@aifabrix/builder 2.53.1 → 2.55.0

package/templates/applications/keycloak/cimd-lenient-parse/SOURCE.md

@@ -0,0 +1,19 @@
+# CIMD image patch (Keycloak 26.7.2)
+
+This directory is **not** a Keycloak source build. `aifabrix build keycloak` still starts from `quay.io/keycloak/keycloak:26.7.2`. A Docker stage recompiles this one class against that image’s jars and injects it into `org.keycloak.keycloak-services-*.jar` before `kc.sh build`.
+
+Upstream file: `services/.../AbstractClientIdMetadataDocumentExecutor.java` @ tag `26.7.2` (Apache 2.0).
+
+## Lenient parse (ChatGPT)
+
+ChatGPT’s CIMD `client.json` includes extra fields (for example `token_endpoint_auth_methods_supported`) that Keycloak 26.7.x rejects because CIMD parse uses Jackson `FAIL_ON_UNKNOWN_PROPERTIES`.
+
+- [keycloak/keycloak#51235](https://github.com/keycloak/keycloak/pull/51235) (open; not in 26.7.2)
+
+## Public client + jwt-bearer (Claude hosted)
+
+Claude’s CIMD is a public client (`token_endpoint_auth_method: none`) that also lists `urn:ietf:params:oauth:grant-type:jwt-bearer`. Keycloak 26.7.2 then fails authorize with `JWT authorization grant cannot be enabled in a public client` ([#50362](https://github.com/keycloak/keycloak/issues/50362)). Official [PR 50411](https://github.com/keycloak/keycloak/pull/50411) is still a draft and defaults the filter **off**. This image always drops confidential-only grants on public CIMD metadata (RFC 7591 §3.2.1), which is enough for hosted Claude Connect (authorization_code). It does **not** implement public-client JWT Authorization Grant / EMA.
+
+26.7.2 already advertises `token_endpoint_auth_methods_supported` `"none"` when `--features=cimd`.
+
+Drop this patched class when the consumed `quay.io` tag includes both behaviors.

package/templates/applications/keycloak/env.template

@@ -55,6 +55,9 @@ KC_HEALTH_ENABLED=true
 KC_HTTP_MANAGEMENT_HEALTH_ENABLED=false
 # Single-instance: use local cache so /health/ready passes (avoids Infinispan cluster check)
 KC_CACHE=local
+# Runtime features. Include cimd so Keycloak 26.7.2 advertises Client ID Metadata
+# Documents. preview alone triggers a start-time rebuild that drops cimd.
+KC_FEATURES=preview,cimd
 
 # =============================================================================
 # DATABASE CONFIGURATION

package/templates/applications/miso-controller/application.yaml

@@ -4,8 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.34'
-
+  version: '2.0.51'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).

package/templates/applications/miso-controller/env.template

@@ -22,9 +22,10 @@
 SKIP_FIRST_TIME_SETUP=false
 
 # Force onboarding to run even when a controller row already exists (default: unset/false).
-# Use only when the DB already had a controller so onboarding was skipped and the admin
-# user was never created in the aifabrix realm. Set to true, restart controller once,
-# then set back to false so onboarding does not re-run on every start.
+# Prefer SQL/API one-shot: POST /api/v1/controller/force-onboarding (controller:admin) or set
+# controllers.configuration.setup.forceOnboarding=true — no App Service restart required.
+# Env FORCE_ONBOARDING still works as bootstrap-only when you must restart: set true, restart once,
+# then set back to false. This is NOT a Tenant Activation wizard reset (does not clear activation JSON).
 # FORCE_ONBOARDING=true
 
 # Optional custom controller key for onboarding (default: miso-controller)
@@ -127,7 +128,9 @@ REDIS_PERMISSIONS_TTL=900
 KEYCLOAK_REALM=aifabrix
 # Public issuer / browser URL (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH=/auth).
 KEYCLOAK_SERVER_URL=url://keycloak-public
-# Internal token/JWKS calls: url://keycloak-internal (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH).
+# Internal token/JWKS calls use url://keycloak-internal.
+# In Traefik/front-door mode, virtual directory mapping supplies relative path semantics.
+# Do not append /auth again when frontDoorRouting is /auth/* — /auth/auth 404s.
 KEYCLOAK_INTERNAL_SERVER_URL=url://keycloak-internal
 # Docker/internal host and port: used when config from DB has localhost (getDockerKeycloakInternalUrl).
 # Resolved from env-config (e.g. KEYCLOAK_HOST=keycloak, KEYCLOAK_PORT=8080 for docker).
@@ -171,6 +174,8 @@ MISO_WEB_SERVER_URL=url://public
 MISO_CONTROLLER_URL=url://internal
 MISO_RELATIVE_PATH=url://vdir-public
 ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private
+# Opt-in: broker/entry/referer under /data keep …/data/auth/callback (do not append /miso). Default off.
+# AUTH_PRESERVE_DATAPLANE_VDIR=true
 
 # MISO Environment Configuration (miso, dev, tst, pro)
 MISO_ENVIRONMENT=miso
@@ -245,10 +250,6 @@ SKIP_DB_REDEPLOY=true
 # Bootstrap (SKIP_FIRST_TIME_SETUP=false) is separate from the activation wizard.
 DEPLOYMENT=database
 
-# Dev/test: open /tenant-activation on Platform Apps (last step). Default false.
-# Does not skip server-side TA — use only when env is already activated/deployed.
-TA_SKIP_TO_APP_DEPLOY=false
-
 # Dev/test: show TA Entra "Completing setup" countdown (120s cap). Default false.
 # Exposed to UI via GET /api/v1/tenant/status → showTaCountdown (restart controller after change).
 SHOW_TA_COUNT_DOWN=false
@@ -323,7 +324,7 @@ MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault
 
 LOG_TO_FILE=true
 LOG_LEVEL=info
-LOG_FILE_PATH=./logs
+LOG_FILE_PATH=/mnt/data/logs
 
 # =============================================================================
 # OPENTELEMETRY CONFIGURATION

package/templates/channels/README.md

@@ -4,14 +4,14 @@ Published copies of communication external-system manifests for `aifabrix channe
 
 ## SSOT
 
-| Channel | Master location | Publish |
-| --- | --- | --- |
-| **All channel targets** | `aifabrix-dataplane/integration/<target>/` | `make sync-json` in dataplane (copies manifests; **no** `*-deploy.json`) |
-| Targets | `slack`, `teams-bot`, `microsoft-copilot`, `chatgpt`, `web-embed` | See `CHANNEL_INTEGRATION_TARGETS` in dataplane `make/config.mk` |
+| Channel | Master location |
+| --- | --- |
+| **All channel targets** | `aifabrix-builder/templates/channels/<target>/` |
+| Targets | `slack`, `teams-bot`, `microsoft-copilot`, `chatgpt`, `claude`, `mcp-client`, `web-embed` |
 
 `channel scaffold` copies files from `integration/` subfolder here into the user's `integration/<target>/`, then generates **only** `<target>-deploy.json` via `aifabrix json`.
 
-Do **not** hardcode manifests in `lib/channels/*.js`.
+Do **not** hardcode manifests in `lib/channels/*.js`. Dataplane `make sync-json` does **not** overwrite these packages.
 
 ## Brand icons (`brand/`)
 

package/templates/channels/chatgpt/TROUBLESHOOTING.md

@@ -0,0 +1,51 @@
+# ChatGPT channel — Runtime and OAuth reference
+
+Customer `INSTALL.md` is a short status/instruction artifact. This file is the operator/debug reference. Do not copy this content into generated install help.
+
+## Desired contract (describe, don't configure)
+
+When ChatGPT is activated, AI Fabrix must be self-describing enough that ChatGPT only needs:
+
+- Name
+- Server URL (Runtime MCP)
+- Authentication: OAuth
+
+ChatGPT then discovers protected-resource metadata, the authorization server, scopes, PKCE `S256`, token-endpoint auth methods, and **client registration**. OpenAI currently prefers **CIMD** (`client_id_metadata_document_supported: true`) and still supports **DCR** (`registration_endpoint`). Pre-created `miso-chatgpt` copy-paste is the fallback when discovery does not advertise registration.
+
+Public OpenAI auth: https://developers.openai.com/apps-sdk/build/auth
+
+## Runtime MCP
+
+- HTTPS Streamable HTTP at the Runtime orchestration MCP URL
+- RFC 9728 protected-resource metadata (Traefik-reachable discovery URL, not a bare origin `/.well-known` 404)
+- `resource` echoed through authorize/token; access token audience must match
+
+## Authorization server metadata
+
+Advertise:
+
+- `authorization_endpoint`, `token_endpoint`
+- `code_challenge_methods_supported`: `S256`
+- `token_endpoint_auth_methods_supported` (CIMD: `none` and/or `private_key_jwt`)
+- `client_id_metadata_document_supported`: `true` (preferred)
+- `registration_endpoint` only if DCR remains required as fallback
+
+Skip Microsoft Entra issuers for ChatGPT. Use the customer OAuth issuer.
+
+## ChatGPT-owned remaining steps
+
+Create with logo (ChatGPT does not let you change the logo after create), risk acknowledgement, Publish, Show in directory, Connect. No AI Fabrix branding SSOT for the ChatGPT logo.
+
+## Callbacks
+
+With CIMD/DCR, ChatGPT's callback URI is part of client registration. Known hardcoded ChatGPT callback URLs are a compatibility patch for user-defined OAuth clients only.
+
+## Client secret
+
+Do not rotate on `channel add` or `--force`. Rotate only when ChatGPT still uses a confidential predefined client and the one-time secret is lost:
+
+```bash
+aifabrix integration-client rotate-secret --id <id>
+```
+
+Never write secrets into `dist/`, INSTALL, or logs.

package/templates/channels/chatgpt/channel.json

@@ -0,0 +1,59 @@
+{
+  "key": "chatgpt",
+  "displayName": "ChatGPT",
+  "description": "Connect ChatGPT as a custom MCP app for employees.",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "system"
+  },
+  "configuration": [
+    {
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
+      }
+    }
+  ],
+  "dataSources": [],
+  "endpointsActive": false,
+  "channel": {
+    "definitionKey": "chatgpt",
+    "provisioning": {
+      "mode": "guided"
+    },
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
+    },
+    "experimental": false,
+    "profiles": [],
+    "packaging": {
+      "channelType": "chatgpt",
+      "templateDir": "chatgpt",
+      "artifactFileName": "channel-chatgpt.json",
+      "artifactFormat": "json",
+      "credentialKey": "chatgpt-channel",
+      "capabilities": [
+        "chat",
+        "enterpriseActions"
+      ],
+      "displayLabel": "ChatGPT",
+      "category": "employee-ai",
+      "wizardOrder": 30,
+      "remainingManualStep": "Add the logo when you create the ChatGPT app. You cannot change it later. Then publish and connect.",
+      "docsAnchor": "chatgpt",
+      "approvalRequired": true,
+      "vendorAuthRequired": true
+    }
+  }
+}

package/templates/channels/chatgpt/icon.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>OpenAI</title><path d="M22.2819 9.8211a5.9847 5.9847 0 0 0-.5157-4.9108 6.0462 6.0462 0 0 0-6.5098-2.9A6.0651 6.0651 0 0 0 4.9807 4.1818a5.9847 5.9847 0 0 0-3.9977 2.9 6.0462 6.0462 0 0 0 .7427 7.0966 5.98 5.98 0 0 0 .511 4.9107 6.051 6.051 0 0 0 6.5146 2.9001A5.9847 5.9847 0 0 0 13.2599 24a6.0557 6.0557 0 0 0 5.7718-4.2058 5.9894 5.9894 0 0 0 3.9977-2.9001 6.0557 6.0557 0 0 0-.7475-7.0729zm-9.022 12.6081a4.4755 4.4755 0 0 1-2.8764-1.0408l.1419-.0804 4.7783-2.7582a.7948.7948 0 0 0 .3927-.6813v-6.7369l2.02 1.1686a.071.071 0 0 1 .038.052v5.5826a4.504 4.504 0 0 1-4.4945 4.4944zm-9.6607-4.1254a4.4708 4.4708 0 0 1-.5346-3.0137l.142.0852 4.783 2.7582a.7712.7712 0 0 0 .7806 0l5.8428-3.3685v2.3324a.0804.0804 0 0 1-.0332.0615L9.74 19.9502a4.4992 4.4992 0 0 1-6.1408-1.6464zM2.3408 7.8956a4.485 4.485 0 0 1 2.3655-1.9728V11.6a.7664.7664 0 0 0 .3879.6765l5.8144 3.3543-2.0201 1.1685a.0757.0757 0 0 1-.071 0l-4.8303-2.7865A4.504 4.504 0 0 1 2.3408 7.872zm16.5963 3.8558L13.1038 8.364 15.1192 7.2a.0757.0757 0 0 1 .071 0l4.8303 2.7913a4.4944 4.4944 0 0 1-.6765 8.1042v-5.6772a.79.79 0 0 0-.407-.667zm2.0107-3.0231l-.142-.0852-4.7735-2.7818a.7759.7759 0 0 0-.7854 0L9.409 9.2297V6.8974a.0662.0662 0 0 1 .0284-.0615l4.8303-2.7866a4.4992 4.4992 0 0 1 6.6802 4.66zM8.3065 12.863l-2.02-1.1638a.0804.0804 0 0 1-.038-.0567V6.0742a4.4992 4.4992 0 0 1 7.3757-3.4537l-.142.0805L8.704 5.459a.7948.7948 0 0 0-.3927.6813zm1.0976-2.3654l2.602-1.4998 2.6069 1.4998v2.9994l-2.5974 1.4997-2.6067-1.4997Z"/></svg>

package/templates/channels/chatgpt/install.template.md.hbs

@@ -1,104 +1,29 @@
-# {{appName}} — ChatGPT custom MCP app setup
+# {{baseName}} — ChatGPT
 
-{{appDescription}}
+Status: {{#if installReady}}Ready{{else}}Not ready{{/if}}
+{{#unless installReady}}
+Reason: {{discoveryBlockerLabel}}
 
-**Environment:** {{environment}}  
-**AI Fabrix credential reference:** `{{credentialKey}}`
+Fix the Runtime connection, then run:
 
-> This document and `dist/channels/chatgpt/channel-chatgpt.json` are deployment references for administrators. ChatGPT does not install the JSON file as a plugin archive. ChatGPT connects directly to the remote MCP endpoint and discovers the tools exposed by that server.
+aifabrix channel add chatgpt --name "{{baseName}}"
+{{/unless}}
 
-## ChatGPT workspace setup
+When ready:
 
-1. Sign in to the ChatGPT web app as a workspace admin or owner.
-2. Enable Developer mode for custom MCP apps:
-   - **Business:** **Workspace settings → Apps → Create**, or **Settings → Apps → Advanced settings**.
-   - **Enterprise/Edu:** grant the appropriate Developer mode permission under **Workspace settings → Permissions & roles → Connected data**, then enable it under **Settings → Apps → Advanced settings**.
-3. Open **Settings → Apps → Create** (or the equivalent **Workspace settings → Apps → Create** entry).
-4. Enter the app name `{{appName}}` and the remote MCP URL shown under **Runtime connection** below.
-5. Select **OAuth** as the authentication mechanism. Do not configure a custom API key in ChatGPT; custom API-key authentication is not supported for a remote custom MCP app.
-6. Select **Scan tools**. If prompted, complete the OAuth authorization flow and wait for ChatGPT to finish scanning the Runtime tool list.
-7. Review the discovered tools and create the app as a draft.
-8. Test representative read and write workflows. Confirm that user authorization and action confirmations behave as expected.
-9. Publish the app to the workspace and configure its access and action controls. Only workspace admins or owners can publish it.
-10. After MCP tool names, schemas, annotations, or authentication metadata change, use **Refresh** in the app's action controls and review the changes before enabling them.
+1. Open ChatGPT Apps:
+   {{{chatgptAppsCreateUrl}}}
 
-## Runtime connection
+2. Create the app with:
+   Name: {{appName}}
+   Description: {{appDescription}}
+   Server URL: {{{mcpUrl}}}
+   Authentication: OAuth
+   Logo: add it now. ChatGPT does not let you change the logo after create.
 
-Configure the following values in the ChatGPT custom MCP app. Never place access tokens, client secrets, or API keys in generated files.
+3. If ChatGPT shows a callback URL that is not already registered:
+   aifabrix channel configure chatgpt --callback-url "<callback-url>"
 
-- **App name:** `{{appName}}`
-{{#if mcpUrl}}
-- **Remote MCP URL:** `{{{mcpUrl}}}`
-{{/if}}
-- **Runtime system key:** `{{runtimeSystemKey}}`
-- **Transport:** Streamable HTTP
-- **Authentication:** OAuth 2.1 authorization-code flow with PKCE (`S256`)
-- **AI Fabrix credential reference:** `{{credentialKey}}`
-- **AI Fabrix authentication settings:** [Open authentication settings]({{{credentialPortalUrl}}})
+4. Publish and connect the app.
 
-The `{{credentialKey}}` value is an AI Fabrix credential reference. It is not a secret to paste into ChatGPT.
-
-## OAuth requirements
-
-Before ChatGPT can connect successfully, the MCP deployment must meet all of these requirements:
-
-- The MCP endpoint is reachable over public HTTPS with a publicly trusted TLS certificate chain.
-- The MCP server publishes OAuth protected-resource metadata, normally at `/.well-known/oauth-protected-resource`, or points to it in the `WWW-Authenticate` header returned with a `401 Unauthorized` response.
-- The protected-resource document identifies the canonical resource URL, authorization server, and supported scopes.
-- The authorization server publishes OAuth or OpenID Connect discovery metadata.
-- The authorization server supports the authorization-code flow and PKCE with `S256`.
-- The OAuth flow preserves the MCP `resource` parameter, and issued access tokens contain the expected audience and scopes.
-- The redirect URI shown by ChatGPT when the app is created is allowlisted in the authorization server.
-- The MCP server validates every access token's signature, issuer, audience, expiry, and scopes.
-- Each authenticated MCP tool declares an `oauth2` security scheme with the scopes it needs.
-
-If this development endpoint is deliberately anonymous, select **No authentication** instead and declare `noauth` on the applicable tools. Do not describe the app as “OAuth or API key”; the selected mechanism must match the behavior advertised by the MCP server.
-
-## Expected governed tools
-
-ChatGPT should discover the following tools from the live MCP server during **Scan tools**:
-
-{{#each layerBToolNames}}
-- `{{this}}`
-{{/each}}
-
-{{#if installReady}}Install ready: yes{{else}}Install ready: no{{#if discoveryBlocker}} ({{discoveryBlocker}}){{/if}}{{/if}}
-
-The live server response is authoritative. This list is an expected deployment contract from External AI Discovery, not a substitute for MCP tool discovery.
-
-## Runtime and Role Assistant boundaries
-
-- Runtime resolves assistants dynamically for the current user from `{{{assistantCatalogUrl}}}`.
-- ChatGPT's top-level tool surface remains limited to the governed tools listed above.
-- Evidence authoring remains an internal Business Transformation Assistant capability. It is reached through `ChatGPT → runtime-orchestration → Business Transformation Assistant → internal evidence capabilities` and is not exposed as a top-level ChatGPT tool.
-- One authenticated Runtime connection can support multiple Role Assistants, subject to the current user's authorization.
-
-## BTA evidence-authoring proof scenario
-
-Use this scenario to verify the ChatGPT → Runtime → BTA path without exposing Evidence commands as top-level ChatGPT tools:
-
-1. Ask {{baseName}} to improve an existing Role Assistant from process documentation.
-2. Confirm that {{baseName}} starts or continues Business Transformation Assistant work through Runtime.
-3. Confirm that BTA performs evidence metadata, download, upload, and reasoning operations internally and presents certified proposals.
-4. Approve selected proposals and confirm that activation remains an explicit human action.
-
-## AI Fabrix validation
-
-Before workspace publication, validate the live Streamable HTTP endpoint with MCP Inspector and confirm that initialization, tool discovery, representative calls, invalid inputs, OAuth challenges, and authorization checks all work.
-
-Then run the AI Fabrix probe:
-
-```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
-```
-
-The probe should validate Runtime through the first-party MCP gateway, including governed tool discovery and BTA Evidence-authoring reachability. A successful AI Fabrix probe does not replace ChatGPT's own **Scan tools**, OAuth, and workspace publication checks.
-
-Use `--force` only to regenerate artifacts and patch channel metadata. It does not rotate credentials.
-
-## Current validation status
-
-- Local artifact validation: complete
-- Live Runtime validation: pending
-- ChatGPT workspace tool scan: pending
-- ChatGPT workspace publication: requires a workspace admin or owner
+AI Fabrix validates Runtime and OAuth automatically.

package/templates/channels/chatgpt/integration/README.md

@@ -1,4 +1,4 @@
-# ChatGPT custom MCP app channel
+# ChatGPT
 
 Generated by `aifabrix channel scaffold chatgpt`.
 

package/templates/channels/chatgpt/integration/application.json

@@ -1,8 +1,8 @@
 {
   "app": {
     "key": "chatgpt",
-    "displayName": "ChatGPT custom MCP app channel",
-    "description": "Assistant communication channel — deploy then channel add",
+    "displayName": "ChatGPT",
+    "description": "Connect ChatGPT as a custom MCP app for employees.",
     "type": "external"
   },
   "externalIntegration": {

package/templates/channels/chatgpt/integration/chatgpt-system.json

@@ -1,14 +1,59 @@
 {
   "key": "chatgpt",
-  "displayName": "ChatGPT custom MCP app channel",
-  "description": "Communication external system for ChatGPT custom MCP app onboarding",
+  "displayName": "ChatGPT",
+  "description": "Connect ChatGPT as a custom MCP app for employees.",
   "type": "custom",
   "systemKind": "communication",
   "enabled": true,
   "authentication": {
     "authType": "system"
   },
-  "configuration": [],
+  "configuration": [
+    {
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
+      }
+    }
+  ],
   "dataSources": [],
-  "endpointsActive": false
+  "endpointsActive": false,
+  "channel": {
+    "definitionKey": "chatgpt",
+    "provisioning": {
+      "mode": "guided"
+    },
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
+    },
+    "experimental": false,
+    "profiles": [],
+    "packaging": {
+      "channelType": "chatgpt",
+      "templateDir": "chatgpt",
+      "artifactFileName": "channel-chatgpt.json",
+      "artifactFormat": "json",
+      "credentialKey": "chatgpt-channel",
+      "capabilities": [
+        "chat",
+        "enterpriseActions"
+      ],
+      "displayLabel": "ChatGPT",
+      "category": "employee-ai",
+      "wizardOrder": 30,
+      "remainingManualStep": "Add the logo when you create the ChatGPT app. You cannot change it later. Then publish and connect.",
+      "docsAnchor": "chatgpt",
+      "approvalRequired": true,
+      "vendorAuthRequired": true
+    }
+  }
 }

package/templates/channels/chatgpt/integration/env.template

@@ -1,4 +1,2 @@
-# ChatGPT custom MCP app channel credential reference
-# aifabrix secret set chatgpt/apiKey "<value>" --shared
-
-KV_CHATGPT_APIKEY=kv://chatgpt/apiKey
+# ChatGPT
+# OAuth is the Integration Client on External Access — do not store API keys here.

package/templates/channels/chatgpt/integration/rbac.json

@@ -0,0 +1,13 @@
+{
+  "roles": [
+    {
+      "name": "Everyone",
+      "value": "aifabrix-everyone",
+      "description": "Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)",
+      "groups": [
+        "AI-Fabrix-Everyone"
+      ]
+    }
+  ],
+  "permissions": []
+}

package/templates/channels/claude/TROUBLESHOOTING.md

@@ -0,0 +1,44 @@
+# Claude channel — Runtime and OAuth reference
+
+Customer `INSTALL.md` is a short status/instruction artifact. This file is the operator/debug reference. Do not copy this content into generated install help.
+
+## Desired contract (describe, don't configure)
+
+When Claude is activated, AI Fabrix must be self-describing enough that Claude only needs:
+
+- Name
+- Server URL (Runtime MCP)
+- Authentication: OAuth (the Runtime MCP requires sign-in; Claude’s form defaults to none)
+
+Claude then discovers protected-resource metadata, the authorization server, scopes, PKCE `S256`, and client registration. Pre-created `miso-claude` copy-paste is the fallback when discovery does not advertise registration.
+
+Public Anthropic connector auth: https://claude.com/docs/connectors/building/authentication
+
+## Runtime MCP
+
+- HTTPS Streamable HTTP at the Runtime orchestration MCP URL
+- RFC 9728 protected-resource metadata
+- `resource` echoed through authorize/token; access token audience must match
+- The MCP URL must be reachable from Anthropic cloud (not localhost)
+
+## Hosted Claude surfaces
+
+Claude.ai web, Claude Desktop, Cowork, and mobile use the same account-level custom connector. Remote MCP is brokered by Anthropic, not by a local `claude_desktop_config.json`.
+
+The Runtime MCP returns **401** without a user token. In Claude connector settings, Authentication must be **OAuth** (require sign-in). If the connector is saved as “not requiring sign-in”, Claude reports that mismatch (HTTP 401) and an `ofid_…` support reference. Edit the connector, set OAuth, then Connect.
+
+## Claude-owned remaining steps
+
+Add the custom connector (Owners on Team or Enterprise), authenticate/consent, and enable it. There is no documented Anthropic API for those steps.
+
+## Callbacks
+
+Hosted Claude surfaces use `https://claude.ai/api/mcp/auth_callback`. Register extra HTTPS callbacks with:
+
+```bash
+aifabrix channel configure claude --callback-url "<callback-url>"
+```
+
+## Client secret
+
+Do not rotate on `channel add` or `--force`. Never write secrets into `dist/`, INSTALL, or logs.

package/templates/channels/claude/channel.json

@@ -0,0 +1,59 @@
+{
+  "key": "claude",
+  "displayName": "Claude",
+  "description": "Connect Claude as a custom remote MCP connector for employees.",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "system"
+  },
+  "configuration": [
+    {
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
+      }
+    }
+  ],
+  "dataSources": [],
+  "endpointsActive": false,
+  "channel": {
+    "definitionKey": "claude",
+    "provisioning": {
+      "mode": "guided"
+    },
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
+    },
+    "experimental": false,
+    "profiles": [],
+    "packaging": {
+      "channelType": "claude",
+      "templateDir": "claude",
+      "artifactFileName": "channel-claude.json",
+      "artifactFormat": "json",
+      "credentialKey": "claude-channel",
+      "capabilities": [
+        "chat",
+        "enterpriseActions"
+      ],
+      "displayLabel": "Claude",
+      "category": "employee-ai",
+      "wizardOrder": 32,
+      "remainingManualStep": "Add the custom connector (Owners for Team or Enterprise), set Authentication to OAuth, authenticate, and enable it.",
+      "docsAnchor": "claude",
+      "approvalRequired": true,
+      "vendorAuthRequired": true
+    }
+  }
+}

package/templates/channels/claude/icon.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Anthropic</title><path d="M17.3041 3.541h-3.6718l6.696 16.918H24Zm-10.6082 0L0 20.459h3.7442l1.3693-3.5527h7.0052l1.3693 3.5528h3.7442L10.5363 3.5409Zm-.3712 10.2232 2.2914-5.9456 2.2914 5.9456Z"/></svg>

package/templates/channels/claude/install.template.md.hbs

@@ -0,0 +1,22 @@
+# {{baseName}} — Claude
+
+Status: {{#if installReady}}Ready{{else}}Not ready{{/if}}
+{{#unless installReady}}
+Reason: {{discoveryBlockerLabel}}
+
+Fix the Runtime connection, then run:
+
+aifabrix channel add claude --name "{{baseName}}"
+{{/unless}}
+
+When ready:
+
+1. Open Claude connectors:
+   {{{claudeConnectorsUrl}}}
+
+2. Add a custom connector with:
+   Name: {{appName}}
+   Server URL: {{{mcpUrl}}}
+   Authentication: OAuth
+
+AI Fabrix validates Runtime and OAuth automatically.

package/templates/channels/claude/integration/README.md

@@ -0,0 +1,14 @@
+# Claude
+
+Generated by `aifabrix channel scaffold claude`.
+
+Recommended flow:
+
+```bash
+aifabrix channel add claude --name "Your Assistant" --probe
+```
+
+`channel add` scaffolds (if needed), uploads when missing (always with `--force`), then
+generates `dist/channels/claude/channel-claude.json` and `INSTALL.md`. Those files are
+deployment references for workspace admins: Claude connects to the remote Runtime MCP URL
+(OAuth) and discovers tools; it does not install the JSON as a plugin archive.

package/templates/channels/claude/integration/application.json

@@ -0,0 +1,15 @@
+{
+  "app": {
+    "key": "claude",
+    "displayName": "Claude",
+    "description": "Connect Claude as a custom remote MCP connector for employees.",
+    "type": "external"
+  },
+  "externalIntegration": {
+    "schemaBasePath": "./",
+    "systems": ["claude-system.json"],
+    "dataSources": [],
+    "autopublish": true,
+    "version": "1.0.0"
+  }
+}