@aifabrix/builder 2.53.1 → 2.55.0

package/templates/agent-kit/skills/aifabrix-prove/references/evidence-lifecycle.md

@@ -0,0 +1,68 @@
+# Evidence lifecycle (PoC)
+
+## Flow
+
+```text
+Demo / workshop / prove observations
+  → learning.md   (FACT | ASSUMPTION)
+  → evidence/candidates/   (drafts — not consumed)
+  → validate + certify path
+  → governed Evidence (consumable by Role Assistant)
+```
+
+## Directories
+
+| Path | Role |
+| --- | --- |
+| `learning/learning.md` | Delivery log only |
+| `evidence/candidates/` | Candidate drafts (English). **Do not** treat as production-like Evidence |
+| `evidence/` (package root, non-candidates) | Only rows ready for the Evidence certification / consume path |
+| `knowledge/` | Reusable **business understanding** from governed content — not operational decision rules |
+
+If Builder upload processes every file under `evidence/`, keep candidates **out of** the upload consume set:
+
+- Prefer `evidence/candidates/` and document in learning.md that upload must exclude candidates until certified, **or**
+- Keep drafts only under `.temp/cust-biz-2-build/<roleKey>/evidence-candidates/` until promotion.
+
+Default convention for this skill: **`evidence/candidates/`** + explicit prove/build note: do not promote; do not claim Runtime consumption.
+
+## Candidate draft shape (English)
+
+One purpose per file or per row. Trace to scenario ID in `key` / filename / title.
+
+Example filename: `FIN-010-cost-centre-authority.json` (array or single object matching platform Evidence row schema when known).
+
+Minimum fields to author:
+
+- `key` — includes scenario id slug
+- `title` / `description`
+- `when` — business condition
+- `expectedBehavior` — ground in Reality; respect authority; refuse raw dump / cross-partition; safe-stop when insufficient
+- Mark in learning.md: `ASSUMPTION` vs `FACT`-backed
+
+## Promotion gate
+
+Promote candidate → governed Evidence only when:
+
+1. Business intent confirmed (FACT in learning.md)
+2. Happy + safe-stop tests observed for the scenario
+3. Contract validation + certification path for Evidence completed (public Evidence Fabrix / operate-first RA docs)
+4. learning.md records promotion date + commit
+
+## Tests
+
+For each in-scope scenario ID:
+
+| Case | Purpose |
+| --- | --- |
+| `*-happy.yaml` | Agreed business outcome under authority |
+| `*-safestop.yaml` | Refusal / missing authority / insufficient information |
+
+Prefer `role-assistant/ra-<roleKey>/tests/<suiteId>/` in this customer repo (package SSOT).
+
+## Forbidden
+
+- Calling workshop acceptance alone “governed Evidence”
+- Hiding process law in Knowledge
+- Uploading candidates as if certified
+- Skipping safe-stop coverage for authority scenarios

package/templates/agent-kit/skills/aifabrix-prove/references/learning-template.md

@@ -0,0 +1,66 @@
+# learning.md template
+
+**Path:** `role-assistant/ra-<roleKey>/learning/learning.md`
+
+Delivery learning artifact only. Not Runtime Knowledge. Not governed Evidence.
+
+## Skeleton
+
+```md
+# PoC learning log
+
+## Current PoC hypothesis
+- Process:
+- Role (responsibility / capabilities / safe boundaries):
+- Expected decision / value:
+- Connected System:
+- Audience:
+
+## Confirmed facts
+| Fact | Source | Date | Owner | Confidence |
+| --- | --- | --- | --- | --- |
+| … | … | … | … | high/med |
+
+## Assumptions
+| Assumption | Why needed | Risk if wrong | Scenario IDs |
+| --- | --- | --- | --- |
+| … | … | … | FIN-010 |
+
+## Open questions and safe stops
+- Missing authority / data / baseline / policy / capability:
+- Scenario IDs affected:
+
+## Scenario map
+| ID | Demo ask (short) | demo.md | Knowledge | Evidence candidate | Tests |
+| --- | --- | --- | --- | --- | --- |
+| FIN-010 | … | y/n | path or — | candidates/… | happy + safestop |
+
+## Observations from proof runs
+| Date | Scenario | Commit | Env | Outcome | Gap class | Notes |
+| --- | --- | --- | --- | --- | --- | --- |
+| … | FIN-010 | abc123 | dev | pass/fail/safestop | none \| product-gap \| missing-customer-fact \| scope-decision | … |
+
+## Changes made
+- YYYY-MM-DD — command — what changed and why
+
+## Decision for next iteration
+- Build | Prove | Obtain customer decision | Stop
+- Rationale:
+```
+
+## Mandatory updates by command
+
+| Command | Sections to update |
+| --- | --- |
+| `/cust-biz-1-validate` | Hypothesis, facts, assumptions, open questions, baseline / prove-ready decision |
+| `/cust-biz-2-build` | Changes made; scenario map (demo / Knowledge / candidates / tests) |
+| `/cust-biz-3-prove` | Observations table; gap class; decision for next iteration |
+
+## Gap class (prove)
+
+| Value | Meaning |
+| --- | --- |
+| `none` | Result matches intent |
+| `product-gap` | Platform / capability / Evidence contract issue |
+| `missing-customer-fact` | Need customer answer (baseline, policy, owner) |
+| `scope-decision` | In/out of PoC scope — not a defect |

package/templates/agent-kit/skills/aifabrix-role-assistant/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: aifabrix-role-assistant
+description: >
+  Download, author, validate, test, or upload a Role Assistant package under
+  role-assistant/ra-*. Use for catalog digital workers. Do not use to invent
+  Connected System operations or to edit platform product source.
+---
+
+# aifabrix-role-assistant
+
+See [package-boundary.md](references/package-boundary.md) and nested `role-assistant/AGENTS.md`.
+Host runtimes (local vs SSH): [hosts.md](../shared/hosts.md).
+
+## Preconditions
+
+```bash
+aifabrix auth status
+aifabrix role list --page-size 1000
+```
+
+Catalog Business Role and an active user binding are prerequisites.
+Connected Systems this assistant needs must be dataplane **published** (deploy, not upload-only).
+
+## Workflow
+
+1. `aifabrix download <catalogRoleOrRaKey>` before editing an existing assistant.
+2. Author settings, Knowledge, Evidence, tests, and sidecars per current Builder contracts. Read `aifabrix role-assistant --help`.
+3. `aifabrix role-assistant test …` is allowed without local RA publish.
+4. Upload/deploy RA only when the user explicitly asks in this turn.
+5. Report results honestly.
+
+## Hard rules
+
+- Package key `ra-<catalogRole>` from the catalog — never `ra-<systemKey>-reader`.
+- Candidate Evidence cannot be reported as certified.
+- Missing subscribed CS capability → fail in CS ownership; no RA-local workaround.
+- No hidden authority, actor, or identity injection.
+- Do not convert RA folders with `aifabrix convert`.
+
+## Trigger examples
+
+- Create or update the Finance Controller Role Assistant

package/templates/agent-kit/skills/aifabrix-role-assistant/references/package-boundary.md

@@ -0,0 +1,21 @@
+# Role Assistant package boundary
+
+Public docs: https://docs.aifabrix.ai/docs/role-assistants
+
+```text
+integration/<systemKey>/         Connected System
+role-assistant/ra-<roleKey>/     Role Assistant
+```
+
+Download writes `role-assistant.yaml` and keeps sidecars. It does not write CS files (`application.*`, `*-system.*`, `*-datasource-*`, `env.template`). Delete those leftovers if they reappear.
+
+If download also writes `integration/ra-*`, move sidecars into `role-assistant/ra-*`.
+
+Generated RA FKs target **CS** datasource keys. Missing RA FK → fix the CS, re-download.
+
+Hand-edit leftover CS manifests under `role-assistant/` is forbidden.
+
+Do not invent an API key for `authType: system`.
+Do not treat passivated invent packages (`ra-<vendor>-*`) as catalog workers.
+
+Operator **Make available** is separate from CS publish.

package/templates/agent-kit/skills/shared/hosts.md

@@ -0,0 +1,78 @@
+# Coding hosts — local vs SSH
+
+Use this workspace from **Cursor**, **Claude Code**, and **Codex**. Skills live in `.agents/skills/`. Invoke `/aifabrix-*` in Cursor and Claude Code, and `$aifabrix-*` in Codex.
+
+Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each host on a local machine or over SSH.
+
+Do not start Claude or Codex in your home directory. `cd` into this git workspace first.
+
+## Auto-approve (optional)
+
+`aifabrix agent-kit install` can write gitignored host configs so Claude Code and Codex do not prompt for every tool:
+
+- Claude Code: `.claude/settings.local.json` (`permissions.defaultMode` = `bypassPermissions`, `allow` = `Bash(aifabrix *)` and `Read(~/**)`)
+- Codex: `.codex/config.toml` (`approval_policy = "never"`, `sandbox_mode = "workspace-write"`)
+
+Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. TTY asks (default yes). `--yes` or a non-TTY / `--json` run writes them. `--skip-approve-all` skips. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
+
+## Cursor
+
+**Local.** Open this folder in Cursor. Skills appear as `/aifabrix-plan` and the other `/aifabrix-*` commands.
+
+**SSH.** Use Cursor Remote SSH to the machine that holds the repo. The session is the Cursor window — no tmux required. Same `/aifabrix-*` skills.
+
+## Claude Code
+
+**Local.**
+
+```bash
+cd /path/to/this-workspace
+claude
+```
+
+Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
+
+**SSH (keep the session after you disconnect).** tmux holds the process on the remote machine:
+
+```bash
+tmux new -s claude -c /path/to/this-workspace
+claude --remote-control
+```
+
+Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t claude`.
+
+**Phone and web.** `--remote-control` (or `claude remote-control` in server mode) publishes the same session to [claude.ai/code](https://claude.ai/code) and the Claude mobile app (**Code**). Press space in server mode for a QR code. In an interactive session, `/remote-control` or `/mobile`. Requires a Claude Pro/Max/Team login (`claude auth login`), not an API key.
+
+Closing SSH does not stop a tmux session. Stopping tmux or the machine does.
+
+## Codex
+
+**Local.**
+
+```bash
+cd /path/to/this-workspace
+codex
+```
+
+Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`.
+
+**SSH (keep the session after you disconnect).**
+
+```bash
+tmux new -s codex -c /path/to/this-workspace
+codex
+```
+
+Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t codex`. Codex has no Claude-style phone/web Remote Control; stay in tmux (or reattach later) to see the session.
+
+## tmux cheat sheet
+
+| Action | Keys / command |
+| --- | --- |
+| New named session | `tmux new -s <name> -c /path/to/this-workspace` |
+| Detach (leave it running) | `Ctrl-b`, then `d` |
+| List sessions | `tmux ls` |
+| Attach | `tmux attach -t <name>` |
+| Kill session | `tmux kill-session -t <name>` |
+
+Use separate session names (`claude` vs `codex`) if both run on the same host.

package/templates/agent-kit/workspace/.cursor/plans/README.md

@@ -0,0 +1,22 @@
+# Plans (customer workspace)
+
+Delivery plans for Connected Systems in this workspace.  
+**Operational limits for a system live in `integration/<systemKey>/README.md`**, not in Agent Kit skills.
+
+## Active
+
+| Plan | Focus |
+| --- | --- |
+| — | No active delivery plan yet |
+
+## Done
+
+| Plan | Focus | Archived |
+| --- | --- | --- |
+| — | — | — |
+
+## Naming
+
+- `{N}.{m}-{slug}.plan.md` under `.cursor/plans/`
+- Archive completed plans under `done/` when finished
+- New delivery work from a business specification starts with **`aifabrix-plan`**

package/templates/agent-kit/workspace/LICENSE.mit

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) {{year}} {{copyrightHolder}}
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/templates/agent-kit/workspace/README.md

@@ -0,0 +1,89 @@
+# {{workspaceName}}
+
+AI Fabrix **customer delivery workspace** for Connected Systems and Role Assistants.
+
+This repository holds **customer packages and data** only. Do not edit platform product source from this workspace.
+
+Vendor limits, credentials, designated test subjects, and PII live only in each system’s `integration/<systemKey>/README.md`.
+
+## How to start
+
+1. Open **this folder** in Cursor, Claude Code, or Codex. Host install and sign-in: **[AGENTKIT.md](./AGENTKIT.md)**.
+2. In a terminal here, run `aifabrix auth status`. If you are not authenticated, run `aifabrix login` (the agent cannot log in for you).
+3. In chat, either **invoke a skill** or **paste a prompt** from the tables below. Work in order. Wait for the gate (`PLAN_READY`, `READY`, `BUILT`, then `PASS` or `PASS_WITH_SKIPS`) before the next step.
+
+### How to use prompts
+
+| Host | Invoke a skill | Or type a prompt |
+| --- | --- | --- |
+| Cursor | `/aifabrix-plan` (and the other `/aifabrix-*` names) | Paste the sentence from **What to ask** |
+| Claude Code | same `/aifabrix-*` names | same sentences |
+| Codex | `$aifabrix-plan` (and the other `$aifabrix-*` names) | same sentences |
+
+You can combine them: invoke the skill, then add the system key or paste a spec. Attach or `@` the specification file when you have one. Replace `<systemKey>` and `<catalogRole>` with real keys. Do not invent `ra-` / `ek-` system keys or `*-reader` roles.
+
+### Connected System (integration)
+
+| Step | Skill | What to ask (prompt) |
+| --- | --- | --- |
+| Plan | `/aifabrix-plan` | Turn this specification into a delivery plan for `<systemKey>` |
+| Validate and build | `/aifabrix-connected-system` | Validate and build the `<systemKey>` integration |
+| Test and publish | `/aifabrix-connected-system` | Publish and certify this Connected System |
+
+Example — plan:
+
+```text
+/aifabrix-plan
+Turn this specification into a delivery plan for <systemKey>
+```
+
+`aifabrix upload` is a **draft**. Publish is **`aifabrix deploy`**. Secrets stay in `kv://` — never paste values into chat or git.
+
+### Role Assistant
+
+Do this after the Connected Systems the role needs are **published** (deploy, not upload-only).
+
+| Step | Skill | What to ask (prompt) |
+| --- | --- | --- |
+| Author, test, or upload | `/aifabrix-role-assistant` | Create or update the `<catalogRole>` Role Assistant |
+| Prove the business case | `/aifabrix-prove` | Prove this business case and update learning |
+
+Example — Role Assistant:
+
+```text
+/aifabrix-role-assistant
+Create or update the <catalogRole> Role Assistant
+```
+
+Use a **catalog** role key (`finance-controller`, `cfo`, …). Package folder: `role-assistant/ra-<catalogRole>/`.
+
+## Layout
+
+```text
+integration/<systemKey>/       Connected System packages (Builder output)
+integration/<systemKey>/data/  Fixtures / source exports
+role-assistant/ra-<roleKey>/   Role Assistant packages
+.agents/skills/                Agent Kit skills (Cursor, Codex, Claude)
+.cursor/plans/                 Delivery plans
+```
+
+As you add packages, list system keys and catalog roles in this README. Keep operational limits in each `integration/<systemKey>/README.md`.
+
+## Agent Kit
+
+Install, coding hosts, auto-approve, and CLI auth: **[AGENTKIT.md](./AGENTKIT.md)**.
+
+```bash
+aifabrix agent-kit status
+aifabrix agent-kit validate
+aifabrix agent-kit update
+```
+
+`aifabrix agent-kit update` refreshes `AGENTKIT.md`. If this README is missing, install/update creates it. An existing README is never overwritten.
+
+## Docs
+
+- [Agent Kit](./AGENTKIT.md) — hosts, install, auto-approve, CLI auth
+- [Build AI-ready systems](https://docs.aifabrix.ai/docs/build-ai-ready-systems)
+- [CLI workflow](https://docs.aifabrix.ai/docs/build-ai-ready-systems-validate-test-cli-workflow)
+- [llms.txt](https://docs.aifabrix.ai/llms.txt)

package/templates/applications/builder-api/Dockerfile

@@ -13,7 +13,7 @@ ENV NODE_ENV=production \
 WORKDIR /app
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends dumb-init \
+    && apt-get install -y --no-install-recommends dumb-init ca-certificates curl \
     && rm -rf /var/lib/apt/lists/*
 
 COPY package.json package-lock.json ./
@@ -23,6 +23,8 @@ COPY docker-builder-api-staging/lib ./lib
 COPY docker-builder-api-staging/bin/builder-api-spike.js ./bin/builder-api-spike.js
 COPY docker-builder-api-staging/bin/builder-api-cleanup.js ./bin/builder-api-cleanup.js
 COPY docker-builder-api-staging/templates ./templates
+# BID resource-type catalog + help fixtures (staged docs/builder-help only)
+COPY docker-builder-api-staging/docs ./docs
 
 RUN addgroup --system appgroup \
     && adduser --system --ingroup appgroup --home /app appuser \

package/templates/applications/builder-api/env.template

@@ -29,12 +29,19 @@ MISO_CLIENTSECRET=kv://builder-api-client-secretKeyVault
 
 # Internal: controller API for token validation (supports all miso-controller auth modes)
 MISO_CONTROLLER_URL=url://miso-controller-internal
+# Public: OAuth profile and remaining-step links shown to vendors (not Docker DNS)
+MISO_CONTROLLER_PUBLIC_URL=url://miso-controller-public
 
 # Internal: server-to-dataplane API (MCP execute, upload, governance)
 DATAPLANE_URL=url://dataplane-internal
+# Public: Slack/Teams/ChatGPT callbacks, packages, and portal remaining-step URLs
+DATAPLANE_PUBLIC_URL=url://dataplane-public
 
 DEFAULT_ENVIRONMENT=dev
 
+# Browser Origin allowlist for portal calls (CORS). url:// expands at resolve.
+ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private
+
 # COM-generated Enterprise MCP owner system (normal MCP execute — no dataplane adapter)
 ENTERPRISE_MCP_SYSTEM_KEY=enterprise-integration-lifecycle
 

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.31
+  version: 2.0.56
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -71,14 +71,15 @@ build:
   envOutputPath: ../../.env # Copy to repo root for local dev
   language: python # Runtime language for template selection (typescript or python)
   # Dev reload: polling + watch /app/app only (avoids EMFILE on full repo bind-mount). See run_local.py, make af-reload.
-  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app
+  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app --reload-exclude tests --reload-exclude .temp --reload-exclude app-ui --timeout-graceful-shutdown 15
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
-  imageRun: exec python -m uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001}
+  # Early ASGI (boot.api) binds PORT before heavy app.main import — Azure App Service warmup.
+  imageRun: exec python -m uvicorn boot.api:app --host 0.0.0.0 --port ${PORT:-3001}
   # Image policy (442.0): explicit Dockerfile COPY; worker/beat via python -m app.core.*
   # integration/ in image: only onboarding-catalog.json keys (+ deploy/application per key).
   worker: true
-  imageRunWorker: exec python -m app.core.celery_worker_main
-  imageRunBeat: exec python -m app.core.celery_beat_main
+  imageRunWorker: exec python -m boot.celery_worker
+  imageRunBeat: exec python -m boot.celery_beat
   # Optional one-shot before ANY long-running role (api/worker/beat). Run exactly once per
   # aifabrix run / Deployment — never once-per-container. Schema: application-schema build.deployJob.
   # Local: aifabrix run; remote: miso Deployment via miso-azure (not Docker on controller).

package/templates/applications/dataplane/env.template

@@ -21,7 +21,7 @@ AIFABRIX_PLATFORM_LANGUAGE=en
 # Docker default (no volume): use LOG_FILE_PATH=/app/logs/app.log (directory created in image).
 # Production with persistent logs: use /mnt/data/logs/app.log and mount a volume at /mnt/data.
 LOG_FILE_PATH=/mnt/data/logs/app.log
-# If true, run without Redis/Celery (single process). Set false on API/worker/beat in production.
+# If true, run without Celery (single process). Pair with build.worker: false so worker/beat are not started.
 LOCAL_MODE=false
 
 # Celery worker process tuning (dataplane-worker container; optional overrides)
@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.31
+VERSION=2.0.56
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/dataplane/rbac.yaml

@@ -50,6 +50,11 @@ roles:
     description: "Discover business context for external systems via REST and MCP"
     groups: ["AI-Fabrix-External-System-Discoverers"]
 
+  - name: "Everyone"
+    value: "aifabrix-everyone"
+    description: "Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)"
+    groups: ["AI-Fabrix-Everyone"]
+
 permissions:
   # Credential management
   - name: "credential:create"
@@ -158,6 +163,34 @@ permissions:
       ]
     description: "Read the global Resource Type catalog (list/get)"
   
+  # Aspect catalog (read-only)
+  - name: "aspect:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-deployment-admin",
+        "aifabrix-compliance-admin",
+        "aifabrix-developer",
+        "aifabrix-observer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Read the shared baseline Aspect catalog (list/get)"
+
+  # Knowledge Type catalog (read-only)
+  - name: "knowledge-type:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-deployment-admin",
+        "aifabrix-compliance-admin",
+        "aifabrix-developer",
+        "aifabrix-observer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Read the Dataplane Knowledge Type catalog (list/get)"
+
   # Generic dataplane operations
   - name: "dataplane:read"
     roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]
@@ -314,11 +347,11 @@ permissions:
   
   # Search operations
   - name: "document:search"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]
+    roles: ["aifabrix-everyone"]
     description: "Search documents"
   
   - name: "record:search"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]
+    roles: ["aifabrix-everyone"]
     description: "Search records"
 
   - name: "external-system:discover"

package/templates/applications/keycloak/Dockerfile

@@ -1,13 +1,39 @@
 # Keycloak Identity and Access Management with Custom Themes
-# This Dockerfile extends Keycloak 26.5.2 with custom themes
+# Official 26.7.2 distro + experimental CIMD. Does not compile Keycloak from source.
+# One class is recompiled against this image's jars:
+# - PR 51235: CIMD parse ignores unknown JSON fields (ChatGPT client.json)
+# - #50362: strip jwt-bearer (and other confidential-only grants) on public CIMD
+# 26.7 advertises token_endpoint_auth_methods_supported "none" for Claude CIMD.
 
-FROM quay.io/keycloak/keycloak:26.5.2
+FROM quay.io/keycloak/keycloak:26.7.2 AS keycloak-base
+
+FROM eclipse-temurin:21-jdk-jammy AS cimd-patch
+COPY --from=keycloak-base /opt/keycloak/lib/lib/main /opt/kc-jars/main
+COPY --from=keycloak-base /opt/keycloak/lib/lib/boot /opt/kc-jars/boot
+COPY cimd-lenient-parse/AbstractClientIdMetadataDocumentExecutor.java \
+     /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java
+RUN mkdir -p /tmp/classes \
+ && find /opt/kc-jars -name '*.jar' | paste -sd: - > /tmp/cp.txt \
+ && { \
+      echo --release; echo 21; echo -cp; cat /tmp/cp.txt; echo -d; echo /tmp/classes; \
+      echo /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java; \
+    } > /tmp/javac.args \
+ && javac @/tmp/javac.args \
+ && SERVICES_JAR=$(ls /opt/kc-jars/main/org.keycloak.keycloak-services-*.jar) \
+ && cp "$SERVICES_JAR" /tmp/keycloak-services-patched.jar \
+ && jar uf /tmp/keycloak-services-patched.jar -C /tmp/classes .
+
+FROM quay.io/keycloak/keycloak:26.7.2
 
 # Set working directory
 WORKDIR /opt/keycloak
 
 # Copy custom themes from share directory (only if themes/ folder exists)
 USER root
+COPY --from=cimd-patch /tmp/keycloak-services-patched.jar /tmp/keycloak-services-patched.jar
+RUN SERVICES_JAR=$(ls /opt/keycloak/lib/lib/main/org.keycloak.keycloak-services-*.jar) \
+ && cp /tmp/keycloak-services-patched.jar "$SERVICES_JAR" \
+ && rm /tmp/keycloak-services-patched.jar
 # Use a shell script approach: copy themes if it exists, otherwise skip
 # First, copy everything from build context to a staging area
 COPY . /tmp/build-context/
@@ -24,7 +50,7 @@ RUN if [ -d "/tmp/build-context/themes" ] && [ "$(ls -A /tmp/build-context/theme
 # Build Keycloak with health checks enabled (similar to Keycloak 24.0)
 # This enables the /health, /health/live, /health/ready, and /health/started endpoints
 # Expose health endpoints on main HTTP port (like 24.0) instead of management port
-RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false
+RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false --features=cimd
 
 # Switch back to keycloak user
 USER keycloak
@@ -34,4 +60,4 @@ EXPOSE 8080
 
 # Default Keycloak command (can be overridden in docker-compose.yaml)
 # Health checks are enabled via the build step above
-CMD ["start-dev"]
+CMD ["start-dev"]

package/templates/applications/keycloak/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'AI Fabrix Keycloak'
   description: 'Identity and Access Management'
   type: webapp
-  version: '26.5.2'
+  version: '26.7.2'
 
 # Image Configuration
 image:
@@ -48,7 +48,7 @@ authentication:
 
 # Build Configuration
 build:
-  context: .. # Docker build context (relative to builder/)
+  context: . # Docker build context: this app dir (CLI copies it to applications-dev-*)
   dockerfile: builder/Dockerfile # Dockerfile name (empty = use template)
   containerPort: 8080 # Container port (different from local port)
   language: typescript # Runtime language for template selection