@aifabrix/builder 2.54.1 → 2.55.2

package/templates/agent-kit/skills/aifabrix-plan/references/interaction.md

@@ -0,0 +1,34 @@
+# Phase and result interaction
+
+Use structured questions. Do not start the next phase from chat prose alone.
+
+## After success
+
+Offer the next eligible phase. Proceed only on `next-yes`.
+
+Shared option ids: `next-yes` · `next-no` · `next-stop`.
+
+| Completed | Next offer |
+| --- | --- |
+| aifabrix-plan PLAN_READY | connected-system validate |
+| connected-system READY | connected-system build |
+| connected-system BUILT | connected-system publish |
+| connected-system PASS or PASS_WITH_SKIPS | archive (separate) and/or prove validate |
+| prove READY / BUILT / UPDATED | prove next phase |
+| prove PASS or PASS_WITH_SKIPS | iterate validate/build |
+
+Archive is a distinct user decision (`archive-yes` / `archive-no`). Never archive as a side effect of PASS.
+
+## On gaps
+
+- NEEDS_DECISIONS: AskQuestion challenge rows. No `cust-next`.
+- BLOCKED / FAIL / NEEDS_FIXES / ABORTED: do not offer the next phase as if success.
+
+## Phase detection (connected-system and prove)
+
+1. Explicit phase from the user
+2. Active plan and package state
+3. Safe next eligible phase
+4. Ask once if ambiguous
+
+Never silently run the following phase after success.

package/templates/agent-kit/skills/aifabrix-plan/references/plan-template.md

@@ -0,0 +1,182 @@
+# Cursor plan template (mandatory section order)
+
+Every `/cust-0-plan` output uses **this order**. Do not rename, skip, or reorder H2 sections. Empty sections get `TBD` plus an Open-question id — never omit the heading.
+
+File: `.cursor/plans/{major}.0-{slug}.plan.md`  
+`{major}` = next integer after existing plans (including `done/`). `{slug}` = kebab from capability name / proposed `system-key`.
+
+## Frontmatter (exact keys)
+
+```yaml
+---
+name: {major}.0-{slug}
+overview: |
+  {2–4 lines: purpose + systems + proof. No secrets.}
+todos:
+  - id: lock-open-questions
+    content: Close Open questions (or defer with owner) until PLAN_READY
+    status: pending
+  - id: map-catalog-roles
+    content: Map spec role labels to COM catalog keys (aifabrix role list)
+    status: pending
+  - id: author-bid
+    content: Author BID (or wizard config) for each new Connected System key
+    status: pending
+  - id: cust-1-validate
+    content: /cust-1-validate <system-key> → READY
+    status: pending
+  - id: cust-2-build
+    content: /cust-2-build <system-key> → BUILT
+    status: pending
+  - id: cust-3-push
+    content: /cust-3-push <system-key> → PASS or PASS_WITH_SKIPS
+    status: pending
+  - id: viewpoints-fk-dims
+    content: Viewpoints have FK + dimensions + ABAC (not raw storage dumps)
+    status: pending
+  - id: identity-fixtures
+    content: Catalog roles + fixtures/groups (skill aifabrix-identity-rbac) — push-scoped
+    status: pending
+  - id: ra-packages
+    content: Role Assistant packages ra-<catalogRole> after CS published
+    status: pending
+  - id: cust-biz-1-validate
+    content: /cust-biz-1-validate — prove-ready scope + learning.md
+    status: pending
+  - id: cust-biz-2-build
+    content: /cust-biz-2-build — demo / Knowledge / candidate Evidence / tests
+    status: pending
+  - id: cust-biz-3-prove
+    content: /cust-biz-3-prove — happy + refusal; Evidence summary
+    status: pending
+status: draft   # draft until PLAN_READY, then active
+isProject: false
+---
+```
+
+Duplicate `author-bid` / `cust-1-validate` / `cust-2-build` / `cust-3-push` **per additional** `system-key` (`author-bid-personio`, …). Do not add extra todo ids unless the spec requires a named workstream.
+
+When `/cust-0-plan` status is **NEEDS_DECISIONS**, keep `lock-open-questions` pending and `status: draft`. When **PLAN_READY**, set `status: active` and mark `lock-open-questions` completed if none remain.
+
+## Body (copy all H2s)
+
+```markdown
+# {major}.0 — {Capability title}
+
+**Plan status:** PLAN_READY | NEEDS_DECISIONS | BLOCKED  
+**Proposed system-key(s):** …  
+**Authoritative source(s):** … (in this workspace / to-be-connected / internal)  
+**Role Assistant(s):** `ra-<catalogRole>` (after D5) or TBD  
+**Operational SSOT (after build):** `integration/<system-key>/README.md`  
+**Public docs:** [Build AI-ready systems](https://docs.aifabrix.ai/docs/build-ai-ready-systems)
+
+## Goal
+
+{Business purpose — verbatim spirit of the spec. Why this capability exists.}
+
+## Non-goals
+
+- {From spec out-of-scope}
+- Extra authority, entities, or source fields not in the spec
+- Prompt-only enforcement of business rules
+
+## Authoritative sources
+
+| Source | Role | In this workspace? | Approved fields only |
+| --- | --- | --- | --- |
+| … | identity / facts / … | yes path / **no — to-be-connected** | list |
+
+Least privilege: the capability may retrieve **only** fields the spec approves.
+
+## Business entities
+
+For each entity: key fields, identity, source. `heroId`-style keys **resolve** to the source identity — they do not create a second master.
+
+## Relationship model
+
+ASCII diagram from the spec. Then the FK list. Call out dual relationships to the same entity (e.g. voter + nominee).
+
+## Foreign-key integrity
+
+- Current eligibility = source of record
+- Historical Evidence keeps stable FKs
+- **Do not** cascade-delete history when a source row becomes inactive
+
+## Business roles
+
+| Spec label | COM catalog key | Can | Cannot |
+| --- | --- | --- | --- |
+| … | from `aifabrix role list` or **TBD** | … | … |
+
+If the label is not a catalog key → Open question (do not invent).
+
+## Language handling
+
+| Artifact | Kind | Rule |
+| --- | --- | --- |
+| Original human text | Evidence | Never overwrite |
+| Normalized / translated text | Derived Knowledge | Separate field |
+
+## Core business rules
+
+Table `BR-ID` | Rule | Enforced as (governed rule, not prompt).
+
+## Governed operations
+
+Grouped by role. Inputs / outputs / window. No extra ops.
+
+## Result Viewpoints
+
+Each viewpoint: returns, **does not return** (no voter identities, no raw text, …). Viewpoints are governed aggregates — not dumps of join tables.
+
+## Validation cases
+
+Keep spec IDs (`VAL-001`, …). These become acceptance tests.
+
+## Security / attack validations
+
+Keep spec IDs (`ATTACK-001`, …). Expected: denied / rejected by BR-*.
+
+## Evidence to capture
+
+Actor, Business Role, operation, authority result, rule version, success/refusal, source, Viewpoint, taxonomy version. Include the spec’s **Evidence summary** shape if given.
+
+## Identity join (most important relationship)
+
+Authenticated person → catalog role → business entity → source record. Nominations (or equivalent) reference **ids**, never display names.
+
+## Locked decisions
+
+| # | Question | Decision | Date |
+| --- | --- | --- | --- |
+| 1 | … | … | … |
+
+## Open questions
+
+| ID | Question | Blocks | Owner |
+| --- | --- | --- | --- |
+| Q1 | … | PLAN_READY / build / push / prove | … |
+
+## Delivery mapping
+
+| Track | Command | When |
+| --- | --- | --- |
+| CS | `/cust-1-validate` → `/cust-2-build` → `/cust-3-push` | After PLAN_READY; one ladder per new `system-key` |
+| PoC | `/cust-biz-1-validate` ↔ `/cust-biz-2-build` ↔ `/cust-biz-3-prove` | After CS published (or explicit waiver) |
+
+Existing connected sources: reuse package; do not duplicate the employee/master.
+
+## Success criteria
+
+Numbered, testable. Include authority-change demo if the spec has one (same person, new role, same interface).
+
+## Next
+
+- **PLAN_READY** → AskQuestion `cust-next` → `/cust-1-validate <system-key>` on **`next-yes`**
+- **NEEDS_DECISIONS** → AskQuestion challenge rows ([challenge-checklist.md](challenge-checklist.md)); lock answers into this file; do not start `/cust-1-validate`
+- **BLOCKED** → stop; do not author BID
+```
+
+## Rewrite rule
+
+Re-running `/cust-0-plan` for the same capability **updates** this file (same `{major}.0-{slug}`). Do not mint a new major for Q&A.

package/templates/agent-kit/skills/aifabrix-prove/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: aifabrix-prove
+description: >
+  Prove a business case on a published Connected System and Role Assistant.
+  Updates learning, keeps candidate Evidence separate from certified Evidence,
+  and iterates validate, build, and prove. Do not use for Builder product
+  source changes or to skip Connected System publish.
+---
+
+# aifabrix-prove
+
+Phases: `validate` | `build` | `prove`.
+Loop: validate ↔ build ↔ prove ↔ learn.
+
+`READY` means prove-ready, not permission to stop authoring. Build may run without READY.
+
+Every phase **must** update [learning-template.md](references/learning-template.md).
+Evidence rules: [evidence-lifecycle.md](references/evidence-lifecycle.md).
+Demo shape: [demo-template.md](references/demo-template.md).
+Next-step: [interaction.md](../aifabrix-plan/references/interaction.md).
+Host runtimes (local vs SSH): [hosts.md](../shared/hosts.md).
+CLI login from chat: [login.md](../shared/login.md).
+
+## Keys
+
+Connected System: same resolution as `aifabrix-connected-system`.
+Role: existing COM catalog key; on disk `role-assistant/ra-<roleKey>/`.
+
+CS must be published (`deploy` + `show --online`) before live prove. Upload-only draft is BLOCKED for prove.
+
+## Validate
+
+Clarify scope and unknowns. Classify MISSING rows. Drafting may continue offline.
+
+## Build
+
+Repeatable: demo, Knowledge, candidate Evidence, tests. Do not refuse because validate is not READY.
+
+## Prove
+
+Run assistant tests. Record observations and gap owner (`none` | `product-gap` | `missing-customer-fact` | `scope-decision`).
+Happy + safe-stop coverage for authority scenarios.
+Never report candidates as certified.
+
+## Narrative
+
+Prefer public product language from https://docs.aifabrix.ai and, when present, sibling website masters. Do not invent slogans. AI has no authority of its own.
+
+## Trigger examples
+
+- Prove this business case and update learning

package/templates/agent-kit/skills/aifabrix-prove/references/demo-template.md

@@ -0,0 +1,65 @@
+# demo.md template (Finnish, customer-facing)
+
+**Path:** `role-assistant/ra-<roleKey>/demo/demo.md`
+
+Feeds PowerPoint / ChatGPT / Gamma. Business language only — no MCP/API how-to.
+
+**Narrative SSOT:** `aifabrix-docs/anchor-docs/web-site/` — especially `evaluate.md`, `homepage.md`, `solutions.md`, `platform.md`, `use-cases.md`. Do not invent slogans; use pillar language from those masters (Enterprise Knowledge, Operational Trust, Role Assistants, Evidence Fabrix). AI has no authority of its own.
+
+## Outline
+
+```md
+# PoC-demo — <prosessi / rooli>
+
+## 1. Ongelma (nykytila)
+- Mitä työtä tehdään tänään (raportit, Excel, ad-hoc kyselyt)?
+- Kuka odottaa vastausta? Kuinka kauan?
+- Missä luottamus pettää (väärä data, väärä näkyvyys)?
+
+## 2. Mitä todistamme
+- Yksi prosessi, yksi rooli, mitattava lopputulos
+- Omistaja:
+- Onnistumisen mittarit (FACT vs oletus merkitty):
+
+## 3. Miksi AI Fabrix
+- Neljä pilaria (solutions/platform): Enterprise Knowledge → Operational Trust → Role Assistants → Evidence Fabrix
+- Luotettu liiketoimintakonteksti (ei raakadata-dumppi); AI:lla ei omaa toimivaltaa
+- Oikeat ihmiset näkevät / päättävät vain oman organisaatiovaltuutuksensa rajoissa
+- Role Assistant + Evidence — tarkastettavissa (evaluate.md / architecture-evidence-observability.md)
+- Lähde: `aifabrix-docs/anchor-docs/web-site/` (ei vapaa markkinointimuisti)
+
+## 4. Demo-skenaariot
+### <DOMAIN>-010 — <lyhyt nimi>
+- Kysymys (liiketoimintakieli):
+- Odotettu lopputulos:
+- Mitä ei saa tapahtua (safe stop / refusal):
+- Liittyvä rooli / oikeusraja:
+
+### <DOMAIN>-020 — …
+…
+
+## 5. Mitattava hyöty
+- Säästetyt tunnit / kierros / virheet — FACT vs oletus
+- Miten mitataan PoCissa
+
+## 6. Mitä ei tehdä tässä PoCissa
+- …
+
+## 7. Päätös (Day 10 -kehys)
+- Proceed / Refine / Stop — kriteerit
+```
+
+## English scenario map (for agents; keep out of customer slide deck)
+
+For each Finnish scenario, maintain in `learning.md` scenario map:
+
+| Field | English |
+| --- | --- |
+| scenarioId | e.g. FIN-010 |
+| intent | One sentence business intent |
+| happyExpected | What success looks like |
+| safeStopExpected | Refusal / authority / insufficient info |
+| capabilitiesInScope | Approved capability keys if known |
+| evidenceCandidate | Path under `evidence/candidates/` or — |
+| testHappy | YAML path |
+| testSafeStop | YAML path |

package/templates/agent-kit/skills/aifabrix-prove/references/evidence-lifecycle.md

@@ -0,0 +1,68 @@
+# Evidence lifecycle (PoC)
+
+## Flow
+
+```text
+Demo / workshop / prove observations
+  → learning.md   (FACT | ASSUMPTION)
+  → evidence/candidates/   (drafts — not consumed)
+  → validate + certify path
+  → governed Evidence (consumable by Role Assistant)
+```
+
+## Directories
+
+| Path | Role |
+| --- | --- |
+| `learning/learning.md` | Delivery log only |
+| `evidence/candidates/` | Candidate drafts (English). **Do not** treat as production-like Evidence |
+| `evidence/` (package root, non-candidates) | Only rows ready for the Evidence certification / consume path |
+| `knowledge/` | Reusable **business understanding** from governed content — not operational decision rules |
+
+If Builder upload processes every file under `evidence/`, keep candidates **out of** the upload consume set:
+
+- Prefer `evidence/candidates/` and document in learning.md that upload must exclude candidates until certified, **or**
+- Keep drafts only under `.temp/cust-biz-2-build/<roleKey>/evidence-candidates/` until promotion.
+
+Default convention for this skill: **`evidence/candidates/`** + explicit prove/build note: do not promote; do not claim Runtime consumption.
+
+## Candidate draft shape (English)
+
+One purpose per file or per row. Trace to scenario ID in `key` / filename / title.
+
+Example filename: `FIN-010-cost-centre-authority.json` (array or single object matching platform Evidence row schema when known).
+
+Minimum fields to author:
+
+- `key` — includes scenario id slug
+- `title` / `description`
+- `when` — business condition
+- `expectedBehavior` — ground in Reality; respect authority; refuse raw dump / cross-partition; safe-stop when insufficient
+- Mark in learning.md: `ASSUMPTION` vs `FACT`-backed
+
+## Promotion gate
+
+Promote candidate → governed Evidence only when:
+
+1. Business intent confirmed (FACT in learning.md)
+2. Happy + safe-stop tests observed for the scenario
+3. Contract validation + certification path for Evidence completed (public Evidence Fabrix / operate-first RA docs)
+4. learning.md records promotion date + commit
+
+## Tests
+
+For each in-scope scenario ID:
+
+| Case | Purpose |
+| --- | --- |
+| `*-happy.yaml` | Agreed business outcome under authority |
+| `*-safestop.yaml` | Refusal / missing authority / insufficient information |
+
+Prefer `role-assistant/ra-<roleKey>/tests/<suiteId>/` in this customer repo (package SSOT).
+
+## Forbidden
+
+- Calling workshop acceptance alone “governed Evidence”
+- Hiding process law in Knowledge
+- Uploading candidates as if certified
+- Skipping safe-stop coverage for authority scenarios

package/templates/agent-kit/skills/aifabrix-prove/references/learning-template.md

@@ -0,0 +1,66 @@
+# learning.md template
+
+**Path:** `role-assistant/ra-<roleKey>/learning/learning.md`
+
+Delivery learning artifact only. Not Runtime Knowledge. Not governed Evidence.
+
+## Skeleton
+
+```md
+# PoC learning log
+
+## Current PoC hypothesis
+- Process:
+- Role (responsibility / capabilities / safe boundaries):
+- Expected decision / value:
+- Connected System:
+- Audience:
+
+## Confirmed facts
+| Fact | Source | Date | Owner | Confidence |
+| --- | --- | --- | --- | --- |
+| … | … | … | … | high/med |
+
+## Assumptions
+| Assumption | Why needed | Risk if wrong | Scenario IDs |
+| --- | --- | --- | --- |
+| … | … | … | FIN-010 |
+
+## Open questions and safe stops
+- Missing authority / data / baseline / policy / capability:
+- Scenario IDs affected:
+
+## Scenario map
+| ID | Demo ask (short) | demo.md | Knowledge | Evidence candidate | Tests |
+| --- | --- | --- | --- | --- | --- |
+| FIN-010 | … | y/n | path or — | candidates/… | happy + safestop |
+
+## Observations from proof runs
+| Date | Scenario | Commit | Env | Outcome | Gap class | Notes |
+| --- | --- | --- | --- | --- | --- | --- |
+| … | FIN-010 | abc123 | dev | pass/fail/safestop | none \| product-gap \| missing-customer-fact \| scope-decision | … |
+
+## Changes made
+- YYYY-MM-DD — command — what changed and why
+
+## Decision for next iteration
+- Build | Prove | Obtain customer decision | Stop
+- Rationale:
+```
+
+## Mandatory updates by command
+
+| Command | Sections to update |
+| --- | --- |
+| `/cust-biz-1-validate` | Hypothesis, facts, assumptions, open questions, baseline / prove-ready decision |
+| `/cust-biz-2-build` | Changes made; scenario map (demo / Knowledge / candidates / tests) |
+| `/cust-biz-3-prove` | Observations table; gap class; decision for next iteration |
+
+## Gap class (prove)
+
+| Value | Meaning |
+| --- | --- |
+| `none` | Result matches intent |
+| `product-gap` | Platform / capability / Evidence contract issue |
+| `missing-customer-fact` | Need customer answer (baseline, policy, owner) |
+| `scope-decision` | In/out of PoC scope — not a defect |

package/templates/agent-kit/skills/aifabrix-role-assistant/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: aifabrix-role-assistant
+description: >
+  Download, author, validate, test, or upload a Role Assistant package under
+  role-assistant/ra-*. Use for catalog digital workers. Do not use to invent
+  Connected System operations or to edit platform product source.
+---
+
+# aifabrix-role-assistant
+
+See [package-boundary.md](references/package-boundary.md) and nested `role-assistant/AGENTS.md`.
+Host runtimes (local vs SSH): [hosts.md](../shared/hosts.md).
+CLI login from chat: [login.md](../shared/login.md).
+
+## Preconditions
+
+```bash
+aifabrix auth status
+aifabrix role list --page-size 1000
+```
+
+Catalog Business Role and an active user binding are prerequisites.
+Connected Systems this assistant needs must be dataplane **published** (deploy, not upload-only).
+
+## Workflow
+
+1. `aifabrix download <catalogRoleOrRaKey>` before editing an existing assistant.
+2. Author settings, Knowledge, Evidence, tests, and sidecars per current Builder contracts. Read `aifabrix role-assistant --help`.
+3. `aifabrix role-assistant test …` is allowed without local RA publish.
+4. Upload/deploy RA only when the user explicitly asks in this turn.
+5. Report results honestly.
+
+## Hard rules
+
+- Package key `ra-<catalogRole>` from the catalog — never `ra-<systemKey>-reader`.
+- Candidate Evidence cannot be reported as certified.
+- Missing subscribed CS capability → fail in CS ownership; no RA-local workaround.
+- No hidden authority, actor, or identity injection.
+- Do not convert RA folders with `aifabrix convert`.
+
+## Trigger examples
+
+- Create or update the Finance Controller Role Assistant

package/templates/agent-kit/skills/aifabrix-role-assistant/references/package-boundary.md

@@ -0,0 +1,21 @@
+# Role Assistant package boundary
+
+Public docs: https://docs.aifabrix.ai/docs/role-assistants
+
+```text
+integration/<systemKey>/         Connected System
+role-assistant/ra-<roleKey>/     Role Assistant
+```
+
+Download writes `role-assistant.yaml` and keeps sidecars. It does not write CS files (`application.*`, `*-system.*`, `*-datasource-*`, `env.template`). Delete those leftovers if they reappear.
+
+If download also writes `integration/ra-*`, move sidecars into `role-assistant/ra-*`.
+
+Generated RA FKs target **CS** datasource keys. Missing RA FK → fix the CS, re-download.
+
+Hand-edit leftover CS manifests under `role-assistant/` is forbidden.
+
+Do not invent an API key for `authType: system`.
+Do not treat passivated invent packages (`ra-<vendor>-*`) as catalog workers.
+
+Operator **Make available** is separate from CS publish.

package/templates/agent-kit/skills/shared/hosts.md

@@ -0,0 +1,65 @@
+# Coding hosts — local vs SSH
+
+Use this workspace from **Cursor**, **Claude Code**, and **Codex**. Skills live in `.agents/skills/`. Invoke `/aifabrix-*` in Cursor and Claude Code, and `$aifabrix-*` in Codex.
+
+Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each host on a local machine or over SSH. Builder CLI login from chat: [login.md](login.md).
+
+Do not start Claude or Codex in your home directory. `cd` into this git workspace first.
+
+## Auto-approve (optional)
+
+`aifabrix agent-kit install` can write gitignored host configs so Claude Code and Codex do not prompt for every tool:
+
+- Claude Code: `.claude/settings.local.json` (`permissions.defaultMode` = `bypassPermissions`, `allow` = `Bash(aifabrix *)` and `Read(~/**)`)
+- Codex: `.codex/config.toml` (`approval_policy = "never"`, `sandbox_mode = "workspace-write"`)
+
+Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. TTY asks which host to auto-approve when both are selected. `--approve-all claude` or `--approve-all codex` writes only that host. `--yes` or a non-TTY / `--json` run writes them. `--skip-approve-all` skips. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
+
+## Cursor
+
+**Local.** Open this folder in Cursor. Skills appear as `/aifabrix-plan` and the other `/aifabrix-*` commands.
+
+**SSH.** Use Cursor Remote SSH to the machine that holds the repo. The session is the Cursor window — no tmux required. Same `/aifabrix-*` skills.
+
+## Claude Code
+
+**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
+
+```bash
+aifabrix agent-kit start claude --remote-control --approve-all --yes
+```
+
+tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`, or run `start` again from the same folder. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
+
+**Phone and PC.** Sign in with the same Claude Pro/Max/Team account (`claude auth login` — not an API key). After Remote Control starts, open **Code** in the Claude mobile app and/or [claude.ai/code](https://claude.ai/code) on the PC. In an already-running session, `/remote-control` or `/mobile`.
+
+Closing the terminal (or SSH) does not stop a tmux session. Stopping tmux or the machine does. Remote Control also stops if this host goes down.
+
+## Codex
+
+**Local or SSH — tmux (recommended).** Same recipe on your PC and on a remote host. tmux keeps Codex running if you close the terminal or disconnect SSH. Codex has no Claude-style phone/web Remote Control.
+
+```bash
+aifabrix agent-kit start codex --approve-all --yes
+```
+
+Equivalent: `tmux new -s aifabrix-docs -c /path/to/this-workspace` then `codex`. Default `--name` is the last folder. If that session already exists, `start` attaches. Detach: `Ctrl-b` then `d`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`.
+
+**Foreground only (no tmux).**
+
+```bash
+cd /path/to/this-workspace
+codex
+```
+
+## tmux cheat sheet
+
+| Action | Keys / command |
+| --- | --- |
+| New named session | `tmux new -s <name> -c /path/to/this-workspace` |
+| Detach (leave it running) | `Ctrl-b`, then `d` |
+| List sessions | `tmux ls` |
+| Attach | `tmux attach -t <name>` |
+| Kill session | `tmux kill-session -t <name>` |
+
+Use a different `--name` per workspace so several Claude or Codex sessions can run on the same host. Claude and Codex in the **same** folder also need two names.

package/templates/agent-kit/skills/shared/login.md

@@ -0,0 +1,16 @@
+# Delivery CLI login (no terminal)
+
+Before any online Builder command (`deploy`, `upload`, `role list`, `show --online`):
+
+1. Run `aifabrix auth status`. If authenticated, continue.
+2. If not, ask the user in chat for the Miso Controller URL. Do not invent it. Paste whatever they give you; extra path segments are ignored.
+3. Run (environment **dev** unless they named another):
+
+```bash
+aifabrix login --method device -c <url> -e dev
+```
+
+4. As soon as the command prints **Open this URL to authenticate:**, copy that full URL into chat and ask the user to open it and approve. Do not ask them to use a terminal.
+5. Leave the login command running until it reports success (or fails). Then run `aifabrix auth status` again.
+
+On 401 later, repeat this flow once, then retry the original command.

package/templates/agent-kit/workspace/.cursor/plans/README.md

@@ -0,0 +1,22 @@
+# Plans (customer workspace)
+
+Delivery plans for Connected Systems in this workspace.  
+**Operational limits for a system live in `integration/<systemKey>/README.md`**, not in Agent Kit skills.
+
+## Active
+
+| Plan | Focus |
+| --- | --- |
+| — | No active delivery plan yet |
+
+## Done
+
+| Plan | Focus | Archived |
+| --- | --- | --- |
+| — | — | — |
+
+## Naming
+
+- `{N}.{m}-{slug}.plan.md` under `.cursor/plans/`
+- Archive completed plans under `done/` when finished
+- New delivery work from a business specification starts with **`aifabrix-plan`**

package/templates/agent-kit/workspace/LICENSE.mit

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) {{year}} {{copyrightHolder}}
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.