@aifabrix/builder 2.57.0 → 2.59.0

package/templates/agent-kit/instructions/root.AGENTS.md

@@ -14,6 +14,44 @@ Do not edit platform product source (`aifabrix-dataplane`, `aifabrix-miso`, `aif
 
 Vendor limits, tenant ids, credentials, PII stance, partitions, and the designated mutation subject live only in `integration/<systemKey>/README.md`.
 
+## First greeting
+
+On a first “Hi”, start with the business problem in plain language. Explain
+that their process, people, outcome, systems, and a real example become a plan,
+Connected Systems, a Role Assistant, and proof. Show these skills in a table:
+
+| Skill | How it helps |
+| --- | --- |
+| aifabrix-plan | Turn the business context or spec into a plan; ask about gaps |
+| aifabrix-connected-system | Validate, build, test, and publish needed systems |
+| aifabrix-role-assistant | Create or update a catalog role using published systems |
+| aifabrix-prove | Test a real business example and record the result |
+
+Render skill names with `$` in Codex and `/` in Claude Code or Cursor. Do not
+run CLI commands or lead with inventory, sign-in, or gates on this first reply.
+
+Ask one opening question: what business process or role should we help, and
+what should improve? Invite a spec, API document, sample payload, or example
+workflow if they have one. Say a plain-language description is enough to start;
+missing details will become explicit questions. Keep the greeting brief.
+
+## After the business context
+
+Before planning or using online Builder commands, check the workspace and
+sign-in. Run `aifabrix auth status`; if signed out, follow
+`.agents/skills/shared/login.md` and ask for the Controller URL only if needed.
+Read `README.md` and list package folder names under `integration/` and
+`role-assistant/`; do not open package data or secrets for discovery. If signed
+in, run `aifabrix list` to find remote systems. If listing fails, report the
+failure; do not infer that there are no systems. Distinguish local packages
+from remote entries, and published Connected Systems from drafts, Role
+Assistants, and Enterprise Knowledge. Never print tokens.
+
+Then suggest the relevant skill from the first table and explain its gate.
+Summarize sign-in and discovery only as needed for the chosen work; give at
+most two relevant remote examples unless asked for the
+full list. Do not print email, IDs, URLs, or versions in a routine status.
+
 ## Secrets
 
 Use `kv://` and `aifabrix secret`. Never store, print, ask for, or commit secret values.
@@ -27,7 +65,8 @@ Do not collapse these into a generic success boolean. Do not start the next life
 
 ## Coding hosts
 
-Cursor, Claude Code, and Codex — local machine or SSH (tmux, Claude Remote Control): `.agents/skills/shared/hosts.md`.
+Cursor, Claude Code, and Codex — local or remote SSH projects, with optional
+tmux terminal sessions: `.agents/skills/shared/hosts.md`.
 Install and sign-in: `AGENTKIT.md`. Builder CLI login from chat: `.agents/skills/shared/login.md`.
 
 ## Docs

package/templates/agent-kit/skills/shared/hosts.md

@@ -6,6 +6,11 @@ Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each
 
 Do not start Claude or Codex in your home directory. `cd` into this git workspace first.
 
+For first-time terminal onboarding, run `aifabrix agent-kit setup <controllerUrl>`.
+It creates a local workspace under AI Fabrix work and starts Codex; use `--code claude`
+to select Claude. GitHub is optional through `--repo owner/name`. Setup preserves
+permission settings; the standalone start defaults below remain separate.
+
 ## Auto-approve
 
 `aifabrix agent-kit install` can write gitignored host configs so Claude Code and Codex do not prompt for every tool:
@@ -23,7 +28,11 @@ Those files stay in **this workspace**. Claude may **read** files under the deve
 
 ## Claude Code
 
-**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**, with Remote Control and workspace auto-approval enabled by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
+On a managed host, `af onboarding --coding claude` starts or reuses a detached
+Claude tmux session and prints how to attach. Its Remote Control session is
+available from the same Claude account when supported.
+
+**Optional terminal session — tmux.** When you choose a terminal workflow, Agent Kit starts Claude **inside tmux**, with Remote Control and workspace auto-approval enabled by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
 
 ```bash
 aifabrix agent-kit start claude
@@ -37,13 +46,21 @@ Closing the terminal (or SSH) does not stop a tmux session. Stopping tmux or the
 
 ## Codex
 
-**Local or SSH — tmux and Remote Control.** tmux keeps Codex running if you close the terminal or disconnect SSH. Agent Kit also starts Codex's native remote-control daemon and workspace auto-approval by default.
+**Remote SSH project.** Open the workspace printed by `af onboarding` in the
+Codex app. The app's server connection runs separately from tmux, so no tmux
+session is needed for that chat.
+
+**Optional terminal session — tmux and Remote Control.** tmux keeps a separate
+terminal Codex session running if you disconnect SSH. `agent-kit start codex`
+also requests Codex's native Remote Control by default; the npm-installed CLI
+may require `--no-remote-control` because the daemon needs Codex's standalone
+installer.
 
 ```bash
 aifabrix agent-kit start codex
 ```
 
-Default `--name` is the last folder. `--no-remote-control` keeps the launch local; `--skip-approve-all` leaves Codex permissions unchanged. If that session already exists, `start` fails with list/kill guidance. Detach: `Ctrl-b` then `d`. Reattach with `tmux attach -t aifabrix-docs`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`. Killing tmux does not stop the shared daemon; use `codex remote-control stop` when required.
+Default `--name` is the last folder. `--no-remote-control` skips that daemon; `--skip-approve-all` leaves Codex permissions unchanged. If that session already exists, `start` fails with list/kill guidance. Detach: `Ctrl-b` then `d`. Reattach with `tmux attach -t aifabrix-docs`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`. A separate Codex app server used by a desktop SSH chat appears in `agent-kit list` and the interactive `agent-kit kill` menu; stopping it requires confirmation and may disconnect the chat. `codex remote-control stop` only controls a standalone-managed daemon.
 
 **Foreground only (no tmux).**
 
@@ -58,8 +75,9 @@ codex
 | --- | --- |
 | New named session | `tmux new -s <name> -c /path/to/this-workspace` |
 | Detach (leave it running) | `Ctrl-b`, then `d` |
-| List sessions | `aifabrix agent-kit list` |
+| List sessions; choose tmux to attach or Close | `aifabrix agent-kit list` |
 | Attach | `tmux attach -t <name>` |
-| Kill session | `aifabrix agent-kit kill <name>` |
+| Stop tmux by name | `aifabrix agent-kit kill <name>` |
+| Choose a tmux session or Codex app server to stop | `aifabrix agent-kit kill` |
 
 Use a different `--name` per workspace so several Claude or Codex sessions can run on the same host. Claude and Codex in the **same** folder also need two names.

package/templates/agent-kit/workspace/README.md

@@ -8,8 +8,21 @@ Vendor limits, credentials, designated test subjects, and PII live only in each
 
 ## How to start
 
+You can say **“Hi”** in a new agent chat. Describe the business process or
+role you want to improve and the result you need; a plain-language example is
+enough to start. The agent will map that context to Connected Systems, a Role
+Assistant, and a way to prove the result. It checks sign-in and existing
+systems before planning the work.
+
+| Claude Code / Cursor | Codex | What the skill guides |
+| --- | --- | --- |
+| `/aifabrix-plan` | `$aifabrix-plan` | Turn business context or a spec into a plan and identify missing facts |
+| `/aifabrix-connected-system` | `$aifabrix-connected-system` | Validate, build, test, and publish Connected Systems |
+| `/aifabrix-role-assistant` | `$aifabrix-role-assistant` | Create or update a catalog Role Assistant using published systems |
+| `/aifabrix-prove` | `$aifabrix-prove` | Prove a real business case and record the result |
+
 1. Open **this folder** in Cursor, Claude Code, or Codex. Host install and sign-in: **[AGENTKIT.md](./AGENTKIT.md)**.
-2. The agent checks `aifabrix auth status`. If you are not signed in, it asks for the Miso Controller URL and gives you a browser link. You do not need a terminal. Details: **[AGENTKIT.md](./AGENTKIT.md)**.
+2. Before planning or using online Builder commands, the agent checks `aifabrix auth status`. If you are not signed in, it asks for the Miso Controller URL and gives you a browser link. You do not need a terminal. Details: **[AGENTKIT.md](./AGENTKIT.md)**.
 3. In chat, either **invoke a skill** or **paste a prompt** from the tables below. Work in order. Wait for the gate (`PLAN_READY`, `READY`, `BUILT`, then `PASS` or `PASS_WITH_SKIPS`) before the next step.
 
 ### How to use prompts

package/templates/applications/builder-api/application.yaml

@@ -5,7 +5,7 @@ app:
   description: 'Business Transformation services — HTTP orchestration for connected-system workspace lifecycle via Dataplane Enterprise MCP and governance APIs.'
   type: webapp
   language: typescript
-  version: 1.0.0
+  version: 2.59.0
 
 # Image Configuration
 image:

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.70
+  version: 2.0.71
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.70
+VERSION=2.0.71
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.81'
+  version: '2.0.82'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).

package/templates/applications/miso-controller/env.template

@@ -46,7 +46,7 @@ SKIP_FIRST_TIME_SETUP=false
 ONBOARDING_CONTROLLER_KEY=miso-controller
 
 # Infrastructure/service name used by controller/onboarding flows
-INFRASTRUCTURE_NAME=aifabrix
+INFRASTRUCTURE_NAME=${DEV_USERNAME}.${DEV_ROOT_DOMAIN}
 
 # Azure region (required for first-time onboarding: controller record / provisioning metadata).
 # Use the region you deploy to (e.g. westeurope, eastus, northeurope). Single env name: LOCATION.

package/templates/external-system/external-datasource.yaml.hbs

@@ -98,7 +98,7 @@ openapi:
 
 # --- Optional sections: uncomment or delete as needed ---
 #
-# Query-time (v2.4): public list/get/filter are served from persisted Dataplane DB — not live external HTTP on every read (Plan 346 section 11).
+# Query-time: public list/get/filter are served from persisted Dataplane DB — not live external HTTP on every read.
 # External APIs: sync jobs and create/update/delete execution paths. CIP fetch→map is for ingestion, writes, or orchestration — populate storage before expecting query APIs.
 #
 # CIP (Composable Integration Pipeline): fetch → [paginate] → [map] → [filter] → output
@@ -106,12 +106,13 @@ openapi:
 # execution.cip requires version "1.0" and operations.<name>.steps ($defs.cipDefinition). Custom operation keys must match the same pattern as capabilities[].
 #
 {{#if (eq schemaEntityType "recordStorage")}}
-# sync: external APIs run during sync (Plan 346 section 11). Minimal contract: mode/schedule/batchSize per schema. FK fields on a record should update atomically in one logical write.
+# sync: external APIs run during synchronization. New automatic schedules default to calendar-month cadence in UTC.
+# Omit schedule to retain manual-only synchronization. Set enabled: false for total synchronization disable; retained schedule and incremental settings are preserved.
 # sync:
-#   pull:
-#     enabled: true
-#     schedule: "0 * * * *"
-#     batchSize: 500
+#   enabled: true
+#   mode: pull
+#   schedule: "@monthly"
+#   batchSize: 500
 # validation: structural / pre-persistence checks; quality: post-mapping acceptance (e.g. rejectIf) — see schema when you enable them.
 # capabilities: standard names list, get, create, update, delete + custom names matching ^[a-z][a-zA-Z0-9]*$; must match execution.cip.operations / openapi.operations you implement.
 # capabilities: [list, get]