@aifabrix/builder 2.45.5 → 2.47.0

package/templates/channels/slack/manifest.template.json.hbs

@@ -0,0 +1,66 @@
+{
+  "display_information": {
+    "name": "{{appName}}",
+    "description": "{{appDescription}}",
+    "background_color": "#0F172A"
+  },
+  "features": {
+    "app_home": {
+      "home_tab_enabled": true,
+      "messages_tab_enabled": false,
+      "messages_tab_read_only_enabled": false
+    },
+    "bot_user": {
+      "display_name": "{{appName}}",
+      "always_online": true
+    },
+    "slash_commands": [
+      {
+        "command": "/aifabrix",
+        "url": "{{commandUrl}}",
+        "description": "Chat with your assistants",
+        "usage_hint": "[assistant or message]",
+        "should_escape": false
+      },
+      {
+        "command": "/assistants",
+        "url": "{{commandUrl}}",
+        "description": "Show available assistants",
+        "should_escape": false
+      }
+    ]
+  },
+  "oauth_config": {
+    "redirect_urls": [
+      "{{oauthCallbackUrl}}"
+    ],
+    "scopes": {
+      "bot": [
+        "app_mentions:read",
+        "chat:write",
+        "commands",
+        "im:history",
+        "im:read",
+        "im:write"
+      ]
+    },
+    "pkce_enabled": false
+  },
+  "settings": {
+    "event_subscriptions": {
+      "request_url": "{{eventsUrl}}",
+      "bot_events": [
+        "app_mention",
+        "message.im"
+      ]
+    },
+    "interactivity": {
+      "is_enabled": true,
+      "request_url": "{{interactionUrl}}"
+    },
+    "org_deploy_enabled": true,
+    "socket_mode_enabled": false,
+    "token_rotation_enabled": true,
+    "is_mcp_enabled": false
+  }
+}

package/templates/channels/teams-bot/install.template.md.hbs

@@ -0,0 +1,49 @@
+# {{appName}} — assistant channel install
+
+{{appDescription}}
+
+Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
+
+## Platform callback URLs
+
+Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+
+{{#if eventsUrl}}
+- **Events:** {{eventsUrl}}
+{{/if}}
+{{#if interactionUrl}}
+- **Interactivity:** {{interactionUrl}}
+{{/if}}
+{{#if commandUrl}}
+- **Slash commands:** {{commandUrl}}
+{{/if}}
+{{#if oauthCallbackUrl}}
+- **OAuth redirect:** {{oauthCallbackUrl}}
+{{/if}}
+{{#if messagesUrl}}
+- **Bot messages:** {{messagesUrl}}
+{{/if}}
+{{#if notificationsUrl}}
+- **Notifications:** {{notificationsUrl}}
+{{/if}}
+{{#if botConfigUrl}}
+- **Bot config:** {{botConfigUrl}}
+{{/if}}
+
+## Assistant catalog
+
+Runtime lists **assistants** available to each user from:
+
+{{assistantCatalogUrl}}
+
+## After admin approval
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+```
+
+Optional validation:
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+```

package/templates/channels/teams-bot/manifest.template.json.hbs

@@ -0,0 +1,13 @@
+{
+  "name": "{{appName}}",
+  "baseName": "{{baseName}}",
+  "description": "{{appDescription}}",
+  "credentialKey": "{{credentialKey}}",
+  "environment": "{{environment}}",
+  "endpoints": {
+    "messagesUrl": "{{messagesUrl}}",
+    "notificationsUrl": "{{notificationsUrl}}",
+    "botConfigUrl": "{{botConfigUrl}}",
+    "assistantCatalogUrl": "{{assistantCatalogUrl}}"
+  }
+}

package/templates/channels/web-embed/install.template.md.hbs

@@ -0,0 +1,49 @@
+# {{appName}} — assistant channel install
+
+{{appDescription}}
+
+Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
+
+## Platform callback URLs
+
+Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+
+{{#if eventsUrl}}
+- **Events:** {{eventsUrl}}
+{{/if}}
+{{#if interactionUrl}}
+- **Interactivity:** {{interactionUrl}}
+{{/if}}
+{{#if commandUrl}}
+- **Slash commands:** {{commandUrl}}
+{{/if}}
+{{#if oauthCallbackUrl}}
+- **OAuth redirect:** {{oauthCallbackUrl}}
+{{/if}}
+{{#if messagesUrl}}
+- **Bot messages:** {{messagesUrl}}
+{{/if}}
+{{#if notificationsUrl}}
+- **Notifications:** {{notificationsUrl}}
+{{/if}}
+{{#if botConfigUrl}}
+- **Bot config:** {{botConfigUrl}}
+{{/if}}
+
+## Assistant catalog
+
+Runtime lists **assistants** available to each user from:
+
+{{assistantCatalogUrl}}
+
+## After admin approval
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+```
+
+Optional validation:
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+```

package/templates/channels/web-embed/manifest.template.json.hbs

@@ -0,0 +1,8 @@
+{
+  "name": "{{appName}}",
+  "description": "{{appDescription}}",
+  "credentialKey": "{{credentialKey}}",
+  "configUrl": "{{configUrl}}",
+  "assistantCatalogUrl": "{{assistantCatalogUrl}}",
+  "experimental": true
+}

package/templates/external-system/README.md.hbs

@@ -23,6 +23,7 @@
 | `{{systemKey}}-deploy.json` | Deploy manifest (`aifabrix json {{appName}}`) |
 | `deploy.js` | Deploy helper |
 | `wizard.yaml` | Wizard input |
+| `scenarios/*.yaml` | Governance scenario packs (optional; dataplane-first via `verify-governance` / `governance generate`; expert YAML via `governance download` / `upload`) |
 | `{{rbacOptionalFile}}` | Roles and permissions |
 
 ## Typical workflow
@@ -33,7 +34,8 @@
 4. **Check locally** — `aifabrix validate {{appName}}` and `aifabrix datasource validate` on files you touched.
 5. **Align manifest** — `aifabrix repair {{appName}}` after bigger edits.
 6. **Publish** — see [Publish and credentials](#publish-and-credentials) (`upload`, `deploy`, or `credential push`).
-7. **Protection** (optional) — dimension grants in `integration/.protection/` — see [Protection manifests](#protection-manifests).
+7. **Certify** — run [Enterprise AI Certification](#enterprise-ai-certification) (`verify-operations` → `verify-trust` → `verify-governance` → `lifecycle`).
+8. **Protection** (optional) — dimension grants in `integration/.protection/` — see [Protection manifests](#protection-manifests).
 
 Rollback an experiment: `datasource capability remove …` → validate → upload/deploy again.
 
@@ -41,7 +43,8 @@ Rollback an experiment: `datasource capability remove …` → validate → uplo
 
 | Command | What it does |
 | --- | --- |
-| `aifabrix upload {{appName}}` | Publishes local integration files to the dataplane and pushes credential secrets from `integration/{{appName}}/.env` (when present). |
+| `aifabrix upload {{appName}}` | Publishes local integration files to the dataplane (refreshes `{{systemKey}}-deploy.json` from sources) and pushes credential secrets from `integration/{{appName}}/.env` (when present). |
+| `aifabrix upload {{appName}} --force` | Same publish path when the interface or datasource schema changed in ways **deploy cannot accept yet**; bypasses active-schema replacement guards. Read the CLI warning before use. |
 | `aifabrix deploy {{appName}}` | Deploys via the controller pipeline. Does **not** replace a full upload for credential secrets — run `upload` or `credential push` when `.env` changed. |
 | `aifabrix credential push {{appName}}` | Pushes `KV_*` values from `.env` only (no manifest publish). |
 
@@ -49,6 +52,10 @@ Rollback an experiment: `datasource capability remove …` → validate → uplo
 aifabrix upload {{appName}}
 # or secrets only:
 aifabrix credential push {{appName}}
+
+# Breaking schema / interface change — deploy blocked; publish for dev iteration
+aifabrix validate {{appName}}
+aifabrix upload {{appName}} --force
 ```
 
 ## Protection manifests
@@ -103,9 +110,9 @@ af ds cap remove {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}
 
 For flags, run `af ds cap <command> --help`.
 
-## Single datasource lifecycle (production-ready)
+## Per-datasource debug ladder
 
-Start with one datasource and iterate until it’s stable.
+Start with one datasource and iterate until it’s stable (architect / CI — use [Enterprise AI Certification](#enterprise-ai-certification) for the product path).
 
 ```bash
 af ds validate {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}}
@@ -137,7 +144,62 @@ aifabrix repair {{appName}}
 
 Useful flags: `--dry-run`, `--auth <method>`, `--rbac`, `--expose`, `--sync`, `--test`.
 
-## Validate and test
+## Enterprise AI Certification
+
+Product-facing commands that prove operational readiness, AI trust, governance enforcement, and an **Enterprise AI Certification** report. Run after [publish](#publish-and-credentials).
+
+| Command | What it proves |
+| --- | --- |
+| `aifabrix verify-operations {{appName}}` | Operational readiness — orchestrates validate, unit test, integration, and E2E for the whole system |
+| `aifabrix verify-trust {{appName}}` | AI business context confidence (semantic agent metadata; not live vendor API calls) |
+| `aifabrix verify-governance {{appName}}` | **Recommended** — publish (unless `--no-sync`), generate scenario packs on the dataplane, then verify ABAC visibility per subject |
+| `aifabrix governance generate {{appName}}` | Granular: generate packs only (after protection + sync) |
+| `aifabrix governance verify {{appName}}` | Granular: verify only (active packs on dataplane, or `--pack` for local YAML override) |
+| `aifabrix lifecycle {{appName}}` | Certification report from persisted pillar results on the dataplane |
+
+**Recommended order:** `upload` → `verify-operations` → `verify-trust` → `verify-governance` → `lifecycle`
+
+Integration validation packs live under `integration/{{appName}}/scenarios/` (YAML per datasource). Prefer **`verify-governance`** (dataplane-first) after identity sync, protection upload, and `datasource load`. Granular: `governance generate` then `governance verify`. Expert YAML: `governance download` / `governance upload` (424.0 schema; pre-424 files fail with a hint to regenerate). **`governance download`** is read-only and does not publish this folder.
+
+```bash
+aifabrix upload {{appName}}
+
+aifabrix verify-operations {{appName}}
+aifabrix verify-operations {{appName}} -v
+
+aifabrix verify-trust {{appName}} -v
+aifabrix verify-trust {{appName}} --no-sync --revalidate
+
+# Governance pillar (replace <email> with a subject from your scenario pack)
+aifabrix verify-governance {{appName}} --subject-email <email> -v
+aifabrix verify-governance {{appName}} --subject-email <email> --no-sync
+
+# Granular governance (debugging)
+aifabrix governance generate {{appName}} --subject-email <email>
+aifabrix governance verify {{appName}} -v
+
+# Report only (GET persisted results)
+aifabrix lifecycle {{appName}}
+aifabrix lifecycle {{appName}} -v
+
+# Run missing verify steps, publish local files, then print report
+aifabrix lifecycle {{appName}} --run
+aifabrix lifecycle {{appName}} --run --no-sync
+```
+
+**Prerequisites:** `aifabrix login`, dataplane reachable, config published (`upload`). Governance also needs identity sync, protection upload, `datasource load` for fixture records, at least one `--subject-email` or `--subject-user-id`, and `governance:evaluate` on your token. Run `aifabrix verify-governance --help` for flags.
+
+**Single-datasource trust** (same semantic check as system `verify-trust`, one key):
+
+```bash
+aifabrix datasource verify-trust {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}} --app {{appName}} -v
+```
+
+Common flags: `-v` / `--verbose`, `-d` / `--debug` (trust), `--no-sync` (skip pre-run upload), `--json` (machine-readable envelope).
+
+## Debug and low-level tests
+
+Advanced commands for architects and CI. Prefer [Enterprise AI Certification](#enterprise-ai-certification) for integrator proof unless you need step-by-step debugging.
 
 | Command | Network | Notes |
 | --- | --- | --- |
@@ -145,14 +207,11 @@ Useful flags: `--dry-run`, `--auth <method>`, `--rbac`, `--expose`, `--sync`, `-
 | `aifabrix test {{appName}}` | Off | Local checks |
 | `aifabrix test-integration {{appName}}` | On | Needs login + dataplane |
 | `aifabrix test-e2e {{appName}}` | On | E2E for every datasource; uploads local files first unless `--no-sync` |
-| `aifabrix test-trust {{appName}}` | On | Semantic agent metadata trust (not live API E2E); uploads first unless `--no-sync` |
 
 System-level tests publish local integration files before the run (same path as `upload`). Use **`--no-sync`** to validate against config already on the dataplane.
 
 ```bash
-aifabrix test-trust {{appName}}
-aifabrix test-trust {{appName}} --no-sync
-aifabrix test-e2e {{appName}} --no-sync
+aifabrix test-e2e {{appName}} --no-sync -d
 ```
 
 Single datasource E2E:
@@ -171,14 +230,9 @@ aifabrix datasource test-e2e <datasource-key> --app {{appName}}
 ```
 {{/if}}
 
-Common flags: `-v` / `--verbose`, `-d` / `--debug`, `--no-async` (datasource E2E only), `--no-sync` (skip pre-run upload on system `test-e2e` / `test-trust`).
+Common flags: `-v` / `--verbose`, `-d` / `--debug`, `--no-async` (datasource E2E only), `--no-sync` (skip pre-run upload on system `test-e2e`).
 
-Datasource trust (one key; uploads before run unless `--no-sync`):
-
-```bash
-aifabrix datasource test-trust {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}} --app {{appName}}
-aifabrix datasource test-trust {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}} --app {{appName}} --no-sync --revalidate
-```
+Debug logs (when using `--debug` on datasource commands) are written under `integration/{{appName}}/logs/` — use `aifabrix datasource log-test`, `log-integration`, `log-e2e`, or `log-trust` to inspect the latest file for each type.
 
 ## Deploy
 
@@ -195,5 +249,8 @@ aifabrix delete {{appName}}
 ## When something fails
 
 - **Validation errors** — Fix JSON/schema issues; run `aifabrix validate {{appName}}` and `aifabrix datasource validate` on the file you changed.
-- **Auth** — `aifabrix auth config` + `aifabrix login` before upload, deploy, or remote tests.
+- **Deploy blocked by schema changes** — When the interface changed and deploy rejects the update, validate locally then `aifabrix upload {{appName}} --force` to publish for dev iteration (see [Publish and credentials](#publish-and-credentials)).
+- **Auth** — `aifabrix auth config` + `aifabrix login` before upload, deploy, remote tests, or certification.
+- **Certification gaps** — Run pillars in order (`verify-operations` → `verify-trust` → `verify-governance`), then `aifabrix lifecycle {{appName}} -v` for per-datasource breakdown; use `lifecycle --run` to execute missing steps and refresh the report.
+- **Governance upload rejected** — Local `scenarios/*.yaml` must meet the 424.0 pack schema; use `verify-governance` or `governance generate` instead of hand-editing old YAML.
 - **Wrong folder** — Run CLI from the project root (where `integration/{{appName}}/` lives).

package/templates/python/docker-compose.hbs

@@ -51,7 +51,7 @@ services:
     env_file:
       - {{envFile}}
     {{#if reloadStartCommand}}
-    command: ["sh", "-c", "cd /app && {{reloadStartCommand}}"]
+    command: ["sh", "-c", "cd /app && {{{reloadStartCommand}}}"]
     {{/if}}
     ports:
       - "{{hostPort}}:{{containerPort}}"
@@ -87,6 +87,62 @@ services:
         condition: service_completed_successfully
     {{/if}}
 
+  {{#if workerSidecars.enabled}}
+  {{#if workerSidecars.worker}}
+  {{workerSidecars.worker.key}}:
+    image: {{image.name}}:{{image.tag}}
+    container_name: {{workerSidecars.worker.containerName}}
+    environment:
+      - MISO_ENVIRONMENT={{misoEnvironment}}
+      - LOCAL_MODE=false
+    env_file:
+      - {{envFile}}
+    command: ["sh", "-c", "cd /app && {{{workerSidecars.worker.command}}}"]
+    networks:
+      - {{networkName}}
+    {{#if devMountPath}}
+    volumes:
+      - {{devMountPath}}:/app
+    user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
+    {{/if}}
+    depends_on:
+      {{app.key}}:
+        condition: service_started
+    healthcheck:
+      disable: true
+    restart: unless-stopped
+  {{/if}}
+
+  {{#if workerSidecars.beat}}
+  {{workerSidecars.beat.key}}:
+    image: {{image.name}}:{{image.tag}}
+    container_name: {{workerSidecars.beat.containerName}}
+    environment:
+      - MISO_ENVIRONMENT={{misoEnvironment}}
+      - LOCAL_MODE=false
+    env_file:
+      - {{envFile}}
+    command: ["sh", "-c", "cd /app && {{{workerSidecars.beat.command}}}"]
+    networks:
+      - {{networkName}}
+    {{#if devMountPath}}
+    volumes:
+      - {{devMountPath}}:/app
+    user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
+    {{/if}}
+    depends_on:
+      {{#if workerSidecars.worker}}
+      {{workerSidecars.worker.key}}:
+      {{else}}
+      {{app.key}}:
+      {{/if}}
+        condition: service_started
+    healthcheck:
+      disable: true
+    restart: unless-stopped
+  {{/if}}
+  {{/if}}
+
   {{#if requiresDatabase}}
   # Database Initialization (uses infra pgpass when available: ~/.aifabrix/infra/pgpass)
   # env_file: .env.run.admin only (POSTGRES_PASSWORD + DB_*); admin secrets never in app container
@@ -134,27 +190,28 @@ services:
         done &&
         {{#if databases}}
         {{#each databases}}
-        echo 'Creating {{name}} database and user...' &&
-        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '{{name}}'" 2>/dev/null | grep -q '^1$$'; then
-          echo 'Database "{{name}}" already exists, syncing user password...' &&
-          psql -d postgres -c "ALTER USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Database "{{name}}" ok.'
+        echo "Creating $${DB_{{@index}}_NAME} database and user..." &&
+        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '$${DB_{{@index}}_NAME}'" 2>/dev/null | grep -q '^1$$'; then
+          echo "Database \"$${DB_{{@index}}_NAME}\" already exists, syncing user password..." &&
+          psql -d postgres -c "ALTER USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" ok."
         else
-          echo 'Creating database "{{name}}"...' &&
-          psql -d postgres -c "CREATE DATABASE \"{{name}}\";" &&
-          echo 'Dropping old user if exists...' &&
+          echo "Creating database \"$${DB_{{@index}}_NAME}\"..." &&
+          psql -d postgres -c "CREATE DATABASE \"$${DB_{{@index}}_NAME}\";" &&
+          echo "Dropping old user if exists..." &&
           psql -d postgres -c "DROP USER IF EXISTS \"{{pgUserOld name}}\";" || true &&
-          echo 'Creating user "{{pgUserName name}}"...' &&
-          psql -d postgres -c "CREATE USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Granting privileges...' &&
-          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"{{name}}\" TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "ALTER SCHEMA public OWNER TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "GRANT ALL ON SCHEMA public TO \"{{pgUserName name}}\";" &&
-          echo 'Database "{{name}}" created successfully!'
+          psql -d postgres -c "DROP USER IF EXISTS \"$${DB_{{@index}}_USER}\";" || true &&
+          echo "Creating user \"$${DB_{{@index}}_USER}\"..." &&
+          psql -d postgres -c "CREATE USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Granting privileges..." &&
+          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"$${DB_{{@index}}_NAME}\" TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "ALTER SCHEMA public OWNER TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "GRANT ALL ON SCHEMA public TO \"$${DB_{{@index}}_USER}\";" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" created successfully!"
         fi &&
         {{#each (extensionsForDb this)}}
-        (psql -d {{../name}} -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo 'Warning: could not create extension {{this}}') &&
-        echo 'Extension "{{this}}" enabled on "{{../name}}".' &&
+        (psql -d "$${DB_{{@../index}}_NAME}" -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo "Warning: could not create extension {{this}}") &&
+        echo "Extension \"{{this}}\" enabled on \"$${DB_{{@../index}}_NAME}\"." &&
         {{/each}}
         {{/each}}
         {{else}}

package/templates/typescript/docker-compose.hbs

@@ -87,6 +87,58 @@ services:
         condition: service_completed_successfully
     {{/if}}
 
+  {{#if workerSidecars.enabled}}
+  {{#if workerSidecars.worker}}
+  {{workerSidecars.worker.key}}:
+    image: {{image.name}}:{{image.tag}}
+    container_name: {{workerSidecars.worker.containerName}}
+    environment:
+      - MISO_ENVIRONMENT={{misoEnvironment}}
+      - LOCAL_MODE=false
+    env_file:
+      - {{envFile}}
+    command: ["sh", "-c", "cd /app && {{{workerSidecars.worker.command}}}"]
+    networks:
+      - {{networkName}}
+    {{#if devMountPath}}
+    volumes:
+      - {{devMountPath}}:/app
+    user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
+    {{/if}}
+    depends_on:
+      {{app.key}}:
+        condition: service_started
+    restart: unless-stopped
+  {{/if}}
+
+  {{#if workerSidecars.beat}}
+  {{workerSidecars.beat.key}}:
+    image: {{image.name}}:{{image.tag}}
+    container_name: {{workerSidecars.beat.containerName}}
+    environment:
+      - MISO_ENVIRONMENT={{misoEnvironment}}
+      - LOCAL_MODE=false
+    env_file:
+      - {{envFile}}
+    command: ["sh", "-c", "cd /app && {{{workerSidecars.beat.command}}}"]
+    networks:
+      - {{networkName}}
+    {{#if devMountPath}}
+    volumes:
+      - {{devMountPath}}:/app
+    user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
+    {{/if}}
+    depends_on:
+      {{#if workerSidecars.worker}}
+      {{workerSidecars.worker.key}}:
+      {{else}}
+      {{app.key}}:
+      {{/if}}
+        condition: service_started
+    restart: unless-stopped
+  {{/if}}
+  {{/if}}
+
   {{#if requiresDatabase}}
   # Database Initialization (uses infra pgpass when available: ~/.aifabrix/infra/pgpass)
   # env_file: .env.run.admin only (POSTGRES_PASSWORD + DB_*); admin secrets never in app container
@@ -134,27 +186,28 @@ services:
         done &&
         {{#if databases}}
         {{#each databases}}
-        echo 'Creating {{name}} database and user...' &&
-        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '{{name}}'" 2>/dev/null | grep -q '^1$$'; then
-          echo 'Database "{{name}}" already exists, syncing user password...' &&
-          psql -d postgres -c "ALTER USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Database "{{name}}" ok.'
+        echo "Creating $${DB_{{@index}}_NAME} database and user..." &&
+        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '$${DB_{{@index}}_NAME}'" 2>/dev/null | grep -q '^1$$'; then
+          echo "Database \"$${DB_{{@index}}_NAME}\" already exists, syncing user password..." &&
+          psql -d postgres -c "ALTER USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" ok."
         else
-          echo 'Creating database "{{name}}"...' &&
-          psql -d postgres -c "CREATE DATABASE \"{{name}}\";" &&
-          echo 'Dropping old user if exists...' &&
+          echo "Creating database \"$${DB_{{@index}}_NAME}\"..." &&
+          psql -d postgres -c "CREATE DATABASE \"$${DB_{{@index}}_NAME}\";" &&
+          echo "Dropping old user if exists..." &&
           psql -d postgres -c "DROP USER IF EXISTS \"{{pgUserOld name}}\";" || true &&
-          echo 'Creating user "{{pgUserName name}}"...' &&
-          psql -d postgres -c "CREATE USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Granting privileges...' &&
-          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"{{name}}\" TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "ALTER SCHEMA public OWNER TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "GRANT ALL ON SCHEMA public TO \"{{pgUserName name}}\";" &&
-          echo 'Database "{{name}}" created successfully!'
+          psql -d postgres -c "DROP USER IF EXISTS \"$${DB_{{@index}}_USER}\";" || true &&
+          echo "Creating user \"$${DB_{{@index}}_USER}\"..." &&
+          psql -d postgres -c "CREATE USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Granting privileges..." &&
+          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"$${DB_{{@index}}_NAME}\" TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "ALTER SCHEMA public OWNER TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "GRANT ALL ON SCHEMA public TO \"$${DB_{{@index}}_USER}\";" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" created successfully!"
         fi &&
         {{#each (extensionsForDb this)}}
-        (psql -d {{../name}} -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo 'Warning: could not create extension {{this}}') &&
-        echo 'Extension "{{this}}" enabled on "{{../name}}".' &&
+        (psql -d "$${DB_{{@../index}}_NAME}" -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo "Warning: could not create extension {{this}}") &&
+        echo "Extension \"{{this}}\" enabled on \"$${DB_{{@../index}}_NAME}\"." &&
         {{/each}}
         {{/each}}
         {{else}}

package/lib/commands/test-governance-command-action.js

@@ -1,55 +0,0 @@
-/**
- * @fileoverview CLI action for `aifabrix test-governance` (plan 406)
- * @author AI Fabrix Team
- * @version 1.0.0
- */
-
-'use strict';
-
-const { handleCommandError } = require('../utils/cli-utils');
-const { runTestGovernanceForExternalSystem } = require('./test-governance-external');
-const { normalizeTestGovernanceCliOptions } = require('./test-governance-cli-options');
-const {
-  displayGovernanceRunTTY,
-  printGovernanceRunJson,
-  exitCodeFromGovernanceSummary
-} = require('../governance/governance-run-display');
-
-/**
- * @async
- * @param {string} appName
- * @param {Object} options
- * @param {import('commander').Command} [cmd]
- */
-async function runTestGovernanceCommandAction(appName, options, cmd) {
-  const opts = normalizeTestGovernanceCliOptions(options, cmd);
-  const { result, packPath, systemKey } = await runTestGovernanceForExternalSystem(appName, opts);
-
-  if (opts.json) {
-    printGovernanceRunJson(result);
-  } else {
-    displayGovernanceRunTTY(systemKey, result, {
-      verbose: opts.verbose,
-      packPath
-    });
-  }
-
-  const exitCode = exitCodeFromGovernanceSummary(result.summary);
-  if (exitCode !== 0) {
-    process.exit(exitCode);
-  }
-}
-
-async function testGovernanceCommandHandler(appName, options, cmd) {
-  try {
-    await runTestGovernanceCommandAction(appName, options, cmd);
-  } catch (error) {
-    handleCommandError(error, 'test-governance');
-    process.exit(3);
-  }
-}
-
-module.exports = {
-  runTestGovernanceCommandAction,
-  testGovernanceCommandHandler
-};