@aifabrix/builder 2.54.1 → 2.55.2

package/templates/agent-kit/workspace/README.md

@@ -0,0 +1,89 @@
+# {{workspaceName}}
+
+AI Fabrix **customer delivery workspace** for Connected Systems and Role Assistants.
+
+This repository holds **customer packages and data** only. Do not edit platform product source from this workspace.
+
+Vendor limits, credentials, designated test subjects, and PII live only in each system’s `integration/<systemKey>/README.md`.
+
+## How to start
+
+1. Open **this folder** in Cursor, Claude Code, or Codex. Host install and sign-in: **[AGENTKIT.md](./AGENTKIT.md)**.
+2. The agent checks `aifabrix auth status`. If you are not signed in, it asks for the Miso Controller URL and gives you a browser link. You do not need a terminal. Details: **[AGENTKIT.md](./AGENTKIT.md)**.
+3. In chat, either **invoke a skill** or **paste a prompt** from the tables below. Work in order. Wait for the gate (`PLAN_READY`, `READY`, `BUILT`, then `PASS` or `PASS_WITH_SKIPS`) before the next step.
+
+### How to use prompts
+
+| Host | Invoke a skill | Or type a prompt |
+| --- | --- | --- |
+| Cursor | `/aifabrix-plan` (and the other `/aifabrix-*` names) | Paste the sentence from **What to ask** |
+| Claude Code | same `/aifabrix-*` names | same sentences |
+| Codex | `$aifabrix-plan` (and the other `$aifabrix-*` names) | same sentences |
+
+You can combine them: invoke the skill, then add the system key or paste a spec. Attach or `@` the specification file when you have one. Replace `<systemKey>` and `<catalogRole>` with real keys. Do not invent `ra-` / `ek-` system keys or `*-reader` roles.
+
+### Connected System (integration)
+
+| Step | Skill | What to ask (prompt) |
+| --- | --- | --- |
+| Plan | `/aifabrix-plan` | Turn this specification into a delivery plan for `<systemKey>` |
+| Validate and build | `/aifabrix-connected-system` | Validate and build the `<systemKey>` integration |
+| Test and publish | `/aifabrix-connected-system` | Publish and certify this Connected System |
+
+Example — plan:
+
+```text
+/aifabrix-plan
+Turn this specification into a delivery plan for <systemKey>
+```
+
+`aifabrix upload` is a **draft**. Publish is **`aifabrix deploy`**. Secrets stay in `kv://` — never paste values into chat or git.
+
+### Role Assistant
+
+Do this after the Connected Systems the role needs are **published** (deploy, not upload-only).
+
+| Step | Skill | What to ask (prompt) |
+| --- | --- | --- |
+| Author, test, or upload | `/aifabrix-role-assistant` | Create or update the `<catalogRole>` Role Assistant |
+| Prove the business case | `/aifabrix-prove` | Prove this business case and update learning |
+
+Example — Role Assistant:
+
+```text
+/aifabrix-role-assistant
+Create or update the <catalogRole> Role Assistant
+```
+
+Use a **catalog** role key (`finance-controller`, `cfo`, …). Package folder: `role-assistant/ra-<catalogRole>/`.
+
+## Layout
+
+```text
+integration/<systemKey>/       Connected System packages (Builder output)
+integration/<systemKey>/data/  Fixtures / source exports
+role-assistant/ra-<roleKey>/   Role Assistant packages
+.agents/skills/                Agent Kit skills (Cursor, Codex, Claude)
+.cursor/plans/                 Delivery plans
+```
+
+As you add packages, list system keys and catalog roles in this README. Keep operational limits in each `integration/<systemKey>/README.md`.
+
+## Agent Kit
+
+Install, coding hosts, auto-approve, and CLI auth: **[AGENTKIT.md](./AGENTKIT.md)**.
+
+```bash
+aifabrix agent-kit status
+aifabrix agent-kit validate
+aifabrix agent-kit update
+```
+
+`aifabrix agent-kit update` refreshes `AGENTKIT.md`. If this README is missing, install/update creates it. An existing README is never overwritten.
+
+## Docs
+
+- [Agent Kit](./AGENTKIT.md) — hosts, install, auto-approve, CLI auth
+- [Build AI-ready systems](https://docs.aifabrix.ai/docs/build-ai-ready-systems)
+- [CLI workflow](https://docs.aifabrix.ai/docs/build-ai-ready-systems-validate-test-cli-workflow)
+- [llms.txt](https://docs.aifabrix.ai/llms.txt)

package/templates/applications/builder-api/Dockerfile

@@ -13,7 +13,7 @@ ENV NODE_ENV=production \
 WORKDIR /app
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends dumb-init ca-certificates \
+    && apt-get install -y --no-install-recommends dumb-init ca-certificates curl \
     && rm -rf /var/lib/apt/lists/*
 
 COPY package.json package-lock.json ./
@@ -23,6 +23,8 @@ COPY docker-builder-api-staging/lib ./lib
 COPY docker-builder-api-staging/bin/builder-api-spike.js ./bin/builder-api-spike.js
 COPY docker-builder-api-staging/bin/builder-api-cleanup.js ./bin/builder-api-cleanup.js
 COPY docker-builder-api-staging/templates ./templates
+# BID resource-type catalog + help fixtures (staged docs/builder-help only)
+COPY docker-builder-api-staging/docs ./docs
 
 RUN addgroup --system appgroup \
     && adduser --system --ingroup appgroup --home /app appuser \

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.47
+  version: 2.0.65
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -71,7 +71,7 @@ build:
   envOutputPath: ../../.env # Copy to repo root for local dev
   language: python # Runtime language for template selection (typescript or python)
   # Dev reload: polling + watch /app/app only (avoids EMFILE on full repo bind-mount). See run_local.py, make af-reload.
-  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app --timeout-graceful-shutdown 15
+  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app --reload-exclude tests --reload-exclude .temp --reload-exclude app-ui --timeout-graceful-shutdown 15
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
   # Early ASGI (boot.api) binds PORT before heavy app.main import — Azure App Service warmup.
   imageRun: exec python -m uvicorn boot.api:app --host 0.0.0.0 --port ${PORT:-3001}
@@ -240,4 +240,3 @@ configuration:
       field: text
       label: "Default LLM provider (system key when two or more providers)"
       placeholder: "openai"
-

package/templates/applications/dataplane/env.template

@@ -30,8 +30,8 @@ LOCAL_MODE=false
 # CELERY_WORKER_RUNTIME is set automatically by python -m app.core.celery_worker_main (NullPool per task).
 # CELERY_LOG_LEVEL=info
 
-# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
-# Same kv:// as miso-controller API_KEY so pipeline Bearer bypass uses one secrets.local entry
+# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation.
+# Same kv:// as miso-controller API_KEY; Azure may leave this optional key empty.
 API_KEY=kv://miso-controller-secrets-apiKeyVault
 # Comma-separated realm roles attached to API_KEY bypass (JWT realm_access.roles). Default: operator.
 # Dev manual tests (437 governance, enterprise-llm llm.call): use full-access locally; restrict in tst/pro.
@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.47
+VERSION=2.0.65
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5
@@ -258,7 +258,7 @@ DATAPLANE_PUBLIC_KEY_ID=
 CERTIFICATE_PRIVATE_KEY=kv://secrets-certificatePrivateKeyVault
 CERTIFICATE_PUBLIC_KEY=kv://secrets-certificatePublicKeyVault
 # Optional public key identifier for issued certificates; default if unset: dataplane-signing-key
-CERTIFICATE_PUBLIC_KEY_ID=dev01-dataplane-signing
+CERTIFICATE_PUBLIC_KEY_ID=dataplane-signing-key
 
 # =============================================================================
 # VALIDATION ENGINE — YAML CONTRACTS
@@ -333,4 +333,4 @@ TRUST_AI_EXPOSURE_GATE_ENABLED=false
 # app/schemas/json/external-datasource.schema.json metadata.version. Set CERTIFICATION_RULES_VERSION
 # when 346.rules / §17 revisions must invalidate existing certificates without matching rulesVersion.
 CERTIFICATION_DATASOURCE_SCHEMA_VERSION=
-CERTIFICATION_RULES_VERSION=
+CERTIFICATION_RULES_VERSION=

package/templates/applications/dataplane/rbac.yaml

@@ -163,6 +163,34 @@ permissions:
       ]
     description: "Read the global Resource Type catalog (list/get)"
   
+  # Aspect catalog (read-only)
+  - name: "aspect:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-deployment-admin",
+        "aifabrix-compliance-admin",
+        "aifabrix-developer",
+        "aifabrix-observer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Read the shared baseline Aspect catalog (list/get)"
+
+  # Knowledge Type catalog (read-only)
+  - name: "knowledge-type:read"
+    roles:
+      [
+        "aifabrix-platform-admin",
+        "aifabrix-security-admin",
+        "aifabrix-deployment-admin",
+        "aifabrix-compliance-admin",
+        "aifabrix-developer",
+        "aifabrix-observer",
+        "aifabrix-ai-trust-operator",
+      ]
+    description: "Read the Dataplane Knowledge Type catalog (list/get)"
+
   # Generic dataplane operations
   - name: "dataplane:read"
     roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]

package/templates/applications/keycloak/env.template

@@ -55,9 +55,9 @@ KC_HEALTH_ENABLED=true
 KC_HTTP_MANAGEMENT_HEALTH_ENABLED=false
 # Single-instance: use local cache so /health/ready passes (avoids Infinispan cluster check)
 KC_CACHE=local
-# Experimental OAuth Client ID Metadata Document (Keycloak 26.6+). Realm well-known
-# advertises client_id_metadata_document_supported. Rebuild the Keycloak image after change.
-KC_FEATURES=cimd
+# Runtime features. Include cimd so Keycloak 26.7.2 advertises Client ID Metadata
+# Documents. preview alone triggers a start-time rebuild that drops cimd.
+KC_FEATURES=preview,cimd
 
 # =============================================================================
 # DATABASE CONFIGURATION

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.43'
+  version: '2.0.66'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -72,10 +72,29 @@ repository:
 #
 # NOT included (auto-configured):
 # - DATABASE_URL, REDIS_URL, KEYCLOAK_* → auto-generated during Azure install
-# - MISO_*, AZURE_*, kv:// → credentials and system parameters
+# - Other MISO_*, AZURE_*, kv:// → credentials and system parameters
 # - PORT, NODE_ENV, MISO_ENVIRONMENT → set by deployment target
 
 configuration:
+  # -------------------------------------------------------------------------
+  # Security & browser session
+  # -------------------------------------------------------------------------
+  - name: MISO_APPLICATION_SECRETS_UI_ENABLED
+    category: Security
+    portalInput:
+      field: select
+      label: 'Enable Settings System Secrets tab'
+      options:
+        - 'false'
+        - 'true'
+
+  - name: AUTH_BROWSER_SESSION_TTL_SECONDS
+    category: Security
+    portalInput:
+      field: text
+      label: 'Browser Session Idle Timeout (seconds)'
+      placeholder: '1800'
+
   # -------------------------------------------------------------------------
   # Operations & Debugging
   # -------------------------------------------------------------------------

package/templates/applications/miso-controller/env.template

@@ -1,10 +1,24 @@
 # Environment Variables Template
 # Use kv:// references for secrets (resolved from secrets.local.yaml)
 # Use ${VAR} for environment-specific values
+#
+# =============================================================================
+# HOW THIS FILE IS ORGANIZED (plan 220.0)
+# =============================================================================
+# One env.template, three documentation blocks. Every variable below is tagged:
+#
+#   [always]        applies to both hosted onboarding modes and local dev
+#   [saasDirect]    eSystems-hosted SaaS activation (four-step wizard)
+#   [customerOwned] Azure-in-tenant activation (existing TA wizard)
+#
+# ONBOARDING_MODE selects the onboarding step list. It is orthogonal to DEPLOYMENT,
+# which selects Azure SDK vs local execution. There is NO fifth DEPLOYMENT value:
+# eSystems-hosted SaaS still runs DEPLOYMENT=azure. See the DEPLOYMENT TYPE and
+# ONBOARDING MODE sections below.
 
 
 # =============================================================================
-# FIRST-TIME ONBOARDING CONFIGURATION
+# FIRST-TIME ONBOARDING CONFIGURATION — [always]
 # =============================================================================
 #
 # Onboarding runs automatically when the database has no controller row (empty DB).
@@ -22,9 +36,10 @@
 SKIP_FIRST_TIME_SETUP=false
 
 # Force onboarding to run even when a controller row already exists (default: unset/false).
-# Use only when the DB already had a controller so onboarding was skipped and the admin
-# user was never created in the aifabrix realm. Set to true, restart controller once,
-# then set back to false so onboarding does not re-run on every start.
+# Prefer SQL/API one-shot: POST /api/v1/controller/force-onboarding (controller:admin) or set
+# controllers.configuration.setup.forceOnboarding=true — no App Service restart required.
+# Env FORCE_ONBOARDING still works as bootstrap-only when you must restart: set true, restart once,
+# then set back to false. This is NOT a Tenant Activation wizard reset (does not clear activation JSON).
 # FORCE_ONBOARDING=true
 
 # Optional custom controller key for onboarding (default: miso-controller)
@@ -44,17 +59,21 @@ ONBOARDING_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
 # Optional admin email for onboarding (default: admin@aifabrix.ai)
 ONBOARDING_ADMIN_EMAIL=kv://miso-controller-admin-emailKeyVault
 
-# Create development environment during onboarding (default: false)
+# [customerOwned] Create development environment during onboarding (default: false)
 # Full platform: create miso, dev, tst, and pro during onboarding (default: false)
 # When true, supersedes ONBOARDING_CREATE_DEV_ENV for which extra environments are created
+# [saasDirect] Keep false in the customer container — extra environments belong to the
+# eSystems deploy path, not the customer wizard.
 ONBOARDING_FULL_PLATFORM=false
 
-# When true, run Azure env deploy for onboarding envs (SDK modules). Default false —
+# [customerOwned] When true, run Azure env deploy for onboarding envs (SDK modules). Default false —
 # Marketplace already provisions infra; TA owns customer env deploy.
+# [saasDirect] Keep false: eSystems already deployed the required runtime services.
 ONBOARDING_CREATE_MISO_ENV=false
 
-# Set to true to create both miso and dev environments during onboarding
+# [customerOwned] Set to true to create both miso and dev environments during onboarding
 # When false (default), only the miso environment is created (ignored when ONBOARDING_FULL_PLATFORM=true)
+# [saasDirect] Keep false in the customer container.
 ONBOARDING_CREATE_DEV_ENV=true
 
 # =============================================================================
@@ -127,7 +146,9 @@ REDIS_PERMISSIONS_TTL=900
 KEYCLOAK_REALM=aifabrix
 # Public issuer / browser URL (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH=/auth).
 KEYCLOAK_SERVER_URL=url://keycloak-public
-# Internal token/JWKS calls: url://keycloak-internal (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH).
+# Internal token/JWKS calls use url://keycloak-internal.
+# In Traefik/front-door mode, virtual directory mapping supplies relative path semantics.
+# Do not append /auth again when frontDoorRouting is /auth/* — /auth/auth 404s.
 KEYCLOAK_INTERNAL_SERVER_URL=url://keycloak-internal
 # Docker/internal host and port: used when config from DB has localhost (getDockerKeycloakInternalUrl).
 # Resolved from env-config (e.g. KEYCLOAK_HOST=keycloak, KEYCLOAK_PORT=8080 for docker).
@@ -145,8 +166,19 @@ KEYCLOAK_DEFAULT_PASSWORD=kv://keycloak-default-passwordKeyVault
 # Password setup for new local users (plan 209.0)
 # email = send invitation email so the user sets their own password (default)
 # admin-reveal = show a one-time temporary password to the admin (labs / no mail)
+# [saasDirect] MUST be `email` — the customer activates its own administrator account from the
+#              Keycloak UPDATE_PASSWORD invitation; eSystems never distributes a password.
+# [customerOwned] `admin-reveal` is allowed only in labs.
 IDENTITY_LOCAL_PASSWORD_MODE=admin-reveal
 
+# =============================================================================
+# MANAGED NOTIFICATION EMAIL (Miso -> Mori REST)
+# =============================================================================
+# Both onboarding modes use Mori's AI Fabrix-owned sender. MORI_API_KEY below is the
+# existing installation service key; no notification-specific secret is created.
+NOTIFICATION_BINDING=aifabrixManaged
+MORI_ENVIRONMENT_ID=
+
 # Keycloak Events Configuration
 KEYCLOAK_EVENTS_ENABLED=true
 KEYCLOAK_EVENTS_VERIFY_SIGNATURE=true
@@ -188,8 +220,11 @@ MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 CONTROLLER_EVALUATION=
 
 # =============================================================================
-# ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent)
+# ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent) — [always]
 # =============================================================================
+# Kept in the shared block because EITHER mode may install Entra later from the plan 219
+# provider catalogue: Azure hosting does not force Entra, and SaaS may choose it.
+#
 # AI Fabrix vendor app for TA-1 admin consent and Entra ID configure flows.
 # Same ENTRA_ID_CLIENT_ID / ENTRA_ID_CLIENT_SECRET on every deployment.
 # Customer SSO after configure uses a separate enterprise app (AI Fabrix Miso);
@@ -202,13 +237,16 @@ CONTROLLER_EVALUATION=
 #
 # Delegated Graph (second redirect URI on the same vendor app): see section below.
 ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-id-concent/callback
+ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-miso-mori.azurewebsites.net/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
 # =============================================================================
-# TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG
+# TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG — [customerOwned]
 # =============================================================================
+# [saasDirect] Omit this block entirely: the SaaS wizard has no Access Model step and
+# creates no LLM resources.
+#
 # Optional JSON array for GET /api/v1/tenant/existing-llm-configurations (and
 # access-model.existingLlmConfigurations). Merge order: env entries first, then
 # entries derived from saved activation LLM (same id in saved overrides).
@@ -220,23 +258,32 @@ ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 # EXISTING_LLM_CONFIGURATIONS=
 
 # =============================================================================
-# AZURE AD PROVIDER CONFIGURATION
+# AZURE AD PROVIDER CONFIGURATION — [always]
 # =============================================================================
+# [customerOwned] These are the customer subscription credentials collected by the TA wizard.
+# [saasDirect] Present on the eSystems HOST controller so eSystems can deploy the hosted
+#              environment. They are never collected from, or shown to, the SaaS customer.
 
 AZURE_SUBSCRIPTION_ID=kv://azure-subscription-idKeyVault
 TENANT_ID=kv://azure-tenant-idKeyVault
 AZURE_SERVICE_NAME=kv://azure-service-nameKeyVault
-AZURE_CLIENT_ID=kv://azure-client-idKeyVault
-AZURE_CLIENT_SECRET=kv://azure-client-secretKeyVault
+# Azure App Service uses managed identity through DefaultAzureCredential.
+# Optional local service-principal overrides may be supplied in the runtime .env:
+# AZURE_CLIENT_ID=
+# AZURE_CLIENT_SECRET=
 
 # When true, environment infrastructure deploy skips the ai.azureOpenAI module (no new Cognitive Services account).
+# [customerOwned] default false — Azure OpenAI is created only when the customer selects it.
+# [saasDirect] leave unset or set true: the minimal SaaS baseline never creates Cognitive Services.
+#              When unset, ONBOARDING_MODE=saasDirect already defaults this to true.
 SKIP_AZURE_OPENAI=false
 
-# When true, environment deploy skips Postgres ARM/KV updates if the flexible server already exists (marketplace redeploy).
+# [customerOwned] When true, environment deploy skips Postgres ARM/KV updates if the flexible server
+# already exists (marketplace redeploy).
 SKIP_DB_REDEPLOY=true
 
 # =============================================================================
-# DEPLOYMENT TYPE
+# DEPLOYMENT TYPE — [always]
 # =============================================================================
 # azure       — Real Azure resources + tenant activation wizard until completed
 # azure-mock  — Mock Azure SDK; dashboard after login (no wizard)
@@ -245,14 +292,28 @@ SKIP_DB_REDEPLOY=true
 #
 # Missing or invalid value defaults to azure (wizard + Azure credentials).
 # Bootstrap (SKIP_FIRST_TIME_SETUP=false) is separate from the activation wizard.
+# NOTE: there is no `saas` value. eSystems-hosted SaaS runs DEPLOYMENT=azure with
+# ONBOARDING_MODE=saasDirect (see next section).
 DEPLOYMENT=database
 
-# Dev/test: open /tenant-activation on Platform Apps (last step). Default false.
-# Does not skip server-side TA — use only when env is already activated/deployed.
-TA_SKIP_TO_APP_DEPLOY=false
+# =============================================================================
+# ONBOARDING MODE — [always]
+# =============================================================================
+# Orthogonal to DEPLOYMENT (Azure SDK vs local). Selects the onboarding step list
+# served by GET /api/v1/tenant/status and rendered by the wizard stepper.
+#
+# customerOwned = Azure-in-tenant wizard
+#                 consent → identity → size → access-model → endpoint → validation
+# saasDirect    = eSystems-hosted activation
+#                 consent → identity → endpoint (domain only) → review
+#                 Omits size, access-model, customer deploy and platform-apps.
+#
+# Unset defaults to customerOwned. An unknown value fails closed with HTTP 400.
+ONBOARDING_MODE=customerOwned
 
 # Dev/test: show TA Entra "Completing setup" countdown (120s cap). Default false.
 # Exposed to UI via GET /api/v1/tenant/status → showTaCountdown (restart controller after change).
+# [saasDirect] Omit — there is no TA Entra countdown in the SaaS wizard.
 SHOW_TA_COUNT_DOWN=false
 
 # =============================================================================
@@ -270,15 +331,25 @@ BOOTSTRAP_APPKEYS=dataplane,builder-api
 # When false (default), uses local AES-256-GCM encryption with ENCRYPTION_KEY
 KEY_VAULT_ENABLED=false
 
+# Show Settings > System Secrets in the portal (runtime feature flag).
+MISO_APPLICATION_SECRETS_UI_ENABLED=false
+
+# Sliding browser-session idle timeout (30 minutes).
+AUTH_BROWSER_SESSION_TTL_SECONDS=1800
+
 # JWT Configuration (for client token generation)
 JWT_SECRET=kv://miso-controller-jwt-secretKeyVault
 
-# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
+# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation.
+# The key is optional: local environments may set it; Azure may leave it empty.
 API_KEY=kv://miso-controller-secrets-apiKeyVault
 
 # =============================================================================
-# LICENSE CONFIGURATION
+# LICENSE CONFIGURATION — [always]
 # =============================================================================
+# [saasDirect] Must use the Mori flow (never DEVELOPMENT): Mori issues and owns the
+# 30-day STANDARD / M trial, and sales later updates the same subscription.
+#
 # Offline JWT license (optional):
 # - If set, controller validates license offline (RS256) without Mori subscription status call.
 # - Value can be literal JWT or kv:// reference.
@@ -294,8 +365,8 @@ LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 # ENTRA ID ONBOARDING (delegated Graph via Mori)
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
-# …/entra-graph-delegated/callback. Shared pro Mori (CICD):
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
+# …/entra-graph-delegated/callback. Shared pro Mori addon (CICD *-miso-rg):
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-miso-mori.azurewebsites.net/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -310,7 +381,7 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsite
 # only works when a local Mori app is registered and running for this developer.
 # MORI_CALLBACK_API_KEY must be the same secret as Mori MORI_CONTROLLER_CALLBACK_API_KEY
 # (both resolve from kv://mori-callback-api-keyKeyVault — do not generate separate values).
-MORI_BASE_URL=https://aifabrix-pro-mori-web-we.azurewebsites.net
+MORI_BASE_URL=https://aifabrix-pro-miso-mori.azurewebsites.net
 MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault
 MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
@@ -325,7 +396,7 @@ MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault
 
 LOG_TO_FILE=true
 LOG_LEVEL=info
-LOG_FILE_PATH=./logs
+LOG_FILE_PATH=/mnt/data/logs
 
 # =============================================================================
 # OPENTELEMETRY CONFIGURATION

package/templates/applications/miso-controller/rbac.yaml

@@ -34,6 +34,11 @@ roles:
     description: 'Read-only access to monitoring, logs, and compliance reports'
     groups: ['AI-Fabrix-Observers']
 
+  - name: 'AI Fabrix Everyone'
+    value: 'aifabrix-everyone'
+    description: 'Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)'
+    groups: ['AI-Fabrix-Everyone']
+
 permissions:
   # Integration clients (Keycloak OIDC clients + control-plane metadata)
   - name: 'integration-client:create'

package/templates/channels/claude/TROUBLESHOOTING.md

@@ -8,6 +8,7 @@ When Claude is activated, AI Fabrix must be self-describing enough that Claude o
 
 - Name
 - Server URL (Runtime MCP)
+- Authentication: OAuth (the Runtime MCP requires sign-in; Claude’s form defaults to none)
 
 Claude then discovers protected-resource metadata, the authorization server, scopes, PKCE `S256`, and client registration. Pre-created `miso-claude` copy-paste is the fallback when discovery does not advertise registration.
 
@@ -24,6 +25,8 @@ Public Anthropic connector auth: https://claude.com/docs/connectors/building/aut
 
 Claude.ai web, Claude Desktop, Cowork, and mobile use the same account-level custom connector. Remote MCP is brokered by Anthropic, not by a local `claude_desktop_config.json`.
 
+The Runtime MCP returns **401** without a user token. In Claude connector settings, Authentication must be **OAuth** (require sign-in). If the connector is saved as “not requiring sign-in”, Claude reports that mismatch (HTTP 401) and an `ofid_…` support reference. Edit the connector, set OAuth, then Connect.
+
 ## Claude-owned remaining steps
 
 Add the custom connector (Owners on Team or Enterprise), authenticate/consent, and enable it. There is no documented Anthropic API for those steps.

package/templates/channels/claude/channel.json

@@ -50,7 +50,7 @@
       "displayLabel": "Claude",
       "category": "employee-ai",
       "wizardOrder": 32,
-      "remainingManualStep": "Add the custom connector (Owners for Team or Enterprise), authenticate, and enable it.",
+      "remainingManualStep": "Add the custom connector (Owners for Team or Enterprise), set Authentication to OAuth, authenticate, and enable it.",
       "docsAnchor": "claude",
       "approvalRequired": true,
       "vendorAuthRequired": true

package/templates/channels/claude/install.template.md.hbs

@@ -17,5 +17,6 @@ When ready:
 2. Add a custom connector with:
    Name: {{appName}}
    Server URL: {{{mcpUrl}}}
+   Authentication: OAuth
 
 AI Fabrix validates Runtime and OAuth automatically.

package/templates/channels/claude/integration/claude-system.json

@@ -50,7 +50,7 @@
       "displayLabel": "Claude",
       "category": "employee-ai",
       "wizardOrder": 32,
-      "remainingManualStep": "Add the custom connector (Owners for Team or Enterprise), authenticate, and enable it.",
+      "remainingManualStep": "Add the custom connector (Owners for Team or Enterprise), set Authentication to OAuth, authenticate, and enable it.",
       "docsAnchor": "claude",
       "approvalRequired": true,
       "vendorAuthRequired": true

package/templates/channels/slack/channel.json

@@ -147,6 +147,17 @@
         }
       }
     },
+    {
+      "name": "ENABLE_MCP_SERVER",
+      "value": "false",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "MCP server",
+        "options": ["true", "false"]
+      }
+    },
     {
       "name": "ENABLE_PROACTIVE_MESSAGING",
       "value": "true",

package/templates/channels/slack/install.template.md.hbs

@@ -25,6 +25,15 @@ Complete remaining Slack steps in this order:
 
 `aifabrix channel add` prints the filled URLs for your app. Do not paste client secrets into this file.
 
+{{#if enableMcpServer}}
+## MCP server
+
+This Slack app is also an MCP client of AI Fabrix Runtime. Connect the **AI Fabrix MCP server** in Slack, then sign in at **AI Fabrix** when Slack asks.
+
+The Slack bot token and signing secret stay inbound Events and slash-command auth. They are not the MCP bearer. Do not paste an Integration Client secret into this file.
+
+{{/if}}
+
 The command may ask **Onboard users?** Yes matches Slack profile email to an existing platform user email and stores the mapping. Unmatched people still use **Link account**. Non-interactive: `--onboard-users` or `--no-onboard-users`. `--force` does not re-onboard unless you pass `--onboard-users` or answer yes again.
 
 Optional validation:

package/templates/channels/slack/integration/slack-system.json

@@ -147,6 +147,17 @@
         }
       }
     },
+    {
+      "name": "ENABLE_MCP_SERVER",
+      "value": "false",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "select",
+        "label": "MCP server",
+        "options": ["true", "false"]
+      }
+    },
     {
       "name": "ENABLE_PROACTIVE_MESSAGING",
       "value": "true",

package/templates/channels/slack/manifest.template.json.hbs

@@ -54,7 +54,8 @@
         "im:read",
         "im:write",
         "users:read",
-        "users:read.email"
+        "users:read.email"{{#if enableMcpServer}},
+        "mcp:connect"{{/if}}
       ]
     },
     "pkce_enabled": false
@@ -74,6 +75,8 @@
     "org_deploy_enabled": true,
     "socket_mode_enabled": false,
     "token_rotation_enabled": {{slackTokenRotationEnabled}},
-    "is_mcp_enabled": false
-  }
+    "is_mcp_enabled": {{#if enableMcpServer}}true{{else}}false{{/if}}
+  }{{#if slackMcpServersJson}},
+  "mcp_servers": {{{slackMcpServersJson}}},
+  "external_auth_providers": {{{slackExternalAuthJson}}}{{/if}}
 }