@aifabrix/builder 2.55.0 → 2.55.2

package/lib/role-assistant/knowledge-sync-settings-push.js

@@ -0,0 +1,172 @@
+/**
+ * Push role-assistant.yaml knowledge/debug/runtime settings to Assistants.
+ *
+ * @fileoverview Map local Role Assistant settings onto dataplane Assistants PATCH
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { updateAssistantSettings } = require('../api/assistants.api');
+const {
+  readRoleAssistantSettings,
+  resolveDocumentStorageKeyFromRoleAssistantSettings,
+  resolveRoleAssistantEnvironmentSettings
+} = require('./settings');
+
+function resolveRoleAssistantSettingsEnvKey(environment) {
+  const token = String(environment || '').trim().toLowerCase();
+  return token === 'dev' || token === 'tst' || token === 'pro' ? token : 'dev';
+}
+
+/**
+ * Map role-assistant.yaml debug.* → Assistants settings PATCH fields.
+ * includePromptTrace → fullDebugEnabled (LLM prompt capture gate).
+ * enabled → debugEnabled (runtime debug traces).
+ * @param {Object|null|undefined} debugSection
+ * @returns {{ debugEnabled?: boolean, fullDebugEnabled?: boolean }}
+ */
+function mapRoleAssistantDebugToAssistantsSettings(debugSection) {
+  if (!debugSection || typeof debugSection !== 'object') {
+    return {};
+  }
+  const body = {};
+  if (typeof debugSection.enabled === 'boolean') {
+    body.debugEnabled = debugSection.enabled;
+  }
+  if (typeof debugSection.includePromptTrace === 'boolean') {
+    body.fullDebugEnabled = debugSection.includePromptTrace;
+  }
+  return body;
+}
+
+/**
+ * Map role-assistant.yaml runtime.* to the governed Assistants settings names.
+ * Provider selection remains platform-owned; the assistant may override only
+ * its workflow reasoning model and execution profile.
+ * @param {Object|null|undefined} runtimeSection
+ * @returns {{ workflowReasoningModel?: string, temperature?: number, maxLlmLoops?: number, maxToolLoops?: number }}
+ */
+function mapRoleAssistantRuntimeToAssistantsSettings(runtimeSection) {
+  if (!runtimeSection || typeof runtimeSection !== 'object') {
+    return {};
+  }
+  const body = {};
+  if (typeof runtimeSection.model === 'string' && runtimeSection.model.trim()) {
+    body.workflowReasoningModel = runtimeSection.model.trim();
+  }
+  if (typeof runtimeSection.temperature === 'number') {
+    body.temperature = runtimeSection.temperature;
+  }
+  if (Number.isInteger(runtimeSection.maxLoops)) {
+    body.maxLlmLoops = runtimeSection.maxLoops;
+    body.maxToolLoops = runtimeSection.maxLoops;
+  }
+  return body;
+}
+
+/**
+ * Push role-assistant.yaml knowledge + debug settings to dataplane Assistants.
+ * Called on upload/deploy so the operator UI and CLI stay aligned.
+ */
+function resolveAssistantSettingsPush(params) {
+  const {
+    systemKey,
+    environment = 'dev',
+    pathOptions = {}
+  } = params;
+  const settingsEnv = resolveRoleAssistantSettingsEnvKey(environment);
+  const settings = readRoleAssistantSettings(systemKey, { required: false, pathOptions });
+  if (!settings) {
+    return { result: { skipped: true, reason: 'missing-role-assistant-settings' } };
+  }
+  const section = resolveRoleAssistantEnvironmentSettings(settings, settingsEnv, {
+    required: false
+  });
+  if (!section) {
+    return { result: { skipped: true, reason: 'missing-env-settings' } };
+  }
+  const documentStorageKey =
+    resolveDocumentStorageKeyFromRoleAssistantSettings(settings, settingsEnv) || '';
+  const debugBody = mapRoleAssistantDebugToAssistantsSettings(section.debug);
+  const runtimeBody = mapRoleAssistantRuntimeToAssistantsSettings(section.runtime);
+  const settingsBody = { ...runtimeBody, ...debugBody };
+  if (!documentStorageKey && Object.keys(settingsBody).length === 0) {
+    return { result: { skipped: true, reason: 'no-document-storage-key', documentStorageKey: null } };
+  }
+  const patchBody = { ...settingsBody };
+  if (documentStorageKey) {
+    patchBody.documentStorageKey = documentStorageKey;
+  }
+  return { documentStorageKey, debugBody: settingsBody, patchBody };
+}
+
+async function applyAssistantSettingsPush(dataplaneUrl, systemKey, authConfig, settingsPush) {
+  const { documentStorageKey, debugBody, patchBody } = settingsPush;
+  const hasDocumentStorageKey = documentStorageKey !== '';
+  const hasDebugSettings = Object.keys(debugBody).length > 0;
+  const assistantKey = String(systemKey || '').trim();
+  let response = await updateAssistantSettings(
+    dataplaneUrl,
+    assistantKey,
+    authConfig,
+    patchBody
+  );
+  if (response && response.success === false && hasDocumentStorageKey && hasDebugSettings) {
+    response = await updateAssistantSettings(
+      dataplaneUrl,
+      assistantKey,
+      authConfig,
+      debugBody
+    );
+    if (response && response.success === false) {
+      throw new Error(
+        response.formattedError ||
+          response.error ||
+          'Failed to update Assistants debug settings'
+      );
+    }
+    return {
+      skipped: false,
+      documentStorageKey: null,
+      documentStoragePushFailed: true,
+      ...debugBody
+    };
+  }
+  if (response && response.success === false) {
+    throw new Error(
+      response.formattedError ||
+        response.error ||
+        'Failed to update Knowledge document storage settings'
+    );
+  }
+  return {
+    skipped: false,
+    documentStorageKey: documentStorageKey || null,
+    ...debugBody
+  };
+}
+
+async function pushRoleAssistantDocumentStorageSettings(params) {
+  const { systemKey, dataplaneUrl, authConfig, dryRun = false } = params;
+  const settingsPush = resolveAssistantSettingsPush(params);
+  if (settingsPush.result) {
+    return settingsPush.result;
+  }
+  const { documentStorageKey, debugBody } = settingsPush;
+  if (dryRun) {
+    return { skipped: false, dryRun: true, documentStorageKey: documentStorageKey || null, ...debugBody };
+  }
+  if (!dataplaneUrl || !authConfig) {
+    return { skipped: true, reason: 'missing-dataplane-auth' };
+  }
+  return applyAssistantSettingsPush(dataplaneUrl, systemKey, authConfig, settingsPush);
+}
+
+module.exports = {
+  resolveRoleAssistantSettingsEnvKey,
+  mapRoleAssistantDebugToAssistantsSettings,
+  mapRoleAssistantRuntimeToAssistantsSettings,
+  pushRoleAssistantDocumentStorageSettings
+};

package/lib/role-assistant/knowledge-sync.js

@@ -15,8 +15,7 @@ const yaml = require('js-yaml');
 const { listDocuments, validateDocuments, bulkDocuments } = require('../api/datasources-extended.api');
 const {
   extractDocumentStorageKeyFromAssistantDetails,
-  getAssistantDetails,
-  updateAssistantSettings
+  getAssistantDetails
 } = require('../api/assistants.api');
 const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
 const { bareRoleKey } = require('../utils/role-assistant-paths');
@@ -24,9 +23,14 @@ const {
   SYSTEM_KIND_DIGITAL_WORKER,
   getRoleAssistantYamlPath,
   readRoleAssistantSettings,
-  resolveDocumentStorageKeyFromRoleAssistantSettings,
-  resolveRoleAssistantEnvironmentSettings
+  resolveDocumentStorageKeyFromRoleAssistantSettings
 } = require('./settings');
+const {
+  resolveRoleAssistantSettingsEnvKey,
+  mapRoleAssistantDebugToAssistantsSettings,
+  mapRoleAssistantRuntimeToAssistantsSettings,
+  pushRoleAssistantDocumentStorageSettings
+} = require('./knowledge-sync-settings-push');
 const {
   knowledgeSearchMetadataFromFrontmatter,
   splitMarkdownFrontmatter
@@ -87,123 +91,6 @@ async function resolveDocumentStorageKeyFromDataplane(dataplaneUrl, authConfig,
   }
 }
 
-/**
- * Map role-assistant.yaml debug.* → Assistants settings PATCH fields.
- * includePromptTrace → fullDebugEnabled (LLM prompt capture gate).
- * enabled → debugEnabled (runtime debug traces).
- * @param {Object|null|undefined} debugSection
- * @returns {{ debugEnabled?: boolean, fullDebugEnabled?: boolean }}
- */
-function mapRoleAssistantDebugToAssistantsSettings(debugSection) {
-  if (!debugSection || typeof debugSection !== 'object') {
-    return {};
-  }
-  const body = {};
-  if (typeof debugSection.enabled === 'boolean') {
-    body.debugEnabled = debugSection.enabled;
-  }
-  if (typeof debugSection.includePromptTrace === 'boolean') {
-    body.fullDebugEnabled = debugSection.includePromptTrace;
-  }
-  return body;
-}
-
-/**
- * Push role-assistant.yaml knowledge + debug settings to dataplane Assistants.
- * Called on upload/deploy so the operator UI and CLI stay aligned.
- */
-function resolveAssistantSettingsPush(params) {
-  const {
-    systemKey,
-    environment = 'dev',
-    pathOptions = {}
-  } = params;
-  const settingsEnv = resolveRoleAssistantSettingsEnvKey(environment);
-  const settings = readRoleAssistantSettings(systemKey, { required: false, pathOptions });
-  if (!settings) {
-    return { result: { skipped: true, reason: 'missing-role-assistant-settings' } };
-  }
-  const section = resolveRoleAssistantEnvironmentSettings(settings, settingsEnv, {
-    required: false
-  });
-  if (!section) {
-    return { result: { skipped: true, reason: 'missing-env-settings' } };
-  }
-  const documentStorageKey =
-    resolveDocumentStorageKeyFromRoleAssistantSettings(settings, settingsEnv) || '';
-  const debugBody = mapRoleAssistantDebugToAssistantsSettings(section.debug);
-  if (!documentStorageKey && Object.keys(debugBody).length === 0) {
-    return { result: { skipped: true, reason: 'no-document-storage-key', documentStorageKey: null } };
-  }
-  const patchBody = { ...debugBody };
-  if (documentStorageKey) {
-    patchBody.documentStorageKey = documentStorageKey;
-  }
-  return { documentStorageKey, debugBody, patchBody };
-}
-
-async function applyAssistantSettingsPush(dataplaneUrl, systemKey, authConfig, settingsPush) {
-  const { documentStorageKey, debugBody, patchBody } = settingsPush;
-  const hasDocumentStorageKey = documentStorageKey !== '';
-  const hasDebugSettings = Object.keys(debugBody).length > 0;
-  const assistantKey = String(systemKey || '').trim();
-  let response = await updateAssistantSettings(
-    dataplaneUrl,
-    assistantKey,
-    authConfig,
-    patchBody
-  );
-  if (response && response.success === false && hasDocumentStorageKey && hasDebugSettings) {
-    response = await updateAssistantSettings(
-      dataplaneUrl,
-      assistantKey,
-      authConfig,
-      debugBody
-    );
-    if (response && response.success === false) {
-      throw new Error(
-        response.formattedError ||
-          response.error ||
-          'Failed to update Assistants debug settings'
-      );
-    }
-    return {
-      skipped: false,
-      documentStorageKey: null,
-      documentStoragePushFailed: true,
-      ...debugBody
-    };
-  }
-  if (response && response.success === false) {
-    throw new Error(
-      response.formattedError ||
-        response.error ||
-        'Failed to update Knowledge document storage settings'
-    );
-  }
-  return {
-    skipped: false,
-    documentStorageKey: documentStorageKey || null,
-    ...debugBody
-  };
-}
-
-async function pushRoleAssistantDocumentStorageSettings(params) {
-  const { systemKey, dataplaneUrl, authConfig, dryRun = false } = params;
-  const settingsPush = resolveAssistantSettingsPush(params);
-  if (settingsPush.result) {
-    return settingsPush.result;
-  }
-  const { documentStorageKey, debugBody } = settingsPush;
-  if (dryRun) {
-    return { skipped: false, dryRun: true, documentStorageKey: documentStorageKey || null, ...debugBody };
-  }
-  if (!dataplaneUrl || !authConfig) {
-    return { skipped: true, reason: 'missing-dataplane-auth' };
-  }
-  return applyAssistantSettingsPush(dataplaneUrl, systemKey, authConfig, settingsPush);
-}
-
 /**
  * Resolve Knowledge document storage key.
  * Order: role-assistant.yaml → dataplane Assistants settings → package dataSources.
@@ -341,11 +228,6 @@ function resolveDocumentFileName(row, index) {
   return filePath.startsWith('/') ? filePath.slice(1) : filePath;
 }
 
-function resolveRoleAssistantSettingsEnvKey(environment) {
-  const token = String(environment || '').trim().toLowerCase();
-  return token === 'dev' || token === 'tst' || token === 'pro' ? token : 'dev';
-}
-
 function writeRoleAssistantSettingsFile(systemKey, docStorageKey, environment = 'dev', pathOptions = {}) {
   const roleAssistantPath = resolveExternalSystemPath(systemKey, pathOptions);
   const roleAssistantYamlPath = getRoleAssistantYamlPath(systemKey, { pathOptions });
@@ -477,6 +359,7 @@ module.exports = {
   resolveRoleAssistantSettingsEnvKey,
   resolveRoleAssistantDocumentStorageKey,
   mapRoleAssistantDebugToAssistantsSettings,
+  mapRoleAssistantRuntimeToAssistantsSettings,
   pushRoleAssistantDocumentStorageSettings,
   importRoleAssistantKnowledge,
   exportRoleAssistantKnowledge,

package/lib/role-assistant/test-cases-evaluate.js

@@ -253,10 +253,21 @@ function collectCapabilityAssertions(capabilities, observedCapabilities, soft) {
   return rows.map((row) => softWrapFailedAssertion(row, soft));
 }
 
+function evaluateExecutionIntegrity(observation) {
+  if (!observation.workResultError) {
+    return null;
+  }
+  return {
+    id: 'execution.integrity',
+    passed: false,
+    message: `Execution did not produce a readable result: ${observation.workResultError}`
+  };
+}
+
 function collectCaseAssertions(expected, observation, preflight = {}) {
   const soft = expected.soft === true;
   const observedCapabilities = observation.capabilities?.observed || [];
-  const assertions = [];
+  const assertions = [evaluateExecutionIntegrity(observation)].filter(Boolean);
   const lifecycleAssertion = softWrapFailedAssertion(
     evaluateLifecycleStateExpectation(expected.lifecycleState, observation.lifecycleState),
     soft

package/lib/role-assistant/test-cases-evidence.js

@@ -55,6 +55,39 @@ function isActiveStatus(status, requiredStatus) {
   return status === requiredStatus;
 }
 
+/**
+ * Dataplane Evidence is append-new versioned, never mutated in place
+ * (dataplane 506.2): once a row's content changes, its literal `key` is
+ * archived permanently and a new `<key>__vN` row becomes the current
+ * identity. A case authored against the original literal key must still
+ * resolve against that current versioned successor, not report it missing.
+ * `rows` here are already scoped to the case's roleKey+resourceType+status
+ * by `loadLiveEvidenceRows`, so any row whose key is exactly `<desired>__vN`
+ * is unambiguously that key's current version.
+ */
+function findVersionedSuccessor(desiredKey, byKey) {
+  const prefix = `${desiredKey}__v`;
+  let best = null;
+  let bestVersion = -1;
+  for (const [key, row] of byKey) {
+    if (!key.startsWith(prefix)) {
+      continue;
+    }
+    const suffix = key.slice(prefix.length);
+    const version = Number(suffix);
+    if (!Number.isInteger(version) || version <= bestVersion) {
+      continue;
+    }
+    best = row;
+    bestVersion = version;
+  }
+  return best;
+}
+
+function resolveEvidenceRow(desiredKey, byKey) {
+  return byKey.get(desiredKey) || findVersionedSuccessor(desiredKey, byKey);
+}
+
 function findMissingEvidenceKeys(spec, rows) {
   const byKey = new Map();
   for (const row of rows) {
@@ -65,7 +98,7 @@ function findMissingEvidenceKeys(spec, rows) {
   }
   const missing = [];
   for (const key of spec.requiredKeys) {
-    const row = byKey.get(key);
+    const row = resolveEvidenceRow(key, byKey);
     if (!row) {
       missing.push(`${key} (not in dataplane)`);
       continue;
@@ -133,11 +166,15 @@ function evaluateEvidenceExpectations(evidenceSpec, observation) {
     return [];
   }
   const preflight = observation?.evidencePreflight || {};
-  const liveKeys = new Set(
-    (Array.isArray(preflight.rows) ? preflight.rows : []).map(rowKey).filter(Boolean)
-  );
+  const liveByKey = new Map();
+  for (const row of Array.isArray(preflight.rows) ? preflight.rows : []) {
+    const key = rowKey(row);
+    if (key) {
+      liveByKey.set(key, row);
+    }
+  }
   return requiredKeys.map((key) => {
-    const passed = liveKeys.has(key);
+    const passed = Boolean(resolveEvidenceRow(key, liveByKey));
     return {
       id: `expected.evidence.requiredKeys:${key}`,
       passed,
@@ -168,6 +205,8 @@ function evaluateForbiddenCapabilities(forbiddenList, observedCapabilities) {
 
 module.exports = {
   evidenceSpecFromCase,
+  findVersionedSuccessor,
+  resolveEvidenceRow,
   findMissingEvidenceKeys,
   assertRoleAssistantEvidencePreflight,
   evaluateEvidenceExpectations,

package/lib/role-assistant/test-cases-lifecycle.js

@@ -274,13 +274,19 @@ function resolveLifecycleStateFromResult(result) {
 }
 
 function deriveLifecycleState(result, lifecycleVerdict) {
-  if (lifecycleVerdict === VERDICT.VERIFIED) {
-    return 'completed';
-  }
+  // lifecycleVerdict is the Role Assistant's own operations/trust/governance
+  // certification status, not this case's execution outcome — a VERIFIED
+  // (published, trusted) Role Assistant can still run a case that fails,
+  // asks a question, or safe-stops. Always prefer a real structured signal
+  // from this execution's own result; the verdict is only a fallback default
+  // for when no signal exists at all (e.g. an empty/no-op result).
   const structuredState = resolveLifecycleStateFromResult(result);
   if (structuredState) {
     return structuredState;
   }
+  if (lifecycleVerdict === VERDICT.VERIFIED) {
+    return 'completed';
+  }
   if (lifecycleVerdict === VERDICT.NOT_VERIFIED) return 'safe-stop';
   return 'failed';
 }

package/lib/role-assistant/test-runner.js

@@ -484,6 +484,9 @@ function lifecycleVerdictFromCaseExecution(executionResult, fallbackVerdict) {
   if (statusToken === 'stopped' || statusToken === 'waiting' || statusToken === 'running') {
     return VERDICT.NOT_VERIFIED;
   }
+  if (statusToken === 'failed' || statusToken === 'cancelled' || statusToken === 'canceled') {
+    return VERDICT.FAILED;
+  }
   return fallbackVerdict || VERDICT.FAILED;
 }
 

package/lib/schema/infra-parameter.schema.json

@@ -37,7 +37,7 @@
     },
     "scopeEnum": {
       "type": "string",
-      "enum": ["infra", "app", "shared-service"]
+      "enum": ["infra", "app", "shared-service", "system"]
     },
     "generator": {
       "type": "object",
@@ -50,6 +50,7 @@
             "randomBytes32",
             "randomAlphanumeric",
             "password",
+            "rsaKeyPair",
             "emptyString",
             "emptyAllowed",
             "literal",
@@ -65,8 +66,20 @@
           "minimum": 1,
           "maximum": 512,
           "description": "For randomAlphanumeric: character count (default 32). For password: default 8. Charset [a-zA-Z0-9]."
+        },
+        "pairId": { "type": "string", "minLength": 1 },
+        "part": { "type": "string", "enum": ["private", "public"] }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "type": { "const": "literal" } } },
+          "then": { "required": ["value"] }
+        },
+        {
+          "if": { "properties": { "type": { "const": "rsaKeyPair" } } },
+          "then": { "required": ["pairId", "part"] }
         }
-      }
+      ]
     },
     "azureBlock": {
       "type": "object",
@@ -74,6 +87,11 @@
       "properties": {
         "vaultSecretName": { "type": "string" },
         "vaultSecretNamePattern": { "type": "string" },
+        "legacyVaultSecretNames": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "uniqueItems": true
+        },
         "notes": { "type": "string" }
       }
     },
@@ -90,6 +108,20 @@
           "type": "string",
           "minLength": 1
         },
+        "category": { "type": "string", "minLength": 1 },
+        "sensitive": { "type": "boolean" },
+        "valueSource": {
+          "type": "string",
+          "enum": [
+            "generated",
+            "onboardingInput",
+            "providerOutput",
+            "legacyMigration",
+            "optionalInput"
+          ]
+        },
+        "requiredOnSystemOnboarding": { "type": "boolean" },
+        "ownerAppKey": { "type": "string", "minLength": 1 },
         "scope": { "$ref": "#/definitions/scopeEnum" },
         "generator": { "$ref": "#/definitions/generator" },
         "ensureOn": {
@@ -100,7 +132,23 @@
         "requiredForLocal": { "type": "boolean" },
         "azure": { "$ref": "#/definitions/azureBlock" },
         "notes": { "type": "string" }
-      }
+      },
+      "allOf": [
+        {
+          "if": {
+            "required": ["scope"],
+            "properties": { "scope": { "const": "system" } }
+          },
+          "then": {
+            "required": [
+              "category",
+              "sensitive",
+              "valueSource",
+              "requiredOnSystemOnboarding"
+            ]
+          }
+        }
+      ]
     }
   }
 }