@aifabrix/builder 2.54.1 → 2.55.0

package/templates/agent-kit/workspace/README.md

@@ -0,0 +1,89 @@
+# {{workspaceName}}
+
+AI Fabrix **customer delivery workspace** for Connected Systems and Role Assistants.
+
+This repository holds **customer packages and data** only. Do not edit platform product source from this workspace.
+
+Vendor limits, credentials, designated test subjects, and PII live only in each system’s `integration/<systemKey>/README.md`.
+
+## How to start
+
+1. Open **this folder** in Cursor, Claude Code, or Codex. Host install and sign-in: **[AGENTKIT.md](./AGENTKIT.md)**.
+2. In a terminal here, run `aifabrix auth status`. If you are not authenticated, run `aifabrix login` (the agent cannot log in for you).
+3. In chat, either **invoke a skill** or **paste a prompt** from the tables below. Work in order. Wait for the gate (`PLAN_READY`, `READY`, `BUILT`, then `PASS` or `PASS_WITH_SKIPS`) before the next step.
+
+### How to use prompts
+
+| Host | Invoke a skill | Or type a prompt |
+| --- | --- | --- |
+| Cursor | `/aifabrix-plan` (and the other `/aifabrix-*` names) | Paste the sentence from **What to ask** |
+| Claude Code | same `/aifabrix-*` names | same sentences |
+| Codex | `$aifabrix-plan` (and the other `$aifabrix-*` names) | same sentences |
+
+You can combine them: invoke the skill, then add the system key or paste a spec. Attach or `@` the specification file when you have one. Replace `<systemKey>` and `<catalogRole>` with real keys. Do not invent `ra-` / `ek-` system keys or `*-reader` roles.
+
+### Connected System (integration)
+
+| Step | Skill | What to ask (prompt) |
+| --- | --- | --- |
+| Plan | `/aifabrix-plan` | Turn this specification into a delivery plan for `<systemKey>` |
+| Validate and build | `/aifabrix-connected-system` | Validate and build the `<systemKey>` integration |
+| Test and publish | `/aifabrix-connected-system` | Publish and certify this Connected System |
+
+Example — plan:
+
+```text
+/aifabrix-plan
+Turn this specification into a delivery plan for <systemKey>
+```
+
+`aifabrix upload` is a **draft**. Publish is **`aifabrix deploy`**. Secrets stay in `kv://` — never paste values into chat or git.
+
+### Role Assistant
+
+Do this after the Connected Systems the role needs are **published** (deploy, not upload-only).
+
+| Step | Skill | What to ask (prompt) |
+| --- | --- | --- |
+| Author, test, or upload | `/aifabrix-role-assistant` | Create or update the `<catalogRole>` Role Assistant |
+| Prove the business case | `/aifabrix-prove` | Prove this business case and update learning |
+
+Example — Role Assistant:
+
+```text
+/aifabrix-role-assistant
+Create or update the <catalogRole> Role Assistant
+```
+
+Use a **catalog** role key (`finance-controller`, `cfo`, …). Package folder: `role-assistant/ra-<catalogRole>/`.
+
+## Layout
+
+```text
+integration/<systemKey>/       Connected System packages (Builder output)
+integration/<systemKey>/data/  Fixtures / source exports
+role-assistant/ra-<roleKey>/   Role Assistant packages
+.agents/skills/                Agent Kit skills (Cursor, Codex, Claude)
+.cursor/plans/                 Delivery plans
+```
+
+As you add packages, list system keys and catalog roles in this README. Keep operational limits in each `integration/<systemKey>/README.md`.
+
+## Agent Kit
+
+Install, coding hosts, auto-approve, and CLI auth: **[AGENTKIT.md](./AGENTKIT.md)**.
+
+```bash
+aifabrix agent-kit status
+aifabrix agent-kit validate
+aifabrix agent-kit update
+```
+
+`aifabrix agent-kit update` refreshes `AGENTKIT.md`. If this README is missing, install/update creates it. An existing README is never overwritten.
+
+## Docs
+
+- [Agent Kit](./AGENTKIT.md) — hosts, install, auto-approve, CLI auth
+- [Build AI-ready systems](https://docs.aifabrix.ai/docs/build-ai-ready-systems)
+- [CLI workflow](https://docs.aifabrix.ai/docs/build-ai-ready-systems-validate-test-cli-workflow)
+- [llms.txt](https://docs.aifabrix.ai/llms.txt)

package/templates/applications/builder-api/Dockerfile

@@ -13,7 +13,7 @@ ENV NODE_ENV=production \
 WORKDIR /app
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends dumb-init ca-certificates \
+    && apt-get install -y --no-install-recommends dumb-init ca-certificates curl \
     && rm -rf /var/lib/apt/lists/*
 
 COPY package.json package-lock.json ./
@@ -23,6 +23,8 @@ COPY docker-builder-api-staging/lib ./lib
 COPY docker-builder-api-staging/bin/builder-api-spike.js ./bin/builder-api-spike.js
 COPY docker-builder-api-staging/bin/builder-api-cleanup.js ./bin/builder-api-cleanup.js
 COPY docker-builder-api-staging/templates ./templates
+# BID resource-type catalog + help fixtures (staged docs/builder-help only)
+COPY docker-builder-api-staging/docs ./docs
 
 RUN addgroup --system appgroup \
     && adduser --system --ingroup appgroup --home /app appuser \

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.47
+  version: 2.0.56
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -71,7 +71,7 @@ build:
   envOutputPath: ../../.env # Copy to repo root for local dev
   language: python # Runtime language for template selection (typescript or python)
   # Dev reload: polling + watch /app/app only (avoids EMFILE on full repo bind-mount). See run_local.py, make af-reload.
-  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app --timeout-graceful-shutdown 15
+  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app --reload-exclude tests --reload-exclude .temp --reload-exclude app-ui --timeout-graceful-shutdown 15
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
   # Early ASGI (boot.api) binds PORT before heavy app.main import — Azure App Service warmup.
   imageRun: exec python -m uvicorn boot.api:app --host 0.0.0.0 --port ${PORT:-3001}

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.47
+VERSION=2.0.56
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/dataplane/rbac.yaml

@@ -163,6 +163,34 @@ permissions:
       ]
     description: "Read the global Resource Type catalog (list/get)"
   
+  # Aspect catalog (read-only)
+  - name: "aspect:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-deployment-admin",
+        "aifabrix-compliance-admin",
+        "aifabrix-developer",
+        "aifabrix-observer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Read the shared baseline Aspect catalog (list/get)"
+
+  # Knowledge Type catalog (read-only)
+  - name: "knowledge-type:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-deployment-admin",
+        "aifabrix-compliance-admin",
+        "aifabrix-developer",
+        "aifabrix-observer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Read the Dataplane Knowledge Type catalog (list/get)"
+
   # Generic dataplane operations
   - name: "dataplane:read"
     roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]

package/templates/applications/keycloak/env.template

@@ -55,9 +55,9 @@ KC_HEALTH_ENABLED=true
 KC_HTTP_MANAGEMENT_HEALTH_ENABLED=false
 # Single-instance: use local cache so /health/ready passes (avoids Infinispan cluster check)
 KC_CACHE=local
-# Experimental OAuth Client ID Metadata Document (Keycloak 26.6+). Realm well-known
-# advertises client_id_metadata_document_supported. Rebuild the Keycloak image after change.
-KC_FEATURES=cimd
+# Runtime features. Include cimd so Keycloak 26.7.2 advertises Client ID Metadata
+# Documents. preview alone triggers a start-time rebuild that drops cimd.
+KC_FEATURES=preview,cimd
 
 # =============================================================================
 # DATABASE CONFIGURATION

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.43'
+  version: '2.0.51'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).

package/templates/applications/miso-controller/env.template

@@ -22,9 +22,10 @@
 SKIP_FIRST_TIME_SETUP=false
 
 # Force onboarding to run even when a controller row already exists (default: unset/false).
-# Use only when the DB already had a controller so onboarding was skipped and the admin
-# user was never created in the aifabrix realm. Set to true, restart controller once,
-# then set back to false so onboarding does not re-run on every start.
+# Prefer SQL/API one-shot: POST /api/v1/controller/force-onboarding (controller:admin) or set
+# controllers.configuration.setup.forceOnboarding=true — no App Service restart required.
+# Env FORCE_ONBOARDING still works as bootstrap-only when you must restart: set true, restart once,
+# then set back to false. This is NOT a Tenant Activation wizard reset (does not clear activation JSON).
 # FORCE_ONBOARDING=true
 
 # Optional custom controller key for onboarding (default: miso-controller)
@@ -127,7 +128,9 @@ REDIS_PERMISSIONS_TTL=900
 KEYCLOAK_REALM=aifabrix
 # Public issuer / browser URL (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH=/auth).
 KEYCLOAK_SERVER_URL=url://keycloak-public
-# Internal token/JWKS calls: url://keycloak-internal (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH).
+# Internal token/JWKS calls use url://keycloak-internal.
+# In Traefik/front-door mode, virtual directory mapping supplies relative path semantics.
+# Do not append /auth again when frontDoorRouting is /auth/* — /auth/auth 404s.
 KEYCLOAK_INTERNAL_SERVER_URL=url://keycloak-internal
 # Docker/internal host and port: used when config from DB has localhost (getDockerKeycloakInternalUrl).
 # Resolved from env-config (e.g. KEYCLOAK_HOST=keycloak, KEYCLOAK_PORT=8080 for docker).
@@ -247,10 +250,6 @@ SKIP_DB_REDEPLOY=true
 # Bootstrap (SKIP_FIRST_TIME_SETUP=false) is separate from the activation wizard.
 DEPLOYMENT=database
 
-# Dev/test: open /tenant-activation on Platform Apps (last step). Default false.
-# Does not skip server-side TA — use only when env is already activated/deployed.
-TA_SKIP_TO_APP_DEPLOY=false
-
 # Dev/test: show TA Entra "Completing setup" countdown (120s cap). Default false.
 # Exposed to UI via GET /api/v1/tenant/status → showTaCountdown (restart controller after change).
 SHOW_TA_COUNT_DOWN=false
@@ -325,7 +324,7 @@ MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault
 
 LOG_TO_FILE=true
 LOG_LEVEL=info
-LOG_FILE_PATH=./logs
+LOG_FILE_PATH=/mnt/data/logs
 
 # =============================================================================
 # OPENTELEMETRY CONFIGURATION

package/templates/channels/claude/TROUBLESHOOTING.md

@@ -8,6 +8,7 @@ When Claude is activated, AI Fabrix must be self-describing enough that Claude o
 
 - Name
 - Server URL (Runtime MCP)
+- Authentication: OAuth (the Runtime MCP requires sign-in; Claude’s form defaults to none)
 
 Claude then discovers protected-resource metadata, the authorization server, scopes, PKCE `S256`, and client registration. Pre-created `miso-claude` copy-paste is the fallback when discovery does not advertise registration.
 
@@ -24,6 +25,8 @@ Public Anthropic connector auth: https://claude.com/docs/connectors/building/aut
 
 Claude.ai web, Claude Desktop, Cowork, and mobile use the same account-level custom connector. Remote MCP is brokered by Anthropic, not by a local `claude_desktop_config.json`.
 
+The Runtime MCP returns **401** without a user token. In Claude connector settings, Authentication must be **OAuth** (require sign-in). If the connector is saved as “not requiring sign-in”, Claude reports that mismatch (HTTP 401) and an `ofid_…` support reference. Edit the connector, set OAuth, then Connect.
+
 ## Claude-owned remaining steps
 
 Add the custom connector (Owners on Team or Enterprise), authenticate/consent, and enable it. There is no documented Anthropic API for those steps.

package/templates/channels/claude/channel.json

@@ -50,7 +50,7 @@
       "displayLabel": "Claude",
       "category": "employee-ai",
       "wizardOrder": 32,
-      "remainingManualStep": "Add the custom connector (Owners for Team or Enterprise), authenticate, and enable it.",
+      "remainingManualStep": "Add the custom connector (Owners for Team or Enterprise), set Authentication to OAuth, authenticate, and enable it.",
       "docsAnchor": "claude",
       "approvalRequired": true,
       "vendorAuthRequired": true

package/templates/channels/claude/install.template.md.hbs

@@ -17,5 +17,6 @@ When ready:
 2. Add a custom connector with:
    Name: {{appName}}
    Server URL: {{{mcpUrl}}}
+   Authentication: OAuth
 
 AI Fabrix validates Runtime and OAuth automatically.

package/templates/channels/claude/integration/claude-system.json

@@ -50,7 +50,7 @@
       "displayLabel": "Claude",
       "category": "employee-ai",
       "wizardOrder": 32,
-      "remainingManualStep": "Add the custom connector (Owners for Team or Enterprise), authenticate, and enable it.",
+      "remainingManualStep": "Add the custom connector (Owners for Team or Enterprise), set Authentication to OAuth, authenticate, and enable it.",
       "docsAnchor": "claude",
       "approvalRequired": true,
       "vendorAuthRequired": true

package/templates/channels/slack/channel.json

@@ -147,6 +147,17 @@
         }
       }
     },
+    {
+      "name": "ENABLE_MCP_SERVER",
+      "value": "false",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "MCP server",
+        "options": ["true", "false"]
+      }
+    },
     {
       "name": "ENABLE_PROACTIVE_MESSAGING",
       "value": "true",

package/templates/channels/slack/install.template.md.hbs

@@ -25,6 +25,15 @@ Complete remaining Slack steps in this order:
 
 `aifabrix channel add` prints the filled URLs for your app. Do not paste client secrets into this file.
 
+{{#if enableMcpServer}}
+## MCP server
+
+This Slack app is also an MCP client of AI Fabrix Runtime. Connect the **AI Fabrix MCP server** in Slack, then sign in at **AI Fabrix** when Slack asks.
+
+The Slack bot token and signing secret stay inbound Events and slash-command auth. They are not the MCP bearer. Do not paste an Integration Client secret into this file.
+
+{{/if}}
+
 The command may ask **Onboard users?** Yes matches Slack profile email to an existing platform user email and stores the mapping. Unmatched people still use **Link account**. Non-interactive: `--onboard-users` or `--no-onboard-users`. `--force` does not re-onboard unless you pass `--onboard-users` or answer yes again.
 
 Optional validation:

package/templates/channels/slack/integration/slack-system.json

@@ -147,6 +147,17 @@
         }
       }
     },
+    {
+      "name": "ENABLE_MCP_SERVER",
+      "value": "false",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "MCP server",
+        "options": ["true", "false"]
+      }
+    },
     {
       "name": "ENABLE_PROACTIVE_MESSAGING",
       "value": "true",

package/templates/channels/slack/manifest.template.json.hbs

@@ -54,7 +54,8 @@
         "im:read",
         "im:write",
         "users:read",
-        "users:read.email"
+        "users:read.email"{{#if enableMcpServer}},
+        "mcp:connect"{{/if}}
       ]
     },
     "pkce_enabled": false
@@ -74,6 +75,8 @@
     "org_deploy_enabled": true,
     "socket_mode_enabled": false,
     "token_rotation_enabled": {{slackTokenRotationEnabled}},
-    "is_mcp_enabled": false
-  }
+    "is_mcp_enabled": {{#if enableMcpServer}}true{{else}}false{{/if}}
+  }{{#if slackMcpServersJson}},
+  "mcp_servers": {{{slackMcpServersJson}}},
+  "external_auth_providers": {{{slackExternalAuthJson}}}{{/if}}
 }

package/templates/channels/teams-bot/channel.json

@@ -136,6 +136,7 @@
       "configurable": true
     },
     "experimental": false,
+    "status": "coming-soon",
     "maxInstances": 1,
     "profiles": [],
     "packaging": {

package/templates/python/docker-compose.hbs

@@ -160,6 +160,13 @@ services:
     {{#if devMountPath}}
     volumes:
       - {{devMountPath}}:/app
+      {{#if requiresStorage}}
+      {{#if localDataMountPath}}
+      - {{localDataMountPath}}:/mnt/data
+      {{else}}
+      - {{#if (eq devId 0)}}aifabrix_{{app.key}}_data{{else}}aifabrix_dev{{devId}}_{{app.key}}_data{{/if}}:/mnt/data
+      {{/if}}
+      {{/if}}
     user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
     {{/if}}
     depends_on:
@@ -188,6 +195,13 @@ services:
     {{#if devMountPath}}
     volumes:
       - {{devMountPath}}:/app
+      {{#if requiresStorage}}
+      {{#if localDataMountPath}}
+      - {{localDataMountPath}}:/mnt/data
+      {{else}}
+      - {{#if (eq devId 0)}}aifabrix_{{app.key}}_data{{else}}aifabrix_dev{{devId}}_{{app.key}}_data{{/if}}:/mnt/data
+      {{/if}}
+      {{/if}}
     user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
     {{/if}}
     depends_on:

package/templates/typescript/docker-compose.hbs

@@ -160,6 +160,13 @@ services:
     {{#if devMountPath}}
     volumes:
       - {{devMountPath}}:/app
+      {{#if requiresStorage}}
+      {{#if localDataMountPath}}
+      - {{localDataMountPath}}:/mnt/data
+      {{else}}
+      - {{#if (eq devId 0)}}aifabrix_{{app.key}}_data{{else}}aifabrix_dev{{devId}}_{{app.key}}_data{{/if}}:/mnt/data
+      {{/if}}
+      {{/if}}
     user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
     {{/if}}
     depends_on:
@@ -186,6 +193,13 @@ services:
     {{#if devMountPath}}
     volumes:
       - {{devMountPath}}:/app
+      {{#if requiresStorage}}
+      {{#if localDataMountPath}}
+      - {{localDataMountPath}}:/mnt/data
+      {{else}}
+      - {{#if (eq devId 0)}}aifabrix_{{app.key}}_data{{else}}aifabrix_dev{{devId}}_{{app.key}}_data{{/if}}:/mnt/data
+      {{/if}}
+      {{/if}}
     user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
     {{/if}}
     depends_on: