v0.3.8

The patch of the operator's audit of the installed 0.3.7 (2026-10-21): other products can now get the access that
fabric.project.resolve needs, the log says what happened, the startup failure names a full disk, and a coding agent
in a folder that is too broad stops asking every half minute. No schema change: 0.3.8 admits schema 94, as 0.3.7 did.

• A full disk is named when the local stack will not start. When the volume that holds Fabric's data has under
  3 GB free (decimal), the startup failure says first how much is free and that Docker stops when the disk runs out (in
  each system's own words), and the copied details and startup-failure.log carry the same number. On macOS the figure
  leaves out space the system could purge, so Finder may show more. The stack's own words only ever named a missing Docker socket.
• Other products can ask Fabric which project a folder belongs to. 0.3.7 shipped fabric.project.resolve, but a
  product had no way to get the access it needs: fabric.access.request refused every ask of Fabric itself but
  session.enroll and board.respond (Observatory's live check, 2026-10-21). Fabric now admits project.resolve on the
  resource projects, read-only, at once on the operator's own machine, for a registered service or a coding agent it
  knows (never for one the person disconnected). Settings → Agent access says it in words, and revoking it ends it:
  fabric.project.resolve now answers only while that grant, or a coding agent's enrollment, is live.
• A coding agent in a folder that is too broad stops asking every half minute. While Fabric refuses the folder as
  too broad (the home folder, a folder right under it, one that holds other projects), fabric-mcp waits twice as long
  each time, up to 10 minutes; a repeated failure waits up to a minute, and a 503 that names Retry-After is waited out.
  Every refusal the person can lift in Fabric keeps its wait (a detached folder 30 s, a denial 60 s), and the agent's
  own fabric_whoami still asks at once. A Hermes in the home folder had asked every 30 s for three days. A coding
  agent already running keeps its old fabric-mcp until it is restarted.
• The log says why a tool turned a call down. A tool's typed refusal (needs-grant, no-session and the like) is
  recorded at warn with its code, not as an error with no reason (CO-335); a product's or Fabric's own failure stays
  an error, and a call that may have run is unknown; an accepted MCP notification is no longer a
  warning (336 in 49 minutes of the 0.3.7 log).
• Docker on Windows is waited for in its bare pipe form too (//./pipe/docker_engine).
• What 0.3.7 said would come in 0.3.8 comes in 0.3.9: the agents' own acts in История and Fabric's own enrollment on
  the shared attribution rules (CO-339). 0.3.8 is this patch; История now says «in a later version».

Verify

gpg --verify SHA256SUMS.asc SHA256SUMS      # key 63B30DC324BD697487AA31944FAFB8AEC803B6A7
shasum -a 256 -c SHA256SUMS --ignore-missing
gh attestation verify <file> --owner passioncode-ai --signer-repo passioncode-ai/.github

The organization's public key: https://github.com/passioncode-ai/.github/blob/main/release-signing/passioncode-release-signing.asc