolve().parent))
 
 from fabric_base import ServiceError  # noqa: E402
-from fabric_secrets import CREDENTIAL_PAIRS, CREDENTIAL_WORDS, JWT_SHAPE, _long_secret, raw_values  # noqa: E402
+from fabric_secrets import (  # noqa: E402
+    JWT_SHAPE, _BEARER_INSIDE as _BEARER, _long_secret, credential_name, raw_values, secret_argument, secret_value,
+)
 
 CONNECTIONS_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/connections/0.1"
 KINDS = ("service", "model", "connector", "store", "channel")
@@ -161,45 +163,9 @@ def _long_run(value: str) -> bool:
     return False
 
 
-# The shared detector (DEC-0044) as the contract's ECMAScript reads it: ASCII case folding, ECMAScript's \s and `.`,
-# an ASCII word boundary. The kit's fabric_secrets keeps Python's semantics for its other callers (LC-21); FAC-SEM-127
-# is held to the reference, so this module reads with the reference's (blind reading of 0.44.0, finding 1).
-_NOT_LINE_END = "[^\n\r\u2028\u2029]"
-_SECRET_VALUE = re.compile(r"(^bearer[%s]%s+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}"
-                           r"|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})" % (_JS_SPACE, _NOT_LINE_END), re.IGNORECASE | re.ASCII)
-_BEARER = re.compile(r"(?<![A-Za-z0-9_])bearer[%s]+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{12,}=*" % _JS_SPACE,
-                     re.IGNORECASE | re.ASCII)
-_PATH_LIKE = re.compile(r"(?:[/~.]|[A-Za-z]:[\\/]|[a-z][a-z0-9+.-]*://)", re.IGNORECASE | re.ASCII)
-_ARGUMENT_SPLIT = re.compile("[%s=]" % _JS_SPACE)
-
-
-def _credential_name(name: str) -> bool:
-    """fabric_secrets.credential_name with ECMAScript's whitespace in the word split (U+FEFF splits a name there)."""
-    spaced = re.sub(r"([a-z0-9])([A-Z])", r"\1 \2", name)
-    spaced = re.sub(r"([A-Z]+)([A-Z][a-z])", r"\1 \2", spaced)
-    split = [w.lower() for w in re.split("[%s._-]+" % _JS_SPACE, spaced) if w]
-    words = split + [w[:-1] for w in split if len(w) > 2 and w.endswith("s")]
-    if any(w in CREDENTIAL_WORDS for w in words) or (len(split) == 1 and any(w in CREDENTIAL_PAIRS for w in words)):
-        return True
-    return any(word in words and any(p in words for p in partners) for word, partners in CREDENTIAL_PAIRS.items())
-
-
-def _secret_value(value: str) -> bool:
-    return bool(JWT_SHAPE.search(value) or _SECRET_VALUE.search(value) or _long_secret(value))
-
-
-def _path_like(piece: str) -> bool:
-    return bool(_PATH_LIKE.match(piece)) or (
-        bool(re.search(r"[\\/]", piece))
-        and (bool(re.search(r"\.[A-Za-z0-9]{1,8}\Z", piece))
-             or any(re.fullmatch(r"[a-z][a-z0-9_-]{2,}", segment) for segment in re.split(r"[\\/]", piece))))
-
-
-def _secret_argument(value: str) -> bool:
-    if JWT_SHAPE.search(value) or _SECRET_VALUE.search(value) or _BEARER.search(value):
-        return True
-    return any(any(_long_secret(part) for part in re.split(r"[\\/]", piece)) if _path_like(piece) else _long_secret(piece)
-               for piece in _ARGUMENT_SPLIT.split(value))
+# The shared detector (DEC-0044) as the contract's ECMAScript reads it: fabric_secrets reads so since 0.56.0 (FAA-136;
+# before, this module kept its own copy, blind reading of 0.44.0, finding 1).
+_credential_name, _secret_value, _secret_argument = credential_name, secret_value, secret_argument
 
 
 _SPECIAL = ("http", "https", "ws", "wss", "ftp", "file")
@@ -335,14 +301,15 @@ def _whatwg_parts(value: str) -> Optional[Dict[str, str]]:
 
 def _raw_values(query: str) -> Dict[str, List[str]]:
     """fabric_secrets.raw_values with the name read as URLSearchParams reads it: one leading `?` of the raw piece is
-    dropped before decoding (`??token` names `?token`, `%3Ftoken` names `?token`; round-3 reading)."""
+    dropped before decoding (`??token` names `?token`, `%3Ftoken` names `?token`; round-3 reading). raw_values drops
+    that one `?` itself since 0.56.0, so the piece's name is handed over as it stands (seam r8)."""
     values: Dict[str, List[str]] = {}
     for piece in query.split("&"):
         if piece == "":
             continue
         at = piece.find("=")
         raw_name = piece if at < 0 else piece[:at]
-        merged = raw_values(raw_name[1:] if raw_name.startswith("?") else raw_name)
+        merged = raw_values(raw_name)
         name = next(iter(merged), "")
         values.setdefault(name, []).extend(raw_values("x" + piece[at:])["x"] if at >= 0 else [""])
     return values

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -624,9 +624,45 @@ def _loopback(host: str) -> bool:
     if host == "localhost":
         return True
     try:
-        return ipaddress.ip_address(host).is_loopback
+        address = ipaddress.ip_address(host)
     except ValueError:
         return False
+    # A zone (`::1%eth0`) is no loopback: urllib decodes `%3A80` in it into another address (0.56.0 seam r13).
+    # Nor an IPv4-mapped address, which Python 3.13+ counts as loopback and 3.9 and Node do not (0.56.0 seam r14).
+    return address.is_loopback and not getattr(address, "scope_id", None) and not getattr(address, "ipv4_mapped", None)
+
+
+# fabric_http._URL_ENDS (this module may not import fabric_http; test_fabric_delegation pins them equal).
+_URL_ENDS = "\t\n\x0b\x0c\r\x1c\x1d\x1e\x1f "
+
+
+def _source_authority_ok(parts: urllib.parse.SplitResult) -> bool:
+    """A key set URL's host and port as urllib will dial them and `new URL` accepts them (fabric_http._authority_ok's
+    rule, which this module may not import): no `%` (urllib decodes it), backslash, space or C0, DEL or C1 control; a
+    bracketed host that is an IPv6 address; any other host without `:`, `[` or `]`; a port of ASCII digits up to
+    65535; a host at all. So `http://[::1]%2Eevil.example/` and `https://[1.2.3.4]/` (both read by Python 3.9's
+    urlsplit) are refused (0.56.0 unit r13, r14)."""
+    netloc = parts.netloc
+    if any(c in "\\%" or ord(c) <= 0x20 or 0x7f <= ord(c) <= 0x9f or c.isspace() for c in netloc):
+        return False
+    if netloc.startswith("["):
+        close = netloc.find("]")
+        try:
+            ipaddress.IPv6Address(netloc[1:close] if close > 0 else "")
+        except ValueError:
+            return False
+        port = netloc[close + 1:]
+        if port and not re.fullmatch(r":[0-9]*", port):
+            return False
+    else:
+        host, _, port = netloc.partition(":")
+        if not host or any(c in "[]:" for c in host + port) or not re.fullmatch(r"[0-9]*", port):
+            return False
+    try:
+        parts.port  # noqa: B018 - raises on a port above 65535
+    except ValueError:
+        return False
+    return bool(parts.hostname)
 
 
 class _NoRedirect(urllib.request.HTTPRedirectHandler):
@@ -669,7 +705,8 @@ def _opener(deadline: Dict[str, Any]) -> urllib.request.OpenerDirector:
 
 def _fetch(source: str) -> Any:
     if source.startswith(("https://", "http://")):
-        request = urllib.request.Request(source, headers={"Accept": "application/json"})
+        # Cut at the first `#`, as `new URL` and the check at construction read it (urllib cuts at the last one).
+        request = urllib.request.Request(source.partition("#")[0], headers={"Accept": "application/json"})
         deadline: Dict[str, Any] = {"end": time.monotonic() + JWKS_FETCH_SECONDS, "fired": False, "timer": None}
         try:
             with _opener(deadline).open(request, timeout=JWKS_FETCH_SECONDS) as response:  # https or loopback http only
@@ -702,9 +739,21 @@ class JwksCache:
         if not isinstance(source, str) or not source:
             raise ValueError("the key set needs a source")
         if source.startswith(("https://", "http://")):
-            parts = urllib.parse.urlsplit(source)
-            if parts.username or parts.password:
+            # The trailing end trimmed as urllib trims it when it reads (a leading one fails the scheme test above, as
+            # in 0.55.0 and in Node); inside, what urllib would send and http.client refuse on every read is refused
+            # (0.56.0 product r16, r17, r18, unit r16, r17). urlsplit's own refusals are said as the key set's.
+            sent = source.strip(_URL_ENDS)
+            try:
+                parts = urllib.parse.urlsplit(sent)
+            except ValueError:
+                raise ValueError("a key set URL's host does not parse") from None
+            if re.search(r"[\x00-\x20\x7f]", sent.partition("#")[0]) or not (parts.path + parts.query).isascii():
+                raise ValueError("a key set URL holds a space, an ASCII control character, or a character outside ASCII "
+                                 "in its path or query")
+            if "@" in parts.netloc:  # an empty one too: urllib would dial `@127.0.0.1` (0.56.0 unit r14)
                 raise ValueError("a key set URL carries no credentials")
+            if not _source_authority_ok(parts):
+                raise ValueError("a key set URL's host does not parse")
             if parts.scheme == "http" and not _loopback(parts.hostname or ""):
                 raise ValueError("a key set is read over https, or over http on loopback only")
         elif "://" in source:

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_descriptor.py

@@ -226,7 +226,11 @@ _SOURCE_URI = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:(?:[A-Za-z0-9._~:/?#@!$&'()*
 # Brackets belong to an IP-literal host only (RFC 3986 3.2.2); the literal is set aside before the character check.
 _IP_LITERAL = re.compile(r"^([A-Za-z][A-Za-z0-9+.-]*://(?:[^/?#@\[\]]*@)?)\[[0-9A-Fa-f:.vV]+\]")
 _URI_AUTHORITY = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://(?:[^/?#@]*@)?(?P<host>\[[^\]]*\]|[^/?#:]*)(?::(?P<port>[^/?#]*))?")
-_URI_PASSWORD = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]*:[^/?#@]*@")
+# A special scheme (http, https, ws, wss, ftp) reads a user:password@ after any run of slashes, none included, as
+# `new URL` does: https:bot:pw@host carries the password too (0.56.0 seam r7).
+_URI_PASSWORD = re.compile(r"^(?:(?:[Hh][Tt][Tt][Pp][Ss]?|[Ww][Ss][Ss]?|[Ff][Tt][Pp]):[/\\]*[^/\\?#]*:[^/\\?#]*@"
+                           # any other scheme: a backslash belongs to the user information (seam r8)
+                           r"|(?![Hh][Tt][Tt][Pp][Ss]?:|[Ww][Ss][Ss]?:|[Ff][Tt][Pp]:)[A-Za-z][A-Za-z0-9+.-]*://[^/?#]*:[^/?#]*@)")
 
 
 _RESIDENCY = re.compile(r"^(A[B-Z]|[B-PR-WY][A-Z]|Q[A-L]|Z[A-Y])\Z", re.ASCII)
@@ -303,10 +307,10 @@ def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
             repository = source["repository"]
             if not (isinstance(repository, str) and _SOURCE_URI.match(_IP_LITERAL.sub(r"\1h", repository, count=1))):
                 problems.append("source.repository is a URI (RFC 3986), such as https://github.com/owner/name")
+            elif _URI_PASSWORD.match(repository):  # before the host: user information is a credential, said as one
+                problems.append("source.repository carries no password: it names the repository, never a credential")
             elif not _authority_ok(repository):
                 problems.append("source.repository names a host, and a port of digits up to 65535 when it has one")
-            elif _URI_PASSWORD.match(repository):
-                problems.append("source.repository carries no password: it names the repository, never a credential")
             places.append(("/source/repository", repository))
     if "peer" in descriptor:
         peer = descriptor.get("peer")

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_events.py

@@ -119,11 +119,13 @@ class JsonlEventLog:
                 continue
         return out
 
-    def append(self, kind: str, level: str, text: str, **extra: Any) -> Dict[str, Any]:
+    def append(self, kind: str, level: str, text: str, subject: Optional[Dict[str, str]] = None,
+               **extra: Any) -> Dict[str, Any]:
+        # `subject` is named so a caller that reads the signature (the board responder) knows this log takes one.
         with self._lock:
             rows = self._all()
             next_id = int(rows[-1]["id"]) + 1 if rows else 1
-            event = make_event(next_id, now_iso(), kind, level, text, **extra)
+            event = make_event(next_id, now_iso(), kind, level, text, subject=subject, **extra)
             rows.append(event)
             rows = rows[-self.keep:]
             atomic_write(self.path, ("\n".join(json.dumps(r, ensure_ascii=False) for r in rows) + "\n").encode(), 0o600)

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_http.py

@@ -113,24 +113,86 @@ def json_bytes(value: Any) -> bytes:
     return json_stringify(value).encode("utf-8")
 
 
+# What both urllib (str.strip when it builds a Request) and a WHATWG parser remove from a URL's ends. urllib also
+# strips a Unicode space there, which `new URL` keeps (and percent-encodes): such a URL is refused (0.56.0 seam r19).
+_URL_ENDS = "\t\n\x0b\x0c\r\x1c\x1d\x1e\x1f "
+
+
+def _sendable(url: str, parts: urllib.parse.SplitResult) -> bool:
+    """Whether urllib can send the URL as checked: no space or ASCII control character before its fragment (urlsplit
+    drops a tab or line break that urllib then sends), and nothing outside ASCII in the path or query, which
+    http.client cannot write in a request line (a host outside ASCII is sent in IDNA)."""
+    # The fragment is never sent: urllib_transport cuts the URL at its first `#`, as `new URL` does (urllib alone
+    # would cut at the last one), so only what precedes it is read (0.56.0 seam r18, r19).
+    return not re.search(r"[\x00-\x20\x7f]", url.partition("#")[0]) and (parts.path + parts.query).isascii()
+
+
+def _authority_ok(netloc: str) -> bool:
+    """The host and port of an authority as a WHATWG URL accepts them, where urlsplit is laxer: a port of ASCII digits
+    only (Python 3.9's int() also takes `1_2`, `+1`, ` 12` and other scripts' digits), a bracketed host that is an IPv6
+    address with no zone, and no backslash, space, control character (C0, DEL or C1) or `%` (0.56.0 unit r11, seam r12, seam r13, product r20:
+    urllib percent-decodes the host before it connects, so `h.example%3A8443` would reach port 8443 and `[::1%3A80]`
+    another address than the one checked; Node refuses a zone and every forbidden code point it decodes)."""
+    hostport = netloc.rpartition("@")[2]
+    if any(c in "\\%" or ord(c) <= 0x20 or 0x7f <= ord(c) <= 0x9f or c.isspace() for c in hostport):
+        return False
+    if hostport.startswith("["):
+        close = hostport.find("]")
+        try:
+            ipaddress.IPv6Address(hostport[1:close])
+        except ValueError:
+            return False
+        port = hostport[close + 1:]
+        return port == "" or (port[:1] == ":" and re.fullmatch(r"[0-9]*", port[1:]) is not None)
+    host, _, port = hostport.partition(":")
+    # No `[` in an unbracketed host: Python 3.9 reads the host after one (`https://]@h.example[evil.example/` as
+    # evil.example), where 3.14 and `new URL` refuse it (0.56.0 unit r15).
+    return not any(c in "[]:" for c in host + port) and re.fullmatch(r"[0-9]*", port) is not None
+
+
 def redact_url(url: str) -> str:
     """The URL as it may appear in an error or a log line: scheme, host, port and path; no userinfo, query or
     fragment, which is where keys and tokens ride."""
-    try:
-        parts = urllib.parse.urlsplit(str(url))
-    except ValueError:
+    # What WHATWG URL parsing does first, as `new URL` does in the Node twin: trim C0 controls and space from the ends,
+    # then remove every tab, CR and LF, so ` https://u:pw@h` and `ht\ttps:u:pw@h` lose their password too (0.56.0
+    # seam r10; Python 3.9's urlsplit keeps a leading space in the scheme).
+    url = re.sub(r"[\t\n\r]", "", str(url).strip("".join(map(chr, range(0x21)))))
+    scheme, colon, rest = url.partition(":")
+    if colon and scheme.lower() in ("http", "https", "ws", "wss", "ftp"):
+        # A special scheme as WHATWG reads it: the authority starts after every slash or backslash that follows the
+        # colon, and a backslash before the query reads as a slash, so `https:u:pw@h` loses its password too (0.56.0
+        # seam r9; the Node twin reads it through `new URL`).
+        cut = min([at for at in (rest.find("?"), rest.find("#")) if at >= 0] or [len(rest)])
+        url = scheme + "://" + (rest[:cut].replace("\\", "/") + rest[cut:]).lstrip("/")
+    if not colon or not re.fullmatch(r"[A-Za-z][A-Za-z0-9+.-]*", scheme):
+        # No scheme as WHATWG reads one (`ht tps:`, `1ttps:`, a relative string): `new URL` refuses it too. Read here,
+        # not by urlsplit, whose scheme rule differs between 3.9 patch releases (0.56.0 hosted floors on 10f6f9d).
         return "<unparseable url>"
-    host = parts.hostname or ""
+    if scheme.lower() in ("http", "https", "ws", "wss", "ftp"):
+        # A special scheme's authority is checked first, its shape as `new URL` checks it (a host, a port of ASCII
+        # digits up to 65535), so `ftp://[` and `ws://h:99999` are unparseable in both twins rather than `<scheme>:
+        # <redacted>` in one (0.56.0 unit r12, r13); on 3.9 a lax port would read as the path. A host name `new URL`
+        # refuses for its structure is not checked (FAA-187 (14)).
+        try:
+            parts = urllib.parse.urlsplit(url)
+            parts.port  # noqa: B018 - raises on a port out of range
+        except ValueError:
+            return "<unparseable url>"
+        if not _authority_ok(parts.netloc) or not parts.hostname:
+            return "<unparseable url>"
+    if scheme.lower() not in ("http", "https"):
+        # Only http and https are sent; any other scheme (a misspelled `htps:` included) keeps no more than its name,
+        # since its user information may sit anywhere in the rest (0.56.0 product r10).
+        return scheme.lower() + ":<redacted>"
+    # The host and port were checked above (a password holding `/`, `https://u:pw/x@h`, reads as a bad port there).
+    host = parts.hostname
     if ":" in host:
         host = "[%s]" % host
-    try:
-        port = parts.port
-    except ValueError:
-        port = None
+    port = parts.port
     if port == {"http": 80, "https": 443}.get(parts.scheme.lower()):
         port = None  # as a WHATWG URL writes it, so both kits print one URL the same way
     netloc = host.lower() + (":%d" % port if port is not None else "")
-    path = parts.path or ("/" if parts.scheme.lower() in ("http", "https") else "")
+    path = parts.path or "/"
     return urllib.parse.urlunsplit((parts.scheme.lower(), netloc, path, "", ""))
 
 
@@ -157,11 +219,23 @@ def check_url(url: str, *, insecure: bool = False) -> None:
     """Refuse what this client never sends: a scheme other than http or https, no host, credentials in the URL, or
     plain http to a host that is not loopback (unless `insecure`)."""
     try:
-        parts = urllib.parse.urlsplit(url)
+        # The ends are trimmed as urllib trims what it sends (and `new URL` too); a URL ending in a line break, which
+        # 0.55.0 sent, still passes (0.56.0 product r17).
+        if not isinstance(url, str):
+            raise TypeError("not a string")
+        sent = url.strip(_URL_ENDS)
+        parts = urllib.parse.urlsplit(sent)
         host = parts.hostname
         parts.port  # noqa: B018 - raises on a bad port
+        if not _authority_ok(parts.netloc):
+            raise ValueError("authority")
     except (ValueError, TypeError):
         raise HttpError("the URL does not parse", url=redact_url(url), kind="refused")
+    if not _sendable(sent, parts):
+        # urllib would send it and http.client refuse every call, where the Node twin percent-encodes it (0.56.0
+        # product r16, r18, unit r16, r17); 0.55.0 retried and answered kind connection.
+        raise HttpError("the URL holds a space, an ASCII control character, or a character outside ASCII in its path "
+                        "or query", url=redact_url(url), kind="refused")
     if parts.scheme not in ("http", "https") or not host:
         raise HttpError("only http and https URLs with a host are sent", url=redact_url(url), kind="refused")
     if parts.username is not None or parts.password is not None:
@@ -275,7 +349,9 @@ def _opener(watchdog: _Watchdog) -> urllib.request.OpenerDirector:
 def urllib_transport(method: str, url: str, headers: Dict[str, str], body: Optional[bytes], timeout_s: float,
                      max_bytes: int) -> Tuple[int, Dict[str, str], bytes]:
     """The default transport: urllib, no redirects followed, the body read to one byte past `max_bytes`."""
-    req = urllib.request.Request(url, data=body, method=method, headers=headers)
+    # Cut at the first `#`, as `new URL` and check_url read the URL: urllib keeps everything before the LAST one in
+    # the request line, so `/x#a#b` went out as `/x#a` (0.56.0 seam r19).
+    req = urllib.request.Request(url.partition("#")[0], data=body, method=method, headers=headers)
     end = time.monotonic() + timeout_s  # one deadline from the first byte sent, headers and body included
     watchdog = _Watchdog(end)
     try:

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_interop.py

@@ -39,6 +39,8 @@ from fabric_page_links import (  # noqa: E402 - DEC-0123
 
 from fabric_interop_rules import (  # noqa: E402,F401 - the rule layer (FAA-92)
     _days_from_civil,
+    UNREADABLE_PROJECT,
+    mandate_spend,
     PROTOCOL,
     EXTENSION_KEY,
     MCP_REVISION,
@@ -511,20 +513,28 @@ class CallContext:
         the mandate carries one) and asks nothing; the job goes on as the operator's decision. Otherwise the job waits
         input_required on `request`, its message naming the part not covered (or `message`), and answers None; the step
         is kept so an answer's `_meta.mandate` that covers it is read when input_actions is on. Any fault job_step answers
-        (mandate-capability-missing, MJ-1, or the server clock's now-unreadable) goes to on_fault under the job's tool."""
+        (mandate-capability-missing, MJ-1, or the server clock's now-unreadable) goes to on_fault under the job's
+        capability. The step is read under that capability, the name the job was created under (FAA-179), which is the
+        tool's own unless the handler created the job under another name with `server.jobs.create`."""
         if self.server.jobs is None:
             raise InteropError("This server has no job store.")
         step: Dict[str, Any] = {"message": None}
+        stored = self.server.jobs.private(job_id).get("capability")
+        capability = stored if isinstance(stored, str) else self.tool
         if self.server.agent_id is not None:
             caller = (self.delegation or {}).get("caller")
-            step = job_step(self.meta.get("mandate"), tier=self.tier, now=format_rfc3339(self.server._clock() * 1000),
-                            self_id=self.server.agent_id, capability=self.tool, key=key, effect=effect, caller_agent=caller,
+            carried = self.meta.get("mandate")
+            if carried is None and "mandate" in self.meta:
+                carried = {}  # a null mandate is present and unreadable, as the answer reads it; never "none" (FAA-178)
+            step = job_step(carried, tier=self.tier, now=format_rfc3339(self.server._clock() * 1000),
+                            self_id=self.server.agent_id, capability=capability, key=key, effect=effect, caller_agent=caller,
                             spend_usd=spend_usd, project=project)
             if step["covered"]:
                 return step["record"]
-            self.server._fault(self.tool, step)  # the start hears it as the answer does (MJ-1)
-        kept = {"effect": effect, **({"spendUsd": spend_usd} if spend_usd is not None else {}),
-                **({"project": project} if project is not None else {})}
+            self.server._fault(capability, step)  # the start hears it as the answer does, under the same name (MJ-1)
+        spend = mandate_spend(spend_usd)  # a NaN or infinity reads as no estimate, and json would write a bare NaN
+        kept = {"effect": effect, **({"spendUsd": spend} if spend is not None else {}),
+                **({"project": project if isinstance(project, str) else UNREADABLE_PROJECT} if project is not None else {})}
         self.server.jobs.request_input(job_id, {key: request}, step["message"] or message, steps={key: kept})
         return None
 
@@ -616,7 +626,7 @@ def mcp_request_headers(method: str, params: Dict[str, Any]) -> Dict[str, str]:
 
 
 _UNREADABLE = object()  # what a service's spend or project function answers when it raised
-_UNREADABLE_PROJECT = "\x00unreadable"  # never a member of a mandate's projects, so a scoped mandate refuses
+_UNREADABLE_PROJECT = UNREADABLE_PROJECT  # never a member of a mandate's projects, so a scoped mandate refuses
 
 
 class McpToolServer:
@@ -915,7 +925,8 @@ class McpToolServer:
                 if not inputs["ok"] and "invalid" in inputs:
                     return self._error(rid, -32602, inputs["invalid"])
                 if not inputs["ok"]:
-                    self._fault(name, inputs)
+                    stored = self.jobs.private(str(arguments.get("id", ""))).get("capability")
+                    self._fault(stored if isinstance(stored, str) else name, inputs)  # as the start heard it (FAA-179)
                     import fabric_delegation as _fd  # noqa: E402 - DL-19
                     return {"jsonrpc": "2.0", "id": rid, "result": _fd.refusal_tool_result(inputs["refusal"], traceparent=span)}
             context = {"tier": tier, "caller": caller, "meta": meta, "input_records": inputs["records"] if inputs else None}

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_interop_rules.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import math
 import re
 import secrets
 from typing import Any, Callable, Dict, List, Optional
@@ -336,16 +337,18 @@ def job_step(mandate: Any, *, tier: Any, now: Any, self_id: Any, capability: Any
       part not covered, or saying the mandate expired or cannot be read; never the operator's words or `source`.
       With `fault` mandate-capability-missing beside it when the job's capability cannot read the step (MJ-1).
     - {"covered": False, "message": None}: no mandate, or a T2 caller's (MD-5): ask as before; with `fault` when the
-      service's own clock does not read."""
+      service's own clock does not read. None is no mandate: a call that carried `_meta.mandate: null` passes `{}`, so
+      it reads as mandate-malformed here as it does at the answer (FAA-178; McpToolServer does)."""
     if mandate is None:
         return {"covered": False, "message": None}
     if not (isinstance(effect, str) and effect in EFFECT_CLASSES):
         raise InteropError("A job's approval step names its effect class (one of %s; DEC-0125)." % ", ".join(EFFECT_CLASSES))
     call: Dict[str, Any] = {"capability": capability, "action": key, "effect": effect}
-    if isinstance(spend_usd, (int, float)) and not isinstance(spend_usd, bool):
-        call["spendUsd"] = spend_usd
-    if isinstance(project, str):
-        call["project"] = project
+    spend = mandate_spend(spend_usd)  # read as action_gate reads it, so the start and the answer agree (FAA-139)
+    if spend is not None:
+        call["spendUsd"] = spend
+    if project is not None:
+        call["project"] = project if isinstance(project, str) else UNREADABLE_PROJECT
     covers: Dict[str, Any] = {"mandate": mandate, "tier": tier, "now": now, "self": self_id, "call": call}
     if isinstance(caller_agent, str) and caller_agent:
         covers["callerAgent"] = caller_agent
@@ -368,6 +371,23 @@ def job_step(mandate: Any, *, tier: Any, now: Any, self_id: Any, capability: Any
             "message": said + ": answer it, or call fabric.job.get with a mandate that covers it in _meta.mandate."}
 
 
+#: The project of a call whose project could not be read: never a member of a mandate's projects, so a mandate limited
+#: to projects refuses it (FAA-139).
+UNREADABLE_PROJECT = "\x00unreadable"
+
+
+def mandate_spend(value: Any) -> Any:
+    """A spend estimate as a mandate reads it (FAA-139): a number read as a double, as the contract does; one that is
+    not a finite double (an int past the float range, NaN, infinity) or not a number is none, which a mandate's
+    ceiling refuses (fail closed). A finite number stays as given (25 stays 25)."""
+    if not isinstance(value, (int, float)) or isinstance(value, bool):
+        return None
+    try:
+        return value if math.isfinite(float(value)) else None
+    except OverflowError:
+        return None
+
+
 def action_gate(action: Any, *, tier: Any, caller: Any, meta: Any = None, target: Optional[str] = None,
                 elicited: bool = False, approval: Any = None, action_digest: Optional[str] = None,
                 human_step_url: Optional[str] = None, now: Any = None, self_id: Optional[str] = None,
@@ -386,7 +406,9 @@ def action_gate(action: Any, *, tier: Any, caller: Any, meta: Any = None, target
     decision, given `effect` (the action's effect class, required: without it the call is the service's fault
     effect-missing), `caller_agent` (only an agent id the service authenticated: a delegation's caller, its own
     per-agent credential; never a name the call carries), `spend_usd` (its own estimate), `project`, and `mandate_capability` (a job's kept step: the job's capability
-    the mandate is read under, DEC-0141 MJ-1; unusable, the refusal is operator-decision-required). A covered call
+    the mandate is read under, DEC-0141 MJ-1; unusable, the refusal is operator-decision-required). Both are read failing
+    closed, as McpToolServer reads them (FAA-139): a spend that is not a finite double is none (`mandate_spend`), a
+    project that is not a string is UNREADABLE_PROJECT, which a mandate limited to projects refuses. A covered call
     answers {ok: True, record: {by: operator, via: mandate, task, chain, caller}, decision: None, mandate}; without
     `self_id` the mandate is not read and the call is answered as before it existed."""
     import fabric_delegation as _fd  # noqa: E402 - beside this file: DL-19
@@ -398,6 +420,8 @@ def action_gate(action: Any, *, tier: Any, caller: Any, meta: Any = None, target
             inputs[name] = value
     if self_id is not None and isinstance(meta, dict) and "mandate" in meta:
         inputs.update({"mandate": meta["mandate"], "self": self_id})
+        spend_usd = mandate_spend(spend_usd)
+        project = project if project is None or isinstance(project, str) else UNREADABLE_PROJECT
         for name, value in (("effect", effect), ("callerAgent", caller_agent), ("spendUsd", spend_usd), ("project", project),
                             ("mandateCapability", mandate_capability)):
             if value is not None:

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_openrouter.py

@@ -164,6 +164,12 @@ class Client:
                                   kind="config")
         if not (isinstance(retries, int) and 0 <= retries <= 5) or isinstance(retries, bool):
             raise OpenRouterError("retries is an integer from 0 to 5", kind="config")
+        # A query or fragment would take `/chat/completions` (0.56.0 unit r19, FAA-187 (17)); refused before
+        # check_url, so a query that also holds a space is kind config here as on Node (product r27).
+        if not isinstance(base_url, str):  # check_url's answer for a base that is not a string, as on Node (unit r28)
+            raise fabric_http.HttpError("the URL does not parse", url="<unparseable url>", kind="refused")
+        if "?" in base_url or "#" in base_url:
+            raise OpenRouterError("the base URL holds no query or fragment", kind="config")
         fabric_http.check_url(base_url)
         _check_attribution(project_id, None)
         self.ceiling_usd = float(ceiling_usd)
@@ -171,7 +177,9 @@ class Client:
         self.prices = {str(k): dict(v) for k, v in prices.items()}
         self.key_env = key_env
         self.window = window
-        self.base_url = base_url.rstrip("/")
+        # The base URL as check_url read it and urllib would send it: its ends trimmed, so `.../v1\n` is not sent
+        # as `.../v1\n/chat/completions` (0.56.0 seam r18; the Node twin trims the ends `new URL` does, product r20).
+        self.base_url = base_url.strip(fabric_http._URL_ENDS).rstrip("/")
         self.attribution = attribution
         self.project_id = project_id
         self.unmeasured_call_usd = unmeasured_call_usd

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_protocols.py

@@ -111,6 +111,19 @@ def _scalar(value: Any) -> bool:
     return value is None or isinstance(value, (bool, int, float)) or (isinstance(value, str) and len(value) <= 500)
 
 
+def _too_deep(key: str, member: Any) -> str:
+    """The first place under a member that breaks the bound, for the refusal (FAA-122): `cited[0]` nests an object."""
+    if isinstance(member, (list, dict)) and len(member) > 32:
+        return ": it has %d entries" % len(member)
+    for inner, leaf in (enumerate(member) if isinstance(member, list) else member.items() if isinstance(member, dict) else ()):
+        if not _scalar(leaf):
+            place = "%s[%d]" % (key, inner) if isinstance(member, list) else "%s.%s" % (key, inner)
+            what = "a string over 500 characters" if isinstance(leaf, str) else "a list" if isinstance(leaf, list) else \
+                "an object" if isinstance(leaf, dict) else "not a scalar"
+            return ": data.value.%s is %s; nest two levels at most (flatten it into lists or members of their own)" % (place, what)
+    return ""
+
+
 def feed_data_problems(data: Any) -> List[str]:
     """DEC-0070's `data {schema, value}` as the schema bounds it, then FAC-SEM-101: no string in `value`, at either
     level, under a credential's name or of a credential's shape (named by its place, never its value)."""
@@ -130,7 +143,8 @@ def feed_data_problems(data: Any) -> List[str]:
             continue
         if isinstance(member, dict) and len(member) <= 32 and all(_scalar(m) for m in member.values()):
             continue
-        problems.append("data.value.%s is a scalar (a string of at most 500 characters), a list of at most 32 scalars or an object of at most 32 scalar members" % key)
+        problems.append("data.value.%s is a scalar (a string of at most 500 characters), a list of at most 32 scalars or an object of at most 32 scalar members%s"
+                        % (key, _too_deep(key, member)))
     if problems:
         return problems
     for finding in feed_data_findings({"events": [{"data": data}]}):