WebSocket v2 Starts with Identity, Not a Query String
Real-time agent messaging should not begin with a browser asserting ?userid=alice. Today we replaced FabrCore's original WebSocket ingress with a v2 handshake that binds the connection to an authenticated principal before the upgrade completes.
Ticket Before Upgrade
The client first calls POST /fabrcoreapi/ws/ticket over authenticated HTTP. FabrCore creates a ticket that is valid for 30 seconds and can be used once. The browser then connects to /ws with two subprotocol values: fabrcore.v2 and fabrcore.ticket.<token>.
This shape works with browser WebSocket APIs, which cannot attach arbitrary authorization headers during upgrade, without putting durable credentials in a URL. The ticket is short-lived, single-use, and bound to the server-side principal produced by normal ASP.NET Core authentication.
The Server Speaks First
After the protocol is accepted, the server sends a hello frame describing the principal, client identity, and protocol capabilities. Clients wait for that frame before sending operations. An explicit opening contract makes version mismatches and authentication failures visible immediately.
The application no longer sends fromHandle as an identity claim. FabrCore constructs the sender from the authenticated connection and validates target handles against the same principal and ACL rules used by REST and in-process messaging.
Typed Operations Replace Raw Wire Objects
WebSocket v2 accepts an operation envelope, not arbitrary serialized grain messages. The catalog includes message.send, event.send, agent.reset, health.get, tracked.list, tracked.contains, and shared.list.
The narrower contract lets the Host validate payloads and evolve transport details without turning every internal AgentMessage field into a public security boundary. The .NET client still offers familiar strongly typed methods; it translates those calls into the v2 operation frames.
Query-string identity, header-selected principals on the socket, raw message envelopes, and transport-level agent creation are removed. Follow the WebSocket v2 migration checklist.