@aifabrix/builder 2.50.0 → 2.51.1

package/templates/applications/miso-controller/rbac.yaml

@@ -303,6 +303,78 @@ permissions:
     roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
     description: 'Delete dimensions and dimension values'
 
+  # Resource Type Management
+  - name: 'resource-types:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View resource types'
+
+  - name: 'resource-types:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Create resource types'
+
+  - name: 'resource-types:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Update resource types'
+
+  - name: 'resource-types:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete resource types'
+
+  # Business Role Management (COM — not RBAC auth roles)
+  - name: 'roles:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View business roles'
+
+  - name: 'roles:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Create business roles'
+
+  - name: 'roles:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Update business roles'
+
+  - name: 'roles:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete business roles'
+
+  # Evidence Kind Management
+  - name: 'evidence-kinds:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'View evidence kinds'
+
+  - name: 'evidence-kinds:create'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Create evidence kinds'
+
+  - name: 'evidence-kinds:update'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    description: 'Update evidence kinds'
+
+  - name: 'evidence-kinds:delete'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Delete evidence kinds'
+
   # Token Providers
   - name: 'token-provider:read'
     roles:

package/templates/channels/chatgpt/install.template.md.hbs

@@ -1,46 +1,64 @@
-# {{appName}} — ChatGPT assistant channel install
+# {{appName}} — ChatGPT custom MCP app setup
 
 {{appDescription}}
 
 Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
 
-## Connect ChatGPT workspace (admin)
+This output is connection and administration material (`channel-chatgpt.json` + `INSTALL.md`), not a plugin archive.
 
-1. Sign in to [OpenAI Platform](https://platform.openai.com/) or your **ChatGPT Enterprise** workspace admin console.
-2. Create a custom GPT, workspace connector, or MCP integration using the generated manifest from `dist/channels/chatgpt/channel-chatgpt.json`.
-3. Configure the **OpenAPI specification URL** and **MCP endpoint** from **Platform endpoints** below.
-4. Complete OAuth or API key setup as required by your ChatGPT deployment model.
-5. Save the **API key** or **OAuth client credentials** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
-6. Publish the connector to your workspace and complete admin approval if your organization requires it.
+## Workspace admin setup (manual)
 
-## Platform endpoints
+1. Sign in to your ChatGPT workspace as an admin and enable **Developer mode / custom MCP apps** if required by workspace policy.
+2. Create a custom MCP app and use the generated artifact from `dist/channels/chatgpt/channel-chatgpt.json` as the connection reference.
+3. Configure the remote MCP URL and transport from **Runtime connection** below.
+4. Complete authentication setup for your workspace policy. Store credential references in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
+5. Refresh tools in ChatGPT after configuration changes so ChatGPT reads the latest Runtime tool list.
+6. Publish the app to the workspace and configure workspace access controls (RBAC or equivalent).
 
-Configure these on the ChatGPT connector / custom GPT. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+## Runtime connection
+
+Configure these values in the ChatGPT custom MCP app. Do not place secrets in generated files.
 
-{{#if openapiUrl}}
-- **OpenAPI spec:** {{openapiUrl}}
-{{/if}}
 {{#if mcpUrl}}
-- **MCP:** {{mcpUrl}}
-{{/if}}
-{{#if actionsBaseUrl}}
-- **Actions base:** {{actionsBaseUrl}}
+- **Remote MCP URL:** {{mcpUrl}}
 {{/if}}
+- **Runtime system key:** {{runtimeSystemKey}}
+- **Transport:** {{runtimeTransport}}
+- **Auth mode:** {{runtimeAuthMode}}
+- **Expected Layer B tools:**
+{{#each layerBToolNames}}
+  - `{{this}}`
+{{/each}}
 
-## Assistant catalog
+AI Fabrix `--probe` validates Runtime through the first-party MCP gateway
+(`/api/v1/mcp/servers/tools` and MCP docs for `{{runtimeSystemKey}}`), including
+Layer B discovery and BTA Evidence authoring reachability. ChatGPT workspace apps still
+require a working streamable-http Remote MCP URL and admin publication.
 
-Runtime lists **assistants** available to each user from:
+## Runtime and Role Assistant boundary checks
+
+- Runtime should resolve assistants dynamically per user from:
 
 {{assistantCatalogUrl}}
 
-## After workspace approval
+- The ChatGPT top-level tool surface should stay at Runtime Layer B tools.
+- Evidence authoring remains an internal Business Transformation Assistant capability path, not top-level ChatGPT tools.
 
-```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}"
-```
+## BTA Evidence-authoring proof scenario
+
+Use this scenario to verify ChatGPT → Runtime → BTA path without exposing Evidence commands as top-level ChatGPT tools:
+
+1. Ask ChatGPT to improve an existing Role Assistant from process documentation.
+2. Confirm ChatGPT starts or continues Business Transformation Assistant work through Runtime.
+3. Confirm BTA performs evidence metadata/download/upload reasoning and presents certified proposals.
+4. Approve selected proposals and confirm activation remains an explicit human action.
 
-Optional validation:
+## AI Fabrix validation commands
+
+After workspace publication and authentication setup:
 
 ```bash
 aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
 ```
+
+Use `--force` only to regenerate artifacts and patch channel metadata. It does not rotate credentials.

package/templates/channels/chatgpt/integration/README.md

@@ -1,11 +1,14 @@
-# ChatGPT assistant channel (lab fixture)
+# ChatGPT custom MCP app channel
 
-SSOT for `aifabrix channel scaffold chatgpt` templates (`make sync-json` → builder).
+Generated by `aifabrix channel scaffold chatgpt`.
+
+Recommended flow:
 
 ```bash
-cd aifabrix-dataplane
-aifabrix validate chatgpt
-aifabrix upload chatgpt --probe
-aifabrix deploy chatgpt
-aifabrix app add-channel chatgpt --name "Your Assistant"
+aifabrix upload chatgpt --force
+aifabrix channel add chatgpt --name "Your Assistant" --probe
 ```
+
+The `channel add` step generates `dist/channels/chatgpt/channel-chatgpt.json` and
+`INSTALL.md` for ChatGPT workspace admins to connect a custom MCP app to the
+runtime-orchestration server.

package/templates/channels/chatgpt/integration/application.json

@@ -1,8 +1,8 @@
 {
   "app": {
     "key": "chatgpt",
-    "displayName": "ChatGPT assistant channel",
-    "description": "Assistant communication channel — deploy then app add-channel",
+    "displayName": "ChatGPT custom MCP app channel",
+    "description": "Assistant communication channel — deploy then channel add",
     "type": "external"
   },
   "externalIntegration": {

package/templates/channels/chatgpt/integration/chatgpt-system.json

@@ -1,7 +1,7 @@
 {
   "key": "chatgpt",
-  "displayName": "ChatGPT assistant channel",
-  "description": "Communication external system for ChatGPT assistant channel install",
+  "displayName": "ChatGPT custom MCP app channel",
+  "description": "Communication external system for ChatGPT custom MCP app onboarding",
   "type": "custom",
   "systemKind": "communication",
   "enabled": true,
@@ -9,7 +9,7 @@
     "authType": "credential",
     "credential": {
       "credentialKey": "chatgpt-channel",
-      "displayName": "ChatGPT assistant channel",
+      "displayName": "ChatGPT custom MCP app channel",
       "method": "apikey",
       "writeOnce": true,
       "variables": {

package/templates/channels/chatgpt/integration/env.template

@@ -1,4 +1,4 @@
-# ChatGPT assistant channel — lab fixture secrets
+# ChatGPT custom MCP app channel credential reference
 # aifabrix secret set chatgpt/apiKey "<value>" --shared
 
 KV_CHATGPT_APIKEY=kv://chatgpt/apiKey

package/templates/channels/chatgpt/manifest.template.json.hbs

@@ -1,9 +1,40 @@
 {
+  "channelTarget": "{{channelTarget}}",
   "name": "{{appName}}",
+  "baseName": "{{baseName}}",
   "description": "{{appDescription}}",
-  "credentialKey": "{{credentialKey}}",
-  "openapiUrl": "{{openapiUrl}}",
-  "mcpUrl": "{{mcpUrl}}",
-  "actionsBaseUrl": "{{actionsBaseUrl}}",
-  "assistantCatalogUrl": "{{assistantCatalogUrl}}"
+  "environment": "{{environment}}",
+  "runtime": {
+    "runtimeSystemKey": "{{runtimeSystemKey}}",
+    "remoteMcpUrl": "{{mcpUrl}}",
+    "transport": "{{runtimeTransport}}",
+    "assistantCatalogUrl": "{{assistantCatalogUrl}}",
+    "roleAssistantResolution": "dynamic-runtime",
+    "layerBToolNames": [
+{{#each layerBToolNames}}
+      "{{this}}"{{#unless @last}},{{/unless}}
+{{/each}}
+    ]
+  },
+  "authentication": {
+    "mode": "{{runtimeAuthMode}}",
+    "credentialKey": "{{credentialKey}}",
+    "credentialPortalUrl": "{{credentialPortalUrl}}",
+    "scopes": {{{scopesJson}}}
+  },
+  "boundaries": {
+    "oneConnectionSupportsManyRoleAssistants": true,
+    "topLevelEvidenceToolsExposed": false,
+    "runtimeOwnsWorkInterface": true,
+    "evidenceCapabilityPath": "ChatGPT -> runtime-orchestration -> Business Transformation Assistant -> internal evidence capabilities"
+  },
+  "lifecycle": {
+    "locallyValidated": true,
+    "runtimeValidated": false,
+    "requiresChatGptWorkspaceAdmin": true
+  },
+  "artifact": {
+    "format": "chatgpt-custom-mcp-app",
+    "version": "1.0.0"
+  }
 }

package/templates/channels/microsoft-copilot/ai-plugin.template.json.hbs

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/copilot/plugin/v2.4/schema.json",
+  "schema_version": "v2.4",
+  "name_for_human": "{{appName}}",
+  "name_for_model": "aifabrix_runtime_orchestration",
+  "description_for_human": "{{appDescription}}",
+  "description_for_model": "Runtime orchestration tools for governed enterprise work.",
+  "runtimes": [
+    {
+      "type": "RemoteMCPServer",
+      "spec": {
+        "url": "{{mcpUrl}}"
+      },
+      "auth": {
+        "type": "oauth",
+        "scopes": {{{scopesJson}}}
+      }
+    }
+  ],
+  "mcp_tool_description": {
+    "mode": "dynamic",
+    "layerBToolNames": [
+{{#each layerBToolNames}}
+      "{{this}}"{{#unless @last}},{{/unless}}
+{{/each}}
+    ]
+  }
+}

package/templates/channels/microsoft-copilot/declarative-agent.template.json.hbs

@@ -0,0 +1,22 @@
+{
+  "id": "{{packageAppId}}-agent",
+  "name": "{{appName}}",
+  "description": "{{appDescription}}",
+  "instructions": "Use Runtime Layer B tools only. Resolve Role Assistants dynamically and keep business reasoning inside authorized Role Assistant boundaries.",
+  "conversation_starters": [
+    {
+      "title": "Show my role assistants",
+      "text": "List my available Role Assistants and what they can do."
+    },
+    {
+      "title": "Start guided work",
+      "text": "Help me start work for my current business objective."
+    }
+  ],
+  "actions": [
+    {
+      "id": "{{pluginId}}",
+      "file": "ai-plugin.json"
+    }
+  ]
+}

package/templates/channels/microsoft-copilot/install.template.md.hbs

@@ -1,29 +1,37 @@
-# {{appName}} — Microsoft Copilot assistant channel install
+# {{appName}} — Microsoft 365 Copilot package setup
 
 {{appDescription}}
 
 Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
 
-## Publish the Copilot extension (M365 admin)
+This channel output is a Microsoft 365 Copilot app package:
 
-1. Sign in to [Microsoft 365 admin](https://admin.cloud.microsoft.com/) or **Copilot Studio** as a tenant admin.
-2. Create or open a Copilot extensibility project (declarative agent or API plugin).
-3. Import or configure using the generated manifest JSON from `dist/channels/microsoft-copilot/channel-microsoft-copilot.json`.
-4. Point the **OpenAPI** and **action** endpoints to the URLs in **Platform endpoints** below.
-5. Register OAuth client credentials for the API provider connection when the platform prompts for them.
-6. Save the **OAuth client ID** and **client secret** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
-7. Submit for M365 admin approval and publish to your organization when review completes.
+```text
+dist/channels/microsoft-copilot/source/manifest.json
+dist/channels/microsoft-copilot/source/declarativeAgent.json
+dist/channels/microsoft-copilot/source/ai-plugin.json
+dist/channels/microsoft-copilot/build/appPackage.{{environment}}.zip
+```
+
+## Microsoft admin workflow (manual)
 
-## Platform endpoints
+1. Sign in to [Microsoft 365 admin](https://admin.cloud.microsoft.com/) or Copilot Studio as a tenant admin.
+2. Upload or sideload `appPackage.{{environment}}.zip` to your organization app catalog.
+3. Review the declarative agent + Remote MCP plugin metadata and approve tenant distribution.
+4. Configure workspace authentication and consent according to your Entra/OAuth policy.
+5. Store credential references in AI Fabrix authentication settings: [Authentication settings]({{credentialPortalUrl}})
+6. Assign the app to users/groups and complete first-user sign-in.
 
-Configure these on the Copilot connector / API plugin. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+## Runtime connection contract
 
-{{#if openapiUrl}}
-- **OpenAPI spec:** {{openapiUrl}}
-{{/if}}
-{{#if actionsBaseUrl}}
-- **Actions base:** {{actionsBaseUrl}}
-{{/if}}
+- **Runtime system key:** `{{runtimeSystemKey}}`
+- **Remote MCP URL:** `{{mcpUrl}}`
+- **Transport:** `{{runtimeTransport}}`
+- **Auth mode:** `{{runtimeAuthMode}}`
+- **Layer B tools expected:**
+{{#each layerBToolNames}}
+  - `{{this}}`
+{{/each}}
 
 ## Assistant catalog
 
@@ -31,14 +39,16 @@ Runtime lists **assistants** available to each user from:
 
 {{assistantCatalogUrl}}
 
-## After M365 admin approval
+## Probe truthfulness
 
-```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}"
-```
+- `builderValidated` means package files, ZIP, hashes, and secret checks passed.
+- `runtimeValidated` means Runtime MCP is reachable and tool boundary checks pass.
+- `requiresMicrosoftAdmin` remains true until tenant upload/approval/assignment is complete.
 
-Optional validation:
+## Validate after admin setup
 
 ```bash
 aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
 ```
+
+`--force` regenerates artifacts but does not rotate credentials.

package/templates/channels/microsoft-copilot/integration/README.md

@@ -1,11 +1,13 @@
-# Microsoft Copilot assistant channel (lab fixture)
+# Microsoft 365 Copilot package channel
 
-SSOT for `aifabrix channel scaffold microsoft-copilot` templates (`make sync-json` → builder).
+Generated by `aifabrix channel scaffold microsoft-copilot`.
+
+Recommended flow:
 
 ```bash
-cd aifabrix-dataplane
-aifabrix validate microsoft-copilot
-aifabrix upload microsoft-copilot --probe
-aifabrix deploy microsoft-copilot
-aifabrix app add-channel microsoft-copilot --name "Your Assistant"
+aifabrix upload microsoft-copilot --force
+aifabrix channel add microsoft-copilot --name "Your Assistant" --probe
 ```
+
+`channel add` generates package artifacts under
+`dist/channels/microsoft-copilot/` for Microsoft 365 tenant admins.

package/templates/channels/microsoft-copilot/integration/application.json

@@ -1,8 +1,8 @@
 {
   "app": {
     "key": "microsoft-copilot",
-    "displayName": "Microsoft Copilot assistant channel",
-    "description": "Assistant communication channel — deploy then app add-channel",
+    "displayName": "Microsoft Copilot package channel",
+    "description": "Assistant communication channel — deploy then channel add",
     "type": "external"
   },
   "externalIntegration": {

package/templates/channels/microsoft-copilot/integration/env.template

@@ -1,4 +1,4 @@
-# Microsoft Copilot assistant channel — lab fixture secrets
+# Microsoft Copilot package channel credential references
 # aifabrix secret set microsoft-copilot/clientId "<value>" --shared
 # aifabrix secret set microsoft-copilot/clientSecret "<value>" --shared
 

package/templates/channels/microsoft-copilot/integration/microsoft-copilot-system.json

@@ -1,7 +1,7 @@
 {
   "key": "microsoft-copilot",
-  "displayName": "Microsoft Copilot assistant channel",
-  "description": "Communication external system for Microsoft Copilot assistant channel install",
+  "displayName": "Microsoft Copilot package channel",
+  "description": "Communication external system for Microsoft Copilot package onboarding",
   "type": "custom",
   "systemKind": "communication",
   "enabled": true,
@@ -9,14 +9,15 @@
     "authType": "credential",
     "credential": {
       "credentialKey": "microsoft-copilot-channel",
-      "displayName": "Microsoft Copilot assistant channel",
+      "displayName": "Microsoft Copilot package channel",
       "method": "oauth2",
       "writeOnce": true,
       "variables": {
+        "baseUrl": "https://login.microsoftonline.com",
+        "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
         "tokenUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-        "grantType": "client_credentials",
-        "scope": "https://graph.microsoft.com/.default",
-        "baseUrl": "https://graph.microsoft.com/v1.0"
+        "grantType": "authorization_code",
+        "scope": "openid profile offline_access"
       },
       "security": {
         "clientId": "kv://microsoft-copilot/clientId",

package/templates/channels/microsoft-copilot/manifest.template.json.hbs

@@ -1,8 +1,36 @@
 {
-  "name": "{{appName}}",
-  "description": "{{appDescription}}",
-  "credentialKey": "{{credentialKey}}",
-  "openapiUrl": "{{openapiUrl}}",
-  "actionsBaseUrl": "{{actionsBaseUrl}}",
-  "assistantCatalogUrl": "{{assistantCatalogUrl}}"
+  "$schema": "https://developer.microsoft.com/json-schemas/teams/v1.21/MicrosoftTeams.schema.json",
+  "manifestVersion": "1.21",
+  "version": "{{packageVersion}}",
+  "id": "{{packageAppId}}",
+  "name": {
+    "short": "{{baseName}}",
+    "full": "{{appName}}"
+  },
+  "description": {
+    "short": "{{appDescription}}",
+    "full": "{{appDescription}}"
+  },
+  "developer": {
+    "name": "AI Fabrix",
+    "websiteUrl": "{{dataplaneBaseUrl}}",
+    "privacyUrl": "{{dataplaneBaseUrl}}/privacy",
+    "termsOfUseUrl": "{{dataplaneBaseUrl}}/terms"
+  },
+  "icons": {
+    "color": "color.png",
+    "outline": "outline.png"
+  },
+  "accentColor": "#0F172A",
+  "copilotAgents": {
+    "declarativeAgents": [
+      {
+        "id": "{{packageAppId}}-agent",
+        "file": "declarativeAgent.json"
+      }
+    ]
+  },
+  "validDomains": [
+    "{{runtimeDomain}}"
+  ]
 }

package/templates/channels/slack/integration/slack-system.json

@@ -17,7 +17,9 @@
         "signatureHeader": "X-Slack-Signature",
         "timestampHeader": "X-Slack-Request-Timestamp",
         "signaturePrefix": "v0=",
-        "timestampMaxAge": "300"
+        "timestampMaxAge": "300",
+        "baseUrl": "https://slack.com",
+        "testEndpoint": "https://slack.com/api/auth.test"
       },
       "security": {
         "signingSecret": "kv://slack/signingSecret",
@@ -36,7 +38,63 @@
       ]
     }
   },
-  "configuration": [],
+  "configuration": [
+    {
+      "name": "ENABLE_PROACTIVE_MESSAGING",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable proactive messaging",
+        "options": ["true", "false"]
+      }
+    },
+    {
+      "name": "ENABLE_CHANNEL_NOTIFICATIONS",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable channel notifications",
+        "options": ["true", "false"]
+      }
+    },
+    {
+      "name": "ENABLE_DIRECT_MESSAGES",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable direct messages",
+        "options": ["true", "false"]
+      }
+    },
+    {
+      "name": "ENABLE_MODALS",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable modals",
+        "options": ["true", "false"]
+      }
+    },
+    {
+      "name": "ENABLE_SHORTCUTS",
+      "value": "true",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "Enable shortcuts",
+        "options": ["true", "false"]
+      }
+    }
+  ],
   "dataSources": ["slack-messages", "slack-conversations"],
   "endpoints": [
     {

package/templates/python/requirements.txt

@@ -1,4 +1,4 @@
 Flask==3.1.3
-gunicorn==21.2.0
+gunicorn==23.0.0
 psycopg2-binary==2.9.9