@aifabrix/builder 2.49.2 → 2.51.0

package/templates/applications/dataplane/application.yaml

@@ -5,8 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python  # Explicitly specify Python language
-  version: 2.0.0
-
+  version: 2.0.10
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build dataplane -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -69,7 +68,7 @@ build:
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
   imageRun: exec python -m uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001}
   # Image policy (442.0): explicit Dockerfile COPY; worker/beat via python -m app.core.*
-  # integration/ in image: <systemKey>-deploy.json + application.json|yaml only (no test-*, wizard-configs).
+  # integration/ in image: only onboarding-catalog.json keys (+ deploy/application per key).
   worker: true
   imageRunWorker: exec python -m app.core.celery_worker_main
   imageRunBeat: exec python -m app.core.celery_beat_main
@@ -83,7 +82,9 @@ build:
 # NOT included (auto-configured):
 # - Database URLs, Redis → auto-generated during Azure install
 # - MISO_*, KEYCLOAK_* → auto-generated during Azure install  
-# - AI params (OPENAI_*, AZURE_OPENAI_*) → from controller config
+# - AI params / provider secrets → LLM external systems + secret store
+#   (never product OPENAI_* / AZURE_OPENAI_*). ≥2 providers →
+#   ENTERPRISE_LLM_DEFAULT_SELECTOR (portal LLM category).
 # - ENVIRONMENT → set by deployment target
 
 configuration:
@@ -91,6 +92,7 @@ configuration:
   # Operations & Debugging
   # -------------------------------------------------------------------------
   - name: LOG_LEVEL
+    category: Operations & Debugging
     portalInput:
       field: select
       label: "Log Level"
@@ -101,6 +103,7 @@ configuration:
         - ERROR
 
   - name: ABAC_AUDIT_DETAIL_LEVEL
+    category: Operations & Debugging
     portalInput:
       field: select
       label: "ABAC Audit Detail Level"
@@ -109,6 +112,7 @@ configuration:
         - detailed
 
   - name: RBAC_AUDIT_DETAIL_LEVEL
+    category: Operations & Debugging
     portalInput:
       field: select
       label: "RBAC Audit Detail Level"
@@ -118,6 +122,7 @@ configuration:
         - explain
 
   - name: TRUST_CUSTOMER_POLICY_LEVEL
+    category: Trust
     portalInput:
       field: select
       label: "Trust policy level (no-policy defaults)"
@@ -127,6 +132,7 @@ configuration:
         - relaxed
 
   - name: TRUST_PUBLISH_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
       label: "Enforce trust gate on datasource publish"
@@ -135,6 +141,7 @@ configuration:
         - "true"
 
   - name: TRUST_PROMOTE_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
       label: "Enforce trust gate on external system publish (promote scope)"
@@ -143,14 +150,16 @@ configuration:
         - "true"
 
   - name: TRUST_RUNTIME_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
-      label: "Enforce trust gate on CIP execution (runtime scope)"
+      label: "Enforce trust gate on CIP execution and workforce generation inputs (runtime scope)"
       options:
         - "false"
         - "true"
 
   - name: TRUST_AI_EXPOSURE_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
       label: "Enforce trust gate on AI document-storage prompt generation"
@@ -164,24 +173,28 @@ configuration:
   # Tune based on customer data volumes and external API characteristics
 
   - name: CIP_EXECUTION_MAX_RECORDS
+    category: CIP Execution
     portalInput:
       field: text
       label: "Max Records per CIP Execution"
       placeholder: "100000"
 
   - name: CIP_EXECUTION_MAX_RESPONSE_SIZE_MB
+    category: CIP Execution
     portalInput:
       field: text
       label: "Max Response Size (MB)"
       placeholder: "100.0"
 
   - name: CIP_EXECUTION_OPERATION_TIMEOUT
+    category: CIP Execution
     portalInput:
       field: text
       label: "Operation Timeout (seconds)"
       placeholder: "300.0"
 
   - name: CIP_EXECUTION_HTTP_TIMEOUT
+    category: CIP Execution
     portalInput:
       field: text
       label: "HTTP Request Timeout (seconds)"
@@ -193,13 +206,22 @@ configuration:
   # Tune to match external API rate limits
 
   - name: CIP_EXECUTION_RATE_LIMIT_REQUESTS_PER_SECOND
+    category: CIP Rate Limiting
     portalInput:
       field: text
       label: "Rate Limit (requests/second)"
       placeholder: "10.0"
 
   - name: CIP_EXECUTION_RATE_LIMIT_BURST_SIZE
+    category: CIP Rate Limiting
     portalInput:
       field: text
       label: "Rate Limit Burst Size"
       placeholder: "20"
+
+  - name: ENTERPRISE_LLM_DEFAULT_SELECTOR
+    category: LLM
+    portalInput:
+      field: text
+      label: "Default LLM provider (system key when two or more providers)"
+      placeholder: "openai"

package/templates/applications/dataplane/env.template

@@ -14,8 +14,9 @@ ENVIRONMENT=dev
 DEBUG=false
 # Logging level: DEBUG, INFO, WARNING, ERROR, CRITICAL
 LOG_LEVEL=INFO
-# Log format: json or text
-LOG_FORMAT=json
+# Platform / enterprise language for Evidence platformText + Knowledge enterpriseLanguage.
+# V1: English only. Do not change after install — no retranslation migration in V1.
+AIFABRIX_PLATFORM_LANGUAGE=en
 # Path for log file output.
 # Docker default (no volume): use LOG_FILE_PATH=/app/logs/app.log (directory created in image).
 # Production with persistent logs: use /mnt/data/logs/app.log and mount a volume at /mnt/data.
@@ -43,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.0
+VERSION=2.0.10
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5
@@ -79,8 +80,9 @@ VECTOR_DATABASE_URL=kv://databases-dataplane-1-urlKeyVault
 DB_1_PASSWORD=kv://databases-dataplane-1-passwordKeyVault
 
 # Base path for document binary storage (used when datasource config has no processing.fileStoragePath).
-# Dataplane creates subdirs per datasource key (e.g. DOCUMENT_STORAGE_BASE_PATH/test-e2e-sharepoint-documents).
-# Production: use a writable path (e.g. /data/documents) and mount a volume. Local/Docker: use /tmp/documents or /app/data/documents.
+# Dataplane creates subdirs per datasource key (e.g. DOCUMENT_STORAGE_BASE_PATH/test-e2e-sharepoint-deals).
+# Container (--reload): /mnt/data/documents with repo mount/ bind-mounted to /mnt/data.
+# Host root .env: aifabrix resolve substitutes /mnt/data → <repo>/mount (e.g. mount/documents).
 DOCUMENT_STORAGE_BASE_PATH=/mnt/data/documents
 
 # Logs Database Configuration (for execution, audit, ABAC traces)
@@ -134,8 +136,6 @@ MISO_CLIENTSECRET=kv://dataplane-client-secretKeyVault
 # Keycloak Configuration (for OAuth2 endpoints)
 # Public: browser / issuer (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH=/auth).
 KEYCLOAK_SERVER_URL=url://keycloak-public
-# Internal: server-to-Keycloak HTTP (docker: service:port + /auth from keycloak application.yaml)
-KEYCLOAK_INTERNAL_SERVER_URL=url://keycloak-internal
 KEYCLOAK_REALM=aifabrix
 
 # =============================================================================
@@ -154,9 +154,14 @@ MISO_LOGOUT_URL=/logout
 MISO_PIPELINE_ENV_KEY=
 
 # LLM: chat/embed route through governed enterprise-llm only. Provider credentials
-# live on LLM provider external systems (integration/openai, azure-openai, ollama).
-# Shared secret for integration/openai: secrets-openaiApiKeyVault (af secret set ... --shared)
-AI_VALIDATION_LLM_MODEL=gpt-4o-mini
+# live on LLM provider external systems + dataplane secret store (not product .env).
+# When ≥2 LLM providers are published under enterprise-llm, set selectorKey
+# (system key), e.g. openai | azure-openai | ollama. Ignored when only one.
+# Prefer portal Configuration category LLM after deploy; this env is the resolve target.
+# Default LLM provider systemKey when ≥2 LLM providers are published under
+# enterprise-llm (fail-closed if empty). Portal category LLM can override.
+# Lab default: openai (catalog also ships azure-openai).
+ENTERPRISE_LLM_DEFAULT_SELECTOR=openai
 
 # =============================================================================
 # AUDIT CONFIGURATION
@@ -193,6 +198,22 @@ AUDIT_ASYNC_SHADOW_ENQUEUE=false
 # Set true for local dev policy CRUD; pair with VITE_POLICY_MANAGEMENT_ENABLED=true in app-ui.
 POLICY_MANAGEMENT_API_ENABLED=false
 
+# Role Assistant debug defaults (Assistants admin overrides per assistant):
+#   debugEnabled      → agent_workforce.debugTraceEnabled
+#   fullDebugEnabled  → agent_workforce.debugFullEnabled (system-prompt capture)
+#   debugRetentionDays → agent_workforce.debugTraceRetentionDays
+WORKFORCE_RUNTIME_DEBUG_TRACE_ENABLED=false
+# Shared retention for WorkerRuntimeDebugTrace + LlmPromptDebugCapture (daily Celery purge).
+# WORKFORCE_RUNTIME_DEBUG_TRACE_RETENTION_DAYS=30
+# WORKFORCE_RUNTIME_DEBUG_TRACE_MAX_ROWS_PER_TASK=500
+
+# Platform default for Role Assistant fullDebugEnabled when assistant has no override.
+# When unset: enabled in LOCAL_MODE or when WORKFORCE_RUNTIME_DEBUG_TRACE_ENABLED=true.
+# Prefer Assistants admin → Full debug per Role Assistant.
+# LLM_PROMPT_DEBUG_CAPTURE_ENABLED=
+# LLM_PROMPT_DEBUG_SYSTEM_PROMPT_MAX_CHARS=32000
+# LLM_PROMPT_DEBUG_USER_CONTENT_MAX_CHARS=4000
+
 # VIEW_MODULES — optional comma-separated UI module allowlist (unset = all modules).
 # Keys: dashboard, work, content-review, assistants, connected-systems, templates,
 # audit-logs, ai-trust, administration (deep link only; never sidebar in V1).
@@ -219,7 +240,6 @@ FIRST_PARTY_HTTP_INTERNAL_SPEC_EXTERNAL_SYSTEM_ID=
 
 # OpenTelemetry Configuration
 OPENTELEMETRY_ENABLED=false
-OPENTELEMETRY_ENDPOINT=
 
 # =============================================================================
 # INTEGRATION CERTIFICATE SIGNING (RS256 PEM)
@@ -234,10 +254,10 @@ DATAPLANE_PUBLIC_KEY_ID=
 # engine uses RS256. When unset and LOCAL_MODE=true, a process-local ephemeral RSA keypair is used
 # (still RS256, with publicKey + publicKeyFingerprint on issued certs). Non-local requires PEM keys.
 # PEM values are often multi-line; resolve via secret store / deploy pipeline (kv://) or inject as env.
-CERTIFICATE_PRIVATE_KEY=
-CERTIFICATE_PUBLIC_KEY=
+CERTIFICATE_PRIVATE_KEY=kv://secrets-certificatePrivateKeyVault
+CERTIFICATE_PUBLIC_KEY=kv://secrets-certificatePublicKeyVault
 # Optional public key identifier for issued certificates; default if unset: dataplane-signing-key
-CERTIFICATE_PUBLIC_KEY_ID=
+CERTIFICATE_PUBLIC_KEY_ID=dev01-dataplane-signing
 
 # =============================================================================
 # VALIDATION ENGINE — YAML CONTRACTS
@@ -296,11 +316,14 @@ TRUST_CUSTOMER_POLICY_LEVEL=standard
 #
 # Opt-in gates (default false). When true, trust is evaluated at the call site;
 # DENY/REVIEW can block the operation (e.g. datasource publish returns 403).
+# Enterprise Knowledge COM compile and Digital Worker capability generation reuse
+# these gates via app/services/workforce/enterprise_binding_eligibility.py when
+# collecting generation bindings (published + trust-ready datasources only).
 # Datasource publish — scope publish; runs before marking the datasource published
 TRUST_PUBLISH_GATE_ENABLED=false
 # External system publish — scope promote; evaluated per active datasource first
 TRUST_PROMOTE_GATE_ENABLED=false
-# CIP operation execution — scope runtime; evaluation uses live/runtime checks
+# CIP operation execution — scope runtime; also filters workforce/EK generation inputs
 TRUST_RUNTIME_GATE_ENABLED=false
 # Document-storage AI system prompt generation — scope aiExposure; before LLM call
 TRUST_AI_EXPOSURE_GATE_ENABLED=false

package/templates/applications/dataplane/rbac.yaml

@@ -27,9 +27,14 @@ roles:
 
   - name: "AI Fabrix Developer"
     value: "aifabrix-developer"
-    description: "Developer access to deploy applications via GitHub Actions"
+    description: "Developer access to deploy applications via CI pipelines"
     groups: ["AI-Fabrix-Developers"]
 
+  - name: "AI Fabrix Business Transformation"
+    value: "aifabrix-business-transformation"
+    description: "Built-in assistant: business intention → governed Connected Systems via Runtime and builder-api"
+    groups: ["AI-Fabrix-Business-Transformation"]
+
   - name: "AI Fabrix Observer"
     value: "aifabrix-observer"
     description: "Read-only access to monitoring, logs, and compliance reports"
@@ -312,6 +317,10 @@ permissions:
       ]
     description: "Discover business context (semantics, exposure, enabled governance, tools, validation state) for external systems"
 
+  - name: "external-system:data-manager"
+    roles: ["aifabrix-platform-admin"]
+    description: "Reset (purge) all stored records, document rows, vectors, relations, and sync job history for a datasource (keeps datasource config)"
+
   - name: "governance:evaluate"
     roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-developer"]
     description: "Run governance scenario acceptance (subject impersonation for ABAC proof)"
@@ -362,7 +371,9 @@ permissions:
         "aifabrix-developer",
         "aifabrix-ai-trust-operator",
       ]
-    description: "Update assistantName or preferredChannel on a user activation"
+    description: >-
+      Update assistantName or preferredChannel on a user activation, and
+      work.continue on Process Executions
 
   - name: "worker:archive"
     roles:
@@ -380,7 +391,9 @@ permissions:
         "aifabrix-security-admin",
         "aifabrix-ai-trust-operator",
       ]
-    description: "Approve or reject pending worker tasks"
+    description: >-
+      Approve or reject pending worker tasks, and record human.respond
+      (ask or approval) on Process Executions
 
   - name: "worker:manager-read"
     roles:
@@ -391,7 +404,67 @@ permissions:
       ]
     description: "Read manager-scoped workforce impact aggregates (no task detail)"
 
+  # Evidence Fabrix v2 operator + runtime retrieval (453.1 / 453.2)
+  - name: "evidence:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "List, get, and retrieve Evidence Fabrix v2 rows for planning"
+
+  - name: "evidence:manage"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Create, update, delete, and reorder Evidence Fabrix v2 rows"
+
+  # Knowledge Asset platform (465.1) — no public knowledge:create
+  - name: "knowledge:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+        "aifabrix-observer",
+      ]
+    description: "List and get Knowledge Assets and EnterpriseLineage edges"
+
+  - name: "knowledge:update"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Update draft Knowledge Assets or supersede active versions"
+
+  - name: "knowledge:archive"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Archive Knowledge Assets and cascade disposable projections"
+
+  - name: "knowledge:delete"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Soft-delete Knowledge Assets and cascade disposable projections"
+
   # Workforce subscriptions (436.11 / 438.6)
+  # Role Assistant surfaces use worker:* (already defined above) — not agentWorkforce:*.
   - name: "subscription:read"
     roles:
       [
@@ -403,6 +476,15 @@ permissions:
       ]
     description: "List workforce subscriptions and execution audit rows"
 
+  - name: "subscription:write"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-deployment-admin",
+      ]
+    description: "Create and update workforce subscriptions"
+
   - name: "subscription:run"
     roles:
       [

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '1.9.5'
+  version: '2.0.8'
 
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
@@ -81,6 +81,7 @@ configuration:
   # Operations & Debugging
   # -------------------------------------------------------------------------
   - name: LOG_LEVEL
+    category: General
     portalInput:
       field: select
       label: 'Log Level'
@@ -91,6 +92,7 @@ configuration:
         - error
 
   - name: ENABLE_API_DOCS
+    category: General
     portalInput:
       field: select
       label: 'Enable API Documentation (Swagger/ReDoc)'
@@ -99,6 +101,7 @@ configuration:
         - 'false'
 
   - name: FAST_STARTUP
+    category: General
     portalInput:
       field: select
       label: 'Fast Startup (skip non-critical init)'
@@ -107,6 +110,7 @@ configuration:
         - 'false'
 
   - name: LOG_TO_FILE
+    category: General
     portalInput:
       field: select
       label: 'Log to File'
@@ -118,6 +122,7 @@ configuration:
   # Keycloak Events (feature flag)
   # -------------------------------------------------------------------------
   - name: KEYCLOAK_EVENTS_ENABLED
+    category: General
     portalInput:
       field: select
       label: 'Keycloak Events (sync users/groups)'
@@ -129,12 +134,14 @@ configuration:
   # Rate Limiting (tune for environment)
   # -------------------------------------------------------------------------
   - name: RATE_LIMIT_WINDOW_MS
+    category: General
     portalInput:
       field: text
       label: 'Rate Limit Window (milliseconds)'
       placeholder: '900000'
 
   - name: RATE_LIMIT_MAX
+    category: General
     portalInput:
       field: text
       label: 'Rate Limit Max Requests per Window'
@@ -144,12 +151,14 @@ configuration:
   # Redis Cache TTL (seconds) – RBAC/roles caching
   # -------------------------------------------------------------------------
   - name: REDIS_ROLES_TTL
+    category: Redis
     portalInput:
       field: text
       label: 'Redis Roles Cache TTL (seconds)'
       placeholder: '900'
 
   - name: REDIS_PERMISSIONS_TTL
+    category: Redis
     portalInput:
       field: text
       label: 'Redis Permissions Cache TTL (seconds)'

package/templates/applications/miso-controller/env.template

@@ -63,6 +63,8 @@ NODE_ENV=dev
 PORT=${PORT}
 AUTO_CREATE_TABLES=true
 FAST_STARTUP=false
+# Pending Prisma migrations still run on startup unless set to false (even when FAST_STARTUP=true).
+# AUTO_RUN_MIGRATIONS=false
 ENABLE_API_DOCS=true
 
 # Rate Limiting Configuration (for local development)
@@ -157,8 +159,6 @@ WAIT_FOR_KEYCLOAK=true
 # For production: use public domain (e.g., https://miso.example.com)
 # url://public includes front-door path from application.yaml (e.g. /controller).
 MISO_WEB_SERVER_URL=url://public
-# Provider-grant OAuth redirect_uri base (Azure/start-dev also set this explicitly; code falls back to MISO_WEB_SERVER_URL)
-CONTROLLER_BASE_URL=url://public
 MISO_CONTROLLER_URL=url://internal
 MISO_RELATIVE_PATH=url://vdir-public
 ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private
@@ -191,7 +191,7 @@ CONTROLLER_EVALUATION=
 #
 # Delegated Graph (second redirect URI on the same vendor app): see section below.
 ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=kv://entra-callback-uri
+ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
@@ -244,7 +244,7 @@ DEPLOYMENT=database
 ENCRYPTION_KEY=kv://miso-controller-secrets-encryptionKeyVault
 
 # Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only)
-BOOTSTRAP_APPKEYS=dataplane
+BOOTSTRAP_APPKEYS=dataplane,builder-api
 
 # Key Vault Integration (for security parameter encryption)
 # Set to true to enable Azure Key Vault for storing security parameters
@@ -267,16 +267,16 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 #
 # Development: set to DEVELOPMENT to disable license validation (no Mori/JWT required):
 #   LICENSE_JWT=DEVELOPMENT
-# - Use only for local development; do not use in production.
-LICENSE_JWT=DEVELOPMENT
+# - Use only for local development (DEPLOYMENT=local|database|azure-mock).
+# - Ignored when DEPLOYMENT=azure (Azure marketplace / App Service installs).
+LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 
 # =============================================================================
 # ENTRA ID ONBOARDING (delegated Graph via Mori)
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
-# …/entra-graph-delegated/callback. Example (001 dev Mori API):
-# ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix001-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=
+# …/entra-graph-delegated/callback. Shared pro Mori (CICD):
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -289,7 +289,8 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=
 # =============================================================================
 
 MORI_BASE_URL=url://mori-controller-public
-MORI_AUTH_METHOD=apiKey
+MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault
+MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
 MORI_USERNAME=kv://mori-controller-basic-usernameKeyVault
 MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault

package/templates/applications/miso-controller/rbac.yaml

@@ -303,6 +303,78 @@ permissions:
     roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
     description: 'Delete dimensions and dimension values'
 
+  # Resource Type Management
+  - name: 'resource-types:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View resource types'
+
+  - name: 'resource-types:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Create resource types'
+
+  - name: 'resource-types:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Update resource types'
+
+  - name: 'resource-types:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete resource types'
+
+  # Business Role Management (COM — not RBAC auth roles)
+  - name: 'roles:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View business roles'
+
+  - name: 'roles:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Create business roles'
+
+  - name: 'roles:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Update business roles'
+
+  - name: 'roles:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete business roles'
+
+  # Evidence Kind Management
+  - name: 'evidence-kinds:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View evidence kinds'
+
+  - name: 'evidence-kinds:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Create evidence kinds'
+
+  - name: 'evidence-kinds:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Update evidence kinds'
+
+  - name: 'evidence-kinds:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete evidence kinds'
+
   # Token Providers
   - name: 'token-provider:read'
     roles:

package/templates/channels/README.md

@@ -0,0 +1,18 @@
+# Channel integration templates
+
+Published copies of communication external-system manifests for `aifabrix channel scaffold <target>`.
+
+## SSOT
+
+| Channel | Master location | Publish |
+| --- | --- | --- |
+| **All channel targets** | `aifabrix-dataplane/integration/<target>/` | `make sync-json` in dataplane (copies manifests; **no** `*-deploy.json`) |
+| Targets | `slack`, `teams-bot`, `microsoft-copilot`, `chatgpt`, `web-embed` | See `CHANNEL_INTEGRATION_TARGETS` in dataplane `make/config.mk` |
+
+`channel scaffold` copies files from `integration/` subfolder here into the user's `integration/<target>/`, then generates **only** `<target>-deploy.json` via `aifabrix json`.
+
+Do **not** hardcode manifests in `lib/channels/*.js`.
+
+## Slack App manifest (install)
+
+`manifest.template.json.hbs` and `install.template.md.hbs` are for `aifabrix channel add slack` (Slack developer portal), separate from the external-system integration tree above.