@passioncode-ai/passioncode 0.2.8 → 0.2.10

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.2.10 - 2026-10-19
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.35.3`** (it was `v0.35.2`). `creating-fabric-agents` asks in its grill
+  whether a new agent writes text people read, and if so gives it the no-em-dash rule (U+2014) in its prompt and a
+  test that fails on it; the resilience reference gains its third pass.
+
+## 0.2.9 - 2026-10-18
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.35.2`** (it was `v0.35.0`). 0.35.1 names the Codex hook groups a removal
+  moves, stops the tests and the session hooks' spool from accumulating files, adds the `creating-fabric-agents`
+  resilience-and-autonomy reference and fixes the Hermes adapter losing a helper's answer; 0.35.2 extends the reference.
+
 ## 0.2.8 - 2026-10-16
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.35.0",
+      "ref": "v0.35.3",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Set up PassionCode.ai on a computer with one command — the apps from their verified releases, their MCP servers for every coding agent and the PassionCode.ai skills — and check and repair it with the same command or `doctor`.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.35.0",
+      "version": "0.35.3",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.2.8",
+      "version": "0.2.10",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.35.0",
-      "commit": "766dde0abadd929bcdb88a0d90fed23c114c3a7a",
-      "version": "0.35.0",
+      "ref": "v0.35.3",
+      "commit": "5657241426db468e4f51f9ef72788efb98eab9f9",
+      "version": "0.35.3",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -23,7 +23,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:6890c665e564ff5215ee809843622120bccf33b1a44d0499556d71058b958823",
+      "contentHash": "sha256:392cd0dd9bf29f450346b9d02af7d6b4cb19922da13aed46dba7fb9b65715e8e",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -62,9 +62,9 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.2.8",
+      "ref": "v0.2.10",
       "commit": null,
-      "version": "0.2.8",
+      "version": "0.2.10",
       "via": "this repository",
       "skills": [
         "setting-up-passioncode",
@@ -72,7 +72,7 @@
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:055dcaab6c5986459556cf3bb5a472c9e7b6bad49562ac1d883def31d03d98a6",
+      "contentHash": "sha256:a34b46fa6572410a232b9c1442eb6df00dc92037b342fb7539b5a378e9c06dac",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.35.0",
+  "version": "0.35.3",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.35.0"
+  version: "0.35.3"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -18,7 +18,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.35.0"
+  version: "0.35.3"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.35.0"
+  version: "0.35.3"
   contract-version: "0.1.0"
   contract-commit: "d8146cfb0a1c74fc6432284c4356bb0c864b37b5"
 ---
@@ -53,6 +53,7 @@ No file is created until every row has an answer. An answer of "later" fails the
 | **Which profile?** | `mcp` when Fabric owns planning and retries and the capability has a schema; `a2a` when the provider owns its task lifecycle end to end; `local-runner` when it is a terminal agent Fabric drives. When unsure, the sibling skill's profile-selection reference is the decision record |
 | **What effects?** | declare anything money-, deletion-, or publication-adjacent now — the host's floor and grants are designed against these declarations, and one discovered late invalidates the admission |
 | **Which tenancy?** | record whether the agent assumes one operator; the assumption is cheap to write down and expensive to excavate |
+| **Text for people?** | if it writes anything a person reads (a reply, a message, a post, a report, a UI string), its prompt forbids the em dash (U+2014) and any substitute for it, and a test fails on U+2014 in new output, from the first commit (the resilience reference, *Text for people*) |
 
 ## Step 1 — the knowledge intake
 
@@ -201,6 +202,16 @@ the pinned `schemas/operator-channel-status.schema.json`; the channel's runtime
 probe rule here yet, so report them `NOT_RUN`. An agent with neither stops nor notify
 events skips this step.
 
+## Resilience and autonomy
+
+Before the first stage that calls a model or spends money, read
+[resilience and autonomy](references/resilience-and-autonomy.md) and design its answers in:
+a limit pauses and resumes, every model answer passes the call site's own acceptance, fallbacks
+and checkers cross vendors, spend is a persisted ledger with idempotency keys, open questions
+become recorded decisions, every fix has a test seen failing, and text a person reads carries no
+em dash (U+2014), held by its prompt and a test. Report its checklist with a
+file and a test per line, or `NOT_RUN` where the agent has no such stage.
+
 ## Completion format
 
 Report: capability, consumer, profile with the step-0 grill answers; the knowledge pack

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/references/resilience-and-autonomy.md

@@ -0,0 +1,254 @@
+# Resilience and autonomy — what kept agents working
+
+Read when designing an agent's loop, its model calls, its spend and its stops — before the first
+stage that calls a model or spends money. These rules come from a retrospective of about twenty
+production agents (2026-10-17): each rule names the failure that taught it, generalized, and the
+mechanism that held after the fix. Every rule is cheaper to build in than to retrofit.
+
+## Contents
+
+- Limits are pauses
+- Model answers are untrusted until accepted
+- Money is a ledger
+- Autonomy: decide, record, continue
+- Verification you can believe
+- Operations that survive restarts
+- Secrets and confinement
+- Text for people
+- Checklist
+
+## Limits are pauses
+
+1. **A provider or subscription limit pauses the job; it never fails it.** Store a typed pause
+   (`quota_exhausted`, `retryable: true`, the reset time when known) and resume from the same
+   stage. Failing it cost callers whole jobs and resubmits.
+2. **Resume first.** Every worker reads its own state — checkpoint, worktree, branches, open
+   pull requests, notes — before it acts, and continues from there. Relaunching from scratch
+   after a limit recreated work over committed work and re-issued credentials already held.
+3. **A silent worker is a limit until proven otherwise.** A watcher that sees no progress for N
+   minutes, or limit text in the last output, resumes the run with the *same* run id.
+4. **Keep prompt cache keys stable across a resume.** One changed argument that every prompt
+   carries (today's date) re-keyed a finished stage and paid for it again.
+5. **Count only the job's own failures toward its retry limit.** A lost lease, a busy lock or a
+   provider outage is bounded by a time budget instead; five infrastructure stops a day ended a
+   healthy phase as FAILED.
+6. **Match concurrency to the account's rate, and cool down after a 429** per provider door: ten
+   parallel workers met a 429 about hourly and each lost a whole batch; three to five heavy ones,
+   resumed in batches, did not. A "busy" or "still starting" dependency is retried a bounded number
+   of times with spacing (a handful, seconds apart, only on refusals classified as transient) —
+   never once, never forever.
+7. **Inside a fallback chain, do not retry a provider that answered 429 or timed out** — move to
+   the next one. Retries there stalled a waiting user. Stagger many resumes; bound each worker's
+   working set (a narrow time window, a prefix), so one stop does not become a burst.
+
+8. **Move a refused request to another account at most once, and only before any byte reached the
+   client** — a replay after streaming began duplicated output. Persist a provider's `Retry-After`
+   across restarts; a check inside the hold answers the stored observation instead of probing.
+
+## Model answers are untrusted until accepted
+
+1. **"Answered" is not "usable".** Each call site has its own `accept(text)` — the parser the
+   result must pass. Empty content, a refusal, a truncation (`finish_reason: length`) or an
+   unparseable answer is a failure, and only an accepted answer may be cached. A cached
+   unreadable answer once served "0 labelled" for hours.
+2. **Fallbacks cross vendors.** A chain is an ordered list of models from different vendors; a
+   same-vendor fallback refuses the same inputs. Build the chain where a test can refuse a lane
+   with no other-vendor route, and act on a new fallback only after measuring it.
+3. **The checker is never the drafter's vendor.** Choose it per turn from the model that
+   *actually* drafted (a fallback may have), in the router, not in configuration. No checker
+   left, or a checker outage, means hold or stay silent — never ship unchecked.
+4. **Size the output budget for the answer, not the input.** Reasoning tokens eat `max_tokens`:
+   a judge capped at 800 tokens returned no JSON in 8 of 14 calls. Give judges room or turn
+   reasoning off for that route; on `length`, retry once with a larger cap.
+5. **Run code checks before model checks**, and degrade to a fixed safe reply with a reason code.
+6. **A model's word verifies nothing.** A fact is verified by stored source text (or two truly
+   independent sources); an effect by the system of record it lands in — never by the page, a
+   flag the model set, or its "done".
+7. **A coding agent runs only on a model it knows.** One CLI agent on an unfamiliar vendor's model
+   read its instructions and ended its turn with nothing written; measure each (agent, model)
+   pair live before making it a default.
+8. **Pin what the agent says about itself.** A short block of true facts (what it can see, its
+   pipeline, its limits) lives in code; a test fails when a fact drifts. Forbid promises the
+   pipeline cannot keep.
+
+## Money is a ledger
+
+1. **Unknown is unknown, never zero** — in cost, in verdicts, in health — and nothing acts on it.
+   A missing price is a high estimate, a missing field is `NOT_RUN`, never a pass; a probe that
+   timed out is "unreadable", not "credential rejected"; a cooldown that could not be read is not
+   "never sent". An owner's refusal inside a successful response (`ok: false` over a 200) is a
+   refusal, never an empty result.
+2. **Persist the attempt before dispatch** — its route and a hash of its prompt — and finalize it
+   in `finally`; spend is Σ actual + Σ estimate for attempts without an actual. In-memory counters
+   reset on every resume. A call that broke before the provider answered is reconciled against
+   the provider's own history by that route and hash, never guessed; one provider request id
+   belongs to exactly one ledger row.
+3. **Check the cap before every HTTP attempt, retries included**, with one stop rule; record the
+   provider's own reported cost per call; count reserved or held tokens as spent.
+4. **A resend of an unknown outcome reuses its idempotency key — or does not happen.** Derive
+   keys from the intent (action and entity, or run and step), never from a clock or a random
+   value, and make them unique in storage: time-and-random keys let redelivered requests charge
+   again. A write whose effect is uncertain stops as `outcome_unknown`; a new key there pays twice.
+5. **A client error at submit is a rejection, not a lost task.** Settle it with known usage (zero
+   if none), release the reserved money in the same transaction, and never resend the identical
+   request; a 4xx while polling is still a lost task.
+6. **A failed outer job cancels the paid work it started**, and a cancel is a row the worker reads
+   at every claim and checkpoint — never an in-memory flag that a restart forgets.
+7. **Reuse what was paid for.** A restarted stage looks up the job's successful call with the
+   same route, prompt version and inputs before calling again (one restart made 117 paid calls
+   where 49 sufficed). Cache keys are content plus definition, never an identity alone.
+8. **A rerun after an interruption calls read-only tools until its open outcomes are reconciled**;
+   an idempotency key covers the content as well as the run, so a retried run that asks a new
+   question is not refused as a conflict.
+9. **Deny spending tools by enumerated name, and test the list**: a provider's newer tools were
+   missing from a deny list while older ones were denied.
+
+## Autonomy: decide, record, continue
+
+1. **An open question is a decision to make.** Decide from the recorded decisions, then the
+   goal, then the safest reversible option; write the decision and its source where the work
+   lives; batch the questions only a person can answer (sign-in, consent, payment, a typed
+   secret) and keep working around them.
+2. **Nothing in a user's path waits for a human approval.** Send now or not at all; when unsure,
+   say so, open a recorded question, and answer again automatically when the knowledge changes.
+   Drafts awaiting approval waited for days.
+3. **Every wait lives in durable storage**, rebuilt on start from a "debt" query — timers in
+   process memory died with every restart. A wait that must outlive a session (a credential that
+   has not landed yet) is an operating-system job, not a session's background task.
+4. **Stop at the third round.** Tuning wording or patching one heuristic a third time means
+   splitting the change or replacing the mechanism with one invariant and a property test.
+   Write a review's exit criterion before its rounds start, and block only on what breaks a
+   documented promise; the rest becomes a board row with its evidence.
+5. **Find the real cause before telling a person what to do** — a full disk once read as "the
+   service stopped" while the service was healthy; check free space and the service's own health
+   first.
+6. **Background chores never hold a finished command open**, unattended runs skip them, and an
+   unattended `--yes` never reverses a "no" a person saved.
+
+7. **When a peer waits on your decision, make it**, mark it reversible, record it where the work
+   lives and reply naming the record; a platform once built nothing for days waiting on a
+   definition. Release a coordination lease in the same step as the commit that used it, the
+   failure path included.
+8. **Hand work over only while it is alive**, and claim each hand-over exactly once by an exclusive
+   create; a forgotten workflow was handed over twice.
+
+## Verification you can believe
+
+1. **A test counts once it was watched failing against a planted defect** (clear bytecode caches
+   first — stale bytecode reported mutants killed); a mutation battery
+   asserts its own reach ("no tests ran" is not "all plants survived"). Exercise every guard
+   with a must-catch and a must-pass case.
+2. **Write expectations out; never compute them from the code under test**, and run a reference
+   function and its schema on the same inputs in one test — the most common defect a first reading
+   found was a function returning what its own schema refuses. A wall-clock bound sits far above a
+   loaded machine and far below the defect it guards.
+3. **Test against the real deployed instance behind its platform**, not a sample the same run
+   wrote: a probe passed the shipped sample and failed the first real service behind a router.
+4. **After each wave, three blind readings** — the changed units, everything that reaches them,
+   and the documented behaviour — then one fix round. Green suites hid six to ten real breaks.
+5. **Read a gate's exit code directly**, never through a pipe in the same command (`| tail` hid a
+   failed gate as success): write the output to a file, take the status, then read the file.
+6. **"Could not measure" is its own outcome.** An overloaded machine makes a gate refuse, and a
+   timeout under load is unmeasured, not failed or passed.
+7. **Measure noise before calling a regression**; release a retrieval change only with zero new
+   confident wrong answers against the previous version.
+8. **Compute a status from the whole group**, never incrementally; verify a release by the
+   commit it serves, from a fresh checkout of that commit.
+9. **Probe live after every deploy on every consumer channel**, not the default one; read the
+   nightly full-suite result first when resuming work, and release from a full local run, not a
+   selected subset.
+10. **Port a protocol from the contract's shared vectors, never its prose** — vendored with a hash
+   per file and run case by case; a prose port accepted a year-0000 date the vectors refused.
+11. **Read an external contract from its raw documentation or a recorded live snapshot**, never
+   from a summarising fetch; fail closed on a field nobody documented.
+
+## Operations that survive restarts
+
+1. **One owner per run, named.** Only the holder of the run's lock changes its lifecycle, and each
+   concurrent worker has its own identity; a refused claim names the run that holds the task, never
+   a guessed race against a lease that lapsed long ago; a copy that a
+   supervisor started backs off on a held lock instead of exiting into a respawn loop. A failed
+   lease renewal is not a lost lease — stop only when the remaining margin runs out.
+2. **Health treats "never finished" as a fault.** Age each phase from its last completion; a
+   phase that only ever yielded looked healthy for fifteen days.
+3. **Everything a run creates carries its owner** (run id, pid); the next start sweeps what a dead
+   owner left — markers, test databases, temp roots, container volumes. Nothing a long job needs
+   lives in a temp directory; a cleaner removed a test database mid-deploy.
+4. **Check disk and load before heavy work**, and serialize heavy suites behind a lock held for
+   the whole run. A disk cleanup never deletes files version control tracks.
+5. **State that must survive a restart or a second instance lives in the shared store**, never in
+   process memory or on one instance's disk; a per-process cache is a cache with a TTL.
+6. **Every scheduled job leaves a trace when it dies, stalls or never starts**: a heartbeat at the
+   start of each tick, a queryable error row, re-arming in `finally`, an alert when quiet for two
+   intervals. Serialize every use of a connection threads share, reads included.
+7. **Bound every wait on a shared lock and survive a lost connection.** A lock timeout (a few
+   seconds) answers a retryable "busy", never a crash or a deadlock; every pooled connection has
+   an error listener, and readiness reports the store while liveness reports the process, so a
+   database blip takes the instance out of traffic instead of restarting it.
+8. **Every accumulating output has a cap in the code that writes it** — logs, receipts, caches —
+   with both bounds tested.
+9. **Name the account and context on every cloud CLI call** and verify the account before a write;
+   a saved default context once pointed a correct token at another team.
+10. **Log by error name and code**, never a driver's raw message, which can carry connection
+   details. A failed command logs its cause — deadline, signal, exit code, missing program — never a
+   bare "command failed"; a watched dependency logs once when it fails and once when it recovers,
+   never on every poll.
+11. **Admit work only when the machine can carry it** — free disk, swap, a cap on concurrent
+   sessions — and say why when you defer.
+
+12. **Keep blocking work off the workers that answer requests**, never let a read wait behind a long
+   transaction, and log a transaction held long with the step that held it. Every blocking network
+   wait is interruptible from outside, with its deadline on the socket, not between frames.
+
+## Secrets and confinement
+
+1. **A secret never enters an environment, argv, URL or log a child can read.** Hand it over a
+   pipe or file descriptor, or through a vault runner per command; never print a configuration
+   dump, and never filter one yourself.
+2. **Confine what an agent runs by the operating system**, per run (filesystem, network, ports),
+   and treat prompt rules and command guards as tripwires, not boundaries.
+3. **Fail closed.** When a reduced view or a scope cannot be built, answer an error, never the
+   wider view; a new matching rule fires only when every neighbouring input is on its allow-list.
+4. **Run the private-name gate chained before every public push** (`<gate> && git push`), not only
+   before merge: a `;` once let a private path reach a public branch.
+5. **Freeze every input at acceptance**, nested references included: copy it by hash and work on
+   the copy, so a file swapped between acceptance and use is never read.
+6. **Pin every tool's input schema to the domain schema with a test.** A save tool that silently
+   dropped unknown fields once stored an agent set to send without the guards it was given.
+7. **Treat what a run wrote as untrusted** before the service copies, reads or renders it: a
+   regular file whose real path is inside the run's own tree.
+8. **An artefact missing a secret refuses to start**, never runs unauthenticated: validation rejects
+   placeholder-shaped values, and a test renders the configuration without the value and expects
+   an error.
+9. **Widen an access configuration first, code second**, so nothing is over-scoped even briefly.
+
+10. **Bound every recursive parse of untrusted input** (a depth limit, tested at the limit and one
+    above). Revoke or retire by a content-addressed reference, never a reusable name: a re-keyed
+    machine keeps its key id. Never refresh a person's own credentials as a side effect; renew only
+    what you own.
+
+## Text for people
+
+1. **Text a person reads carries no em dash** (U+2014) and no substitute for it: not `--`, not a
+   spaced hyphen used as a dash. The operator reads it as the mark of machine-written text. Use a
+   full stop, a comma, a colon or parentheses, or rewrite the sentence. This covers replies,
+   messages, posts, mail, reports, captions and UI strings, in every language.
+2. **Exceptions are exact, never stylistic:** exact quotations, code, commands, paths and
+   historical records keep the character as they are.
+3. **The rule lives in the prompt and in a test.** The prompt of every lane that writes for people
+   states it; a test feeds that lane's output (and every fixed template) through a check that
+   fails on U+2014, for example `assert "\u2014" not in text`, and is seen failing on a planted
+   dash. A spaced hyphen cannot be told from a range or a minus by a pattern: the prompt and a
+   reviewer carry that half, the check does not guess.
+4. **A model's slip is rewritten or refused, never shipped.** When an accepted answer still holds U+2014, the
+   call site's `accept` rewrites it or retries once, then refuses; it never sends the dash on.
+
+## Checklist
+
+Before the first release, answer each with a file and a test: where a limit pauses and resumes; what
+`accept` each model call has; which vendors its fallback and checker use; where the attempt ledger
+and idempotency keys live; what happens to an unknown outcome; which waits are durable; who owns the
+run lock; what the next start sweeps; how a cancel reaches paid inner work; which outputs are
+capped; how a secret reaches a child; which test was seen failing for each fix; and, for an agent
+that writes text for people, where its prompt says no em dash and which test fails on U+2014 in its
+output.

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -19,7 +19,7 @@ compatibility: >-
   this plugin; Codex/Kimi use command hooks; Hermes/OpenCode/OpenClaw/Pi use native context plugins after opt-in.
 metadata:
   author: PassionCode.ai
-  version: "0.35.0"
+  version: "0.35.3"
 ---
 
 # Working with Fabric
@@ -105,7 +105,7 @@ and its answer is an error that names what Fabric waits for — never a fake suc
 |---|---|---|
 | Fabric is not running, or its hub is closed | no live hub | Step 1; Settings → Agent access in Fabric says why a hub is closed |
 | Fabric's hub could not be verified | foreign protocol, dead pid, token outside Fabric's folder | send nothing; ask the person to open Fabric |
-| the folder is not a project | no project holds this folder | the person opens it in Fabric (+ Project → Open a project) |
+| the folder is not a project | no project holds this folder yet | Fabric with automatic project admission creates or attaches the Project during enrollment; an older Fabric needs the person to open it (+ Project → Open a project) |
 | waiting for the operator to allow this coding agent | the consent prompt is on their screen | tell the person; call again in a moment; never loop fast |
 | denied | the operator said no | stop; the denial stands until they clear it in Agent access |
 | connecting | enrollment in progress | call again in a moment |

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/references/project-board.md

@@ -134,8 +134,9 @@ personal data or private path in a body or an artifact reference: name a vault s
 - Never enroll a second session from a hook or a script: a `fabric-mcp` started outside the agent's own connection
   enrolls a new session, and Fabric ends a binding's oldest live session past eight — the agent's own. The plugin's
   hooks and `watch-mail` only rejoin (`--rejoin-only`).
-- Never attach a folder to a Project, or create a Project, to make enrollment succeed. "The folder is not a project"
-  is the answer: tell the person; which Projects exist is their decision.
+- Never attach a folder or create a Project through a side channel to make enrollment succeed. Fabric's own
+  enrollment admits an eligible Git folder and records the Project it creates or attaches. If the answer is still
+  "the folder is not a project", report it; never write another product's registry or improvise a second admission path.
 
 ## Not yet available
 

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/references/session-hooks.md

@@ -43,7 +43,9 @@ would add — never a value already in the file — and the `--apply --expect-sh
 backs the file up (`<file>.<UTC stamp>.bak`, never overwriting an earlier backup), keeps the file's mode, refuses a
 file whose shape is not `{"hooks": {"<Event>": [{"hooks": [...]}]}}` (Codex) or an array of `[[hooks]]` tables
 (Kimi Code, read back with `tomllib`: Python 3.11+), and refuses one that changed since the dry run. `--remove` takes
-the entry out again. Codex may ask the person to trust a new hook (`/hooks`) before it runs. The hook runs the
+the entry out again. Codex may ask the person to trust a new hook (`/hooks`) before it runs. Codex keys that trust by event, group and index, so
+`--remove` names the SessionStart groups after the removed one that it moves, which Codex asks the person to approve
+again. The hook runs the
 `fabric_session.py` of the skills install (`~/.agents/skills/working-with-fabric/`) when there is one, else this
 script's own path; a plugin cache path changes with each update, so pass `--script <a stable path>` there.
 
@@ -93,7 +95,9 @@ only variable names are looked at, never a value (two of them carry the session'
 One line per event that did something, never content: `~/Library/Caches/ai.passioncode.fabric-agent-adapter/hooks.log`
 (macOS), `$XDG_CACHE_HOME/fabric-agent-adapter/hooks.log` (Linux, default `~/.cache`),
 `%LOCALAPPDATA%\fabric-agent-adapter\hooks.log` (Windows). Mode 0600, rotated at 1 MB to `hooks.log.1`. The
-per-session spool is `sessions/<session id>/` beside it (turn entries capped at 50, `board.json`, `board.shown`),
+per-session spool is `sessions/<session id>/` beside it (turn entries capped at 50, `board.json`, `board.shown`; a
+folder untouched for 7 days, whose worker failed or whose session ended without SessionEnd, is removed by the next
+spooling hook),
 removed at the session's end.
 
 Turn them off with Claude Code's own switch (`/hooks`, or `"disableAllHooks": true` in settings), or remove the

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session.py

@@ -53,6 +53,9 @@ PS_TIMEOUT_S = 0.5
 LOG_CAP_BYTES = 1_000_000
 SPOOL_CAP = 50
 LOCK_STALE_S = 30.0
+#: A session folder untouched this long belongs to a session that will not spool again: its worker failed, or the
+#: session ended without SessionEnd. Nothing retries it, so the next spooling hook removes it (FAA-50).
+SESSION_STALE_S = 7 * 86400
 READ_CAP = 64 * 1024
 CONFIG_CAP = 32 * 1024 * 1024
 WATCH_MIN_INTERVAL_S = 10
@@ -60,7 +63,7 @@ WATCH_MAX_BACKOFF_S = 900
 SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 LOCAL_ORIGIN = re.compile(r'"origin": "http://(?:127\.0\.0\.1|localhost)')
-VERSION = "0.35.0"
+VERSION = "0.35.3"
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",
          "hermes": "Hermes", "opencode": "OpenCode", "openclaw": "OpenClaw", "pi": "Pi"}
 NATIVE_PLUGIN_HOSTS = frozenset(("hermes", "opencode", "openclaw", "pi"))
@@ -413,6 +416,30 @@ def spool(directory: Path, entry: Dict[str, Any]) -> Path:
     return path
 
 
+def prune_stale_sessions(env: Optional[Dict[str, str]] = None, now: Optional[float] = None,
+                         keep: Optional[str] = None) -> int:
+    """Remove session folders whose newest file is older than SESSION_STALE_S (a running worker's lock is a fresh file,
+    so its folder is never stale); never the folder of the session `keep`. Returns how many were removed. Never
+    raises."""
+    now = time.time() if now is None else now
+    removed = 0
+    try:
+        folders = list((state_root(env=env) / "sessions").iterdir())
+    except OSError:
+        return 0
+    for folder in folders:
+        try:
+            if folder.name == keep or not SESSION_ID.fullmatch(folder.name) or not folder.is_dir():
+                continue
+            newest = max([folder.stat().st_mtime] + [f.stat().st_mtime for f in folder.iterdir()])
+            if now - newest > SESSION_STALE_S:
+                _remove_tree(folder)
+                removed += 1
+        except OSError:
+            continue
+    return removed
+
+
 def lock_held(directory: Path) -> bool:
     lock = directory / "worker.lock"
     try:
@@ -528,6 +555,7 @@ def hook_spool(payload: Dict[str, Any], event: str, env: Optional[Dict[str, str]
         return "skipped: launched by Fabric"
     entry = {"event": event, "runtimeSessionId": session_id, "cwd": str(cwd),
              "observedAt": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())}
+    prune_stale_sessions(env, keep=session_id)
     if event == "end" and isinstance(payload.get("reason"), str):
         entry["reason"] = payload["reason"][:64]
     spool(directory, entry)
@@ -1105,6 +1133,7 @@ def install_host_hooks_cli(argv: Sequence[str], env: Optional[Dict[str, str]] =
     else:
         path = _home(env) / ".kimi-code" / "config.toml"
     command = hook_command(str(args.script or default_hook_script(env)), args.host)
+    shifted = 0  # Codex hook groups after ours, whose position a removal moves
     try:
         data = _read_bytes(path)
         digest = _digest(data)
@@ -1118,11 +1147,15 @@ def install_host_hooks_cli(argv: Sequence[str], env: Optional[Dict[str, str]] =
                 if not present:
                     out("install-host-hooks: no Fabric preamble hook in %s; nothing to change" % path)
                     return 0
-                groups = []
-                for group in doc["hooks"]["SessionStart"]:
+                groups, dropped = [], None
+                for index, group in enumerate(doc["hooks"]["SessionStart"]):
                     kept = [h for h in group.get("hooks", []) if not _is_ours(h.get("command"), args.host)]
                     if kept or not group.get("hooks"):
                         groups.append(dict(group, hooks=kept) if kept != group.get("hooks") else group)
+                    elif dropped is None:
+                        dropped = index  # a group that held only our hook goes; the groups after it move up
+                if dropped is not None:
+                    shifted = len(doc["hooks"]["SessionStart"]) - dropped - 1
                 if groups:
                     doc["hooks"]["SessionStart"] = groups
                 else:
@@ -1187,6 +1220,11 @@ def install_host_hooks_cli(argv: Sequence[str], env: Optional[Dict[str, str]] =
                                               else "added the Fabric preamble hook to", path,
                                               "(backup: %s)" % backup if backup else "(new file)"))
         out("Undo: fabric_session.py install-host-hooks --host %s %s" % (args.host, "--apply" if args.remove else "--remove"))
+        if shifted:
+            # Codex keys a hook's trust by its event, group and index: the groups after ours moved up one, so Codex asks
+            # the person to trust them again in /hooks before they run.
+            out("Codex trusts a hook by its position: %d SessionStart hook group(s) after the removed one moved, and "
+                "Codex will ask you to approve them again in /hooks." % shifted)
         return 0
     except Refused as exc:
         err("install-host-hooks: refused — %s" % exc)

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/hosts/hermes/__init__.py

@@ -53,8 +53,11 @@ def _capture(command, payload):
     reader = threading.Thread(target=read_output, daemon=True)
     reader.start()
     try:
-        process.stdin.write(payload)
-        process.stdin.close()
+        try:
+            process.stdin.write(payload)
+            process.stdin.close()
+        except BrokenPipeError:
+            pass  # FAA-51: a helper may exit without reading its input; its output still counts
         process.wait(timeout=max(0.001, deadline - time.monotonic()))
         reader.join(timeout=max(0, deadline - time.monotonic()))
         if reader.is_alive() or invalid.is_set() or process.returncode != 0:
@@ -69,7 +72,10 @@ def _capture(command, payload):
         reader.join(timeout=0.2)
         if not reader.is_alive():
             process.stdout.close()
-        process.stdin.close()
+        try:
+            process.stdin.close()
+        except BrokenPipeError:
+            pass
 
 
 def fabric_registered(config=None):

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",