@aifabrix/builder 2.50.0 → 2.51.0

package/templates/applications/dataplane/env.template

@@ -14,8 +14,9 @@ ENVIRONMENT=dev
 DEBUG=false
 # Logging level: DEBUG, INFO, WARNING, ERROR, CRITICAL
 LOG_LEVEL=INFO
-# Log format: json or text
-LOG_FORMAT=json
+# Platform / enterprise language for Evidence platformText + Knowledge enterpriseLanguage.
+# V1: English only. Do not change after install — no retranslation migration in V1.
+AIFABRIX_PLATFORM_LANGUAGE=en
 # Path for log file output.
 # Docker default (no volume): use LOG_FILE_PATH=/app/logs/app.log (directory created in image).
 # Production with persistent logs: use /mnt/data/logs/app.log and mount a volume at /mnt/data.
@@ -43,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.0
+VERSION=2.0.10
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5
@@ -135,8 +136,6 @@ MISO_CLIENTSECRET=kv://dataplane-client-secretKeyVault
 # Keycloak Configuration (for OAuth2 endpoints)
 # Public: browser / issuer (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH=/auth).
 KEYCLOAK_SERVER_URL=url://keycloak-public
-# Internal: server-to-Keycloak HTTP (docker: service:port + /auth from keycloak application.yaml)
-KEYCLOAK_INTERNAL_SERVER_URL=url://keycloak-internal
 KEYCLOAK_REALM=aifabrix
 
 # =============================================================================
@@ -155,9 +154,14 @@ MISO_LOGOUT_URL=/logout
 MISO_PIPELINE_ENV_KEY=
 
 # LLM: chat/embed route through governed enterprise-llm only. Provider credentials
-# live on LLM provider external systems (integration/openai, azure-openai, ollama).
-# Shared secret for integration/openai: secrets-openaiApiKeyVault (af secret set ... --shared)
-AI_VALIDATION_LLM_MODEL=gpt-4o-mini
+# live on LLM provider external systems + dataplane secret store (not product .env).
+# When ≥2 LLM providers are published under enterprise-llm, set selectorKey
+# (system key), e.g. openai | azure-openai | ollama. Ignored when only one.
+# Prefer portal Configuration category LLM after deploy; this env is the resolve target.
+# Default LLM provider systemKey when ≥2 LLM providers are published under
+# enterprise-llm (fail-closed if empty). Portal category LLM can override.
+# Lab default: openai (catalog also ships azure-openai).
+ENTERPRISE_LLM_DEFAULT_SELECTOR=openai
 
 # =============================================================================
 # AUDIT CONFIGURATION
@@ -194,6 +198,22 @@ AUDIT_ASYNC_SHADOW_ENQUEUE=false
 # Set true for local dev policy CRUD; pair with VITE_POLICY_MANAGEMENT_ENABLED=true in app-ui.
 POLICY_MANAGEMENT_API_ENABLED=false
 
+# Role Assistant debug defaults (Assistants admin overrides per assistant):
+#   debugEnabled      → agent_workforce.debugTraceEnabled
+#   fullDebugEnabled  → agent_workforce.debugFullEnabled (system-prompt capture)
+#   debugRetentionDays → agent_workforce.debugTraceRetentionDays
+WORKFORCE_RUNTIME_DEBUG_TRACE_ENABLED=false
+# Shared retention for WorkerRuntimeDebugTrace + LlmPromptDebugCapture (daily Celery purge).
+# WORKFORCE_RUNTIME_DEBUG_TRACE_RETENTION_DAYS=30
+# WORKFORCE_RUNTIME_DEBUG_TRACE_MAX_ROWS_PER_TASK=500
+
+# Platform default for Role Assistant fullDebugEnabled when assistant has no override.
+# When unset: enabled in LOCAL_MODE or when WORKFORCE_RUNTIME_DEBUG_TRACE_ENABLED=true.
+# Prefer Assistants admin → Full debug per Role Assistant.
+# LLM_PROMPT_DEBUG_CAPTURE_ENABLED=
+# LLM_PROMPT_DEBUG_SYSTEM_PROMPT_MAX_CHARS=32000
+# LLM_PROMPT_DEBUG_USER_CONTENT_MAX_CHARS=4000
+
 # VIEW_MODULES — optional comma-separated UI module allowlist (unset = all modules).
 # Keys: dashboard, work, content-review, assistants, connected-systems, templates,
 # audit-logs, ai-trust, administration (deep link only; never sidebar in V1).
@@ -220,7 +240,6 @@ FIRST_PARTY_HTTP_INTERNAL_SPEC_EXTERNAL_SYSTEM_ID=
 
 # OpenTelemetry Configuration
 OPENTELEMETRY_ENABLED=false
-OPENTELEMETRY_ENDPOINT=
 
 # =============================================================================
 # INTEGRATION CERTIFICATE SIGNING (RS256 PEM)

package/templates/applications/dataplane/rbac.yaml

@@ -30,6 +30,11 @@ roles:
     description: "Developer access to deploy applications via CI pipelines"
     groups: ["AI-Fabrix-Developers"]
 
+  - name: "AI Fabrix Business Transformation"
+    value: "aifabrix-business-transformation"
+    description: "Built-in assistant: business intention → governed Connected Systems via Runtime and builder-api"
+    groups: ["AI-Fabrix-Business-Transformation"]
+
   - name: "AI Fabrix Observer"
     value: "aifabrix-observer"
     description: "Read-only access to monitoring, logs, and compliance reports"
@@ -312,6 +317,10 @@ permissions:
       ]
     description: "Discover business context (semantics, exposure, enabled governance, tools, validation state) for external systems"
 
+  - name: "external-system:data-manager"
+    roles: ["aifabrix-platform-admin"]
+    description: "Reset (purge) all stored records, document rows, vectors, relations, and sync job history for a datasource (keeps datasource config)"
+
   - name: "governance:evaluate"
     roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-developer"]
     description: "Run governance scenario acceptance (subject impersonation for ABAC proof)"
@@ -362,7 +371,9 @@ permissions:
         "aifabrix-developer",
         "aifabrix-ai-trust-operator",
       ]
-    description: "Update assistantName or preferredChannel on a user activation"
+    description: >-
+      Update assistantName or preferredChannel on a user activation, and
+      work.continue on Process Executions
 
   - name: "worker:archive"
     roles:
@@ -380,7 +391,9 @@ permissions:
         "aifabrix-security-admin",
         "aifabrix-ai-trust-operator",
       ]
-    description: "Approve or reject pending worker tasks"
+    description: >-
+      Approve or reject pending worker tasks, and record human.respond
+      (ask or approval) on Process Executions
 
   - name: "worker:manager-read"
     roles:
@@ -411,7 +424,47 @@ permissions:
       ]
     description: "Create, update, delete, and reorder Evidence Fabrix v2 rows"
 
+  # Knowledge Asset platform (465.1) — no public knowledge:create
+  - name: "knowledge:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+        "aifabrix-observer",
+      ]
+    description: "List and get Knowledge Assets and EnterpriseLineage edges"
+
+  - name: "knowledge:update"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Update draft Knowledge Assets or supersede active versions"
+
+  - name: "knowledge:archive"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Archive Knowledge Assets and cascade disposable projections"
+
+  - name: "knowledge:delete"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Soft-delete Knowledge Assets and cascade disposable projections"
+
   # Workforce subscriptions (436.11 / 438.6)
+  # Role Assistant surfaces use worker:* (already defined above) — not agentWorkforce:*.
   - name: "subscription:read"
     roles:
       [
@@ -423,6 +476,15 @@ permissions:
       ]
     description: "List workforce subscriptions and execution audit rows"
 
+  - name: "subscription:write"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-deployment-admin",
+      ]
+    description: "Create and update workforce subscriptions"
+
   - name: "subscription:run"
     roles:
       [

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.0'
+  version: '2.0.8'
 
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
@@ -81,6 +81,7 @@ configuration:
   # Operations & Debugging
   # -------------------------------------------------------------------------
   - name: LOG_LEVEL
+    category: General
     portalInput:
       field: select
       label: 'Log Level'
@@ -91,6 +92,7 @@ configuration:
         - error
 
   - name: ENABLE_API_DOCS
+    category: General
     portalInput:
       field: select
       label: 'Enable API Documentation (Swagger/ReDoc)'
@@ -99,6 +101,7 @@ configuration:
         - 'false'
 
   - name: FAST_STARTUP
+    category: General
     portalInput:
       field: select
       label: 'Fast Startup (skip non-critical init)'
@@ -107,6 +110,7 @@ configuration:
         - 'false'
 
   - name: LOG_TO_FILE
+    category: General
     portalInput:
       field: select
       label: 'Log to File'
@@ -118,6 +122,7 @@ configuration:
   # Keycloak Events (feature flag)
   # -------------------------------------------------------------------------
   - name: KEYCLOAK_EVENTS_ENABLED
+    category: General
     portalInput:
       field: select
       label: 'Keycloak Events (sync users/groups)'
@@ -129,12 +134,14 @@ configuration:
   # Rate Limiting (tune for environment)
   # -------------------------------------------------------------------------
   - name: RATE_LIMIT_WINDOW_MS
+    category: General
     portalInput:
       field: text
       label: 'Rate Limit Window (milliseconds)'
       placeholder: '900000'
 
   - name: RATE_LIMIT_MAX
+    category: General
     portalInput:
       field: text
       label: 'Rate Limit Max Requests per Window'
@@ -144,12 +151,14 @@ configuration:
   # Redis Cache TTL (seconds) – RBAC/roles caching
   # -------------------------------------------------------------------------
   - name: REDIS_ROLES_TTL
+    category: Redis
     portalInput:
       field: text
       label: 'Redis Roles Cache TTL (seconds)'
       placeholder: '900'
 
   - name: REDIS_PERMISSIONS_TTL
+    category: Redis
     portalInput:
       field: text
       label: 'Redis Permissions Cache TTL (seconds)'

package/templates/applications/miso-controller/env.template

@@ -63,6 +63,8 @@ NODE_ENV=dev
 PORT=${PORT}
 AUTO_CREATE_TABLES=true
 FAST_STARTUP=false
+# Pending Prisma migrations still run on startup unless set to false (even when FAST_STARTUP=true).
+# AUTO_RUN_MIGRATIONS=false
 ENABLE_API_DOCS=true
 
 # Rate Limiting Configuration (for local development)
@@ -189,7 +191,7 @@ CONTROLLER_EVALUATION=
 #
 # Delegated Graph (second redirect URI on the same vendor app): see section below.
 ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=kv://entra-callback-uri
+ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
@@ -265,16 +267,16 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 #
 # Development: set to DEVELOPMENT to disable license validation (no Mori/JWT required):
 #   LICENSE_JWT=DEVELOPMENT
-# - Use only for local development; do not use in production.
-LICENSE_JWT=DEVELOPMENT
+# - Use only for local development (DEPLOYMENT=local|database|azure-mock).
+# - Ignored when DEPLOYMENT=azure (Azure marketplace / App Service installs).
+LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 
 # =============================================================================
 # ENTRA ID ONBOARDING (delegated Graph via Mori)
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
-# …/entra-graph-delegated/callback. Example (001 dev Mori API):
-# ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix001-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=
+# …/entra-graph-delegated/callback. Shared pro Mori (CICD):
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -287,7 +289,8 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=
 # =============================================================================
 
 MORI_BASE_URL=url://mori-controller-public
-MORI_AUTH_METHOD=apiKey
+MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault
+MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
 MORI_USERNAME=kv://mori-controller-basic-usernameKeyVault
 MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault

package/templates/applications/miso-controller/rbac.yaml

@@ -303,6 +303,78 @@ permissions:
     roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
     description: 'Delete dimensions and dimension values'
 
+  # Resource Type Management
+  - name: 'resource-types:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View resource types'
+
+  - name: 'resource-types:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Create resource types'
+
+  - name: 'resource-types:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Update resource types'
+
+  - name: 'resource-types:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete resource types'
+
+  # Business Role Management (COM — not RBAC auth roles)
+  - name: 'roles:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View business roles'
+
+  - name: 'roles:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Create business roles'
+
+  - name: 'roles:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Update business roles'
+
+  - name: 'roles:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete business roles'
+
+  # Evidence Kind Management
+  - name: 'evidence-kinds:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View evidence kinds'
+
+  - name: 'evidence-kinds:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Create evidence kinds'
+
+  - name: 'evidence-kinds:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Update evidence kinds'
+
+  - name: 'evidence-kinds:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete evidence kinds'
+
   # Token Providers
   - name: 'token-provider:read'
     roles:

package/templates/channels/slack/integration/slack-system.json

@@ -17,7 +17,9 @@
         "signatureHeader": "X-Slack-Signature",
         "timestampHeader": "X-Slack-Request-Timestamp",
         "signaturePrefix": "v0=",
-        "timestampMaxAge": "300"
+        "timestampMaxAge": "300",
+        "baseUrl": "https://slack.com",
+        "testEndpoint": "https://slack.com/api/auth.test"
       },
       "security": {
         "signingSecret": "kv://slack/signingSecret",
@@ -36,7 +38,63 @@
       ]
     }
   },
-  "configuration": [],
+  "configuration": [
+    {
+      "name": "ENABLE_PROACTIVE_MESSAGING",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable proactive messaging",
+        "options": ["true", "false"]
+      }
+    },
+    {
+      "name": "ENABLE_CHANNEL_NOTIFICATIONS",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable channel notifications",
+        "options": ["true", "false"]
+      }
+    },
+    {
+      "name": "ENABLE_DIRECT_MESSAGES",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable direct messages",
+        "options": ["true", "false"]
+      }
+    },
+    {
+      "name": "ENABLE_MODALS",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable modals",
+        "options": ["true", "false"]
+      }
+    },
+    {
+      "name": "ENABLE_SHORTCUTS",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable shortcuts",
+        "options": ["true", "false"]
+      }
+    }
+  ],
   "dataSources": ["slack-messages", "slack-conversations"],
   "endpoints": [
     {

package/templates/python/requirements.txt

@@ -1,4 +1,4 @@
 Flask==3.1.3
-gunicorn==21.2.0
+gunicorn==23.0.0
 psycopg2-binary==2.9.9