@aifabrix/builder 2.51.1 → 2.52.1

package/lib/utils/promote-dev-docker-image.js

@@ -1,9 +1,10 @@
 /**
  * Promote a developer-scoped local Docker image to the manifest base repository (tag only).
  *
- * @fileoverview Used by `aifabrix build --base --from-dev` and dev-promote workflows
+ * @fileoverview Used by `aifabrix build --base --from-dev` and dev-promote workflows.
+ * Promote always applies two base tags: `main` (floating) and the version tag (TAG / package version).
  * @author AI Fabrix Team
- * @version 1.0.0
+ * @version 1.1.0
  */
 
 'use strict';
@@ -15,6 +16,9 @@ const { execWithDockerEnv } = require('./docker-exec');
 const logger = require('./logger');
 const { formatSuccessLine } = require('./cli-test-layout-chalk');
 
+/** Floating base tag applied on every promote alongside the version tag. */
+const PROMOTE_MAIN_TAG = 'main';
+
 /**
  * @param {string} value
  * @returns {string}
@@ -61,6 +65,33 @@ async function dockerTagImageRef(sourceRef, targetRef) {
   await execWithDockerEnv(`docker tag ${shellQuote(sourceRef)} ${shellQuote(targetRef)}`);
 }
 
+/**
+ * Version tag for promote (not floating aliases).
+ * @param {Object} options
+ * @returns {string}
+ */
+function resolvePromoteVersionTag(options = {}) {
+  const raw = String(options.tag || '').trim();
+  if (!raw || raw === 'latest' || raw === PROMOTE_MAIN_TAG) {
+    return 'latest';
+  }
+  return raw;
+}
+
+/**
+ * Base tags to apply on promote: version first, then `main` when distinct.
+ * @param {Object} options
+ * @returns {string[]}
+ */
+function resolvePromoteBaseTags(options = {}) {
+  const versionTag = resolvePromoteVersionTag(options);
+  const tags = [versionTag];
+  if (versionTag !== PROMOTE_MAIN_TAG) {
+    tags.push(PROMOTE_MAIN_TAG);
+  }
+  return tags;
+}
+
 /**
  * @param {string} appName
  * @param {Object} variables
@@ -69,7 +100,7 @@ async function dockerTagImageRef(sourceRef, targetRef) {
  * @returns {Promise<{ devRef: string, baseRef: string, devTag: string, baseTag: string }>}
  */
 async function resolveDevAndBaseImageRefs(appName, variables, developerId, options) {
-  const baseTag = options.tag || 'latest';
+  const baseTag = resolvePromoteVersionTag(options);
   const devTag = options.fromDevTag || 'latest';
   const { buildImageName: baseName } = await resolveBuildDockerTagNames(appName, variables, developerId, {
     ...options,
@@ -93,31 +124,68 @@ async function resolveDevAndBaseImageRefs(appName, variables, developerId, optio
  * @param {Object} appConfig
  * @param {string|number} developerId
  * @param {Object} options
- * @returns {Promise<{ devRef: string, baseRef: string }|null>}
+ * @returns {Promise<{
+ *   devRef: string,
+ *   baseRef: string,
+ *   baseName: string,
+ *   baseTags: string[]
+ * }|null>}
  */
 async function resolvePromoteSourceAndTargetRefs(appName, appConfig, developerId, options) {
-  const baseTag = options.tag || 'latest';
+  const baseTags = resolvePromoteBaseTags(options);
+  const versionTag = baseTags[0];
   const devTagCandidates = ['latest'];
-  if (baseTag !== 'latest' && !devTagCandidates.includes(baseTag)) {
-    devTagCandidates.push(baseTag);
+  if (versionTag !== 'latest' && !devTagCandidates.includes(versionTag)) {
+    devTagCandidates.push(versionTag);
   }
   for (const fromDevTag of devTagCandidates) {
     const refs = await resolveDevAndBaseImageRefs(appName, appConfig, developerId, {
       ...options,
+      tag: versionTag,
       fromDevTag
     });
     if (await dockerImageRefExists(refs.devRef)) {
-      return { devRef: refs.devRef, baseRef: refs.baseRef };
+      const baseName = refs.baseRef.slice(0, refs.baseRef.lastIndexOf(':'));
+      return {
+        devRef: refs.devRef,
+        baseRef: refs.baseRef,
+        baseName,
+        baseTags
+      };
     }
   }
   return null;
 }
 
+/**
+ * @param {string} baseName
+ * @param {string[]} baseTags
+ * @param {string|null} devId
+ * @returns {Promise<boolean>} true when every target already matches dev image id
+ */
+async function allBaseTagsMatchDev(baseName, baseTags, devId) {
+  if (!devId) {
+    return false;
+  }
+  for (const tag of baseTags) {
+    const ref = `${baseName}:${tag}`;
+    if (!(await dockerImageRefExists(ref))) {
+      return false;
+    }
+    const baseId = await readDockerImageId(ref);
+    if (!baseId || baseId !== devId) {
+      return false;
+    }
+  }
+  return true;
+}
+
 /**
  * Tag developer-scoped image as manifest base when present locally.
+ * Always applies the version tag and `main`.
  * @param {string} appName
  * @param {Object} options - build options (`base`, `tag`, `registry`, `fromDev`)
- * @returns {Promise<string|null>} base image ref when promoted/skipped; null when dev image missing
+ * @returns {Promise<string|null>} primary base image ref (version) when promoted; null when missing
  */
 async function tryPromoteDevImageToBase(appName, options = {}) {
   if (options.base !== true) {
@@ -135,19 +203,27 @@ async function tryPromoteDevImageToBase(appName, options = {}) {
   if (!resolved) {
     return null;
   }
-  const { devRef, baseRef } = resolved;
+  const { devRef, baseRef, baseName, baseTags } = resolved;
 
   const devId = await readDockerImageId(devRef);
-  if (await dockerImageRefExists(baseRef)) {
-    const baseId = await readDockerImageId(baseRef);
-    if (devId && baseId && devId === baseId) {
-      logger.log(formatSuccessLine(`Base image already matches dev build: ${baseRef}`));
-      return baseRef;
-    }
+  if (await allBaseTagsMatchDev(baseName, baseTags, devId)) {
+    logger.log(
+      formatSuccessLine(
+        `Base image already matches dev build: ${baseTags.map((t) => `${baseName}:${t}`).join(', ')}`
+      )
+    );
+    return baseRef;
   }
 
-  await dockerTagImageRef(devRef, baseRef);
-  logger.log(formatSuccessLine(`Promoted dev image to base (tag only): ${baseRef}`));
+  for (const tag of baseTags) {
+    const targetRef = `${baseName}:${tag}`;
+    await dockerTagImageRef(devRef, targetRef);
+  }
+  logger.log(
+    formatSuccessLine(
+      `Promoted dev image to base (tag only): ${baseTags.map((t) => `${baseName}:${t}`).join(', ')}`
+    )
+  );
   return baseRef;
 }
 
@@ -160,10 +236,13 @@ function shouldAttemptDevPromote(options) {
 }
 
 module.exports = {
+  PROMOTE_MAIN_TAG,
   tryPromoteDevImageToBase,
   shouldAttemptDevPromote,
   resolveDevAndBaseImageRefs,
   resolvePromoteSourceAndTargetRefs,
+  resolvePromoteBaseTags,
+  resolvePromoteVersionTag,
   dockerImageRefExists,
   readDockerImageId,
   dockerTagImageRef

package/lib/utils/role-assistant-paths.js

@@ -3,7 +3,7 @@
  *
  * @fileoverview Paths under role-assistant/ for Role Assistant packages
  * @author AI Fabrix Team
- * @version 1.0.0
+ * @version 1.1.0
  */
 
 'use strict';
@@ -14,6 +14,7 @@ const { nodeFs } = require('../internal/node-fs');
 
 const WORKSPACE_ROLE_ASSISTANT = 'role-assistant';
 const SYSTEM_KIND_DIGITAL_WORKER = 'digitalWorker';
+const ROLE_ASSISTANT_SYSTEM_PREFIX = 'ra-';
 
 function getMaterializationParent() {
   const work = process.env.AIFABRIX_WORK;
@@ -63,7 +64,64 @@ function isExistingDirectory(disk, dirPath) {
 }
 
 /**
- * Resolves role-assistant/<roleKey> with cwd-first behavior.
+ * Bare business roleKey (strips leading ra- if present).
+ * @param {string} roleKeyOrSystemKey
+ * @returns {string}
+ */
+function bareRoleKey(roleKeyOrSystemKey) {
+  const raw = String(roleKeyOrSystemKey || '').trim();
+  if (raw.toLowerCase().startsWith(ROLE_ASSISTANT_SYSTEM_PREFIX)) {
+    return raw.slice(ROLE_ASSISTANT_SYSTEM_PREFIX.length);
+  }
+  return raw;
+}
+
+/**
+ * Folder / ExternalSystem key for a Role Assistant: ra-{roleKey}.
+ * @param {string} roleKeyOrSystemKey
+ * @returns {string}
+ */
+function roleAssistantSystemKey(roleKeyOrSystemKey) {
+  const bare = bareRoleKey(roleKeyOrSystemKey);
+  if (!bare) {
+    return '';
+  }
+  return `${ROLE_ASSISTANT_SYSTEM_PREFIX}${bare}`;
+}
+
+/**
+ * Candidate folder names under role-assistant/ (prefer ra-, then legacy bare).
+ * @param {string} roleKeyOrSystemKey
+ * @returns {string[]}
+ */
+function roleAssistantFolderCandidates(roleKeyOrSystemKey) {
+  const withRa = roleAssistantSystemKey(roleKeyOrSystemKey);
+  const bare = bareRoleKey(roleKeyOrSystemKey);
+  const out = [];
+  if (withRa) {
+    out.push(withRa);
+  }
+  if (bare && bare !== withRa) {
+    out.push(bare);
+  }
+  return out;
+}
+
+function firstExistingUnderRoot(disk, root, folderNames) {
+  if (!root) {
+    return null;
+  }
+  for (const name of folderNames) {
+    const candidate = path.join(root, name);
+    if (isExistingDirectory(disk, candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolves role-assistant/ra-{roleKey} (preferred) or legacy bare folder.
  * @param {string} roleKey
  * @returns {string}
  */
@@ -72,27 +130,31 @@ function getRoleAssistantPath(roleKey) {
     throw new Error('Role key is required and must be a string');
   }
   const disk = nodeFs();
+  const folders = roleAssistantFolderCandidates(roleKey);
+  const preferred = roleAssistantSystemKey(roleKey);
   const cwdRoot = getCwdRoleAssistantRoot();
-  const matPath = path.join(getMaterializationParent(), WORKSPACE_ROLE_ASSISTANT, roleKey);
-  if (cwdRoot) {
-    const cwdPath = path.join(cwdRoot, roleKey);
-    if (isExistingDirectory(disk, cwdPath)) {
-      return cwdPath;
-    }
-  }
-  if (isExistingDirectory(disk, matPath)) {
-    return matPath;
+  const matRoot = path.join(getMaterializationParent(), WORKSPACE_ROLE_ASSISTANT);
+
+  const existing =
+    firstExistingUnderRoot(disk, cwdRoot, folders) ||
+    firstExistingUnderRoot(disk, matRoot, folders);
+  if (existing) {
+    return existing;
   }
   if (cwdRoot) {
-    return path.join(cwdRoot, roleKey);
+    return path.join(cwdRoot, preferred);
   }
-  return matPath;
+  return path.join(matRoot, preferred);
 }
 
 module.exports = {
   WORKSPACE_ROLE_ASSISTANT,
   SYSTEM_KIND_DIGITAL_WORKER,
+  ROLE_ASSISTANT_SYSTEM_PREFIX,
   getCwdRoleAssistantRoot,
   getRoleAssistantRoot,
-  getRoleAssistantPath
+  getRoleAssistantPath,
+  bareRoleKey,
+  roleAssistantSystemKey,
+  roleAssistantFolderCandidates
 };

package/lib/utils/transient-developer-id.js

@@ -0,0 +1,28 @@
+/**
+ * Transient developer-id override for CLI commands (does not persist config).
+ *
+ * @fileoverview Resolve optional --developer-id / --developer without setDeveloperId
+ */
+
+'use strict';
+
+const { validateAndNormalizeDeveloperId } = require('../core/config-normalize');
+
+/**
+ * Resolve optional CLI developer override (transient — does not persist).
+ * Prefers developerId (--developer-id) over developer (-d/--developer).
+ *
+ * @param {Object} [options] - Commander options
+ * @returns {string|undefined} Normalized digit string, or undefined to use config
+ */
+function resolveTransientDeveloperIdFromOptions(options) {
+  const raw = options && (options.developerId ?? options.developer);
+  if (raw === undefined || raw === null || raw === '') {
+    return undefined;
+  }
+  return validateAndNormalizeDeveloperId(raw);
+}
+
+module.exports = {
+  resolveTransientDeveloperIdFromOptions
+};

package/lib/utils/upload-sync-options.js

@@ -10,7 +10,7 @@
 
 /**
  * @param {Object} [options] - CLI options from test / sync callers
- * @returns {{ minimal: true, verbose: boolean, silentResolve: true, syncMode: true, force?: true, authConfig?: Object, dataplaneUrl?: string, environment?: string }}
+ * @returns {{ minimal: true, verbose: boolean, silentResolve: boolean, syncMode: boolean, force?: true, authConfig?: Object, dataplaneUrl?: string, environment?: string }}
  */
 function buildMinimalUploadSyncOptions(options = {}) {
   const deployPreflight = options.uploadContext === 'deploy-preflight';
@@ -18,11 +18,14 @@ function buildMinimalUploadSyncOptions(options = {}) {
     minimal: true,
     // CLI -v on verify-* / test-* is for run output, not preflight upload banners.
     verbose: false,
-    silentResolve: true,
-    syncMode: true,
+    // Deploy preflight should match `af upload` progress (URL + Publishing spinner).
+    // Verify/test --sync stays silent so parent command owns the progress line.
+    silentResolve: !deployPreflight,
+    syncMode: !deployPreflight,
     skipDataSync: true,
+    // Explicit suppress wins; deploy-preflight never suppresses the Publishing spinner.
     suppressPipelineSpinner:
-      options.suppressPipelineSpinner === true || deployPreflight === true
+      options.suppressPipelineSpinner === true && !deployPreflight
   };
   if (options.force === true) {
     out.force = true;

package/lib/validation/reserved-system-key-prefixes.js

@@ -0,0 +1,56 @@
+/**
+ * Frozen ExternalSystem key prefixes (Role Assistant / Enterprise Knowledge).
+ *
+ * @fileoverview Reject hand-authored ra-/ek- keys under integration/
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const RESERVED_SYSTEM_KEY_PREFIXES = ['ra-', 'ek-'];
+
+/**
+ * @param {string|null|undefined} systemKey
+ * @returns {boolean}
+ */
+function hasReservedPlatformSystemKeyPrefix(systemKey) {
+  const normalized = String(systemKey || '')
+    .trim()
+    .toLowerCase();
+  if (!normalized) {
+    return false;
+  }
+  return RESERVED_SYSTEM_KEY_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+
+/**
+ * Connected Systems under integration/ must not use reserved prefixes.
+ * Role Assistant packages live under role-assistant/ra-*.
+ *
+ * @param {string|null|undefined} systemKey
+ * @param {string|null|undefined} workspaceBaseDir - integration | role-assistant | …
+ * @returns {string|null} Error message or null when allowed
+ */
+function reservedSystemKeyError(systemKey, workspaceBaseDir) {
+  if (!hasReservedPlatformSystemKeyPrefix(systemKey)) {
+    return null;
+  }
+  const workspace = String(workspaceBaseDir || '')
+    .trim()
+    .toLowerCase();
+  if (workspace === 'role-assistant' || workspace === 'enterprise-knowledge') {
+    return null;
+  }
+  return (
+    `System key '${systemKey}' uses a reserved prefix (ra- or ek-). ` +
+    'Role Assistant packages use role-assistant/ra-{roleKey}/; ' +
+    'Enterprise Knowledge uses ek- keys from platform generators only.'
+  );
+}
+
+module.exports = {
+  RESERVED_SYSTEM_KEY_PREFIXES,
+  hasReservedPlatformSystemKeyPrefix,
+  reservedSystemKeyError
+};

package/lib/validation/validate.js

@@ -22,6 +22,7 @@ const { generateControllerManifest } = require('../generator/external-controller
 const { validateControllerManifest } = require('./external-manifest-validator');
 const { runExternalValidateWithOptionalCertSync } = require('./validate-external-cert-sync');
 const { validateExternalFile } = require('./validate-external-file');
+const { reservedSystemKeyError } = require('./reserved-system-key-prefixes');
 
 /**
  * Validates a file path (detects type and validates)
@@ -276,6 +277,52 @@ async function validateManifestStep(appName, options = {}) {
   }
 }
 
+/**
+ * Early-fail payload when system key uses a reserved prefix.
+ * @param {string} reservedError
+ * @param {string} appPath
+ * @returns {Object}
+ */
+function reservedSystemKeyValidationResult(reservedError, appPath) {
+  return {
+    valid: false,
+    errors: [reservedError],
+    warnings: [],
+    steps: {
+      application: { valid: false, errors: [reservedError], warnings: [] },
+      components: { valid: true, errors: [], warnings: [], files: [], skipped: true },
+      manifest: { valid: true, errors: [], warnings: [], skipped: true }
+    },
+    appPath
+  };
+}
+
+/**
+ * Aggregate step results into the complete validation response.
+ * @param {Object} steps
+ * @param {string} appPath
+ * @returns {Object}
+ */
+function aggregateExternalValidationSteps(steps, appPath) {
+  const allErrors = [
+    ...steps.application.errors,
+    ...steps.components.errors,
+    ...steps.manifest.errors
+  ];
+  const allWarnings = [
+    ...steps.application.warnings,
+    ...steps.components.warnings,
+    ...steps.manifest.warnings
+  ];
+  return {
+    valid: allErrors.length === 0,
+    errors: allErrors,
+    warnings: allWarnings,
+    steps,
+    appPath
+  };
+}
+
 /**
  * Validates external system completely (components + full manifest)
  * Performs step-by-step validation: application config → components → full manifest
@@ -295,7 +342,12 @@ async function validateExternalSystemComplete(appName, options = {}) {
     throw new Error('App name is required and must be a string');
   }
 
-  const { appPath } = await detectAppType(appName, options);
+  const { appPath, baseDir } = await detectAppType(appName, options);
+  const reservedError = reservedSystemKeyError(appName, baseDir);
+  if (reservedError) {
+    return reservedSystemKeyValidationResult(reservedError, appPath);
+  }
+
   const steps = {
     application: { valid: false, errors: [], warnings: [] },
     components: { valid: false, errors: [], warnings: [], files: [] },
@@ -303,14 +355,9 @@ async function validateExternalSystemComplete(appName, options = {}) {
   };
 
   const externalOptions = { ...options };
-
-  // Step 1: Validate Application Config
   steps.application = await validateApplicationStep(appName, externalOptions);
-
-  // Step 2: Validate Individual Components
   steps.components = await validateComponentsStep(appName, externalOptions);
 
-  // If components have errors, return early (don't validate manifest)
   if (!steps.components.valid) {
     steps.manifest = { valid: true, errors: [], warnings: [], skipped: true };
     return {
@@ -322,20 +369,8 @@ async function validateExternalSystemComplete(appName, options = {}) {
     };
   }
 
-  // Step 3 & 4: Generate and Validate Full Manifest (only if Step 2 passes)
   steps.manifest = await validateManifestStep(appName, { ...externalOptions, appPath });
-
-  // Aggregate Results
-  const allErrors = [...steps.application.errors, ...steps.components.errors, ...steps.manifest.errors];
-  const allWarnings = [...steps.application.warnings, ...steps.components.warnings, ...steps.manifest.warnings];
-
-  return {
-    valid: allErrors.length === 0,
-    errors: allErrors,
-    warnings: allWarnings,
-    steps,
-    appPath
-  };
+  return aggregateExternalValidationSteps(steps, appPath);
 }
 
 async function validateAppOrFile(appOrFile, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.51.1",
+  "version": "2.52.1",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {

package/scripts/pnpm/af.mjs

@@ -4,9 +4,13 @@
  * Usage: pnpm run af <subcommand>  |  npm run af -- <subcommand>
  */
 import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { resolveAifabrixBin } from './lib/resolve-aifabrix-bin.mjs';
 
 const AIFABRIX_BIN = resolveAifabrixBin();
+const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '../..');
 
 const USAGE = `Usage: pnpm run af <subcommand>
 
@@ -19,7 +23,7 @@ Subcommands:
   ba-build        aifabrix build builder-api
   dev-build       ba-build then ba-run (local Docker image)
   dev-reload      Docker live reload (spinner + URL + .temp/dev-reload.log)
-  dev-promote     build --base --from-dev + run --base (global image; TAG=1.9.5 pnpm run dev-promote)
+  dev-promote     build --base --from-dev + run --base (tags main + version; TAG=2.52.0 or package.json)
 `;
 
 const COMMANDS = {
@@ -36,10 +40,20 @@ async function runDevBuild() {
   await runCommand(COMMANDS['ba-run']);
 }
 
+function readPackageVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(REPO_ROOT, 'package.json'), 'utf8'));
+    const version = String(pkg.version || '').trim();
+    return version || null;
+  } catch {
+    return null;
+  }
+}
+
 function resolvePromoteTag() {
   const fromArg = process.argv[3];
-  const tag = (process.env.TAG || fromArg || '').trim();
-  if (!tag || tag === 'latest') {
+  const tag = (process.env.TAG || fromArg || readPackageVersion() || '').trim();
+  if (!tag || tag === 'latest' || tag === 'main') {
     return null;
   }
   return tag;
@@ -47,13 +61,14 @@ function resolvePromoteTag() {
 
 async function runDevPromote() {
   const tag = resolvePromoteTag();
-  if (tag) {
-    await runCommand([AIFABRIX_BIN, 'build', 'builder-api', '--base', '--from-dev', '--tag', tag]);
-    await runCommand([AIFABRIX_BIN, 'run', 'builder-api', '--base', '--tag', tag]);
-    return;
+  if (!tag) {
+    throw new Error(
+      'dev-promote requires a version tag. Set TAG=x.y.z or ensure package.json has "version".'
+    );
   }
-  await runCommand([AIFABRIX_BIN, 'build', 'builder-api', '--base', '--from-dev']);
-  await runCommand([AIFABRIX_BIN, 'run', 'builder-api', '--base']);
+  // Promote applies both :main and :<version>; run uses the version tag.
+  await runCommand([AIFABRIX_BIN, 'build', 'builder-api', '--base', '--from-dev', '--tag', tag]);
+  await runCommand([AIFABRIX_BIN, 'run', 'builder-api', '--base', '--tag', tag]);
 }
 
 function runCommand(args) {

package/scripts/pnpm/help.mjs

@@ -25,7 +25,7 @@ const publicSections = [
 
 const advancedLines = [
   '--- Advanced (help -- --all) ---',
-  'dev-build / dev-promote / af ba-*',
+  'dev-build / dev-promote (tags main + version) / af ba-*',
   'build:ci           → lint + schema-sync + flags + test:ci (same as GitHub)',
   'sync-json          → publish builder/builder-api → templates/',
   'test:154           → builder-api scoped Jest + arch grep',

package/templates/applications/builder-api/application.yaml

@@ -2,7 +2,7 @@
 app:
   key: builder-api
   displayName: 'AI Fabrix Builder API'
-  description: 'Stateless HTTP orchestration for external-system workspace lifecycle. Provider-neutral integration flows via Dataplane Enterprise MCP and governance APIs (154.0 / 154.1).'
+  description: 'Business Transformation services — HTTP orchestration for connected-system workspace lifecycle via Dataplane Enterprise MCP and governance APIs.'
   type: webapp
   language: typescript
   version: 1.0.0
@@ -11,8 +11,8 @@ app:
 image:
   name: aifabrix/builder-api
   tag: latest
-  registry: aifabrixdevacr.azurecr.io
-  registryMode: acr
+  registry: aifabrixacr.azurecr.io
+  registryMode: external
 
 # Port Configuration (container port; host port = port + developer_id * 100)
 port: 3005

package/templates/applications/dataplane/application.yaml

@@ -5,16 +5,15 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.15
-
+  version: 2.0.26
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
 image:
   name: aifabrix/dataplane
   tag: latest
-  registry: aifabrixdevacr.azurecr.io
-  registryMode: acr
+  registry: aifabrixacr.azurecr.io
+  registryMode: external
 
 # Port Configuration
 port: 3001
@@ -89,7 +88,8 @@ build:
 # - MISO_*, KEYCLOAK_* → auto-generated during Azure install
 # - AI params / provider secrets → LLM external systems + secret store
 #   (never product OPENAI_* / AZURE_OPENAI_*). ≥2 providers →
-#   ENTERPRISE_LLM_DEFAULT_SELECTOR (portal LLM category).
+#   ENTERPRISE_LLM_DEFAULT_SELECTOR (portal/env deploy default); Environment
+#   Settings ai.llmProvider overrides without redeploy.
 # - ENVIRONMENT → set by deployment target
 
 configuration: