@aifabrix/builder 2.56.0 → 2.57.0

package/lib/role-assistant/test-runner-clarification-resubmit.js

@@ -0,0 +1,149 @@
+/**
+ * Resubmit work.start with a businessRoleRef when an omitted-RA case's
+ * free-text message gets a synchronous clarificationRequired rejection.
+ * @fileoverview Extracted from test-runner.js (file-size)
+ */
+
+'use strict';
+
+function normalizeToken(value) {
+  if (typeof value !== 'string') {
+    return '';
+  }
+  return value
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '');
+}
+
+function isRoleAssistantClarificationRequired(startResponse) {
+  return normalizeToken(startResponse?.status) === 'clarificationrequired';
+}
+
+function extractProcessExecutionId(startResponse) {
+  const candidates = [
+    startResponse?.work?.processExecutionId,
+    startResponse?.intent?.processExecutionId,
+    startResponse?.processExecutionId,
+    startResponse?.status?.processExecutionId
+  ];
+  for (const row of candidates) {
+    if (typeof row === 'string' && row.trim()) {
+      return row.trim();
+    }
+  }
+  return '';
+}
+
+function findRuntimeRoleAssistantAnswerValue(testCase) {
+  const answers = Array.isArray(testCase?.answers) ? testCase.answers : [];
+  for (const candidate of answers) {
+    const when = candidate && typeof candidate === 'object' ? candidate.when : null;
+    const questionKey = when && typeof when === 'object' ? when.questionKey : null;
+    if (normalizeToken(questionKey) !== 'runtimeroleassistant') {
+      continue;
+    }
+    const value = candidate.value;
+    if (typeof value === 'string' && value.trim()) {
+      return value.trim();
+    }
+  }
+  return '';
+}
+
+/**
+ * work.start with an omitted businessRoleRef and an ambiguous free-text
+ * message can return a *synchronous* `clarificationRequired` rejection with
+ * no task/processExecutionId at all -- there is nothing to `respond`/
+ * `continue` against yet. A case authored for this "omitted RA" scenario
+ * (input.businessRoleRef omitted, answers[].when.questionKey:
+ * runtimeRoleAssistant) is asserting the *next* work.start call should carry
+ * that answer's businessRoleRef, not that this one can be answered in place.
+ * Resubmit once with it before giving up.
+ *
+ * @param {object} params
+ * @param {(dataplaneUrl: string, authConfig: object, body: object) => Promise<object>} params.startWorkIntent
+ * @param {string} params.dataplaneUrl
+ * @param {object} params.authConfig
+ * @param {object} params.startPayload
+ * @param {object} params.testCase
+ * @param {string} params.roleKey
+ * @param {(prefix: string) => string} params.buildRuntimeId
+ * @returns {Promise<object|null>} the resubmitted start response, or null when no answer matched
+ */
+async function resubmitStartWithRoleAssistantAnswer({
+  startWorkIntent,
+  dataplaneUrl,
+  authConfig,
+  startPayload,
+  testCase,
+  roleKey,
+  buildRuntimeId
+}) {
+  const roleAssistantAnswer = findRuntimeRoleAssistantAnswerValue(testCase);
+  if (!roleAssistantAnswer) {
+    return null;
+  }
+  return startWorkIntent(dataplaneUrl, authConfig, {
+    ...startPayload,
+    // The rejected first call already recorded its submissionId as an
+    // idempotency key server-side (live-reproduced: reusing it here 409s
+    // with "submissionId was already used for a different request") --
+    // this resubmission is a genuinely new request, not a retry of the
+    // same one.
+    submissionId: buildRuntimeId(`ra-${roleKey}`),
+    businessRoleRef: roleAssistantAnswer
+  });
+}
+
+/**
+ * Start a free-text role-assistant case, resubmitting once with a matching
+ * `runtimeRoleAssistant` answer if the first call comes back as a
+ * synchronous clarification rejection with no processExecutionId.
+ *
+ * @param {object} params
+ * @param {(dataplaneUrl: string, authConfig: object, body: object) => Promise<object>} params.startWorkIntent
+ * @param {string} params.dataplaneUrl
+ * @param {object} params.authConfig
+ * @param {object} params.startPayload
+ * @param {object} params.testCase
+ * @param {string} params.roleKey
+ * @param {(prefix: string) => string} params.buildRuntimeId
+ * @returns {Promise<{startResponse: object, processExecutionId: string}>}
+ */
+async function startRoleAssistantCaseWithClarificationResubmit({
+  startWorkIntent,
+  dataplaneUrl,
+  authConfig,
+  startPayload,
+  testCase,
+  roleKey,
+  buildRuntimeId
+}) {
+  let startResponse = await startWorkIntent(dataplaneUrl, authConfig, startPayload);
+  let processExecutionId = extractProcessExecutionId(startResponse);
+  if (!processExecutionId && isRoleAssistantClarificationRequired(startResponse)) {
+    const resubmitted = await resubmitStartWithRoleAssistantAnswer({
+      startWorkIntent,
+      dataplaneUrl,
+      authConfig,
+      startPayload,
+      testCase,
+      roleKey,
+      buildRuntimeId
+    });
+    if (resubmitted) {
+      startResponse = resubmitted;
+      processExecutionId = extractProcessExecutionId(startResponse);
+    }
+  }
+  return { startResponse, processExecutionId };
+}
+
+module.exports = {
+  isRoleAssistantClarificationRequired,
+  findRuntimeRoleAssistantAnswerValue,
+  resubmitStartWithRoleAssistantAnswer,
+  startRoleAssistantCaseWithClarificationResubmit,
+  extractProcessExecutionId
+};

package/lib/role-assistant/test-runner.js

@@ -25,6 +25,10 @@ const {
   resolveInputMessage
 } = require('./test-runner-start-payload');
 const { pickHumanRespondBody } = require('./test-runner-respond-body');
+const {
+  startRoleAssistantCaseWithClarificationResubmit,
+  extractProcessExecutionId
+} = require('./test-runner-clarification-resubmit');
 const TERMINAL_STATUSES = new Set(['completed', 'stopped']);
 const WAITING_STATUS = 'waiting';
 
@@ -73,21 +77,6 @@ function isExecutableRoleAssistantCase(testCase) {
   return false;
 }
 
-function extractProcessExecutionId(startResponse) {
-  const candidates = [
-    startResponse?.work?.processExecutionId,
-    startResponse?.intent?.processExecutionId,
-    startResponse?.processExecutionId,
-    startResponse?.status?.processExecutionId
-  ];
-  for (const row of candidates) {
-    if (typeof row === 'string' && row.trim()) {
-      return row.trim();
-    }
-  }
-  return '';
-}
-
 function isTerminalStatus(statusValue) {
   return TERMINAL_STATUSES.has(normalizeToken(statusValue));
 }
@@ -420,8 +409,16 @@ async function runRoleAssistantCaseLifecycle(roleKey, testCase, runtimeContext,
     return runWorkHubCaseLifecycle(roleKey, testCase, runtimeContext, runnerOptions);
   }
   const startPayload = buildStartIntentPayload(roleKey, testCase);
-  const startResponse = await startWorkIntent(dataplaneUrl, authConfig, startPayload);
-  const processExecutionId = extractProcessExecutionId(startResponse);
+  const { startResponse, processExecutionId } = await startRoleAssistantCaseWithClarificationResubmit({
+    startWorkIntent,
+    extractProcessExecutionId,
+    dataplaneUrl,
+    authConfig,
+    startPayload,
+    testCase,
+    roleKey,
+    buildRuntimeId
+  });
   if (!processExecutionId) {
     throw new Error(
       'work.start missing processExecutionId; use input.executionPath: workHub for free-text RA cases.'

package/lib/schema/application-schema.json

@@ -7,12 +7,12 @@
     "key": "application-schema",
     "name": "Application Configuration Schema",
     "description": "JSON schema for validating AI Fabrix application configuration files",
-    "version": "1.6.2",
+    "version": "1.7.0",
     "type": "schema",
     "category": "infrastructure",
     "author": "AI Fabrix Team",
     "createdAt": "2024-01-01T00:00:00Z",
-    "updatedAt": "2026-08-06T00:00:00Z",
+    "updatedAt": "2026-09-16T00:00:00Z",
     "compatibility": {
       "minVersion": "1.0.0",
       "maxVersion": "2.0.0",
@@ -30,6 +30,14 @@
       "external-datasource.schema.json"
     ],
     "changelog": [
+      {
+        "version": "1.7.0",
+        "date": "2026-09-16T00:00:00Z",
+        "changes": [
+          "Added optional top-level required: unique environment-variable names the application needs in every deployment target. Absent or empty keeps existing behavior."
+        ],
+        "breaking": false
+      },
       {
         "version": "1.6.2",
         "date": "2026-08-06T00:00:00Z",
@@ -937,6 +945,16 @@
         "$ref": "aifabrix://schema/external-datasource.schema.json"
       }
     },
+    "required": {
+      "type": "array",
+      "description": "Environment-variable names this application requires in every deployment target. Each name must be declared by the application configuration (env.template) and resolve before deployment. Absent or empty means no extra requirement.",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Z_][A-Z0-9_]*$",
+        "maxLength": 255
+      }
+    },
     "environmentScopedResources": {
       "type": "boolean",
       "description": "When true, this application supports environment-scoped resource names (Key Vault key prefixes, Redis DB index, local Docker container and Traefik paths) when useEnvironmentScopedResources is activated in ~/.aifabrix/config.yaml and the target environment is dev or tst. Does not apply to pro. Used to share Postgres/Docker across dev/tst without collisions."

package/lib/schema/infra-parameter.schema.json

@@ -122,6 +122,13 @@
         },
         "requiredOnSystemOnboarding": { "type": "boolean" },
         "ownerAppKey": { "type": "string", "minLength": 1 },
+        "sharedWithAppKeys": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "minItems": 1,
+          "uniqueItems": true,
+          "description": "Named applications, other than ownerAppKey, that may read this value."
+        },
         "scope": { "$ref": "#/definitions/scopeEnum" },
         "generator": { "$ref": "#/definitions/generator" },
         "ensureOn": {

package/lib/schema/infra.parameter.yaml

@@ -435,6 +435,13 @@ parameters:
 
   - key: miso-controller-secrets-encryptionKeyVault
     ownerAppKey: miso-controller
+    # Plan 227.4: the data plane must hold the same key. It hands this value to MisoClient so
+    # the controller's encrypt/decrypt service interoperates, and a credential encrypted by one
+    # side is decrypted by the other. The read was already happening in the shipped template
+    # and the policy denied it. Declared rather than silently permitted, and kept to the one
+    # application that needs it instead of moving the key to a scope that grants everyone.
+    sharedWithAppKeys:
+      - dataplane
     scope: app
     generator:
       type: randomBytes32
@@ -619,21 +626,6 @@ parameters:
       notes: Per-app OAuth client secret for dataplane; generated on first ensure.
 
   # Mori / telemetry is optional for an unlicensed Community installation.
-  # MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault — local default apiKey.
-  - key: mori-controller-auth-methodKeyVault
-    category: Mori
-    sensitive: false
-    valueSource: optionalInput
-    requiredOnSystemOnboarding: false
-    scope: system
-    generator:
-      type: literal
-      value: 'apiKey'
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      notes: >-
-        Local/dev default apiKey. Override when using Mori basic auth or other methods.
-
   - key: mori-controller-api-keyKeyVault
     category: Mori
     sensitive: true
@@ -646,19 +638,8 @@ parameters:
     azure:
       notes: Empty locally; set when calling Mori with API key auth.
 
-  - key: mori-controller-basic-usernameKeyVault
-    category: Mori
-    sensitive: false
-    valueSource: optionalInput
-    requiredOnSystemOnboarding: false
-    scope: system
-    generator:
-      type: emptyString
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      notes: Empty locally; Mori basic auth optional.
-
-  - key: mori-controller-basic-passwordKeyVault
+  # Public, but a security-critical trust anchor. Never derive it from a pasted JWT.
+  - key: mori-license-public-keyKeyVault
     category: Mori
     sensitive: true
     valueSource: optionalInput
@@ -668,7 +649,8 @@ parameters:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
     azure:
-      notes: Empty locally; Mori basic auth optional.
+      vaultSecretName: mori-license-public-keyKeyVault
+      notes: Trusted Mori SPKI PEM public key, provisioned by the installer or issuer release identity.
 
   - key: appinsights-connectionStringKeyVault
     category: Observability
@@ -842,8 +824,9 @@ parameters:
       type: databaseUrl
     ensureOn: [upInfra, resolveApp]
     azure:
-      vaultSecretName: databases-miso-controller-0-urlKeyVault
+      vaultSecretNamePattern: '{appKey}-databases-{index}-urlKeyVault'
       legacyVaultSecretNames:
+        - '{key}'
         - '{serviceName}-databases-0-urlKeyVault'
 
   - key: databases-miso-controller-0-passwordKeyVault
@@ -853,7 +836,9 @@ parameters:
       type: databasePassword
     ensureOn: [upInfra, resolveApp]
     azure:
-      vaultSecretName: databases-miso-controller-0-passwordKeyVault
+      vaultSecretNamePattern: '{appKey}-databases-{index}-passwordKeyVault'
+      legacyVaultSecretNames:
+        - '{key}'
 
   - key: databases-miso-controller-1-urlKeyVault
     ownerAppKey: miso-controller
@@ -862,8 +847,9 @@ parameters:
       type: databaseUrl
     ensureOn: [upInfra, resolveApp]
     azure:
-      vaultSecretName: databases-miso-controller-1-urlKeyVault
+      vaultSecretNamePattern: '{appKey}-databases-{index}-urlKeyVault'
       legacyVaultSecretNames:
+        - '{key}'
         - '{serviceName}-databases-1-urlKeyVault'
 
   - key: databases-miso-controller-1-passwordKeyVault
@@ -873,7 +859,9 @@ parameters:
       type: databasePassword
     ensureOn: [upInfra, resolveApp]
     azure:
-      vaultSecretName: databases-miso-controller-1-passwordKeyVault
+      vaultSecretNamePattern: '{appKey}-databases-{index}-passwordKeyVault'
+      legacyVaultSecretNames:
+        - '{key}'
 
   # Per-index database secrets. Index must match requires.databases order in application.yaml.
   - keyPattern: '^databases-[a-z0-9-]+-\d+-urlKeyVault$'
@@ -882,9 +870,10 @@ parameters:
       type: databaseUrl
     ensureOn: [upInfra, resolveApp]
     azure:
+      vaultSecretNamePattern: '{appKey}-databases-{index}-urlKeyVault'
       legacyVaultSecretNames:
-        - '{appKey}-databases-{index}-urlKeyVault'
-      notes: The direct manifest key is canonical; the app-prefixed form is migration-only.
+        - '{key}'
+      notes: The manifest key stays logical; the app-prefixed name is the physical vault key.
 
   - keyPattern: '^databases-[a-z0-9-]+-\d+-passwordKeyVault$'
     scope: app
@@ -892,8 +881,9 @@ parameters:
       type: databasePassword
     ensureOn: [upInfra, resolveApp]
     azure:
+      vaultSecretNamePattern: '{appKey}-databases-{index}-passwordKeyVault'
       legacyVaultSecretNames:
-        - '{appKey}-databases-{index}-passwordKeyVault'
+        - '{key}'
 
   # Keycloak and other *-url keys (non-database).
   - keyPattern: '^keycloak-.+-url$'