@aifabrix/builder 2.49.1 → 2.50.0

package/scripts/sync-builder-api-template.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+/**
+ * Publish builder/builder-api/ SSOT → templates/applications/builder-api/
+ * (manifest files only — no README; use builder/builder-api/README.md and packages/builder-api/README.md)
+ *
+ * @fileoverview sync-json for builder-api platform app (plan 154.2)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const SSOT_DIR = path.join(REPO_ROOT, 'builder', 'builder-api');
+const TEMPLATE_DIR = path.join(REPO_ROOT, 'templates', 'applications', 'builder-api');
+
+const SYNC_FILES = ['application.yaml', 'Dockerfile', 'env.template'];
+
+/**
+ * Publish builder/builder-api/ SSOT → templates/applications/builder-api/
+ * @returns {void}
+ */
+function main() {
+  if (!fs.existsSync(SSOT_DIR)) {
+    console.error(`Missing SSOT directory: ${SSOT_DIR}`);
+    process.exit(1);
+  }
+  fs.mkdirSync(TEMPLATE_DIR, { recursive: true });
+  for (const name of SYNC_FILES) {
+    const src = path.join(SSOT_DIR, name);
+    const dest = path.join(TEMPLATE_DIR, name);
+    if (!fs.existsSync(src)) {
+      console.error(`Missing SSOT file: ${src}`);
+      process.exit(1);
+    }
+    fs.copyFileSync(src, dest);
+    console.log(`sync-json: ${path.relative(REPO_ROOT, src)} → ${path.relative(REPO_ROOT, dest)}`);
+  }
+}
+
+main();

package/templates/README.md

@@ -13,6 +13,9 @@ Application templates are folder-based and located under `templates/applications
 **Example:**
 - `templates/applications/miso-controller/` - Miso Controller application template
 - `templates/applications/keycloak/` - Keycloak application template
+- `templates/applications/builder-api/` - Builder API platform webapp (published from `builder/builder-api/` via `npm run sync-json`)
+
+**Platform SSOT (builder-api, plan 154.2):** Edit `builder/builder-api/` in the aifabrix-builder repo, then run `npm run sync-json` to publish `application.yaml`, `Dockerfile`, and `env.template` into `templates/applications/builder-api/`. Install with `aifabrix up-platform` or `aifabrix up-builder-api` — not hand-editing the template copy.
 
 **Template Validation:**
 - Template folder must exist in `templates/applications/<name>/`

package/templates/applications/builder-api/Dockerfile

@@ -0,0 +1,38 @@
+# Builder API production image — explicit runtime COPY only (plan 154.3).
+# SSOT: builder/builder-api/Dockerfile — publish with `npm run sync-json`
+# Staging: node scripts/stage_builder_api_for_docker.js (also runs via `aifabrix build builder-api`)
+# Build context: repo root (application.yaml build.context ../..). .dockerignore is second line of defense.
+# Never ship: .cursor/, integration/, tests/, templates/applications|github|infra|*, bin/aifabrix.js, packages/.
+# Allowed templates in image: templates/openapi/, templates/external-system/ (via staging manifest only).
+
+FROM node:20-bookworm-slim
+
+ENV NODE_ENV=production \
+    PORT=3005
+
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends dumb-init \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
+COPY docker-builder-api-staging/lib ./lib
+COPY docker-builder-api-staging/bin/builder-api-spike.js ./bin/builder-api-spike.js
+COPY docker-builder-api-staging/bin/builder-api-cleanup.js ./bin/builder-api-cleanup.js
+COPY docker-builder-api-staging/templates ./templates
+
+RUN addgroup --system appgroup \
+    && adduser --system --ingroup appgroup --home /app appuser \
+    && chown -R appuser:appgroup /app
+USER appuser
+
+EXPOSE 3005
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
+  CMD node -e "require('http').get('http://127.0.0.1:'+(process.env.PORT||3005)+'/api/v1/builder/health',(r)=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
+
+ENTRYPOINT ["dumb-init", "--"]
+CMD ["node", "bin/builder-api-spike.js"]

package/templates/applications/builder-api/application.yaml

@@ -0,0 +1,75 @@
+# Application Metadata
+app:
+  key: builder-api
+  displayName: 'AI Fabrix Builder API'
+  description: 'Stateless HTTP orchestration for external-system workspace lifecycle. Provider-neutral integration flows via Dataplane Enterprise MCP and governance APIs (154.0 / 154.1).'
+  type: webapp
+  language: typescript
+  version: 1.0.0
+
+# Image Configuration
+image:
+  name: aifabrix/builder-api
+  tag: latest
+  registry: aifabrixdevacr.azurecr.io
+  registryMode: acr
+
+# Port Configuration (container port; host port = port + developer_id * 100)
+port: 3005
+
+frontDoorRouting:
+  enabled: false
+
+requires:
+  database: false
+  redis: false
+  storage: true
+
+healthCheck:
+  path: /api/v1/builder/health
+  interval: 30
+  bashProbe: true
+  probePath: /api/v1/builder/health
+  probeRequestType: GET
+  probeProtocol: Https
+  probeIntervalInSeconds: 120
+
+authentication:
+  enableSSO: false
+
+build:
+  context: ../..
+  dockerfile: builder/builder-api/Dockerfile
+  # Image policy (154.3): host staging → docker-builder-api-staging/; explicit COPY in Dockerfile;
+  # .dockerignore deny-by-default; verify with scripts/docker_image_content_gate.js builder-api.
+  envOutputPath: ../../.env
+  language: typescript
+  reloadStart: node bin/builder-api-spike.js
+  imageRun: exec node bin/builder-api-spike.js
+
+repository:
+  enabled: true
+  repositoryUrl: https://github.com/esystemsdev/aifabrix-builder
+
+configuration:
+  - name: LOG_LEVEL
+    portalInput:
+      field: select
+      label: 'Log Level'
+      options:
+        - debug
+        - info
+        - warn
+        - error
+
+  - name: WORKSPACE_DRAFT_TTL_DAYS
+    portalInput:
+      field: text
+      label: 'Draft workspace TTL (days)'
+      placeholder: '30'
+
+  - name: WORKSPACE_INACTIVE_MAX_DAYS
+    portalInput:
+      field: text
+      label: 'Inactive workspace purge threshold (days)'
+      placeholder: '90'

package/templates/applications/builder-api/env.template

@@ -0,0 +1,48 @@
+# Environment Variables Template — builder-api
+# SSOT: builder/builder-api/env.template — publish with `npm run sync-json`
+
+# =============================================================================
+# APPLICATION
+# =============================================================================
+
+PORT=${PORT}
+NODE_ENV=production
+LOG_LEVEL=info
+
+# Multi-user workspace root (persist via /mnt/data volume in Docker)
+WORKSPACE_ROOT=/mnt/data/builder-workspaces
+
+WORKSPACE_DRAFT_TTL_DAYS=30
+WORKSPACE_INACTIVE_MAX_DAYS=90
+
+MAX_BODY_BYTES=10485760
+MAX_UPLOAD_TIMEOUT_MS=300000
+
+# =============================================================================
+# PLATFORM URLS
+# =============================================================================
+# url:// resolves after kv:// at resolve time (see docs/configuration/resolve-running-urls.md)
+
+# Registered OAuth client (populated by aifabrix app register / bootstrap — same as dataplane)
+MISO_CLIENTID=kv://builder-api-client-idKeyVault
+MISO_CLIENTSECRET=kv://builder-api-client-secretKeyVault
+
+# Internal: controller API for token validation (supports all miso-controller auth modes)
+MISO_CONTROLLER_URL=url://miso-controller-internal
+
+# Internal: server-to-dataplane API (MCP execute, upload, governance)
+DATAPLANE_URL=url://dataplane-internal
+
+DEFAULT_ENVIRONMENT=dev
+
+# COM-generated Enterprise MCP owner system (normal MCP execute — no dataplane adapter)
+ENTERPRISE_MCP_SYSTEM_KEY=enterprise-integration-lifecycle
+
+# =============================================================================
+# RUNTIME CONFIG (Docker dev-reload)
+# =============================================================================
+# Resolves kv:// for workspace upload/validate. On the host, symlink or copy under
+# mount/aifabrix/ (bind-mounted at /mnt/data): config.yaml, secrets.local.yaml, certs/
+# from ~/.aifabrix. Symlinks to host paths work because the kernel resolves them on the host.
+
+AIFABRIX_CONFIG=/mnt/data/aifabrix/config.yaml

package/templates/applications/dataplane/application.yaml

@@ -145,7 +145,7 @@ configuration:
   - name: TRUST_RUNTIME_GATE_ENABLED
     portalInput:
       field: select
-      label: "Enforce trust gate on CIP execution (runtime scope)"
+      label: "Enforce trust gate on CIP execution and workforce generation inputs (runtime scope)"
       options:
         - "false"
         - "true"

package/templates/applications/dataplane/env.template

@@ -79,8 +79,9 @@ VECTOR_DATABASE_URL=kv://databases-dataplane-1-urlKeyVault
 DB_1_PASSWORD=kv://databases-dataplane-1-passwordKeyVault
 
 # Base path for document binary storage (used when datasource config has no processing.fileStoragePath).
-# Dataplane creates subdirs per datasource key (e.g. DOCUMENT_STORAGE_BASE_PATH/test-e2e-sharepoint-documents).
-# Production: use a writable path (e.g. /data/documents) and mount a volume. Local/Docker: use /tmp/documents or /app/data/documents.
+# Dataplane creates subdirs per datasource key (e.g. DOCUMENT_STORAGE_BASE_PATH/test-e2e-sharepoint-deals).
+# Container (--reload): /mnt/data/documents with repo mount/ bind-mounted to /mnt/data.
+# Host root .env: aifabrix resolve substitutes /mnt/data → <repo>/mount (e.g. mount/documents).
 DOCUMENT_STORAGE_BASE_PATH=/mnt/data/documents
 
 # Logs Database Configuration (for execution, audit, ABAC traces)
@@ -234,10 +235,10 @@ DATAPLANE_PUBLIC_KEY_ID=
 # engine uses RS256. When unset and LOCAL_MODE=true, a process-local ephemeral RSA keypair is used
 # (still RS256, with publicKey + publicKeyFingerprint on issued certs). Non-local requires PEM keys.
 # PEM values are often multi-line; resolve via secret store / deploy pipeline (kv://) or inject as env.
-CERTIFICATE_PRIVATE_KEY=
-CERTIFICATE_PUBLIC_KEY=
+CERTIFICATE_PRIVATE_KEY=kv://secrets-certificatePrivateKeyVault
+CERTIFICATE_PUBLIC_KEY=kv://secrets-certificatePublicKeyVault
 # Optional public key identifier for issued certificates; default if unset: dataplane-signing-key
-CERTIFICATE_PUBLIC_KEY_ID=
+CERTIFICATE_PUBLIC_KEY_ID=dev01-dataplane-signing
 
 # =============================================================================
 # VALIDATION ENGINE — YAML CONTRACTS
@@ -296,11 +297,14 @@ TRUST_CUSTOMER_POLICY_LEVEL=standard
 #
 # Opt-in gates (default false). When true, trust is evaluated at the call site;
 # DENY/REVIEW can block the operation (e.g. datasource publish returns 403).
+# Enterprise Knowledge COM compile and Digital Worker capability generation reuse
+# these gates via app/services/workforce/enterprise_binding_eligibility.py when
+# collecting generation bindings (published + trust-ready datasources only).
 # Datasource publish — scope publish; runs before marking the datasource published
 TRUST_PUBLISH_GATE_ENABLED=false
 # External system publish — scope promote; evaluated per active datasource first
 TRUST_PROMOTE_GATE_ENABLED=false
-# CIP operation execution — scope runtime; evaluation uses live/runtime checks
+# CIP operation execution — scope runtime; also filters workforce/EK generation inputs
 TRUST_RUNTIME_GATE_ENABLED=false
 # Document-storage AI system prompt generation — scope aiExposure; before LLM call
 TRUST_AI_EXPOSURE_GATE_ENABLED=false

package/templates/applications/dataplane/rbac.yaml

@@ -27,7 +27,7 @@ roles:
 
   - name: "AI Fabrix Developer"
     value: "aifabrix-developer"
-    description: "Developer access to deploy applications via GitHub Actions"
+    description: "Developer access to deploy applications via CI pipelines"
     groups: ["AI-Fabrix-Developers"]
 
   - name: "AI Fabrix Observer"
@@ -391,6 +391,26 @@ permissions:
       ]
     description: "Read manager-scoped workforce impact aggregates (no task detail)"
 
+  # Evidence Fabrix v2 operator + runtime retrieval (453.1 / 453.2)
+  - name: "evidence:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "List, get, and retrieve Evidence Fabrix v2 rows for planning"
+
+  - name: "evidence:manage"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Create, update, delete, and reorder Evidence Fabrix v2 rows"
+
   # Workforce subscriptions (436.11 / 438.6)
   - name: "subscription:read"
     roles:

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '1.9.5'
+  version: '2.0.0'
 
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)

package/templates/applications/miso-controller/env.template

@@ -157,8 +157,6 @@ WAIT_FOR_KEYCLOAK=true
 # For production: use public domain (e.g., https://miso.example.com)
 # url://public includes front-door path from application.yaml (e.g. /controller).
 MISO_WEB_SERVER_URL=url://public
-# Provider-grant OAuth redirect_uri base (Azure/start-dev also set this explicitly; code falls back to MISO_WEB_SERVER_URL)
-CONTROLLER_BASE_URL=url://public
 MISO_CONTROLLER_URL=url://internal
 MISO_RELATIVE_PATH=url://vdir-public
 ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private
@@ -244,7 +242,7 @@ DEPLOYMENT=database
 ENCRYPTION_KEY=kv://miso-controller-secrets-encryptionKeyVault
 
 # Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only)
-BOOTSTRAP_APPKEYS=dataplane
+BOOTSTRAP_APPKEYS=dataplane,builder-api
 
 # Key Vault Integration (for security parameter encryption)
 # Set to true to enable Azure Key Vault for storing security parameters

package/templates/channels/README.md

@@ -0,0 +1,18 @@
+# Channel integration templates
+
+Published copies of communication external-system manifests for `aifabrix channel scaffold <target>`.
+
+## SSOT
+
+| Channel | Master location | Publish |
+| --- | --- | --- |
+| **All channel targets** | `aifabrix-dataplane/integration/<target>/` | `make sync-json` in dataplane (copies manifests; **no** `*-deploy.json`) |
+| Targets | `slack`, `teams-bot`, `microsoft-copilot`, `chatgpt`, `web-embed` | See `CHANNEL_INTEGRATION_TARGETS` in dataplane `make/config.mk` |
+
+`channel scaffold` copies files from `integration/` subfolder here into the user's `integration/<target>/`, then generates **only** `<target>-deploy.json` via `aifabrix json`.
+
+Do **not** hardcode manifests in `lib/channels/*.js`.
+
+## Slack App manifest (install)
+
+`manifest.template.json.hbs` and `install.template.md.hbs` are for `aifabrix channel add slack` (Slack developer portal), separate from the external-system integration tree above.

package/templates/channels/chatgpt/install.template.md.hbs

@@ -1,33 +1,30 @@
-# {{appName}} — assistant channel install
+# {{appName}} — ChatGPT assistant channel install
 
 {{appDescription}}
 
 Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
 
-## Platform callback URLs
+## Connect ChatGPT workspace (admin)
 
-Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+1. Sign in to [OpenAI Platform](https://platform.openai.com/) or your **ChatGPT Enterprise** workspace admin console.
+2. Create a custom GPT, workspace connector, or MCP integration using the generated manifest from `dist/channels/chatgpt/channel-chatgpt.json`.
+3. Configure the **OpenAPI specification URL** and **MCP endpoint** from **Platform endpoints** below.
+4. Complete OAuth or API key setup as required by your ChatGPT deployment model.
+5. Save the **API key** or **OAuth client credentials** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
+6. Publish the connector to your workspace and complete admin approval if your organization requires it.
 
-{{#if eventsUrl}}
-- **Events:** {{eventsUrl}}
-{{/if}}
-{{#if interactionUrl}}
-- **Interactivity:** {{interactionUrl}}
-{{/if}}
-{{#if commandUrl}}
-- **Slash commands:** {{commandUrl}}
-{{/if}}
-{{#if oauthCallbackUrl}}
-- **OAuth redirect:** {{oauthCallbackUrl}}
-{{/if}}
-{{#if messagesUrl}}
-- **Bot messages:** {{messagesUrl}}
+## Platform endpoints
+
+Configure these on the ChatGPT connector / custom GPT. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+
+{{#if openapiUrl}}
+- **OpenAPI spec:** {{openapiUrl}}
 {{/if}}
-{{#if notificationsUrl}}
-- **Notifications:** {{notificationsUrl}}
+{{#if mcpUrl}}
+- **MCP:** {{mcpUrl}}
 {{/if}}
-{{#if botConfigUrl}}
-- **Bot config:** {{botConfigUrl}}
+{{#if actionsBaseUrl}}
+- **Actions base:** {{actionsBaseUrl}}
 {{/if}}
 
 ## Assistant catalog
@@ -36,14 +33,14 @@ Runtime lists **assistants** available to each user from:
 
 {{assistantCatalogUrl}}
 
-## After admin approval
+## After workspace approval
 
 ```bash
-aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+aifabrix channel add {{channelTarget}} --name "{{baseName}}"
 ```
 
 Optional validation:
 
 ```bash
-aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
 ```

package/templates/channels/chatgpt/integration/README.md

@@ -0,0 +1,11 @@
+# ChatGPT assistant channel (lab fixture)
+
+SSOT for `aifabrix channel scaffold chatgpt` templates (`make sync-json` → builder).
+
+```bash
+cd aifabrix-dataplane
+aifabrix validate chatgpt
+aifabrix upload chatgpt --probe
+aifabrix deploy chatgpt
+aifabrix app add-channel chatgpt --name "Your Assistant"
+```

package/templates/channels/chatgpt/integration/application.json

@@ -0,0 +1,15 @@
+{
+  "app": {
+    "key": "chatgpt",
+    "displayName": "ChatGPT assistant channel",
+    "description": "Assistant communication channel — deploy then app add-channel",
+    "type": "external"
+  },
+  "externalIntegration": {
+    "schemaBasePath": "./",
+    "systems": ["chatgpt-system.json"],
+    "dataSources": [],
+    "autopublish": true,
+    "version": "1.0.0"
+  }
+}

package/templates/channels/chatgpt/integration/chatgpt-system.json

@@ -0,0 +1,29 @@
+{
+  "key": "chatgpt",
+  "displayName": "ChatGPT assistant channel",
+  "description": "Communication external system for ChatGPT assistant channel install",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "credential",
+    "credential": {
+      "credentialKey": "chatgpt-channel",
+      "displayName": "ChatGPT assistant channel",
+      "method": "apikey",
+      "writeOnce": true,
+      "variables": {
+        "baseUrl": "https://api.openai.com/v1"
+      },
+      "security": {
+        "apiKey": "kv://chatgpt/apiKey"
+      },
+      "formFields": [
+        { "name": "apiKey", "required": true }
+      ]
+    }
+  },
+  "configuration": [],
+  "dataSources": [],
+  "endpointsActive": false
+}

package/templates/channels/chatgpt/integration/env.template

@@ -0,0 +1,4 @@
+# ChatGPT assistant channel — lab fixture secrets
+# aifabrix secret set chatgpt/apiKey "<value>" --shared
+
+KV_CHATGPT_APIKEY=kv://chatgpt/apiKey

package/templates/channels/microsoft-copilot/install.template.md.hbs

@@ -1,33 +1,28 @@
-# {{appName}} — assistant channel install
+# {{appName}} — Microsoft Copilot assistant channel install
 
 {{appDescription}}
 
 Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
 
-## Platform callback URLs
+## Publish the Copilot extension (M365 admin)
 
-Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+1. Sign in to [Microsoft 365 admin](https://admin.cloud.microsoft.com/) or **Copilot Studio** as a tenant admin.
+2. Create or open a Copilot extensibility project (declarative agent or API plugin).
+3. Import or configure using the generated manifest JSON from `dist/channels/microsoft-copilot/channel-microsoft-copilot.json`.
+4. Point the **OpenAPI** and **action** endpoints to the URLs in **Platform endpoints** below.
+5. Register OAuth client credentials for the API provider connection when the platform prompts for them.
+6. Save the **OAuth client ID** and **client secret** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
+7. Submit for M365 admin approval and publish to your organization when review completes.
 
-{{#if eventsUrl}}
-- **Events:** {{eventsUrl}}
-{{/if}}
-{{#if interactionUrl}}
-- **Interactivity:** {{interactionUrl}}
-{{/if}}
-{{#if commandUrl}}
-- **Slash commands:** {{commandUrl}}
-{{/if}}
-{{#if oauthCallbackUrl}}
-- **OAuth redirect:** {{oauthCallbackUrl}}
-{{/if}}
-{{#if messagesUrl}}
-- **Bot messages:** {{messagesUrl}}
-{{/if}}
-{{#if notificationsUrl}}
-- **Notifications:** {{notificationsUrl}}
+## Platform endpoints
+
+Configure these on the Copilot connector / API plugin. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+
+{{#if openapiUrl}}
+- **OpenAPI spec:** {{openapiUrl}}
 {{/if}}
-{{#if botConfigUrl}}
-- **Bot config:** {{botConfigUrl}}
+{{#if actionsBaseUrl}}
+- **Actions base:** {{actionsBaseUrl}}
 {{/if}}
 
 ## Assistant catalog
@@ -36,14 +31,14 @@ Runtime lists **assistants** available to each user from:
 
 {{assistantCatalogUrl}}
 
-## After admin approval
+## After M365 admin approval
 
 ```bash
-aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+aifabrix channel add {{channelTarget}} --name "{{baseName}}"
 ```
 
 Optional validation:
 
 ```bash
-aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
 ```

package/templates/channels/microsoft-copilot/integration/README.md

@@ -0,0 +1,11 @@
+# Microsoft Copilot assistant channel (lab fixture)
+
+SSOT for `aifabrix channel scaffold microsoft-copilot` templates (`make sync-json` → builder).
+
+```bash
+cd aifabrix-dataplane
+aifabrix validate microsoft-copilot
+aifabrix upload microsoft-copilot --probe
+aifabrix deploy microsoft-copilot
+aifabrix app add-channel microsoft-copilot --name "Your Assistant"
+```

package/templates/channels/microsoft-copilot/integration/application.json

@@ -0,0 +1,15 @@
+{
+  "app": {
+    "key": "microsoft-copilot",
+    "displayName": "Microsoft Copilot assistant channel",
+    "description": "Assistant communication channel — deploy then app add-channel",
+    "type": "external"
+  },
+  "externalIntegration": {
+    "schemaBasePath": "./",
+    "systems": ["microsoft-copilot-system.json"],
+    "dataSources": [],
+    "autopublish": true,
+    "version": "1.0.0"
+  }
+}

package/templates/channels/microsoft-copilot/integration/env.template

@@ -0,0 +1,6 @@
+# Microsoft Copilot assistant channel — lab fixture secrets
+# aifabrix secret set microsoft-copilot/clientId "<value>" --shared
+# aifabrix secret set microsoft-copilot/clientSecret "<value>" --shared
+
+KV_MICROSOFT_COPILOT_CLIENTID=kv://microsoft-copilot/clientId
+KV_MICROSOFT_COPILOT_CLIENTSECRET=kv://microsoft-copilot/clientSecret

package/templates/channels/microsoft-copilot/integration/microsoft-copilot-system.json

@@ -0,0 +1,34 @@
+{
+  "key": "microsoft-copilot",
+  "displayName": "Microsoft Copilot assistant channel",
+  "description": "Communication external system for Microsoft Copilot assistant channel install",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "credential",
+    "credential": {
+      "credentialKey": "microsoft-copilot-channel",
+      "displayName": "Microsoft Copilot assistant channel",
+      "method": "oauth2",
+      "writeOnce": true,
+      "variables": {
+        "tokenUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+        "grantType": "client_credentials",
+        "scope": "https://graph.microsoft.com/.default",
+        "baseUrl": "https://graph.microsoft.com/v1.0"
+      },
+      "security": {
+        "clientId": "kv://microsoft-copilot/clientId",
+        "clientSecret": "kv://microsoft-copilot/clientSecret"
+      },
+      "formFields": [
+        { "name": "clientId", "required": true },
+        { "name": "clientSecret", "required": true }
+      ]
+    }
+  },
+  "configuration": [],
+  "dataSources": [],
+  "endpointsActive": false
+}