@aifabrix/builder 2.50.0 → 2.51.1

package/scripts/lib/plan-prevalidate-gates.js

@@ -17,6 +17,17 @@ const { loadPlanFile, hasSurface } = require('./plan-parse');
 const REPO_ROOT = path.resolve(__dirname, '../..');
 const PREVALIDATE_REPORT_DIR = path.join(REPO_ROOT, 'temp/plan-prevalidation');
 
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function escapeMarkdownCell(value) {
+  return String(value ?? '')
+    .replace(/\r?\n+/g, ' ')
+    .replace(/\|/g, '\\|')
+    .trim();
+}
+
 /**
  * @typedef {{ label: string, status: 'pass' | 'fail' | 'warn' | 'skip', detail?: string }} GateResult
  */
@@ -299,7 +310,7 @@ function buildPrevalidateReport(params) {
     '| --- | --- | --- |'
   ];
   for (const g of gates) {
-    lines.push(`| ${g.label} | ${g.status} | ${(g.detail || '').replace(/\|/g, '\\|')} |`);
+    lines.push(`| ${escapeMarkdownCell(g.label)} | ${escapeMarkdownCell(g.status)} | ${escapeMarkdownCell(g.detail || '')} |`);
   }
   return `${lines.join('\n')}\n`;
 }

package/scripts/lib/plan-run-report.js

@@ -8,6 +8,17 @@ const fs = require('fs');
 const path = require('path');
 const { REPORT_DIR } = require('./plan-config');
 
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function escapeMarkdownCell(value) {
+  return String(value ?? '')
+    .replace(/\r?\n+/g, ' ')
+    .replace(/\|/g, '\\|')
+    .trim();
+}
+
 /**
  * @param {object} params
  * @returns {string}
@@ -44,13 +55,13 @@ function buildSummaryMarkdown(params) {
 
   for (const g of gates) {
     const icon = g.status === 'pass' ? 'pass' : g.status === 'warn' ? 'warn' : 'FAIL';
-    lines.push(`| ${g.label} | ${icon} | ${(g.detail || '').replace(/\|/g, '\\|')} |`);
+    lines.push(`| ${escapeMarkdownCell(g.label)} | ${icon} | ${escapeMarkdownCell(g.detail || '')} |`);
   }
 
   lines.push('', '## Todos', '', '| ID | Status | Content |', '| --- | --- | --- |');
   for (const t of todos) {
     lines.push(
-      `| ${t.id} | ${t.status} | ${String(t.content).replace(/\|/g, '\\|').slice(0, 100)} |`
+      `| ${escapeMarkdownCell(t.id)} | ${escapeMarkdownCell(t.status)} | ${escapeMarkdownCell(t.content).slice(0, 100)} |`
     );
   }
 

package/scripts/pnpm/lib/resolve-aifabrix-bin.mjs

@@ -10,8 +10,8 @@ const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../
 const MIN_AIFABRIX_VERSION = '2.45.0';
 
 /**
- * @param {string} version
- * @returns {number[]}
+ * @param {string} version - Semver string.
+ * @returns {number[]} Parsed numeric semver segments.
  */
 function parseSemver(version) {
   return String(version)
@@ -21,9 +21,9 @@ function parseSemver(version) {
 }
 
 /**
- * @param {string} left
- * @param {string} right
- * @returns {number}
+ * @param {string} left - Left semver.
+ * @param {string} right - Right semver.
+ * @returns {number} Compare result (1, 0, -1).
  */
 function compareSemver(left, right) {
   const a = parseSemver(left);
@@ -38,8 +38,8 @@ function compareSemver(left, right) {
 }
 
 /**
- * @param {string} bin
- * @returns {string|null}
+ * @param {string} bin - Candidate executable path.
+ * @returns {string|null} CLI version output or null.
  */
 function readAifabrixVersion(bin) {
   try {
@@ -50,7 +50,7 @@ function readAifabrixVersion(bin) {
 }
 
 /**
- * @returns {string[]}
+ * @returns {string[]} Candidate aifabrix binary paths.
  */
 function collectAifabrixCandidates() {
   const candidates = [];
@@ -85,14 +85,14 @@ function collectAifabrixCandidates() {
 /**
  * Prefer this repo's bin/aifabrix.js when developing the builder package locally.
  *
- * @returns {string}
+ * @returns {string} Resolved aifabrix executable path.
  */
 export function resolveAifabrixBin() {
   let bestBin = null;
   let bestVersion = null;
 
   for (const candidate of collectAifabrixCandidates()) {
-    let resolved = candidate;
+    let resolved;
     try {
       if (fs.existsSync(candidate)) {
         resolved = fs.realpathSync(candidate);

package/templates/applications/dataplane/application.yaml

@@ -4,12 +4,12 @@ app:
   displayName: "AI Fabrix Dataplane"
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
-  language: python  # Explicitly specify Python language
-  version: 2.0.0
+  language: python # Explicitly specify Python language
+  version: 2.0.15
 
 # Image Configuration
-# Set tag to match your build (e.g. aifabrix build dataplane -t 1.0.0 then tag: 1.0.0)
-# Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
+# Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
+# Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
 image:
   name: aifabrix/dataplane
   tag: latest
@@ -35,10 +35,10 @@ frontDoorRouting:
 requires:
   database: true
   databases:
-    - name: dataplane          # Main database - configuration only
-    - name: dataplane-vector   # Vector and document store: chunks, embeddings, vector indexes (pgvector)
-    - name: dataplane-logs     # Logs database - execution, audit, ABAC traces
-    - name: dataplane-records  # Records database - external records storage
+    - name: dataplane # Main database - configuration only
+    - name: dataplane-vector # Vector and document store: chunks, embeddings, vector indexes (pgvector)
+    - name: dataplane-logs # Logs database - execution, audit, ABAC traces
+    - name: dataplane-records # Records database - external records storage
   redis: true
   storage: true
 
@@ -60,19 +60,23 @@ authentication:
 # Build Configuration
 # Dataplane builds from published image; context is project root (like miso-controller)
 build:
-  context: ../..                  # Docker build context (relative to builder/dataplane/)
-  dockerfile: builder/dataplane/Dockerfile  # Dockerfile path (relative to project root)
-  envOutputPath: ../../.env       # Copy to repo root for local dev
-  language: python                # Runtime language for template selection (typescript or python)
+  context: ../.. # Docker build context (relative to builder/dataplane/)
+  dockerfile: builder/dataplane/Dockerfile # Dockerfile path (relative to project root)
+  envOutputPath: ../../.env # Copy to repo root for local dev
+  language: python # Runtime language for template selection (typescript or python)
   # Dev reload: polling + watch /app/app only (avoids EMFILE on full repo bind-mount). See run_local.py, make af-reload.
   reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
   imageRun: exec python -m uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001}
   # Image policy (442.0): explicit Dockerfile COPY; worker/beat via python -m app.core.*
-  # integration/ in image: <systemKey>-deploy.json + application.json|yaml only (no test-*, wizard-configs).
+  # integration/ in image: only onboarding-catalog.json keys (+ deploy/application per key).
   worker: true
   imageRunWorker: exec python -m app.core.celery_worker_main
   imageRunBeat: exec python -m app.core.celery_beat_main
+  # Optional one-shot before ANY long-running role (api/worker/beat). Run exactly once per
+  # aifabrix run / Deployment — never once-per-container. Schema: application-schema build.deployJob.
+  # Local: aifabrix run; remote: miso Deployment via miso-azure (not Docker on controller).
+  deployJob: python -m app.db.migrate upgrade
 
 # =============================================================================
 # Portal Input Configuration (Deployment Wizard)
@@ -82,8 +86,10 @@ build:
 #
 # NOT included (auto-configured):
 # - Database URLs, Redis → auto-generated during Azure install
-# - MISO_*, KEYCLOAK_* → auto-generated during Azure install  
-# - AI params (OPENAI_*, AZURE_OPENAI_*) → from controller config
+# - MISO_*, KEYCLOAK_* → auto-generated during Azure install
+# - AI params / provider secrets → LLM external systems + secret store
+#   (never product OPENAI_* / AZURE_OPENAI_*). ≥2 providers →
+#   ENTERPRISE_LLM_DEFAULT_SELECTOR (portal LLM category).
 # - ENVIRONMENT → set by deployment target
 
 configuration:
@@ -91,6 +97,7 @@ configuration:
   # Operations & Debugging
   # -------------------------------------------------------------------------
   - name: LOG_LEVEL
+    category: Operations & Debugging
     portalInput:
       field: select
       label: "Log Level"
@@ -101,6 +108,7 @@ configuration:
         - ERROR
 
   - name: ABAC_AUDIT_DETAIL_LEVEL
+    category: Operations & Debugging
     portalInput:
       field: select
       label: "ABAC Audit Detail Level"
@@ -109,6 +117,7 @@ configuration:
         - detailed
 
   - name: RBAC_AUDIT_DETAIL_LEVEL
+    category: Operations & Debugging
     portalInput:
       field: select
       label: "RBAC Audit Detail Level"
@@ -118,6 +127,7 @@ configuration:
         - explain
 
   - name: TRUST_CUSTOMER_POLICY_LEVEL
+    category: Trust
     portalInput:
       field: select
       label: "Trust policy level (no-policy defaults)"
@@ -127,22 +137,27 @@ configuration:
         - relaxed
 
   - name: TRUST_PUBLISH_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
-      label: "Enforce trust gate on datasource publish"
+      label: "Enforce trust gate on datasource publish (empty=ENVIRONMENT default)"
       options:
+        - ""
         - "false"
         - "true"
 
   - name: TRUST_PROMOTE_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
-      label: "Enforce trust gate on external system publish (promote scope)"
+      label: "Enforce trust gate on Deploy / system publish (empty=ENVIRONMENT default)"
       options:
+        - ""
         - "false"
         - "true"
 
   - name: TRUST_RUNTIME_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
       label: "Enforce trust gate on CIP execution and workforce generation inputs (runtime scope)"
@@ -151,6 +166,7 @@ configuration:
         - "true"
 
   - name: TRUST_AI_EXPOSURE_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
       label: "Enforce trust gate on AI document-storage prompt generation"
@@ -164,24 +180,28 @@ configuration:
   # Tune based on customer data volumes and external API characteristics
 
   - name: CIP_EXECUTION_MAX_RECORDS
+    category: CIP Execution
     portalInput:
       field: text
       label: "Max Records per CIP Execution"
       placeholder: "100000"
 
   - name: CIP_EXECUTION_MAX_RESPONSE_SIZE_MB
+    category: CIP Execution
     portalInput:
       field: text
       label: "Max Response Size (MB)"
       placeholder: "100.0"
 
   - name: CIP_EXECUTION_OPERATION_TIMEOUT
+    category: CIP Execution
     portalInput:
       field: text
       label: "Operation Timeout (seconds)"
       placeholder: "300.0"
 
   - name: CIP_EXECUTION_HTTP_TIMEOUT
+    category: CIP Execution
     portalInput:
       field: text
       label: "HTTP Request Timeout (seconds)"
@@ -193,13 +213,23 @@ configuration:
   # Tune to match external API rate limits
 
   - name: CIP_EXECUTION_RATE_LIMIT_REQUESTS_PER_SECOND
+    category: CIP Rate Limiting
     portalInput:
       field: text
       label: "Rate Limit (requests/second)"
       placeholder: "10.0"
 
   - name: CIP_EXECUTION_RATE_LIMIT_BURST_SIZE
+    category: CIP Rate Limiting
     portalInput:
       field: text
       label: "Rate Limit Burst Size"
       placeholder: "20"
+
+  - name: ENTERPRISE_LLM_DEFAULT_SELECTOR
+    category: LLM
+    portalInput:
+      field: text
+      label: "Default LLM provider (system key when two or more providers)"
+      placeholder: "openai"
+

package/templates/applications/dataplane/env.template

@@ -14,8 +14,9 @@ ENVIRONMENT=dev
 DEBUG=false
 # Logging level: DEBUG, INFO, WARNING, ERROR, CRITICAL
 LOG_LEVEL=INFO
-# Log format: json or text
-LOG_FORMAT=json
+# Platform / enterprise language for Evidence platformText + Knowledge enterpriseLanguage.
+# V1: English only. Do not change after install — no retranslation migration in V1.
+AIFABRIX_PLATFORM_LANGUAGE=en
 # Path for log file output.
 # Docker default (no volume): use LOG_FILE_PATH=/app/logs/app.log (directory created in image).
 # Production with persistent logs: use /mnt/data/logs/app.log and mount a volume at /mnt/data.
@@ -43,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.0
+VERSION=2.0.15
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5
@@ -135,8 +136,6 @@ MISO_CLIENTSECRET=kv://dataplane-client-secretKeyVault
 # Keycloak Configuration (for OAuth2 endpoints)
 # Public: browser / issuer (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH=/auth).
 KEYCLOAK_SERVER_URL=url://keycloak-public
-# Internal: server-to-Keycloak HTTP (docker: service:port + /auth from keycloak application.yaml)
-KEYCLOAK_INTERNAL_SERVER_URL=url://keycloak-internal
 KEYCLOAK_REALM=aifabrix
 
 # =============================================================================
@@ -155,9 +154,14 @@ MISO_LOGOUT_URL=/logout
 MISO_PIPELINE_ENV_KEY=
 
 # LLM: chat/embed route through governed enterprise-llm only. Provider credentials
-# live on LLM provider external systems (integration/openai, azure-openai, ollama).
-# Shared secret for integration/openai: secrets-openaiApiKeyVault (af secret set ... --shared)
-AI_VALIDATION_LLM_MODEL=gpt-4o-mini
+# live on LLM provider external systems + dataplane secret store (not product .env).
+# When ≥2 LLM providers are published under enterprise-llm, set selectorKey
+# (system key), e.g. openai | azure-openai | ollama. Ignored when only one.
+# Prefer portal Configuration category LLM after deploy; this env is the resolve target.
+# Default LLM provider systemKey when ≥2 LLM providers are published under
+# enterprise-llm (fail-closed if empty). Portal category LLM can override.
+# Lab default: openai (catalog also ships azure-openai).
+ENTERPRISE_LLM_DEFAULT_SELECTOR=openai
 
 # =============================================================================
 # AUDIT CONFIGURATION
@@ -194,6 +198,22 @@ AUDIT_ASYNC_SHADOW_ENQUEUE=false
 # Set true for local dev policy CRUD; pair with VITE_POLICY_MANAGEMENT_ENABLED=true in app-ui.
 POLICY_MANAGEMENT_API_ENABLED=false
 
+# Role Assistant debug defaults (Assistants admin overrides per assistant):
+#   debugEnabled      → agent_workforce.debugTraceEnabled
+#   fullDebugEnabled  → agent_workforce.debugFullEnabled (system-prompt capture)
+#   debugRetentionDays → agent_workforce.debugTraceRetentionDays
+WORKFORCE_RUNTIME_DEBUG_TRACE_ENABLED=false
+# Shared retention for WorkerRuntimeDebugTrace + LlmPromptDebugCapture (daily Celery purge).
+# WORKFORCE_RUNTIME_DEBUG_TRACE_RETENTION_DAYS=30
+# WORKFORCE_RUNTIME_DEBUG_TRACE_MAX_ROWS_PER_TASK=500
+
+# Platform default for Role Assistant fullDebugEnabled when assistant has no override.
+# When unset: enabled in LOCAL_MODE or when WORKFORCE_RUNTIME_DEBUG_TRACE_ENABLED=true.
+# Prefer Assistants admin → Full debug per Role Assistant.
+# LLM_PROMPT_DEBUG_CAPTURE_ENABLED=
+# LLM_PROMPT_DEBUG_SYSTEM_PROMPT_MAX_CHARS=32000
+# LLM_PROMPT_DEBUG_USER_CONTENT_MAX_CHARS=4000
+
 # VIEW_MODULES — optional comma-separated UI module allowlist (unset = all modules).
 # Keys: dashboard, work, content-review, assistants, connected-systems, templates,
 # audit-logs, ai-trust, administration (deep link only; never sidebar in V1).
@@ -220,7 +240,6 @@ FIRST_PARTY_HTTP_INTERNAL_SPEC_EXTERNAL_SYSTEM_ID=
 
 # OpenTelemetry Configuration
 OPENTELEMETRY_ENABLED=false
-OPENTELEMETRY_ENDPOINT=
 
 # =============================================================================
 # INTEGRATION CERTIFICATE SIGNING (RS256 PEM)

package/templates/applications/dataplane/rbac.yaml

@@ -30,6 +30,11 @@ roles:
     description: "Developer access to deploy applications via CI pipelines"
     groups: ["AI-Fabrix-Developers"]
 
+  - name: "AI Fabrix Business Transformation"
+    value: "aifabrix-business-transformation"
+    description: "Built-in assistant: business intention → governed Connected Systems via Runtime and builder-api"
+    groups: ["AI-Fabrix-Business-Transformation"]
+
   - name: "AI Fabrix Observer"
     value: "aifabrix-observer"
     description: "Read-only access to monitoring, logs, and compliance reports"
@@ -138,6 +143,20 @@ permissions:
   - name: "integration-template:delete"
     roles: ["aifabrix-platform-admin", "aifabrix-developer"]
     description: "Delete integration templates"
+
+  # Resource type catalog (public read; Miso owns writes via controller sync)
+  - name: "resource-type:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-deployment-admin",
+        "aifabrix-compliance-admin",
+        "aifabrix-developer",
+        "aifabrix-observer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Read the global Resource Type catalog (list/get)"
   
   # Generic dataplane operations
   - name: "dataplane:read"
@@ -312,6 +331,10 @@ permissions:
       ]
     description: "Discover business context (semantics, exposure, enabled governance, tools, validation state) for external systems"
 
+  - name: "external-system:data-manager"
+    roles: ["aifabrix-platform-admin"]
+    description: "Reset (purge) all stored records, document rows, vectors, relations, and sync job history for a datasource (keeps datasource config)"
+
   - name: "governance:evaluate"
     roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-developer"]
     description: "Run governance scenario acceptance (subject impersonation for ABAC proof)"
@@ -362,7 +385,9 @@ permissions:
         "aifabrix-developer",
         "aifabrix-ai-trust-operator",
       ]
-    description: "Update assistantName or preferredChannel on a user activation"
+    description: >-
+      Update assistantName or preferredChannel on a user activation, and
+      work.continue on Process Executions
 
   - name: "worker:archive"
     roles:
@@ -380,7 +405,9 @@ permissions:
         "aifabrix-security-admin",
         "aifabrix-ai-trust-operator",
       ]
-    description: "Approve or reject pending worker tasks"
+    description: >-
+      Approve or reject pending worker tasks, and record human.respond
+      (ask or approval) on Process Executions
 
   - name: "worker:manager-read"
     roles:
@@ -411,7 +438,47 @@ permissions:
       ]
     description: "Create, update, delete, and reorder Evidence Fabrix v2 rows"
 
+  # Knowledge Asset platform (465.1) — no public knowledge:create
+  - name: "knowledge:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+        "aifabrix-observer",
+      ]
+    description: "List and get Knowledge Assets and EnterpriseLineage edges"
+
+  - name: "knowledge:update"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Update draft Knowledge Assets or supersede active versions"
+
+  - name: "knowledge:archive"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Archive Knowledge Assets and cascade disposable projections"
+
+  - name: "knowledge:delete"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Soft-delete Knowledge Assets and cascade disposable projections"
+
   # Workforce subscriptions (436.11 / 438.6)
+  # Role Assistant surfaces use worker:* (already defined above) — not agentWorkforce:*.
   - name: "subscription:read"
     roles:
       [
@@ -423,6 +490,15 @@ permissions:
       ]
     description: "List workforce subscriptions and execution audit rows"
 
+  - name: "subscription:write"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-developer",
+        "aifabrix-deployment-admin",
+      ]
+    description: "Create and update workforce subscriptions"
+
   - name: "subscription:run"
     roles:
       [

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.0'
+  version: '2.0.10'
 
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
@@ -81,6 +81,7 @@ configuration:
   # Operations & Debugging
   # -------------------------------------------------------------------------
   - name: LOG_LEVEL
+    category: General
     portalInput:
       field: select
       label: 'Log Level'
@@ -91,6 +92,7 @@ configuration:
         - error
 
   - name: ENABLE_API_DOCS
+    category: General
     portalInput:
       field: select
       label: 'Enable API Documentation (Swagger/ReDoc)'
@@ -99,6 +101,7 @@ configuration:
         - 'false'
 
   - name: FAST_STARTUP
+    category: General
     portalInput:
       field: select
       label: 'Fast Startup (skip non-critical init)'
@@ -107,6 +110,7 @@ configuration:
         - 'false'
 
   - name: LOG_TO_FILE
+    category: General
     portalInput:
       field: select
       label: 'Log to File'
@@ -118,6 +122,7 @@ configuration:
   # Keycloak Events (feature flag)
   # -------------------------------------------------------------------------
   - name: KEYCLOAK_EVENTS_ENABLED
+    category: General
     portalInput:
       field: select
       label: 'Keycloak Events (sync users/groups)'
@@ -129,12 +134,14 @@ configuration:
   # Rate Limiting (tune for environment)
   # -------------------------------------------------------------------------
   - name: RATE_LIMIT_WINDOW_MS
+    category: General
     portalInput:
       field: text
       label: 'Rate Limit Window (milliseconds)'
       placeholder: '900000'
 
   - name: RATE_LIMIT_MAX
+    category: General
     portalInput:
       field: text
       label: 'Rate Limit Max Requests per Window'
@@ -144,12 +151,14 @@ configuration:
   # Redis Cache TTL (seconds) – RBAC/roles caching
   # -------------------------------------------------------------------------
   - name: REDIS_ROLES_TTL
+    category: Redis
     portalInput:
       field: text
       label: 'Redis Roles Cache TTL (seconds)'
       placeholder: '900'
 
   - name: REDIS_PERMISSIONS_TTL
+    category: Redis
     portalInput:
       field: text
       label: 'Redis Permissions Cache TTL (seconds)'

package/templates/applications/miso-controller/env.template

@@ -63,6 +63,8 @@ NODE_ENV=dev
 PORT=${PORT}
 AUTO_CREATE_TABLES=true
 FAST_STARTUP=false
+# Pending Prisma migrations still run on startup unless set to false (even when FAST_STARTUP=true).
+# AUTO_RUN_MIGRATIONS=false
 ENABLE_API_DOCS=true
 
 # Rate Limiting Configuration (for local development)
@@ -189,7 +191,7 @@ CONTROLLER_EVALUATION=
 #
 # Delegated Graph (second redirect URI on the same vendor app): see section below.
 ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=kv://entra-callback-uri
+ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
@@ -265,16 +267,16 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 #
 # Development: set to DEVELOPMENT to disable license validation (no Mori/JWT required):
 #   LICENSE_JWT=DEVELOPMENT
-# - Use only for local development; do not use in production.
-LICENSE_JWT=DEVELOPMENT
+# - Use only for local development (DEPLOYMENT=local|database|azure-mock).
+# - Ignored when DEPLOYMENT=azure (Azure marketplace / App Service installs).
+LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 
 # =============================================================================
 # ENTRA ID ONBOARDING (delegated Graph via Mori)
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
-# …/entra-graph-delegated/callback. Example (001 dev Mori API):
-# ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix001-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=
+# …/entra-graph-delegated/callback. Shared pro Mori (CICD):
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -286,8 +288,11 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=
 # MORI SERVICE CONFIGURATION
 # =============================================================================
 
-MORI_BASE_URL=url://mori-controller-public
-MORI_AUTH_METHOD=apiKey
+# Shared pro Mori (Entra handoff + Graph callback). Prefer this over url://mori-controller-public
+# unless a local Mori app is registered and running for the developer.
+MORI_BASE_URL=https://aifabrix-pro-mori-web-we.azurewebsites.net
+MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault
+MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
 MORI_USERNAME=kv://mori-controller-basic-usernameKeyVault
 MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault