@aifabrix/builder 2.51.0 → 2.51.1

package/lib/utils/schema-resolver.js

@@ -175,6 +175,18 @@ function resolveDatasourceFiles(schemaBasePath, datasourceFiles) {
   return datasourceFiles.map(fileName => resolveSingleExternalFile(schemaBasePath, fileName, 'datasource'));
 }
 
+function resolveRoleAssistantSettingsFile(appPath) {
+  const yamlPath = path.join(appPath, 'role-assistant.yaml');
+  if (fs.existsSync(yamlPath)) {
+    return resolveSingleExternalFile(appPath, 'role-assistant.yaml', 'role-assistant-settings');
+  }
+  const ymlPath = path.join(appPath, 'role-assistant.yml');
+  if (fs.existsSync(ymlPath)) {
+    return resolveSingleExternalFile(appPath, 'role-assistant.yml', 'role-assistant-settings');
+  }
+  return resolveSingleExternalFile(appPath, 'role-assistant.yaml', 'role-assistant-settings');
+}
+
 /**
  * @param {string} schemaBasePath
  * @param {string[]} systemFileNames
@@ -282,6 +294,21 @@ async function loadAndValidateVariables(appPath) {
   }
 }
 
+function readSystemKindFromFirstSystemFile(schemaBasePath, systemFileNames) {
+  if (!systemFileNames.length) {
+    return '';
+  }
+  try {
+    const firstSystemPath = path.join(schemaBasePath, systemFileNames[0]);
+    const parsedSystem = loadConfigFile(firstSystemPath);
+    return parsedSystem && typeof parsedSystem.systemKind === 'string'
+      ? parsedSystem.systemKind
+      : '';
+  } catch {
+    return '';
+  }
+}
+
 async function resolveExternalFiles(appName, options = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
@@ -295,15 +322,20 @@ async function resolveExternalFiles(appName, options = {}) {
   }
 
   const schemaBasePath = await resolveSchemaBasePath(appName, options);
-  const systemFiles = resolveSystemFiles(schemaBasePath, variables.externalIntegration.systems);
+  const systemFileNames = variables.externalIntegration.systems || [];
+  const systemFiles = resolveSystemFiles(schemaBasePath, systemFileNames);
+  const systemKind = readSystemKindFromFirstSystemFile(schemaBasePath, systemFileNames);
   const orderedNames = orderDatasourceFileNamesBySystemKeys(
     schemaBasePath,
-    variables.externalIntegration.systems,
+    systemFileNames,
     variables.externalIntegration.dataSources || []
   );
   const datasourceFiles = resolveDatasourceFiles(schemaBasePath, orderedNames);
-
-  return [...systemFiles, ...datasourceFiles];
+  const extraFiles = [];
+  if (String(systemKind).trim() === 'digitalWorker') {
+    extraFiles.push(resolveRoleAssistantSettingsFile(appPath));
+  }
+  return [...systemFiles, ...datasourceFiles, ...extraFiles];
 }
 
 module.exports = {

package/lib/utils/token-manager.js

@@ -408,53 +408,62 @@ function applyLabDataplaneApiKeyBearer(authConfig) {
   return authConfig;
 }
 
+function looksLikeJwtBearer(token) {
+  const existing = token ? String(token) : '';
+  return existing.split('.').length === 3 && existing.length > 80;
+}
+
+function preferClientCredentialsDeploymentAuth() {
+  return String(process.env.AIFABRIX_DEPLOYMENT_AUTH || '').toLowerCase() === 'client-credentials';
+}
+
+/**
+ * @param {Object} authConfig
+ * @returns {boolean} true when a substitution was applied
+ */
+function trySubstituteEnvApiKeyBearer(authConfig) {
+  if (!process.env.API_KEY) {
+    return false;
+  }
+  const apiKey = String(process.env.API_KEY);
+  if (authConfig.type === 'bearer' && authConfig.token !== apiKey) {
+    authConfig.token = apiKey;
+    return true;
+  }
+  if (authConfig.type === 'client-token') {
+    authConfig.type = 'bearer';
+    authConfig.token = apiKey;
+    return true;
+  }
+  if (!authConfig.token) {
+    authConfig.type = 'bearer';
+    authConfig.token = apiKey;
+    return true;
+  }
+  return false;
+}
+
 function requireBearerForDataplanePipeline(authConfig) {
   if (!authConfig || typeof authConfig !== 'object') {
     return;
   }
-
   if (authConfig.type === 'client-token' && authConfig.token) {
     return;
   }
-
   // Token-forward (builder-api / bearerForward): never substitute lab API_KEY for the caller JWT.
   if (authConfig.preserveBearer && authConfig.token) {
     return;
   }
-
-  const preferAppClientToken =
-    String(process.env.AIFABRIX_DEPLOYMENT_AUTH || '').toLowerCase() === 'client-credentials';
-
-  const existing = authConfig.token ? String(authConfig.token) : '';
-  const looksLikeJwt = existing.split('.').length === 3 && existing.length > 80;
   // Enterprise path: keep a real OAuth JWT; do not overwrite with process.env.API_KEY.
-  if (looksLikeJwt) {
+  if (looksLikeJwtBearer(authConfig.token)) {
     return;
   }
-
-  if (!preferAppClientToken && process.env.API_KEY) {
-    const apiKey = String(process.env.API_KEY);
-    if (authConfig.type === 'bearer' && authConfig.token !== apiKey) {
-      authConfig.token = apiKey;
-      return;
-    }
-    if (authConfig.type === 'client-token') {
-      authConfig.type = 'bearer';
-      authConfig.token = apiKey;
-      return;
-    }
-  }
-
-  if (authConfig.token) {
+  if (!preferClientCredentialsDeploymentAuth() && trySubstituteEnvApiKeyBearer(authConfig)) {
     return;
   }
-
-  if (!preferAppClientToken && process.env.API_KEY) {
-    authConfig.type = 'bearer';
-    authConfig.token = String(process.env.API_KEY);
+  if (authConfig.token) {
     return;
   }
-
   if (authConfig.clientId || authConfig.clientSecret) {
     throw new Error(
       'Dataplane pipeline endpoints require OAuth2 (Bearer token) or x-client-token. ' +

package/lib/utils/url-declarative-resolve-load-doc.js

@@ -25,6 +25,42 @@ function tryReadApplicationYamlAt(cfgPath) {
   }
 }
 
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isPositivePortValue(value) {
+  if (typeof value === 'number' && value > 0) {
+    return true;
+  }
+  return typeof value === 'string' && /^\d+$/.test(String(value).trim());
+}
+
+/**
+ * True when a manifest can authoritatively supply listen/port for url:// expansion.
+ * External-system `application.json` (upload payload) has no HTTP listen port — using it
+ * for `url://builder-api-internal` falls through to {@link DECLARATIVE_URL_INFRA_DEFAULTS}
+ * (3000) and breaks Docker CIP against the real builder-api container (3005).
+ *
+ * @param {object|null|undefined} doc
+ * @returns {boolean}
+ */
+function isDeclarativeUrlPortAuthorityDoc(doc) {
+  if (!doc || typeof doc !== 'object') {
+    return false;
+  }
+  if ((doc.app && doc.app.type) === 'external') {
+    return false;
+  }
+  if (doc.externalIntegration && typeof doc.externalIntegration === 'object') {
+    return false;
+  }
+  return (
+    isPositivePortValue(doc.port) ||
+    isPositivePortValue(doc.build && doc.build.containerPort)
+  );
+}
+
 /**
  * Candidate paths for cross-app url:// resolution (low → high priority).
  * Platform system apps prefer materialized `~/.aifabrix-work|home/builder` over CLI package `builder/` stubs.
@@ -83,7 +119,7 @@ function loadApplicationYamlDocForUrlResolve(appKey, ctx, pathsUtil) {
     if (appKey === current && ctx.variablesPath) {
       const vp = path.resolve(String(ctx.variablesPath));
       const fromVars = tryReadApplicationYamlAt(vp);
-      if (fromVars) {
+      if (isDeclarativeUrlPortAuthorityDoc(fromVars)) {
         return fromVars;
       }
     }
@@ -105,5 +141,6 @@ function loadApplicationYamlDocForUrlResolve(appKey, ctx, pathsUtil) {
 
 module.exports = {
   collectApplicationYamlPathsForUrlResolve,
+  isDeclarativeUrlPortAuthorityDoc,
   loadApplicationYamlDocForUrlResolve
 };

package/lib/validation/external-manifest-validator.js

@@ -217,6 +217,36 @@ function validateDatasourceSystemKeyAlignment(manifest, errors) {
   });
 }
 
+/**
+ * Vendor OpenAPI contract surface is for Connected Systems. Role Assistants
+ * (digitalWorker) promote settings + Evidence — skip blocking OpenAPI vendor checks.
+ * @param {Object} manifest
+ * @param {Object} options
+ * @param {string[]} errors
+ * @param {string[]} warnings
+ */
+function applyExternalContractSurfaceChecks(manifest, options, errors, warnings) {
+  if (manifest.type !== 'external' || !Array.isArray(manifest.dataSources) || !manifest.system?.key) {
+    return;
+  }
+  const appPath = options.appPath;
+  if (typeof appPath !== 'string' || !appPath) {
+    return;
+  }
+  const systemKind =
+    typeof manifest.system.systemKind === 'string' ? manifest.system.systemKind.trim() : '';
+  if (systemKind === 'digitalWorker') {
+    warnings.push(
+      'Role Assistant (digitalWorker): vendor OpenAPI contract checks skipped ' +
+        '(settings + evidence path; run repair --api only when binding vendor OpenAPI).'
+    );
+    return;
+  }
+  const contract = validateAppContractSurface(appPath, manifest.system.key, manifest.dataSources);
+  errors.push(...contract.errors);
+  warnings.push(...contract.warnings);
+}
+
 /**
  * Validates controller deployment manifest for external systems
  * Validates manifest structure and inline system/dataSources against their schemas
@@ -251,14 +281,7 @@ async function validateControllerManifest(manifest, options = {}) {
   validateDatasources(manifest, ajv, externalDatasourceSchema, errors, warnings);
   validateDatasourceSystemKeyAlignment(manifest, errors);
   errors.push(...validateManifestRuntimeConfiguration(manifest));
-  if (manifest.type === 'external' && Array.isArray(manifest.dataSources) && manifest.system?.key) {
-    const appPath = options.appPath;
-    if (typeof appPath === 'string' && appPath) {
-      const contract = validateAppContractSurface(appPath, manifest.system.key, manifest.dataSources);
-      errors.push(...contract.errors);
-      warnings.push(...contract.warnings);
-    }
-  }
+  applyExternalContractSurfaceChecks(manifest, options, errors, warnings);
   validateConditionalRequirements(manifest, errors, warnings);
   validateRequiredFields(manifest, errors);
 

package/lib/validation/validate-external-file.js

@@ -10,7 +10,11 @@
 
 const fs = require('fs');
 const yaml = require('js-yaml');
-const { loadExternalSystemSchema, loadExternalDataSourceSchema } = require('../utils/schema-loader');
+const {
+  loadExternalSystemSchema,
+  loadExternalDataSourceSchema,
+  loadRoleAssistantSettingsSchema
+} = require('../utils/schema-loader');
 const { formatValidationErrors } = require('../utils/error-formatter');
 const { validateFieldReferences } = require('../datasource/field-reference-validator');
 const { validateAbac } = require('../datasource/abac-validator');
@@ -53,6 +57,9 @@ function getValidatorForType(normalizedType) {
   if (normalizedType === 'datasource') {
     return loadExternalDataSourceSchema();
   }
+  if (normalizedType === 'role-assistant-settings') {
+    return loadRoleAssistantSettingsSchema();
+  }
   throw new Error(`Unknown file type: ${normalizedType}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.51.0",
+  "version": "2.51.1",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -114,6 +114,7 @@
   },
   "dependencies": {
     "@aifabrix/miso-client": "^4.19.0",
+    "adm-zip": "^0.6.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "axios": "^1.18.1",

package/scripts/export-builder-api-evidence.js

@@ -238,7 +238,7 @@ function rowsFromManifestGuides() {
       title: 'Section quality and missing inputs',
       when: 'GET manifest section returns quality.missingInputs',
       expectedBehavior:
-        'Collect required missing inputs from the user before PATCH. Do not guess values. Include sectionReadToken from GET in PATCH body.',
+        'Collect required missing inputs from the user before PATCH. Do not guess values. sectionReadToken from GET is optional on PATCH (server re-reads when omitted; stale token returns 409). Prefer GET when you need quality or missingInputs.',
       order: 17
     })
   ];

package/templates/applications/dataplane/application.yaml

@@ -4,11 +4,12 @@ app:
   displayName: "AI Fabrix Dataplane"
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
-  language: python  # Explicitly specify Python language
-  version: 2.0.10
+  language: python # Explicitly specify Python language
+  version: 2.0.15
+
 # Image Configuration
-# Set tag to match your build (e.g. aifabrix build dataplane -t 1.0.0 then tag: 1.0.0)
-# Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
+# Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
+# Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
 image:
   name: aifabrix/dataplane
   tag: latest
@@ -34,10 +35,10 @@ frontDoorRouting:
 requires:
   database: true
   databases:
-    - name: dataplane          # Main database - configuration only
-    - name: dataplane-vector   # Vector and document store: chunks, embeddings, vector indexes (pgvector)
-    - name: dataplane-logs     # Logs database - execution, audit, ABAC traces
-    - name: dataplane-records  # Records database - external records storage
+    - name: dataplane # Main database - configuration only
+    - name: dataplane-vector # Vector and document store: chunks, embeddings, vector indexes (pgvector)
+    - name: dataplane-logs # Logs database - execution, audit, ABAC traces
+    - name: dataplane-records # Records database - external records storage
   redis: true
   storage: true
 
@@ -59,10 +60,10 @@ authentication:
 # Build Configuration
 # Dataplane builds from published image; context is project root (like miso-controller)
 build:
-  context: ../..                  # Docker build context (relative to builder/dataplane/)
-  dockerfile: builder/dataplane/Dockerfile  # Dockerfile path (relative to project root)
-  envOutputPath: ../../.env       # Copy to repo root for local dev
-  language: python                # Runtime language for template selection (typescript or python)
+  context: ../.. # Docker build context (relative to builder/dataplane/)
+  dockerfile: builder/dataplane/Dockerfile # Dockerfile path (relative to project root)
+  envOutputPath: ../../.env # Copy to repo root for local dev
+  language: python # Runtime language for template selection (typescript or python)
   # Dev reload: polling + watch /app/app only (avoids EMFILE on full repo bind-mount). See run_local.py, make af-reload.
   reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
@@ -72,6 +73,10 @@ build:
   worker: true
   imageRunWorker: exec python -m app.core.celery_worker_main
   imageRunBeat: exec python -m app.core.celery_beat_main
+  # Optional one-shot before ANY long-running role (api/worker/beat). Run exactly once per
+  # aifabrix run / Deployment — never once-per-container. Schema: application-schema build.deployJob.
+  # Local: aifabrix run; remote: miso Deployment via miso-azure (not Docker on controller).
+  deployJob: python -m app.db.migrate upgrade
 
 # =============================================================================
 # Portal Input Configuration (Deployment Wizard)
@@ -81,7 +86,7 @@ build:
 #
 # NOT included (auto-configured):
 # - Database URLs, Redis → auto-generated during Azure install
-# - MISO_*, KEYCLOAK_* → auto-generated during Azure install  
+# - MISO_*, KEYCLOAK_* → auto-generated during Azure install
 # - AI params / provider secrets → LLM external systems + secret store
 #   (never product OPENAI_* / AZURE_OPENAI_*). ≥2 providers →
 #   ENTERPRISE_LLM_DEFAULT_SELECTOR (portal LLM category).
@@ -135,8 +140,9 @@ configuration:
     category: Trust
     portalInput:
       field: select
-      label: "Enforce trust gate on datasource publish"
+      label: "Enforce trust gate on datasource publish (empty=ENVIRONMENT default)"
       options:
+        - ""
         - "false"
         - "true"
 
@@ -144,8 +150,9 @@ configuration:
     category: Trust
     portalInput:
       field: select
-      label: "Enforce trust gate on external system publish (promote scope)"
+      label: "Enforce trust gate on Deploy / system publish (empty=ENVIRONMENT default)"
       options:
+        - ""
         - "false"
         - "true"
 
@@ -225,3 +232,4 @@ configuration:
       field: text
       label: "Default LLM provider (system key when two or more providers)"
       placeholder: "openai"
+

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.10
+VERSION=2.0.15
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/dataplane/rbac.yaml

@@ -143,6 +143,20 @@ permissions:
   - name: "integration-template:delete"
     roles: ["aifabrix-platform-admin", "aifabrix-developer"]
     description: "Delete integration templates"
+
+  # Resource type catalog (public read; Miso owns writes via controller sync)
+  - name: "resource-type:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-deployment-admin",
+        "aifabrix-compliance-admin",
+        "aifabrix-developer",
+        "aifabrix-observer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Read the global Resource Type catalog (list/get)"
   
   # Generic dataplane operations
   - name: "dataplane:read"

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.8'
+  version: '2.0.10'
 
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)

package/templates/applications/miso-controller/env.template

@@ -288,7 +288,9 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsite
 # MORI SERVICE CONFIGURATION
 # =============================================================================
 
-MORI_BASE_URL=url://mori-controller-public
+# Shared pro Mori (Entra handoff + Graph callback). Prefer this over url://mori-controller-public
+# unless a local Mori app is registered and running for the developer.
+MORI_BASE_URL=https://aifabrix-pro-mori-web-we.azurewebsites.net
 MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault
 MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault

package/templates/channels/chatgpt/install.template.md.hbs

@@ -1,46 +1,64 @@
-# {{appName}} — ChatGPT assistant channel install
+# {{appName}} — ChatGPT custom MCP app setup
 
 {{appDescription}}
 
 Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
 
-## Connect ChatGPT workspace (admin)
+This output is connection and administration material (`channel-chatgpt.json` + `INSTALL.md`), not a plugin archive.
 
-1. Sign in to [OpenAI Platform](https://platform.openai.com/) or your **ChatGPT Enterprise** workspace admin console.
-2. Create a custom GPT, workspace connector, or MCP integration using the generated manifest from `dist/channels/chatgpt/channel-chatgpt.json`.
-3. Configure the **OpenAPI specification URL** and **MCP endpoint** from **Platform endpoints** below.
-4. Complete OAuth or API key setup as required by your ChatGPT deployment model.
-5. Save the **API key** or **OAuth client credentials** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
-6. Publish the connector to your workspace and complete admin approval if your organization requires it.
+## Workspace admin setup (manual)
 
-## Platform endpoints
+1. Sign in to your ChatGPT workspace as an admin and enable **Developer mode / custom MCP apps** if required by workspace policy.
+2. Create a custom MCP app and use the generated artifact from `dist/channels/chatgpt/channel-chatgpt.json` as the connection reference.
+3. Configure the remote MCP URL and transport from **Runtime connection** below.
+4. Complete authentication setup for your workspace policy. Store credential references in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
+5. Refresh tools in ChatGPT after configuration changes so ChatGPT reads the latest Runtime tool list.
+6. Publish the app to the workspace and configure workspace access controls (RBAC or equivalent).
 
-Configure these on the ChatGPT connector / custom GPT. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+## Runtime connection
+
+Configure these values in the ChatGPT custom MCP app. Do not place secrets in generated files.
 
-{{#if openapiUrl}}
-- **OpenAPI spec:** {{openapiUrl}}
-{{/if}}
 {{#if mcpUrl}}
-- **MCP:** {{mcpUrl}}
-{{/if}}
-{{#if actionsBaseUrl}}
-- **Actions base:** {{actionsBaseUrl}}
+- **Remote MCP URL:** {{mcpUrl}}
 {{/if}}
+- **Runtime system key:** {{runtimeSystemKey}}
+- **Transport:** {{runtimeTransport}}
+- **Auth mode:** {{runtimeAuthMode}}
+- **Expected Layer B tools:**
+{{#each layerBToolNames}}
+  - `{{this}}`
+{{/each}}
 
-## Assistant catalog
+AI Fabrix `--probe` validates Runtime through the first-party MCP gateway
+(`/api/v1/mcp/servers/tools` and MCP docs for `{{runtimeSystemKey}}`), including
+Layer B discovery and BTA Evidence authoring reachability. ChatGPT workspace apps still
+require a working streamable-http Remote MCP URL and admin publication.
 
-Runtime lists **assistants** available to each user from:
+## Runtime and Role Assistant boundary checks
+
+- Runtime should resolve assistants dynamically per user from:
 
 {{assistantCatalogUrl}}
 
-## After workspace approval
+- The ChatGPT top-level tool surface should stay at Runtime Layer B tools.
+- Evidence authoring remains an internal Business Transformation Assistant capability path, not top-level ChatGPT tools.
 
-```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}"
-```
+## BTA Evidence-authoring proof scenario
+
+Use this scenario to verify ChatGPT → Runtime → BTA path without exposing Evidence commands as top-level ChatGPT tools:
+
+1. Ask ChatGPT to improve an existing Role Assistant from process documentation.
+2. Confirm ChatGPT starts or continues Business Transformation Assistant work through Runtime.
+3. Confirm BTA performs evidence metadata/download/upload reasoning and presents certified proposals.
+4. Approve selected proposals and confirm activation remains an explicit human action.
 
-Optional validation:
+## AI Fabrix validation commands
+
+After workspace publication and authentication setup:
 
 ```bash
 aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
 ```
+
+Use `--force` only to regenerate artifacts and patch channel metadata. It does not rotate credentials.

package/templates/channels/chatgpt/integration/README.md

@@ -1,11 +1,14 @@
-# ChatGPT assistant channel (lab fixture)
+# ChatGPT custom MCP app channel
 
-SSOT for `aifabrix channel scaffold chatgpt` templates (`make sync-json` → builder).
+Generated by `aifabrix channel scaffold chatgpt`.
+
+Recommended flow:
 
 ```bash
-cd aifabrix-dataplane
-aifabrix validate chatgpt
-aifabrix upload chatgpt --probe
-aifabrix deploy chatgpt
-aifabrix app add-channel chatgpt --name "Your Assistant"
+aifabrix upload chatgpt --force
+aifabrix channel add chatgpt --name "Your Assistant" --probe
 ```
+
+The `channel add` step generates `dist/channels/chatgpt/channel-chatgpt.json` and
+`INSTALL.md` for ChatGPT workspace admins to connect a custom MCP app to the
+runtime-orchestration server.

package/templates/channels/chatgpt/integration/application.json

@@ -1,8 +1,8 @@
 {
   "app": {
     "key": "chatgpt",
-    "displayName": "ChatGPT assistant channel",
-    "description": "Assistant communication channel — deploy then app add-channel",
+    "displayName": "ChatGPT custom MCP app channel",
+    "description": "Assistant communication channel — deploy then channel add",
     "type": "external"
   },
   "externalIntegration": {

package/templates/channels/chatgpt/integration/chatgpt-system.json

@@ -1,7 +1,7 @@
 {
   "key": "chatgpt",
-  "displayName": "ChatGPT assistant channel",
-  "description": "Communication external system for ChatGPT assistant channel install",
+  "displayName": "ChatGPT custom MCP app channel",
+  "description": "Communication external system for ChatGPT custom MCP app onboarding",
   "type": "custom",
   "systemKind": "communication",
   "enabled": true,
@@ -9,7 +9,7 @@
     "authType": "credential",
     "credential": {
       "credentialKey": "chatgpt-channel",
-      "displayName": "ChatGPT assistant channel",
+      "displayName": "ChatGPT custom MCP app channel",
       "method": "apikey",
       "writeOnce": true,
       "variables": {

package/templates/channels/chatgpt/integration/env.template

@@ -1,4 +1,4 @@
-# ChatGPT assistant channel — lab fixture secrets
+# ChatGPT custom MCP app channel credential reference
 # aifabrix secret set chatgpt/apiKey "<value>" --shared
 
 KV_CHATGPT_APIKEY=kv://chatgpt/apiKey