@aifabrix/builder 2.53.1 → 2.55.0

package/lib/utils/token-manager.js

@@ -212,6 +212,15 @@ async function tryClientTokenAuth(environment, appName, controllerUrl) {
   return null;
 }
 
+function throwNoDeploymentAuth(credentialApp) {
+  const err = new Error(
+    `No authentication method available. For CI: set AIFABRIX_DEPLOYMENT_AUTH=client-credentials and MISO_CLIENTID/MISO_CLIENTSECRET in .env or '${credentialApp}-client-idKeyVault' in secrets.local.yaml. For interactive use: aifabrix login`
+  );
+  err.statusCode = 401;
+  err.authFailure = true;
+  throw err;
+}
+
 /**
  * Get deployment authentication configuration with priority:
  * 1. Device token → type 'bearer' (user token) → send as Authorization: Bearer
@@ -265,11 +274,7 @@ async function getDeploymentAuth(controllerUrl, environment, appName, options =
     }
   }
 
-  throw new Error(
-    'No authentication method available. For CI: set AIFABRIX_DEPLOYMENT_AUTH=client-credentials and ' +
-      `MISO_CLIENTID/MISO_CLIENTSECRET in .env or '${credentialApp}-client-idKeyVault' in secrets.local.yaml. ` +
-      'For interactive use: aifabrix login'
-  );
+  throwNoDeploymentAuth(credentialApp);
 }
 
 /**

package/lib/validation/validate-external-file.js

@@ -13,7 +13,8 @@ const yaml = require('js-yaml');
 const {
   loadExternalSystemSchema,
   loadExternalDataSourceSchema,
-  loadRoleAssistantSettingsSchema
+  loadRoleAssistantSettingsSchema,
+  loadRoleAssistantTestCaseSchema
 } = require('../utils/schema-loader');
 const { formatValidationErrors } = require('../utils/error-formatter');
 const { validateFieldReferences } = require('../datasource/field-reference-validator');
@@ -60,6 +61,9 @@ function getValidatorForType(normalizedType) {
   if (normalizedType === 'role-assistant-settings') {
     return loadRoleAssistantSettingsSchema();
   }
+  if (normalizedType === 'role-assistant-test-case') {
+    return loadRoleAssistantTestCaseSchema();
+  }
   throw new Error(`Unknown file type: ${normalizedType}`);
 }
 

package/lib/validation/validate.js

@@ -23,6 +23,11 @@ const { validateControllerManifest } = require('./external-manifest-validator');
 const { runExternalValidateWithOptionalCertSync } = require('./validate-external-cert-sync');
 const { validateExternalFile } = require('./validate-external-file');
 const { reservedSystemKeyError } = require('./reserved-system-key-prefixes');
+const {
+  isRoleAssistantWorkspace,
+  isEnterpriseKnowledgeWorkspace
+} = require('../utils/platform-shell-package');
+const { validateRoleAssistantPackage } = require('../role-assistant/package-validate');
 
 /**
  * Validates a file path (detects type and validates)
@@ -323,6 +328,32 @@ function aggregateExternalValidationSteps(steps, appPath) {
   };
 }
 
+function skippedValidationStep() {
+  return { valid: true, errors: [], warnings: [], skipped: true };
+}
+
+function skippedComponentsStep() {
+  return { valid: true, errors: [], warnings: [], files: [], skipped: true };
+}
+
+async function validatePlatformShellPackage(_appName, baseDir, appPath, _options) {
+  if (isEnterpriseKnowledgeWorkspace(baseDir)) {
+    return aggregateExternalValidationSteps({
+      application: skippedValidationStep(),
+      components: skippedComponentsStep(),
+      manifest: skippedValidationStep()
+    }, appPath);
+  }
+  if (!isRoleAssistantWorkspace(baseDir)) {
+    return null;
+  }
+  return aggregateExternalValidationSteps({
+    application: skippedValidationStep(),
+    components: await validateRoleAssistantPackage(appPath),
+    manifest: skippedValidationStep()
+  }, appPath);
+}
+
 /**
  * Validates external system completely (components + full manifest)
  * Performs step-by-step validation: application config → components → full manifest
@@ -355,6 +386,16 @@ async function validateExternalSystemComplete(appName, options = {}) {
   };
 
   const externalOptions = { ...options };
+  const platformResult = await validatePlatformShellPackage(
+    appName,
+    baseDir,
+    appPath,
+    externalOptions
+  );
+  if (platformResult) {
+    return platformResult;
+  }
+
   steps.application = await validateApplicationStep(appName, externalOptions);
   steps.components = await validateComponentsStep(appName, externalOptions);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.53.1",
+  "version": "2.55.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {

package/templates/README.md

@@ -21,7 +21,7 @@ Application templates are folder-based and located under `templates/applications
 | --- | --- |
 | `aifabrix-builder/builder/builder-api/` | `templates/applications/builder-api/` |
 | `aifabrix-miso/builder/miso-controller/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/miso-controller/` |
-| `aifabrix-miso/builder/keycloak/` (`env.template`, `application.yaml`) | `templates/applications/keycloak/` |
+| `aifabrix-miso/builder/keycloak/` (`env.template`, `application.yaml`, `Dockerfile`, `cimd-lenient-parse/`) | `templates/applications/keycloak/` |
 | `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
 
 **Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. Builder-owned schemas in `lib/schema/` (wizard, infra, etc.) are left alone.

package/templates/agent-kit/adapters/claude/nested.CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/agent-kit/adapters/claude/root.CLAUDE.md

@@ -0,0 +1,5 @@
+@AGENTS.md
+
+Delivery skills: `/aifabrix-plan`, `/aifabrix-connected-system`, `/aifabrix-role-assistant`, `/aifabrix-prove`.
+The skill body lives under `.agents/skills/`. Do not invent a parallel workflow.
+Local vs SSH (tmux, Remote Control): `.agents/skills/shared/hosts.md`.

package/templates/agent-kit/adapters/cursor/commands/cust-0-plan.md

@@ -0,0 +1,5 @@
+# cust-0-plan
+
+Compatibility alias for skill **aifabrix-plan**. Optional system key.
+
+Contains no business rules. Prefer `/aifabrix-plan` on fresh installs.

package/templates/agent-kit/adapters/cursor/commands/cust-1-validate.md

@@ -0,0 +1,5 @@
+# cust-1-validate
+
+Compatibility alias for skill **aifabrix-connected-system** phase `validate`.
+
+Contains no business rules. Prefer `/aifabrix-connected-system`.

package/templates/agent-kit/adapters/cursor/commands/cust-2-build.md

@@ -0,0 +1,5 @@
+# cust-2-build
+
+Compatibility alias for skill **aifabrix-connected-system** phase `build`.
+
+Contains no business rules. Prefer `/aifabrix-connected-system`.

package/templates/agent-kit/adapters/cursor/commands/cust-3-push.md

@@ -0,0 +1,5 @@
+# cust-3-push
+
+Compatibility alias for skill **aifabrix-connected-system** phase `publish`.
+
+Contains no business rules. Prefer `/aifabrix-connected-system`.

package/templates/agent-kit/adapters/cursor/commands/cust-biz-1-validate.md

@@ -0,0 +1,5 @@
+# cust-biz-1-validate
+
+Compatibility alias for skill **aifabrix-prove** phase `validate`.
+
+Contains no business rules. Prefer `/aifabrix-prove`.

package/templates/agent-kit/adapters/cursor/commands/cust-biz-2-build.md

@@ -0,0 +1,5 @@
+# cust-biz-2-build
+
+Compatibility alias for skill **aifabrix-prove** phase `build`.
+
+Contains no business rules. Prefer `/aifabrix-prove`.

package/templates/agent-kit/adapters/cursor/commands/cust-biz-3-prove.md

@@ -0,0 +1,5 @@
+# cust-biz-3-prove
+
+Compatibility alias for skill **aifabrix-prove** phase `prove`.
+
+Contains no business rules. Prefer `/aifabrix-prove`.

package/templates/agent-kit/agent-kit.yaml

@@ -0,0 +1,45 @@
+schemaVersion: "1"
+kitVersion: "1.1.1"
+minimumBuilderVersion: "2.54.2"
+skills:
+  - aifabrix-plan
+  - aifabrix-connected-system
+  - aifabrix-role-assistant
+  - aifabrix-prove
+managed:
+  - source: skills
+    target: .agents/skills
+    mode: tree
+  - source: instructions/root.AGENTS.md
+    target: AGENTS.md
+    mode: managed-section
+  - source: instructions/integration.AGENTS.md
+    target: integration/AGENTS.md
+    mode: managed-section
+  - source: instructions/role-assistant.AGENTS.md
+    target: role-assistant/AGENTS.md
+    mode: managed-section
+  - source: instructions/AGENTKIT.md
+    target: AGENTKIT.md
+    mode: file
+    render: hosts
+  - source: workspace/README.md
+    target: README.md
+    mode: if-missing
+optional:
+  - source: adapters/cursor/commands
+    target: .cursor/commands
+    mode: tree
+    when: v1-migration
+  - source: adapters/claude/root.CLAUDE.md
+    target: CLAUDE.md
+    mode: managed-section
+    when: host-claude
+  - source: adapters/claude/nested.CLAUDE.md
+    target: integration/CLAUDE.md
+    mode: managed-section
+    when: host-claude
+  - source: adapters/claude/nested.CLAUDE.md
+    target: role-assistant/CLAUDE.md
+    mode: managed-section
+    when: host-claude

package/templates/agent-kit/instructions/AGENTKIT.md

@@ -0,0 +1,83 @@
+# Agent Kit
+
+Builder-owned. `aifabrix agent-kit update` refreshes this file. If workspace `README.md` is missing, install/update creates it. An existing README is never overwritten.
+
+## Install
+
+From this git repository (Builder CLI on PATH):
+
+```bash
+aifabrix agent-kit install --host {{hostFlag}}{{#if autoApprove}} --approve-all --yes{{/if}}
+aifabrix agent-kit status
+```
+
+`--host` may be `all`, `cursor`, `codex`, or `claude`. Shared skills always land in `.agents/skills/`.
+{{#if claude}}
+`claude` also writes `CLAUDE.md` and thin `.claude/skills` pointers.
+{{/if}}
+
+## Update
+
+When this CLI is newer than the workspace kit, or you add or switch coding hosts:
+
+```bash
+aifabrix agent-kit update --host {{hostFlag}}{{#if autoApprove}} --approve-all --yes{{/if}}
+aifabrix agent-kit validate
+```
+
+Omit `--host` to keep the hosts already recorded. Pass `--host` when the developer changes Cursor / Claude Code / Codex.
+
+New workspace instead of an existing repo: `aifabrix agent-kit init <workspaceName> --host {{hostFlag}}`.
+
+## Activate hosts
+
+Install the coding app, then sign in. How to **run** it locally or over SSH is in `.agents/skills/shared/hosts.md` (linked from every Agent Kit skill).
+{{#if autoApprove}}
+
+On TTY, install **asks** to auto-approve tool permissions **in this workspace**. Claude Code also allows `Bash(aifabrix *)` (delivery CLI) and `Read(~/**)` (home Read). Silent (`--yes` / non-TTY) writes them; `--skip-approve-all` skips.
+{{#if claude}}
+- Claude Code writes `.claude/settings.local.json` (gitignored).
+{{/if}}
+{{#if codex}}
+- Codex writes `.codex/config.toml` (gitignored).
+{{/if}}
+{{/if}}
+{{#if cursor}}
+
+### Cursor
+
+Open this folder in Cursor (this machine, or Cursor Remote SSH). Skills: `/aifabrix-plan`, `/aifabrix-connected-system`, `/aifabrix-role-assistant`, `/aifabrix-prove`.
+{{/if}}
+{{#if claude}}
+
+### Claude Code
+
+```bash
+curl -fsSL https://claude.ai/install.sh | bash
+claude auth login
+```
+
+Skills: same `/aifabrix-*` names. First `claude` must run inside this workspace, not your home directory.
+{{/if}}
+{{#if codex}}
+
+### Codex
+
+Install the Codex CLI, then sign in with your Codex account. Skills: `$aifabrix-plan` (and the other `$aifabrix-*` names). Codex reads `AGENTS.md`.
+{{/if}}
+
+## Auth for delivery CLI
+
+```bash
+aifabrix auth status
+```
+
+If still unauthenticated, run `aifabrix login` (the agent cannot log in for you).
+
+## How to start
+
+After this folder is open in the coding host, follow **How to start** in the workspace `README.md` (how to use prompts, then plan → validate/build → publish, then Role Assistant).
+
+## Docs
+
+Agents load the public index from `AGENTS.md`. Humans: the workspace `README.md` Docs section.

package/templates/agent-kit/instructions/integration.AGENTS.md

@@ -0,0 +1,25 @@
+# Connected System laws
+
+Load when working under `integration/`. Follow skill `aifabrix-connected-system` and its references.
+
+## Builder-first packages
+
+Generate EDS with BID apply, wizard, repair, or `aifabrix json`. Do not hand-seed greenfield `*-system.json` / `*-datasource-*.json` / `application.*`. Manual deltas need `INTEGRATION_CHANGELOG.md`.
+
+## Contract
+
+- `exposed` needs `filterable`, real `profiles`, and `schema`. Schema-only is not BUILT.
+- Every `exposed.filterable` field has `metadataSchema.properties.<field>.filter: true`.
+- Foreign keys sit on the child (`from`) only; `targetFields: ["externalId"]`. No reverse parent FKs. Empty FK on business storage is not READY/BUILT unless config, logs, documented root, or self-tree (field only).
+- Partitioned and current-state views need FK + dimensions (`type: fk`) + usually `accessControl.abac.applicability: required`.
+- `roles[].value` must be a COM catalog key from `aifabrix role list`. Never invent `*-reader`.
+
+## Publish
+
+`aifabrix upload` is a draft application. `aifabrix deploy` publishes. Dataplane `show --online` status **published** is truth. Ignore upload banners that say Published.
+
+## Safety
+
+One designated mutation subject from the integration README. Credential-deferred live E2E may skip honestly; failed sync with a secret present is FAIL. See `production-safety.md` in the connected-system skill.
+
+Do not bulk-sync views as storage. Do not invent a Connected System key starting with `ra-` or `ek-`.

package/templates/agent-kit/instructions/role-assistant.AGENTS.md

@@ -0,0 +1,22 @@
+# Role Assistant laws
+
+Load when working under `role-assistant/`. Follow skill `aifabrix-role-assistant`.
+
+## Packages are separate
+
+Connected Systems live under `integration/<systemKey>/`.
+Role Assistants live under `role-assistant/ra-<catalogRole>/`.
+Do not keep CS manifests inside an RA folder. Do not run `aifabrix convert` on RA packages.
+
+## Authority
+
+The catalog Business Role must exist (`aifabrix role list`). Package key is `ra-<catalogRole>`.
+Download an existing assistant before editing generated yaml.
+Candidate Evidence is not certified Evidence.
+Missing CS capability is fixed on the Connected System, then re-subscribed — never as an RA-local operation.
+
+## Publish and prove
+
+CS must be dataplane **published** (deploy, not upload-only) before subscription-driven capabilities exist.
+Do not upload or deploy an RA unless the user explicitly asks in this turn.
+Agent prompts never supply the actor. Verified backend identity is authoritative.

package/templates/agent-kit/instructions/root.AGENTS.md

@@ -0,0 +1,37 @@
+# AI Fabrix customer workspace
+
+This repository delivers Connected Systems and Role Assistants with the Builder CLI.
+Do not edit platform product source (`aifabrix-dataplane`, `aifabrix-miso`, `aifabrix-builder`) from this workspace.
+
+## Ownership
+
+| Owner | Holds |
+| --- | --- |
+| This repository | Customer facts, specifications, plans, fixtures, tests, learning |
+| Agent Kit | Reusable delivery behavior (installed skills and these managed sections) |
+| Builder CLI | Commands, package validation, install/update of this kit |
+| Dataplane / controller | Auth, RBAC, ABAC, Protection, publication, Runtime execution |
+
+Vendor limits, tenant ids, credentials, PII stance, partitions, and the designated mutation subject live only in `integration/<systemKey>/README.md`.
+
+## Secrets
+
+Use `kv://` and `aifabrix secret`. Never store, print, ask for, or commit secret values.
+Missing vendor secret: upload a draft, print the Authentication tab link, stop. Do not collect credentials in chat.
+
+## Verdicts
+
+`PLAN_READY` · `READY` · `BUILT` · `PASS` · `PASS_WITH_SKIPS` · `NEEDS_DECISIONS` · `NEEDS_FIXES` · `BLOCKED` · `ABORTED`
+
+Do not collapse these into a generic success boolean. Do not start the next lifecycle phase unless the user selects it.
+
+## Coding hosts
+
+Cursor, Claude Code, and Codex — local machine or SSH (tmux, Claude Remote Control): `.agents/skills/shared/hosts.md`.
+Install and sign-in: `AGENTKIT.md`.
+
+## Docs
+
+Integrator hub: https://docs.aifabrix.ai/docs/build-ai-ready-systems
+CLI workflow: https://docs.aifabrix.ai/docs/build-ai-ready-systems-validate-test-cli-workflow
+Index: https://docs.aifabrix.ai/llms.txt

package/templates/agent-kit/parity-inventory.yaml

@@ -0,0 +1,188 @@
+# Frozen v1 → kit owner map. Not installed into customer repos.
+schemaVersion: "1"
+v1Files:
+  - source: commands/cust-0-plan.md
+    installedPath: .cursor/commands/cust-0-plan.md
+    sha256: a72c24163cafff97decd8382fdce1127e32ce416e05839128048b122de22b409
+    owner: aifabrix-plan
+    disposition: shim
+  - source: commands/cust-1-validate.md
+    installedPath: .cursor/commands/cust-1-validate.md
+    sha256: 8b84a1ba015516141959c311ac34ed9dd6b6dd66f286e8efc47bf34f5b2bb091
+    owner: aifabrix-connected-system
+    disposition: shim
+  - source: commands/cust-2-build.md
+    installedPath: .cursor/commands/cust-2-build.md
+    sha256: 7da4843cde98428b8f1c2ac991149d5ece8beccbfe7de7e99ef2cb80c98a42f5
+    owner: aifabrix-connected-system
+    disposition: shim
+  - source: commands/cust-3-push.md
+    installedPath: .cursor/commands/cust-3-push.md
+    sha256: f6ded45baa8517cb3280d58b92a3fd620707e2fe282726cd1087640ae92ebe30
+    owner: aifabrix-connected-system
+    disposition: shim
+  - source: commands/cust-biz-1-validate.md
+    installedPath: .cursor/commands/cust-biz-1-validate.md
+    sha256: 16ada9069f2a06d54ff63f52422283060c14de9c5bbb7b9abc6616d4451b1bee
+    owner: aifabrix-prove
+    disposition: shim
+  - source: commands/cust-biz-2-build.md
+    installedPath: .cursor/commands/cust-biz-2-build.md
+    sha256: 8b32f9b71261791d27ff0d3ae7b054334fc94ecaeb6389a1e2f50956a07b05b7
+    owner: aifabrix-prove
+    disposition: shim
+  - source: commands/cust-biz-3-prove.md
+    installedPath: .cursor/commands/cust-biz-3-prove.md
+    sha256: 7b7d6b69a74a6292cb2a581ebb68caee8d06c4ccf431ad79c044710ed167a58c
+    owner: aifabrix-prove
+    disposition: shim
+  - source: rules/README.md
+    installedPath: .cursor/rules/README.md
+    sha256: 17e691f791a5cfd686b89bf3298e55fe3fe1a933dc7f99b95ae6d08f294700d7
+    owner: package-manifest
+    disposition: obsolete
+  - source: rules/aifabrix-builder.mdc
+    installedPath: .cursor/rules/aifabrix-builder.mdc
+    sha256: 6bb6c2174c44c2489287765a8cc20121d46d8b0e7f7ab96571e2c666f710bf21
+    owner: integration/AGENTS.md
+    disposition: obsolete
+  - source: rules/builder-first-integration-generation.mdc
+    installedPath: .cursor/rules/builder-first-integration-generation.mdc
+    sha256: e52d3d15ee641affa979430b2cec5284508f4cecaf29e2a011280b95325114d1
+    owner: integration/AGENTS.md
+    disposition: obsolete
+  - source: rules/cip-field-mapping-rules.mdc
+    installedPath: .cursor/rules/cip-field-mapping-rules.mdc
+    sha256: 2f0039e8518a86902497e20e67d8fc288412105917b3c2f150f513a213180545
+    owner: contract-checklist.md
+    disposition: obsolete
+  - source: rules/credential-security-rules.mdc
+    installedPath: .cursor/rules/credential-security-rules.mdc
+    sha256: bf8089e23a65a05faf751d00178fb2d0b39308518bb7bea3f97bc8228154f076
+    owner: AGENTS.md
+    disposition: obsolete
+  - source: rules/cust-commands.mdc
+    installedPath: .cursor/rules/cust-commands.mdc
+    sha256: 7e48f104dd990a7e51d79e1a17463c0b40e98bf29f9ac4de85b49b600a03c693
+    owner: aifabrix-connected-system
+    disposition: obsolete
+  - source: rules/datasource-schema-validation.mdc
+    installedPath: .cursor/rules/datasource-schema-validation.mdc
+    sha256: eec532089e8416cbfce5859bfbf6eed187c8e6144ead2b0cd17aa36d1bdddd2f
+    owner: contract-checklist.md
+    disposition: obsolete
+  - source: rules/exposed-interface.mdc
+    installedPath: .cursor/rules/exposed-interface.mdc
+    sha256: 7fd19b564f9f31ab2d6c71b9f2d9f5f327a907909a1149861ccfa0e1cab088a9
+    owner: contract-checklist.md
+    disposition: obsolete
+  - source: rules/foreign-keys-challenge.mdc
+    installedPath: .cursor/rules/foreign-keys-challenge.mdc
+    sha256: 321ee8c2ebbecaef1132e95a27839978cfb705567a93576780c441f4d7865872
+    owner: contract-checklist.md
+    disposition: obsolete
+  - source: rules/integration-change-documentation.mdc
+    installedPath: .cursor/rules/integration-change-documentation.mdc
+    sha256: 6864f2aa7e57e4751ea75b4025ff084a6585ae4e7b679b58e5f8ed845bfe2ee3
+    owner: integration/AGENTS.md
+    disposition: obsolete
+  - source: rules/integration-test-lifecycle.mdc
+    installedPath: .cursor/rules/integration-test-lifecycle.mdc
+    sha256: ea884b9945f9effe8f026c8d713cd365aa6f94265cf8fa1ce5a0a3deff462d35
+    owner: delivery-gates.md
+    disposition: obsolete
+  - source: rules/production-system-safety.mdc
+    installedPath: .cursor/rules/production-system-safety.mdc
+    sha256: 80fc24104326aa5b0d01556a607b15cd7dac4e59248491ca11dc204b8e6db20e
+    owner: production-safety.md
+    disposition: obsolete
+  - source: rules/project.mdc
+    installedPath: .cursor/rules/project.mdc
+    sha256: 3f5692a2bd626d68e4b5c05939ee60c2d9e46d9f3dc257b2e042d65e46b22e75
+    owner: AGENTS.md
+    disposition: obsolete
+  - source: rules/rbac-abac-integration-rules.mdc
+    installedPath: .cursor/rules/rbac-abac-integration-rules.mdc
+    sha256: 2953c47dd148df8d2738e229dbe2784871ff3fabce6d64d08943de73a151177a
+    owner: contract-checklist.md
+    disposition: obsolete
+  - source: rules/role-assistant.mdc
+    installedPath: .cursor/rules/role-assistant.mdc
+    sha256: cc62ae840cbed94b7b9f50ccd52d94ab290f5c262e5e8158abfbf60db21b4f3f
+    owner: role-assistant/AGENTS.md
+    disposition: obsolete
+  - source: rules/viewpoint-fk-dimensions.mdc
+    installedPath: .cursor/rules/viewpoint-fk-dimensions.mdc
+    sha256: 76df5f2f29c15faafaed8c7c89f7d407eb2281c57c16b47bf149703a688b1736
+    owner: contract-checklist.md
+    disposition: obsolete
+  - source: skills/aifabrix-business-spec-to-plan/SKILL.md
+    installedPath: .cursor/skills/aifabrix-business-spec-to-plan/SKILL.md
+    sha256: 0b83e81d0852962dc4802a57857dfe02914165be6ab03c36c3f58f5a47e3ae33
+    owner: aifabrix-plan
+    disposition: obsolete
+  - source: skills/aifabrix-business-spec-to-plan/challenge-checklist.md
+    installedPath: .cursor/skills/aifabrix-business-spec-to-plan/challenge-checklist.md
+    sha256: 6e6d5b7340bddd9dba63626c718906420186ee490094a2db6681ea82541f9357
+    owner: aifabrix-plan/references/challenge-checklist.md
+    disposition: moved
+  - source: skills/aifabrix-business-spec-to-plan/plan-template.md
+    installedPath: .cursor/skills/aifabrix-business-spec-to-plan/plan-template.md
+    sha256: 06b46d9d45c0eb297b6e6deeb5b8803a7d79a12b8b77491dc3537e950dd6081c
+    owner: aifabrix-plan/references/plan-template.md
+    disposition: moved
+  - source: skills/aifabrix-foreign-keys-challenge/SKILL.md
+    installedPath: .cursor/skills/aifabrix-foreign-keys-challenge/SKILL.md
+    sha256: 28c9e2b41a3c89d66bb005e803b3c0655203a8e8a5ccbfe9b19eaaace46ae1a0
+    owner: contract-checklist.md
+    disposition: obsolete
+  - source: skills/aifabrix-identity-rbac/SKILL.md
+    installedPath: .cursor/skills/aifabrix-identity-rbac/SKILL.md
+    sha256: 2bc31b1a96c3a0a2cf6a9220b07c330e08b4dc0ddc6487eb4bd7c3fffdeabe63
+    owner: contract-checklist.md
+    disposition: obsolete
+  - source: skills/aifabrix-integration-e2e-tester/SKILL.md
+    installedPath: .cursor/skills/aifabrix-integration-e2e-tester/SKILL.md
+    sha256: 2dcad14746a03a88de869d8856584d8daa799312475467fd2a85ceb3ebd4b0e5
+    owner: delivery-gates.md
+    disposition: obsolete
+  - source: skills/aifabrix-integration-lifecycle/SKILL.md
+    installedPath: .cursor/skills/aifabrix-integration-lifecycle/SKILL.md
+    sha256: 6d67bdc9bee11d8e9a72b62de2133f9dc0fac80964d98f905d6a189e59bd2d76
+    owner: aifabrix-connected-system
+    disposition: obsolete
+  - source: skills/aifabrix-manifest-validator/SKILL.md
+    installedPath: .cursor/skills/aifabrix-manifest-validator/SKILL.md
+    sha256: 1dc366fb0efeafa87f643fcb6341021c42a6ce4b5a65ce9ccb4b24bb8f720c91
+    owner: aifabrix-connected-system
+    disposition: obsolete
+  - source: skills/aifabrix-package-format/SKILL.md
+    installedPath: .cursor/skills/aifabrix-package-format/SKILL.md
+    sha256: 51db0c52ff271cbe9c3f02582a1d629aab10d74a6bf0cc7b0837a936e8399fe2
+    owner: aifabrix-connected-system
+    disposition: obsolete
+  - source: skills/aifabrix-poc-business-case/SKILL.md
+    installedPath: .cursor/skills/aifabrix-poc-business-case/SKILL.md
+    sha256: b6e949292f6b9d2f1a87560594d23161a734d9cadb09b29efdf56f589ba9ac00
+    owner: aifabrix-prove
+    disposition: obsolete
+  - source: skills/aifabrix-poc-business-case/reference-demo-md.md
+    installedPath: .cursor/skills/aifabrix-poc-business-case/reference-demo-md.md
+    sha256: 3505779196339a63d4e0813de10695a59c887684e0cf1c14512f1c743c846592
+    owner: aifabrix-prove/references/demo-template.md
+    disposition: moved
+  - source: skills/aifabrix-poc-business-case/reference-evidence-lifecycle.md
+    installedPath: .cursor/skills/aifabrix-poc-business-case/reference-evidence-lifecycle.md
+    sha256: cfdeadb7417ea307028791c0a126b5ac5d6a7f1a456e05871b8d0d389c0c85a8
+    owner: aifabrix-prove/references/evidence-lifecycle.md
+    disposition: moved
+  - source: skills/aifabrix-poc-business-case/reference-learning-md.md
+    installedPath: .cursor/skills/aifabrix-poc-business-case/reference-learning-md.md
+    sha256: f89817be3dfcf5c821d565b022a8b8ead7d77b594f2561196f3b52c25999ade6
+    owner: aifabrix-prove/references/learning-template.md
+    disposition: moved
+  - source: skills/aifabrix-role-assistant-lifecycle/SKILL.md
+    installedPath: .cursor/skills/aifabrix-role-assistant-lifecycle/SKILL.md
+    sha256: 27781f1a5c5d4bb7b2e9551a063e66fceaf8f99a38dc2e6efe20048754a1de3f
+    owner: aifabrix-role-assistant
+    disposition: obsolete

package/templates/agent-kit/skills/aifabrix-connected-system/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: aifabrix-connected-system
+description: >
+  Plan, validate, build, or publish a customer Connected System with Builder.
+  Preserves READY, BUILT, PASS, and PASS_WITH_SKIPS gates. Use for integration
+  packages under integration/. Do not use to change Builder product source or
+  to author Role Assistant sidecars.
+---
+
+# aifabrix-connected-system
+
+Phases: `plan` | `validate` | `build` | `publish`.
+Resolve phase: explicit argument → plan/package state → safe next → ask once.
+
+Stop at the phase gate. Do not run the next phase without `next-yes`
+([interaction.md](../aifabrix-plan/references/interaction.md)).
+
+| Phase | Entry | Success |
+| --- | --- | --- |
+| plan | business specification exists | PLAN_READY via `aifabrix-plan` |
+| validate | plan decisions locked | READY |
+| build | READY | BUILT |
+| publish | package exists and local validate passes | PASS or PASS_WITH_SKIPS |
+
+Read current CLI help before composing commands. You own orchestration, not CLI implementation.
+Host runtimes (local vs SSH): [hosts.md](../shared/hosts.md).
+
+## Always
+
+```bash
+aifabrix auth status
+```
+
+Refresh first. User runs `aifabrix login` only if still unauthenticated. Re-run on 401, then retry once.
+
+System key: argument → active plan → sole `integration/` folder → ask once. Never invent. Reject `ra-` / `ek-` ([scripts/reserved-system-key.js](scripts/reserved-system-key.js)).
+
+## References
+
+- [delivery-gates.md](references/delivery-gates.md) — BID/wizard/repair, upload vs deploy, tests, identity, protection
+- [contract-checklist.md](references/contract-checklist.md) — exposed, FK, viewpoints, RBAC/ABAC
+- [production-safety.md](references/production-safety.md) — designated subject, credential-deferred E2E
+
+## Hard gates
+
+- Builder/BID/wizard/repair owns generated package shape
+- Manual EDS delta requires changelog
+- Schema-only `exposed` is not BUILT
+- Unexplained empty FK on business storage is not READY/BUILT
+- Non-catalog role fails
+- Upload without deploy is not published and not PASS
+- No system-level sync of views
+- No publish continuation after an unresolved hard failure
+
+## Trigger examples
+
+- Validate and build the Person system integration
+- Publish and certify this Connected System