@aifabrix/builder 2.55.0 → 2.56.0

package/templates/agent-kit/skills/shared/hosts.md

@@ -2,7 +2,7 @@
 
 Use this workspace from **Cursor**, **Claude Code**, and **Codex**. Skills live in `.agents/skills/`. Invoke `/aifabrix-*` in Cursor and Claude Code, and `$aifabrix-*` in Codex.
 
-Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each host on a local machine or over SSH.
+Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each host on a local machine or over SSH. Builder CLI login from chat: [login.md](login.md).
 
 Do not start Claude or Codex in your home directory. `cd` into this git workspace first.
 
@@ -13,7 +13,7 @@ Do not start Claude or Codex in your home directory. `cd` into this git workspac
 - Claude Code: `.claude/settings.local.json` (`permissions.defaultMode` = `bypassPermissions`, `allow` = `Bash(aifabrix *)` and `Read(~/**)`)
 - Codex: `.codex/config.toml` (`approval_policy = "never"`, `sandbox_mode = "workspace-write"`)
 
-Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. TTY asks (default yes). `--yes` or a non-TTY / `--json` run writes them. `--skip-approve-all` skips. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
+Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. TTY asks which host to auto-approve when both are selected. `--approve-all claude` or `--approve-all codex` writes only that host. `--yes` or a non-TTY / `--json` run writes them. `--skip-approve-all` skips. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
 
 ## Cursor
 
@@ -23,48 +23,35 @@ Those files stay in **this workspace**. Claude may **read** files under the deve
 
 ## Claude Code
 
-**Local.**
+**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
 
 ```bash
-cd /path/to/this-workspace
-claude
-```
-
-Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
-
-**SSH (keep the session after you disconnect).** tmux holds the process on the remote machine:
-
-```bash
-tmux new -s claude -c /path/to/this-workspace
-claude --remote-control
+aifabrix agent-kit start claude --remote-control --approve-all --yes
 ```
 
-Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t claude`.
+tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`, or run `start` again from the same folder. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
 
-**Phone and web.** `--remote-control` (or `claude remote-control` in server mode) publishes the same session to [claude.ai/code](https://claude.ai/code) and the Claude mobile app (**Code**). Press space in server mode for a QR code. In an interactive session, `/remote-control` or `/mobile`. Requires a Claude Pro/Max/Team login (`claude auth login`), not an API key.
+**Phone and PC.** Sign in with the same Claude Pro/Max/Team account (`claude auth login` — not an API key). After Remote Control starts, open **Code** in the Claude mobile app and/or [claude.ai/code](https://claude.ai/code) on the PC. In an already-running session, `/remote-control` or `/mobile`.
 
-Closing SSH does not stop a tmux session. Stopping tmux or the machine does.
+Closing the terminal (or SSH) does not stop a tmux session. Stopping tmux or the machine does. Remote Control also stops if this host goes down.
 
 ## Codex
 
-**Local.**
+**Local or SSH — tmux (recommended).** Same recipe on your PC and on a remote host. tmux keeps Codex running if you close the terminal or disconnect SSH. Codex has no Claude-style phone/web Remote Control.
 
 ```bash
-cd /path/to/this-workspace
-codex
+aifabrix agent-kit start codex --approve-all --yes
 ```
 
-Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`.
+Equivalent: `tmux new -s aifabrix-docs -c /path/to/this-workspace` then `codex`. Default `--name` is the last folder. If that session already exists, `start` attaches. Detach: `Ctrl-b` then `d`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`.
 
-**SSH (keep the session after you disconnect).**
+**Foreground only (no tmux).**
 
 ```bash
-tmux new -s codex -c /path/to/this-workspace
+cd /path/to/this-workspace
 codex
 ```
 
-Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t codex`. Codex has no Claude-style phone/web Remote Control; stay in tmux (or reattach later) to see the session.
-
 ## tmux cheat sheet
 
 | Action | Keys / command |
@@ -75,4 +62,4 @@ Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t codex`. Codex has no Claude
 | Attach | `tmux attach -t <name>` |
 | Kill session | `tmux kill-session -t <name>` |
 
-Use separate session names (`claude` vs `codex`) if both run on the same host.
+Use a different `--name` per workspace so several Claude or Codex sessions can run on the same host. Claude and Codex in the **same** folder also need two names.

package/templates/agent-kit/skills/shared/login.md

@@ -0,0 +1,16 @@
+# Delivery CLI login (no terminal)
+
+Before any online Builder command (`deploy`, `upload`, `role list`, `show --online`):
+
+1. Run `aifabrix auth status`. If authenticated, continue.
+2. If not, ask the user in chat for the Miso Controller URL. Do not invent it. Paste whatever they give you; extra path segments are ignored.
+3. Run (environment **dev** unless they named another):
+
+```bash
+aifabrix login --method device -c <url> -e dev
+```
+
+4. As soon as the command prints **Open this URL to authenticate:**, copy that full URL into chat and ask the user to open it and approve. Do not ask them to use a terminal.
+5. Leave the login command running until it reports success (or fails). Then run `aifabrix auth status` again.
+
+On 401 later, repeat this flow once, then retry the original command.

package/templates/agent-kit/workspace/README.md

@@ -9,7 +9,7 @@ Vendor limits, credentials, designated test subjects, and PII live only in each
 ## How to start
 
 1. Open **this folder** in Cursor, Claude Code, or Codex. Host install and sign-in: **[AGENTKIT.md](./AGENTKIT.md)**.
-2. In a terminal here, run `aifabrix auth status`. If you are not authenticated, run `aifabrix login` (the agent cannot log in for you).
+2. The agent checks `aifabrix auth status`. If you are not signed in, it asks for the Miso Controller URL and gives you a browser link. You do not need a terminal. Details: **[AGENTKIT.md](./AGENTKIT.md)**.
 3. In chat, either **invoke a skill** or **paste a prompt** from the tables below. Work in order. Wait for the gate (`PLAN_READY`, `READY`, `BUILT`, then `PASS` or `PASS_WITH_SKIPS`) before the next step.
 
 ### How to use prompts

package/templates/applications/builder-api/env.template

@@ -37,6 +37,10 @@ DATAPLANE_URL=url://dataplane-internal
 # Public: Slack/Teams/ChatGPT callbacks, packages, and portal remaining-step URLs
 DATAPLANE_PUBLIC_URL=url://dataplane-public
 
+# Self URLs: internal service calls and public links generated by Builder API
+BUILDER_API_URL=url://internal
+BUILDER_API_PUBLIC_URL=url://public
+
 DEFAULT_ENVIRONMENT=dev
 
 # Browser Origin allowlist for portal calls (CORS). url:// expands at resolve.

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.56
+  version: 2.0.68
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -240,4 +240,3 @@ configuration:
       field: text
       label: "Default LLM provider (system key when two or more providers)"
       placeholder: "openai"
-

package/templates/applications/dataplane/env.template

@@ -30,8 +30,8 @@ LOCAL_MODE=false
 # CELERY_WORKER_RUNTIME is set automatically by python -m app.core.celery_worker_main (NullPool per task).
 # CELERY_LOG_LEVEL=info
 
-# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
-# Same kv:// as miso-controller API_KEY so pipeline Bearer bypass uses one secrets.local entry
+# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation.
+# Same kv:// as miso-controller API_KEY; Azure may leave this optional key empty.
 API_KEY=kv://miso-controller-secrets-apiKeyVault
 # Comma-separated realm roles attached to API_KEY bypass (JWT realm_access.roles). Default: operator.
 # Dev manual tests (437 governance, enterprise-llm llm.call): use full-access locally; restrict in tst/pro.
@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.56
+VERSION=2.0.68
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5
@@ -258,7 +258,7 @@ DATAPLANE_PUBLIC_KEY_ID=
 CERTIFICATE_PRIVATE_KEY=kv://secrets-certificatePrivateKeyVault
 CERTIFICATE_PUBLIC_KEY=kv://secrets-certificatePublicKeyVault
 # Optional public key identifier for issued certificates; default if unset: dataplane-signing-key
-CERTIFICATE_PUBLIC_KEY_ID=dev01-dataplane-signing
+CERTIFICATE_PUBLIC_KEY_ID=dataplane-signing-key
 
 # =============================================================================
 # VALIDATION ENGINE — YAML CONTRACTS
@@ -333,4 +333,4 @@ TRUST_AI_EXPOSURE_GATE_ENABLED=false
 # app/schemas/json/external-datasource.schema.json metadata.version. Set CERTIFICATION_RULES_VERSION
 # when 346.rules / §17 revisions must invalidate existing certificates without matching rulesVersion.
 CERTIFICATION_DATASOURCE_SCHEMA_VERSION=
-CERTIFICATION_RULES_VERSION=
+CERTIFICATION_RULES_VERSION=

package/templates/applications/keycloak/Dockerfile

@@ -1,29 +1,34 @@
 # Keycloak Identity and Access Management with Custom Themes
-# Official 26.7.2 distro + experimental CIMD. Does not compile Keycloak from source.
+# Official 26.7.3 distro + experimental CIMD. Does not compile Keycloak from source.
 # One class is recompiled against this image's jars:
 # - PR 51235: CIMD parse ignores unknown JSON fields (ChatGPT client.json)
 # - #50362: strip jwt-bearer (and other confidential-only grants) on public CIMD
 # 26.7 advertises token_endpoint_auth_methods_supported "none" for Claude CIMD.
 
-FROM quay.io/keycloak/keycloak:26.7.2 AS keycloak-base
+FROM quay.io/keycloak/keycloak:26.7.3 AS keycloak-base
 
 FROM eclipse-temurin:21-jdk-jammy AS cimd-patch
 COPY --from=keycloak-base /opt/keycloak/lib/lib/main /opt/kc-jars/main
 COPY --from=keycloak-base /opt/keycloak/lib/lib/boot /opt/kc-jars/boot
 COPY cimd-lenient-parse/AbstractClientIdMetadataDocumentExecutor.java \
      /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java
+COPY mori-email-sender/com /tmp/src/com
+COPY mori-email-sender/META-INF /tmp/mori-provider/META-INF
 RUN mkdir -p /tmp/classes \
  && find /opt/kc-jars -name '*.jar' | paste -sd: - > /tmp/cp.txt \
  && { \
       echo --release; echo 21; echo -cp; cat /tmp/cp.txt; echo -d; echo /tmp/classes; \
       echo /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java; \
+      find /tmp/src/com -name '*.java'; \
     } > /tmp/javac.args \
  && javac @/tmp/javac.args \
  && SERVICES_JAR=$(ls /opt/kc-jars/main/org.keycloak.keycloak-services-*.jar) \
  && cp "$SERVICES_JAR" /tmp/keycloak-services-patched.jar \
- && jar uf /tmp/keycloak-services-patched.jar -C /tmp/classes .
+ && jar uf /tmp/keycloak-services-patched.jar -C /tmp/classes org/keycloak \
+ && cp -r /tmp/classes/com /tmp/mori-provider/ \
+ && jar cf /tmp/mori-email-sender.jar -C /tmp/mori-provider .
 
-FROM quay.io/keycloak/keycloak:26.7.2
+FROM quay.io/keycloak/keycloak:26.7.3
 
 # Set working directory
 WORKDIR /opt/keycloak
@@ -31,6 +36,7 @@ WORKDIR /opt/keycloak
 # Copy custom themes from share directory (only if themes/ folder exists)
 USER root
 COPY --from=cimd-patch /tmp/keycloak-services-patched.jar /tmp/keycloak-services-patched.jar
+COPY --from=cimd-patch /tmp/mori-email-sender.jar /opt/keycloak/providers/mori-email-sender.jar
 RUN SERVICES_JAR=$(ls /opt/keycloak/lib/lib/main/org.keycloak.keycloak-services-*.jar) \
  && cp /tmp/keycloak-services-patched.jar "$SERVICES_JAR" \
  && rm /tmp/keycloak-services-patched.jar
@@ -50,7 +56,8 @@ RUN if [ -d "/tmp/build-context/themes" ] && [ "$(ls -A /tmp/build-context/theme
 # Build Keycloak with health checks enabled (similar to Keycloak 24.0)
 # This enables the /health, /health/live, /health/ready, and /health/started endpoints
 # Expose health endpoints on main HTTP port (like 24.0) instead of management port
-RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false --features=cimd
+RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false \
+    --features=cimd --spi-email-sender--provider=mori
 
 # Switch back to keycloak user
 USER keycloak

package/templates/applications/keycloak/application.yaml

@@ -4,12 +4,12 @@ app:
   displayName: 'AI Fabrix Keycloak'
   description: 'Identity and Access Management'
   type: webapp
-  version: '26.7.2'
+  version: '26.7.3-aifabrix.1'
 
 # Image Configuration
 image:
   name: aifabrix/keycloak
-  tag: 'latest'
+  tag: '26.7.3-aifabrix.1'
   registry: aifabrixacr.azurecr.io
   registryMode: external
 

package/templates/applications/keycloak/cimd-lenient-parse/AbstractClientIdMetadataDocumentExecutor.java

@@ -1,6 +1,6 @@
 package org.keycloak.protocol.oauth2.cimd.clientpolicy.executor;
 
-// AI Fabrix Keycloak image patch on 26.7.2 (not a Keycloak source build):
+// AI Fabrix Keycloak image patch on 26.7.3 (not a Keycloak source build):
 // 1) PR 51235 — ignore unknown CIMD JSON fields (ChatGPT client.json).
 // 2) keycloak#50362 / PR 50411 idea — drop confidential-only grants (jwt-bearer)
 //    from public CIMD metadata so Claude hosted Connect can register.
@@ -848,7 +848,7 @@ public abstract class AbstractClientIdMetadataDocumentExecutor<CONFIG extends Ab
 
     /**
      * Grant types Keycloak's DescriptionConverter refuses on a public client.
-     * Same set as Keycloak PR 50411 (not in 26.7.2).
+     * Same set as Keycloak PR 50411 (not in 26.7.3).
      */
     protected static final Set<String> CONFIDENTIAL_ONLY_GRANT_TYPES = new LinkedHashSet<>(Arrays.asList(
             OAuth2Constants.CLIENT_CREDENTIALS,
@@ -873,7 +873,7 @@ public abstract class AbstractClientIdMetadataDocumentExecutor<CONFIG extends Ab
 
     /**
      * RFC 7591 §3.2.1 lets the AS replace requested grant_types. Claude CIMD is public
-     * (`none`) plus jwt-bearer; Keycloak 26.7.2 rejects that combination (#50362).
+     * (`none`) plus jwt-bearer; Keycloak 26.7.3 rejects that combination (#50362).
      */
     protected void stripConfidentialOnlyGrantsForPublicClient(OIDCClientRepresentation oidcClient) {
         if (!"none".equals(oidcClient.getTokenEndpointAuthMethod())) {

package/templates/applications/keycloak/cimd-lenient-parse/SOURCE.md

@@ -1,19 +1,19 @@
-# CIMD image patch (Keycloak 26.7.2)
+# CIMD image patch (Keycloak 26.7.3)
 
-This directory is **not** a Keycloak source build. `aifabrix build keycloak` still starts from `quay.io/keycloak/keycloak:26.7.2`. A Docker stage recompiles this one class against that image’s jars and injects it into `org.keycloak.keycloak-services-*.jar` before `kc.sh build`.
+This directory is **not** a Keycloak source build. `aifabrix build keycloak` still starts from `quay.io/keycloak/keycloak:26.7.3`. A Docker stage recompiles this one class against that image’s jars and injects it into `org.keycloak.keycloak-services-*.jar` before `kc.sh build`.
 
-Upstream file: `services/.../AbstractClientIdMetadataDocumentExecutor.java` @ tag `26.7.2` (Apache 2.0).
+Upstream file: `services/.../AbstractClientIdMetadataDocumentExecutor.java` @ tag `26.7.3` (Apache 2.0).
 
 ## Lenient parse (ChatGPT)
 
 ChatGPT’s CIMD `client.json` includes extra fields (for example `token_endpoint_auth_methods_supported`) that Keycloak 26.7.x rejects because CIMD parse uses Jackson `FAIL_ON_UNKNOWN_PROPERTIES`.
 
-- [keycloak/keycloak#51235](https://github.com/keycloak/keycloak/pull/51235) (open; not in 26.7.2)
+- [keycloak/keycloak#51235](https://github.com/keycloak/keycloak/pull/51235) (open; not in 26.7.3)
 
 ## Public client + jwt-bearer (Claude hosted)
 
-Claude’s CIMD is a public client (`token_endpoint_auth_method: none`) that also lists `urn:ietf:params:oauth:grant-type:jwt-bearer`. Keycloak 26.7.2 then fails authorize with `JWT authorization grant cannot be enabled in a public client` ([#50362](https://github.com/keycloak/keycloak/issues/50362)). Official [PR 50411](https://github.com/keycloak/keycloak/pull/50411) is still a draft and defaults the filter **off**. This image always drops confidential-only grants on public CIMD metadata (RFC 7591 §3.2.1), which is enough for hosted Claude Connect (authorization_code). It does **not** implement public-client JWT Authorization Grant / EMA.
+Claude’s CIMD is a public client (`token_endpoint_auth_method: none`) that also lists `urn:ietf:params:oauth:grant-type:jwt-bearer`. Keycloak 26.7.3 then fails authorize with `JWT authorization grant cannot be enabled in a public client` ([#50362](https://github.com/keycloak/keycloak/issues/50362)). Official [PR 50411](https://github.com/keycloak/keycloak/pull/50411) is still a draft and defaults the filter **off**. This image always drops confidential-only grants on public CIMD metadata (RFC 7591 §3.2.1), which is enough for hosted Claude Connect (authorization_code). It does **not** implement public-client JWT Authorization Grant / EMA.
 
-26.7.2 already advertises `token_endpoint_auth_methods_supported` `"none"` when `--features=cimd`.
+26.7.3 already advertises `token_endpoint_auth_methods_supported` `"none"` when `--features=cimd`.
 
 Drop this patched class when the consumed `quay.io` tag includes both behaviors.

package/templates/applications/keycloak/env.template

@@ -55,7 +55,7 @@ KC_HEALTH_ENABLED=true
 KC_HTTP_MANAGEMENT_HEALTH_ENABLED=false
 # Single-instance: use local cache so /health/ready passes (avoids Infinispan cluster check)
 KC_CACHE=local
-# Runtime features. Include cimd so Keycloak 26.7.2 advertises Client ID Metadata
+# Runtime features. Include cimd so Keycloak 26.7.3 advertises Client ID Metadata
 # Documents. preview alone triggers a start-time rebuild that drops cimd.
 KC_FEATURES=preview,cimd
 
@@ -67,6 +67,18 @@ KC_FEATURES=preview,cimd
 MISO_CLIENTID=kv://keycloak-client-idKeyVault
 MISO_CLIENTSECRET=kv://keycloak-client-secretKeyVault
 
+# =============================================================================
+# MANAGED ACTION EMAIL (Keycloak -> Mori REST)
+# =============================================================================
+# The custom EmailSenderProvider relays Keycloak-rendered signed action emails to
+# Mori. It never receives ACS credentials and never sends the action URL to Miso.
+# Installation must supply the Mori environment returned during registration.
+MORI_BASE_URL=kv://mori-controller-web-server-url
+MORI_ENVIRONMENT_ID=kv://mori-controller-environment-idKeyVault
+MORI_API_KEY=kv://mori-controller-api-keyKeyVault
+MORI_NOTIFICATION_TIMEOUT_MS=10000
+MORI_NOTIFICATION_MAX_ATTEMPTS=2
+
 # Connects to postgres service in Docker network (postgres) or localhost (local)
 
 KC_DB=postgres

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.51'
+  version: '2.0.78'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -72,10 +72,29 @@ repository:
 #
 # NOT included (auto-configured):
 # - DATABASE_URL, REDIS_URL, KEYCLOAK_* → auto-generated during Azure install
-# - MISO_*, AZURE_*, kv:// → credentials and system parameters
+# - Other MISO_*, AZURE_*, kv:// → credentials and system parameters
 # - PORT, NODE_ENV, MISO_ENVIRONMENT → set by deployment target
 
 configuration:
+  # -------------------------------------------------------------------------
+  # Security & browser session
+  # -------------------------------------------------------------------------
+  - name: MISO_APPLICATION_SECRETS_UI_ENABLED
+    category: Security
+    portalInput:
+      field: select
+      label: 'Enable Settings System Secrets tab'
+      options:
+        - 'false'
+        - 'true'
+
+  - name: AUTH_BROWSER_SESSION_TTL_SECONDS
+    category: Security
+    portalInput:
+      field: text
+      label: 'Browser Session Idle Timeout (seconds)'
+      placeholder: '1800'
+
   # -------------------------------------------------------------------------
   # Operations & Debugging
   # -------------------------------------------------------------------------

package/templates/applications/miso-controller/env.template

@@ -1,10 +1,24 @@
 # Environment Variables Template
 # Use kv:// references for secrets (resolved from secrets.local.yaml)
 # Use ${VAR} for environment-specific values
+#
+# =============================================================================
+# HOW THIS FILE IS ORGANIZED (plan 220.0)
+# =============================================================================
+# One env.template, three documentation blocks. Every variable below is tagged:
+#
+#   [always]        applies to both hosted onboarding modes and local dev
+#   [saasDirect]    eSystems-hosted SaaS activation (four-step wizard)
+#   [customerOwned] Azure-in-tenant activation (existing TA wizard)
+#
+# ONBOARDING_MODE selects the onboarding step list. It is orthogonal to DEPLOYMENT,
+# which selects Azure SDK vs local execution. There is NO fifth DEPLOYMENT value:
+# eSystems-hosted SaaS still runs DEPLOYMENT=azure. See the DEPLOYMENT TYPE and
+# ONBOARDING MODE sections below.
 
 
 # =============================================================================
-# FIRST-TIME ONBOARDING CONFIGURATION
+# FIRST-TIME ONBOARDING CONFIGURATION — [always]
 # =============================================================================
 #
 # Onboarding runs automatically when the database has no controller row (empty DB).
@@ -45,17 +59,21 @@ ONBOARDING_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
 # Optional admin email for onboarding (default: admin@aifabrix.ai)
 ONBOARDING_ADMIN_EMAIL=kv://miso-controller-admin-emailKeyVault
 
-# Create development environment during onboarding (default: false)
+# [customerOwned] Create development environment during onboarding (default: false)
 # Full platform: create miso, dev, tst, and pro during onboarding (default: false)
 # When true, supersedes ONBOARDING_CREATE_DEV_ENV for which extra environments are created
+# [saasDirect] Keep false in the customer container — extra environments belong to the
+# eSystems deploy path, not the customer wizard.
 ONBOARDING_FULL_PLATFORM=false
 
-# When true, run Azure env deploy for onboarding envs (SDK modules). Default false —
+# [customerOwned] When true, run Azure env deploy for onboarding envs (SDK modules). Default false —
 # Marketplace already provisions infra; TA owns customer env deploy.
+# [saasDirect] Keep false: eSystems already deployed the required runtime services.
 ONBOARDING_CREATE_MISO_ENV=false
 
-# Set to true to create both miso and dev environments during onboarding
+# [customerOwned] Set to true to create both miso and dev environments during onboarding
 # When false (default), only the miso environment is created (ignored when ONBOARDING_FULL_PLATFORM=true)
+# [saasDirect] Keep false in the customer container.
 ONBOARDING_CREATE_DEV_ENV=true
 
 # =============================================================================
@@ -148,8 +166,19 @@ KEYCLOAK_DEFAULT_PASSWORD=kv://keycloak-default-passwordKeyVault
 # Password setup for new local users (plan 209.0)
 # email = send invitation email so the user sets their own password (default)
 # admin-reveal = show a one-time temporary password to the admin (labs / no mail)
+# [saasDirect] MUST be `email` — the customer activates its own administrator account from the
+#              Keycloak UPDATE_PASSWORD invitation; eSystems never distributes a password.
+# [customerOwned] `admin-reveal` is allowed only in labs.
 IDENTITY_LOCAL_PASSWORD_MODE=admin-reveal
 
+# =============================================================================
+# MANAGED NOTIFICATION EMAIL (Miso -> Mori REST)
+# =============================================================================
+# Both onboarding modes use Mori's AI Fabrix-owned sender. MORI_API_KEY below is the
+# existing installation service key; no notification-specific secret is created.
+NOTIFICATION_BINDING=aifabrixManaged
+MORI_ENVIRONMENT_ID=kv://mori-controller-environment-idKeyVault
+
 # Keycloak Events Configuration
 KEYCLOAK_EVENTS_ENABLED=true
 KEYCLOAK_EVENTS_VERIFY_SIGNATURE=true
@@ -191,8 +220,11 @@ MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 CONTROLLER_EVALUATION=
 
 # =============================================================================
-# ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent)
+# ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent) — [always]
 # =============================================================================
+# Kept in the shared block because EITHER mode may install Entra later from the plan 219
+# provider catalogue: Azure hosting does not force Entra, and SaaS may choose it.
+#
 # AI Fabrix vendor app for TA-1 admin consent and Entra ID configure flows.
 # Same ENTRA_ID_CLIENT_ID / ENTRA_ID_CLIENT_SECRET on every deployment.
 # Customer SSO after configure uses a separate enterprise app (AI Fabrix Miso);
@@ -205,13 +237,16 @@ CONTROLLER_EVALUATION=
 #
 # Delegated Graph (second redirect URI on the same vendor app): see section below.
 ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-id-concent/callback
+ENTRA_ID_CENTRAL_CALLBACK_URI=https://dev01.aifabrix.dev/mori/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
 # =============================================================================
-# TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG
+# TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG — [customerOwned]
 # =============================================================================
+# [saasDirect] Omit this block entirely: the SaaS wizard has no Access Model step and
+# creates no LLM resources.
+#
 # Optional JSON array for GET /api/v1/tenant/existing-llm-configurations (and
 # access-model.existingLlmConfigurations). Merge order: env entries first, then
 # entries derived from saved activation LLM (same id in saved overrides).
@@ -223,23 +258,32 @@ ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 # EXISTING_LLM_CONFIGURATIONS=
 
 # =============================================================================
-# AZURE AD PROVIDER CONFIGURATION
+# AZURE AD PROVIDER CONFIGURATION — [always]
 # =============================================================================
+# [customerOwned] These are the customer subscription credentials collected by the TA wizard.
+# [saasDirect] Present on the eSystems HOST controller so eSystems can deploy the hosted
+#              environment. They are never collected from, or shown to, the SaaS customer.
 
 AZURE_SUBSCRIPTION_ID=kv://azure-subscription-idKeyVault
 TENANT_ID=kv://azure-tenant-idKeyVault
 AZURE_SERVICE_NAME=kv://azure-service-nameKeyVault
-AZURE_CLIENT_ID=kv://azure-client-idKeyVault
-AZURE_CLIENT_SECRET=kv://azure-client-secretKeyVault
+# Azure App Service uses managed identity through DefaultAzureCredential.
+# Optional local service-principal overrides may be supplied in the runtime .env:
+# AZURE_CLIENT_ID=
+# AZURE_CLIENT_SECRET=
 
 # When true, environment infrastructure deploy skips the ai.azureOpenAI module (no new Cognitive Services account).
+# [customerOwned] default false — Azure OpenAI is created only when the customer selects it.
+# [saasDirect] leave unset or set true: the minimal SaaS baseline never creates Cognitive Services.
+#              When unset, ONBOARDING_MODE=saasDirect already defaults this to true.
 SKIP_AZURE_OPENAI=false
 
-# When true, environment deploy skips Postgres ARM/KV updates if the flexible server already exists (marketplace redeploy).
+# [customerOwned] When true, environment deploy skips Postgres ARM/KV updates if the flexible server
+# already exists (marketplace redeploy).
 SKIP_DB_REDEPLOY=true
 
 # =============================================================================
-# DEPLOYMENT TYPE
+# DEPLOYMENT TYPE — [always]
 # =============================================================================
 # azure       — Real Azure resources + tenant activation wizard until completed
 # azure-mock  — Mock Azure SDK; dashboard after login (no wizard)
@@ -248,10 +292,28 @@ SKIP_DB_REDEPLOY=true
 #
 # Missing or invalid value defaults to azure (wizard + Azure credentials).
 # Bootstrap (SKIP_FIRST_TIME_SETUP=false) is separate from the activation wizard.
+# NOTE: there is no `saas` value. eSystems-hosted SaaS runs DEPLOYMENT=azure with
+# ONBOARDING_MODE=saasDirect (see next section).
 DEPLOYMENT=database
 
+# =============================================================================
+# ONBOARDING MODE — [always]
+# =============================================================================
+# Orthogonal to DEPLOYMENT (Azure SDK vs local). Selects the onboarding step list
+# served by GET /api/v1/tenant/status and rendered by the wizard stepper.
+#
+# customerOwned = Azure-in-tenant wizard
+#                 consent → identity → size → access-model → endpoint → validation
+# saasDirect    = eSystems-hosted activation
+#                 consent → identity → endpoint (domain only) → review
+#                 Omits size, access-model, customer deploy and platform-apps.
+#
+# Unset defaults to customerOwned. An unknown value fails closed with HTTP 400.
+ONBOARDING_MODE=customerOwned
+
 # Dev/test: show TA Entra "Completing setup" countdown (120s cap). Default false.
 # Exposed to UI via GET /api/v1/tenant/status → showTaCountdown (restart controller after change).
+# [saasDirect] Omit — there is no TA Entra countdown in the SaaS wizard.
 SHOW_TA_COUNT_DOWN=false
 
 # =============================================================================
@@ -261,40 +323,50 @@ SHOW_TA_COUNT_DOWN=false
 # Encryption Key for Database Secrets
 ENCRYPTION_KEY=kv://miso-controller-secrets-encryptionKeyVault
 
-# Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only)
-BOOTSTRAP_APPKEYS=dataplane,builder-api
+# Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only).
+# Environment placement is a separate controller rule: workloads (dataplane, builder-api) install into
+# dev/tst/pro but never `miso`; miso-controller and keycloak only into `miso`; mori-controller anywhere.
+BOOTSTRAP_APPKEYS=dataplane,builder-api,mori-controller
 
 # Key Vault Integration (for security parameter encryption)
 # Set to true to enable Azure Key Vault for storing security parameters
 # When false (default), uses local AES-256-GCM encryption with ENCRYPTION_KEY
 KEY_VAULT_ENABLED=false
 
+# Show Settings > System Secrets in the portal (runtime feature flag).
+MISO_APPLICATION_SECRETS_UI_ENABLED=false
+
+# Sliding browser-session idle timeout (30 minutes).
+AUTH_BROWSER_SESSION_TTL_SECONDS=1800
+
 # JWT Configuration (for client token generation)
 JWT_SECRET=kv://miso-controller-jwt-secretKeyVault
 
-# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
+# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation.
+# The key is optional: local environments may set it; Azure may leave it empty.
 API_KEY=kv://miso-controller-secrets-apiKeyVault
 
 # =============================================================================
-# LICENSE CONFIGURATION
+# LICENSE CONFIGURATION — [always]
 # =============================================================================
+# [saasDirect] Must use the Mori flow: Mori issues and owns the
+# 30-day STANDARD / M trial, and sales later updates the same subscription.
+#
 # Offline JWT license (optional):
 # - If set, controller validates license offline (RS256) without Mori subscription status call.
 # - Value can be literal JWT or kv:// reference.
-# - If not set, controller falls back to existing Mori subscription validation flow.
-#
-# Development: set to DEVELOPMENT to disable license validation (no Mori/JWT required):
-#   LICENSE_JWT=DEVELOPMENT
-# - Use only for local development (DEPLOYMENT=local|database|azure-mock).
-# - Ignored when DEPLOYMENT=azure (Azure marketplace / App Service installs).
+# - If empty and no stored licence exists, controller runs as Community edition
+#   (DEV environment, size S, shared resources).
+# - Set only to a real signed offline licence JWT. Controlled tests may use the separate
+#   LICENSE_VALIDATION_DISABLED=true switch; do not use it in deployed installations.
 LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 
 # =============================================================================
 # ENTRA ID ONBOARDING (delegated Graph via Mori)
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
-# …/entra-graph-delegated/callback. Shared pro Mori (CICD):
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
+# …/entra-graph-delegated/callback. Shared pro Mori addon (CICD *-miso-rg):
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://dev01.aifabrix.dev/mori/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -309,12 +381,9 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-mori-web-we.azurewebsite
 # only works when a local Mori app is registered and running for this developer.
 # MORI_CALLBACK_API_KEY must be the same secret as Mori MORI_CONTROLLER_CALLBACK_API_KEY
 # (both resolve from kv://mori-callback-api-keyKeyVault — do not generate separate values).
-MORI_BASE_URL=https://aifabrix-pro-mori-web-we.azurewebsites.net
-MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault
+MORI_BASE_URL=kv://mori-controller-web-server-url
 MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
-MORI_USERNAME=kv://mori-controller-basic-usernameKeyVault
-MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault
 
 # =============================================================================
 # LOGGING CONFIGURATION

package/templates/applications/miso-controller/rbac.yaml

@@ -34,6 +34,11 @@ roles:
     description: 'Read-only access to monitoring, logs, and compliance reports'
     groups: ['AI-Fabrix-Observers']
 
+  - name: 'AI Fabrix Everyone'
+    value: 'aifabrix-everyone'
+    description: 'Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)'
+    groups: ['AI-Fabrix-Everyone']
+
 permissions:
   # Integration clients (Keycloak OIDC clients + control-plane metadata)
   - name: 'integration-client:create'