@aifabrix/builder 2.58.0 → 2.59.0

package/lib/utils/dev-init-ssh-merge.js

@@ -163,16 +163,17 @@ async function mergeDevSshConfigBlock(p) {
  * Update ~/.ssh/config with Host <user>.<host> for interactive SSH; log result.
  * @param {string} baseUrl - Builder Server base URL
  * @param {string} devId - Developer ID (digits)
+ * @param {Object} [freshSettings] - Current authenticated server settings; never mix with saved identity
  * @returns {Promise<{ hostAlias: string|null, syncUser: string, syncHost: string|null }>}
  */
-async function mergeDevSshConfigAfterInit(baseUrl, devId) {
-  const syncHost = (await config.getSyncSshHost()) || hostnameFromBaseUrl(baseUrl);
-  const syncUser = (await config.getSyncSshUser()) || `dev${devId}`;
+async function mergeDevSshConfigAfterInit(baseUrl, devId, freshSettings) {
+  const syncHost = (freshSettings ? freshSettings['sync-ssh-host'] : await config.getSyncSshHost()) || hostnameFromBaseUrl(baseUrl);
+  const syncUser = (freshSettings ? freshSettings['sync-ssh-user'] : await config.getSyncSshUser()) || `dev${devId}`;
   if (!syncHost) {
     return { hostAlias: null, syncUser, syncHost: null };
   }
   try {
-    const rootTrimmed = trimDeveloperRootDomain(await config.getDeveloperRootDomain());
+    const rootTrimmed = trimDeveloperRootDomain(freshSettings ? freshSettings['developer-root-domain'] : await config.getDeveloperRootDomain());
     return await mergeDevSshConfigBlock({
       baseUrl,
       devId,

package/lib/utils/dev-user-groups.js

@@ -10,7 +10,8 @@ const ALLOWED_DEV_GROUPS = Object.freeze([
   'secret-manager',
   'secret-reader',
   'developer',
-  'docker'
+  'docker',
+  'integrator'
 ]);
 
 /**

package/lib/utils/docker-daemon-tls-ca.js

@@ -146,7 +146,7 @@ function dockerEndpointFromRemoteServer(remoteServerUrl) {
 }
 
 /**
- * Resolve docker-endpoint for CA augmentation (settings override, else derive from remote-server).
+ * Resolve only an explicitly advertised docker-endpoint; a server hostname is not Docker access.
  * @param {{ settings?: Object|null, remoteServerUrl?: string|null }} ctx
  * @returns {string|null}
  */
@@ -156,7 +156,7 @@ function resolveDockerEndpointForCaAugment(ctx) {
   if (typeof fromSettings === 'string' && fromSettings.trim()) {
     return fromSettings.trim();
   }
-  return dockerEndpointFromRemoteServer(ctx && ctx.remoteServerUrl);
+  return null;
 }
 
 /**

package/lib/utils/error-formatters/validation-errors.js

@@ -11,6 +11,26 @@ const { formatBlockingError } = require('../cli-test-layout-chalk');
 
 const chalk = require('chalk');
 
+/**
+ * Resolves legacy application lookup codes without replacing API explanations.
+ * @param {Object|string} error - Validation error entry
+ * @returns {{message: string, applicationNotFound: boolean}} Display information
+ */
+function getValidationMessage(error) {
+  const message = typeof error === 'string' ? error : error.msg || error.message;
+  const code = typeof error === 'object' ? error.code : undefined;
+  const applicationNotFound = message === 'APPLICATION_NOT_FOUND' || code === 'APPLICATION_NOT_FOUND';
+  if (applicationNotFound && (!message || message === 'APPLICATION_NOT_FOUND')) {
+    return {
+      message: 'The controller could not find the application. ' +
+        'Check that it is registered on the selected controller and that its application key matches. ' +
+        '(Error code: APPLICATION_NOT_FOUND)',
+      applicationNotFound
+    };
+  }
+  return { message: message || 'Invalid value', applicationNotFound };
+}
+
 /**
  * Adds main error message to lines array
  * @param {Array<string>} lines - Lines array to append to
@@ -52,7 +72,7 @@ function addValidationErrorsList(lines, errors) {
   lines.push(chalk.yellow('Validation errors:'));
   errors.forEach(err => {
     const field = err.field || err.path || err.loc?.join('.') || 'validation';
-    const message = err.msg || err.message || 'Invalid value';
+    const { message } = getValidationMessage(err);
     const value = err.value !== undefined ? ` (value: ${JSON.stringify(err.value)})` : '';
     if (field === 'validation' || field === 'unknown') {
       lines.push(chalk.gray(`  • ${message}${value}`));
@@ -91,10 +111,10 @@ function addConfigurationErrors(lines, configuration) {
 /**
  * Adds actionable guidance tips to lines
  * @param {Array<string>} lines - Lines array to append to
- * @param {boolean} hasErrors - Whether there are validation errors
+ * @param {Array<Object|string>} errors - Validation errors
  */
-function addValidationGuidance(lines, hasErrors) {
-  if (!hasErrors) {
+function addValidationGuidance(lines, errors) {
+  if (!Array.isArray(errors) || !errors.some(err => !getValidationMessage(err).applicationNotFound)) {
     return;
   }
   lines.push(chalk.gray('Tips:'));
@@ -117,7 +137,7 @@ function formatValidationError(errorData) {
   addValidationErrorMessage(lines, errorData);
   addValidationErrorsList(lines, errorData.errors);
   addConfigurationErrors(lines, errorData.configuration);
-  addValidationGuidance(lines, errorData.errors && errorData.errors.length > 0);
+  addValidationGuidance(lines, errorData.errors);
 
   if (errorData.instance) {
     lines.push(chalk.gray(`Endpoint: ${errorData.instance}`));

package/lib/utils/help-builder.js

@@ -17,6 +17,7 @@ const { Help } = require('commander');
  * @type {Array<{ name: string, commands: Array<{ name: string, term?: string }> }>}
  */
 const CATEGORIES = [
+  { name: 'Getting Started', commands: [{ name: 'help', term: 'help [command]' }, { name: 'onboarding' }] },
   {
     name: 'Infrastructure (Local Development)',
     commands: [
@@ -209,9 +210,9 @@ function formatCommandCategories(helper, program) {
     for (const { term, desc: d } of lines) out.push(`  ${term.padEnd(pad)}${d}`);
     out.push('');
   }
-  out.push('Help:');
-  out.push(`  ${'help [command]'.padEnd(pad)}display help for command`);
-  out.push('');
+  if (!program.commands.some(command => command.name() === 'help')) {
+    out.push('Help:', `  ${'help [command]'.padEnd(pad)}display help for command`, '');
+  }
   out.push(`  ${''.padEnd(pad)}Tip: aifabrix <command> --help for flags and examples`);
   out.push('');
   return out;

package/lib/utils/token-manager.js

@@ -11,6 +11,7 @@
 
 const config = require('../core/config');
 const logger = require('./logger');
+const { maskSensitiveData } = require('./log-redaction');
 const {
   refreshClientToken,
   refreshDeviceToken
@@ -99,55 +100,47 @@ async function getOrRefreshClientToken(environment, appName, controllerUrl) {
  * @returns {Promise<{token: string, controller: string}|null>} Token and controller URL, or null if not available
  */
 async function getOrRefreshDeviceToken(controllerUrl) {
-  // Try to get existing token
   const tokenInfo = await getDeviceToken(controllerUrl);
-
-  if (!tokenInfo) {
-    return null;
+  if (!tokenInfo) return null;
+  if (reusableDeviceToken(tokenInfo) && !shouldRefreshToken(tokenInfo.expiresAt)) {
+    return reusableDeviceToken(tokenInfo);
   }
-
-  // Check if token should be refreshed proactively (within 15 minutes of expiry)
-  // This ensures we refresh before Keycloak's SSO Session Idle timeout (30 minutes)
-  const needsRefresh = shouldRefreshToken(tokenInfo.expiresAt);
-
-  if (!needsRefresh) {
-    // Token is valid and doesn't need refresh yet
-    return {
-      token: tokenInfo.token,
-      controller: tokenInfo.controller
-    };
-  }
-
-  // Token needs refresh (expired or within 15 minutes of expiry)
-  // Try to refresh if refresh token exists
   if (!tokenInfo.refreshToken) {
-    const { isSetupPlatformFlow } = require('../commands/setup-run-context');
-    if (!isSetupPlatformFlow()) {
-      logger.warn(
-        'Access token expired and no refresh token available. Please login again using: aifabrix login'
-      );
+    const usable = reusableDeviceToken(tokenInfo);
+    if (!usable) {
+      warnRefreshFailureOnce(controllerUrl, 'No usable access token and no refresh token available. Please login again using: aifabrix login');
     }
-    return null;
+    return usable;
   }
-
   try {
     const refreshed = await refreshDeviceToken(controllerUrl, tokenInfo.refreshToken);
-    return {
-      token: refreshed.token,
-      controller: controllerUrl
-    };
+    return { token: refreshed.token, controller: controllerUrl };
   } catch (error) {
-    // Refresh failed - check if it's a refresh token expiry
-    const errorMessage = error.message || String(error);
-    if (errorMessage.includes('Refresh token has expired')) {
-      warnRefreshTokenExpiredOnce(controllerUrl, errorMessage);
+    let message = error.message || String(error);
+    for (const secret of [tokenInfo.token, tokenInfo.refreshToken]) {
+      if (secret) message = message.split(secret).join('***');
+    }
+    message = maskSensitiveData(message);
+    if (message.includes('Refresh token has expired')) {
+      warnRefreshTokenExpiredOnce(controllerUrl, message);
     } else {
-      warnRefreshFailureOnce(controllerUrl, errorMessage);
+      warnRefreshFailureOnce(controllerUrl, message);
     }
-    return null;
+    return reusableDeviceToken(tokenInfo);
   }
 }
 
+/**
+ * Reuse only a token whose actual expiry is known and still in the future.
+ * @param {Object} tokenInfo - Stored device token
+ * @returns {Object|null} Usable token, without refresh credentials
+ */
+function reusableDeviceToken(tokenInfo) {
+  const expiry = typeof tokenInfo.expiresAt === 'string' ? Date.parse(tokenInfo.expiresAt) : NaN;
+  return tokenInfo.token && Number.isFinite(expiry) && expiry > Date.now()
+    ? { token: tokenInfo.token, controller: tokenInfo.controller } : null;
+}
+
 /**
  * Validates deployment auth parameters
  * @function validateDeploymentAuthParams

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.58.0",
+  "version": "2.59.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -131,7 +131,8 @@
     }
   },
   "dependencies": {
-    "@aifabrix/miso-client": "4.22.4",
+    "@aifabrix/miso-client": "4.23.1",
+    "@azure/identity": "4.11.1",
     "adm-zip": "^0.6.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/templates/agent-kit/instructions/AGENTKIT.md

@@ -2,6 +2,35 @@
 
 Builder-owned. `aifabrix agent-kit update` refreshes this file. If workspace `README.md` is missing, install/update creates it. An existing README is never overwritten.
 
+## Onboard
+
+On an organisation-managed SSH workspace with a provisioned `config.yaml`:
+
+```bash
+af onboarding
+af onboarding --coding claude   # or codex or cursor for this run
+```
+
+For Claude, onboarding starts or reuses a detached tmux session and prints
+its attach command. For Codex or Cursor, open the printed workspace in the
+selected coding client over SSH, then say “Hi”. `--coding` selects a platform
+for one run without changing the provisioned default.
+The agent reads this workspace's `AGENTS.md` and `README.md`, checks which
+packages already exist, and guides you to a first delivery task.
+
+On a Linux or macOS terminal with Builder, Git, and tmux:
+
+```bash
+aifabrix agent-kit setup https://controller.example.com
+```
+
+This prepares a local workspace under the configured AI Fabrix work directory and starts
+Codex. Select Claude with `--code claude`. GitHub is optional: add `--repo owner/name`
+to reuse a matching local checkout, clone a remote, or create a private repository.
+The repository name becomes the folder name; unresolved access stops safely.
+Setup preserves existing agent permissions. Change environment afterward with
+`aifabrix auth --set-environment <environment>`.
+
 ## Install
 
 From this git repository (Builder CLI on PATH):
@@ -57,7 +86,12 @@ curl -fsSL https://claude.ai/install.sh | bash
 claude auth login
 ```
 
-**Run in tmux** from this workspace so closing the terminal does not kill Claude. The command enables Remote Control and this workspace's Claude auto-approval by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (Code). That is not `claude --cloud` (a separate cloud VM). Claude `--tmux` is for worktrees only.
+**Optional terminal session in tmux:** run from this workspace so closing the
+terminal does not kill Claude. The command enables Remote Control and this
+workspace's Claude auto-approval by default. Remote Control is the **same**
+session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude
+mobile app (Code). That is not `claude --cloud` (a separate cloud VM). Claude
+`--tmux` is for worktrees only.
 
 ```bash
 aifabrix agent-kit start claude
@@ -76,7 +110,10 @@ npm install -g @openai/codex
 codex login
 ```
 
-**Run in tmux** from this workspace so the session stays if you close the terminal. The command starts native Codex Remote Control and writes this workspace's Codex auto-approval by default:
+**Optional terminal session in tmux:** run from this workspace so a terminal
+Codex session stays after SSH disconnects. This session is separate from a
+Codex app chat opened over SSH. The command requests native Codex Remote
+Control and writes workspace auto-approval by default:
 
 ```bash
 aifabrix agent-kit start codex

package/templates/agent-kit/instructions/root.AGENTS.md

@@ -14,6 +14,44 @@ Do not edit platform product source (`aifabrix-dataplane`, `aifabrix-miso`, `aif
 
 Vendor limits, tenant ids, credentials, PII stance, partitions, and the designated mutation subject live only in `integration/<systemKey>/README.md`.
 
+## First greeting
+
+On a first “Hi”, start with the business problem in plain language. Explain
+that their process, people, outcome, systems, and a real example become a plan,
+Connected Systems, a Role Assistant, and proof. Show these skills in a table:
+
+| Skill | How it helps |
+| --- | --- |
+| aifabrix-plan | Turn the business context or spec into a plan; ask about gaps |
+| aifabrix-connected-system | Validate, build, test, and publish needed systems |
+| aifabrix-role-assistant | Create or update a catalog role using published systems |
+| aifabrix-prove | Test a real business example and record the result |
+
+Render skill names with `$` in Codex and `/` in Claude Code or Cursor. Do not
+run CLI commands or lead with inventory, sign-in, or gates on this first reply.
+
+Ask one opening question: what business process or role should we help, and
+what should improve? Invite a spec, API document, sample payload, or example
+workflow if they have one. Say a plain-language description is enough to start;
+missing details will become explicit questions. Keep the greeting brief.
+
+## After the business context
+
+Before planning or using online Builder commands, check the workspace and
+sign-in. Run `aifabrix auth status`; if signed out, follow
+`.agents/skills/shared/login.md` and ask for the Controller URL only if needed.
+Read `README.md` and list package folder names under `integration/` and
+`role-assistant/`; do not open package data or secrets for discovery. If signed
+in, run `aifabrix list` to find remote systems. If listing fails, report the
+failure; do not infer that there are no systems. Distinguish local packages
+from remote entries, and published Connected Systems from drafts, Role
+Assistants, and Enterprise Knowledge. Never print tokens.
+
+Then suggest the relevant skill from the first table and explain its gate.
+Summarize sign-in and discovery only as needed for the chosen work; give at
+most two relevant remote examples unless asked for the
+full list. Do not print email, IDs, URLs, or versions in a routine status.
+
 ## Secrets
 
 Use `kv://` and `aifabrix secret`. Never store, print, ask for, or commit secret values.
@@ -27,7 +65,8 @@ Do not collapse these into a generic success boolean. Do not start the next life
 
 ## Coding hosts
 
-Cursor, Claude Code, and Codex — local machine or SSH (tmux, Claude Remote Control): `.agents/skills/shared/hosts.md`.
+Cursor, Claude Code, and Codex — local or remote SSH projects, with optional
+tmux terminal sessions: `.agents/skills/shared/hosts.md`.
 Install and sign-in: `AGENTKIT.md`. Builder CLI login from chat: `.agents/skills/shared/login.md`.
 
 ## Docs

package/templates/agent-kit/skills/shared/hosts.md

@@ -6,6 +6,11 @@ Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each
 
 Do not start Claude or Codex in your home directory. `cd` into this git workspace first.
 
+For first-time terminal onboarding, run `aifabrix agent-kit setup <controllerUrl>`.
+It creates a local workspace under AI Fabrix work and starts Codex; use `--code claude`
+to select Claude. GitHub is optional through `--repo owner/name`. Setup preserves
+permission settings; the standalone start defaults below remain separate.
+
 ## Auto-approve
 
 `aifabrix agent-kit install` can write gitignored host configs so Claude Code and Codex do not prompt for every tool:
@@ -23,7 +28,11 @@ Those files stay in **this workspace**. Claude may **read** files under the deve
 
 ## Claude Code
 
-**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**, with Remote Control and workspace auto-approval enabled by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
+On a managed host, `af onboarding --coding claude` starts or reuses a detached
+Claude tmux session and prints how to attach. Its Remote Control session is
+available from the same Claude account when supported.
+
+**Optional terminal session — tmux.** When you choose a terminal workflow, Agent Kit starts Claude **inside tmux**, with Remote Control and workspace auto-approval enabled by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
 
 ```bash
 aifabrix agent-kit start claude
@@ -37,13 +46,21 @@ Closing the terminal (or SSH) does not stop a tmux session. Stopping tmux or the
 
 ## Codex
 
-**Local or SSH — tmux and Remote Control.** tmux keeps Codex running if you close the terminal or disconnect SSH. Agent Kit also starts Codex's native remote-control daemon and workspace auto-approval by default.
+**Remote SSH project.** Open the workspace printed by `af onboarding` in the
+Codex app. The app's server connection runs separately from tmux, so no tmux
+session is needed for that chat.
+
+**Optional terminal session — tmux and Remote Control.** tmux keeps a separate
+terminal Codex session running if you disconnect SSH. `agent-kit start codex`
+also requests Codex's native Remote Control by default; the npm-installed CLI
+may require `--no-remote-control` because the daemon needs Codex's standalone
+installer.
 
 ```bash
 aifabrix agent-kit start codex
 ```
 
-Default `--name` is the last folder. `--no-remote-control` keeps the launch local; `--skip-approve-all` leaves Codex permissions unchanged. If that session already exists, `start` fails with list/kill guidance. Detach: `Ctrl-b` then `d`. Reattach with `tmux attach -t aifabrix-docs`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`. Killing tmux does not stop the shared daemon; use `codex remote-control stop` when required.
+Default `--name` is the last folder. `--no-remote-control` skips that daemon; `--skip-approve-all` leaves Codex permissions unchanged. If that session already exists, `start` fails with list/kill guidance. Detach: `Ctrl-b` then `d`. Reattach with `tmux attach -t aifabrix-docs`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`. A separate Codex app server used by a desktop SSH chat appears in `agent-kit list` and the interactive `agent-kit kill` menu; stopping it requires confirmation and may disconnect the chat. `codex remote-control stop` only controls a standalone-managed daemon.
 
 **Foreground only (no tmux).**
 
@@ -58,8 +75,9 @@ codex
 | --- | --- |
 | New named session | `tmux new -s <name> -c /path/to/this-workspace` |
 | Detach (leave it running) | `Ctrl-b`, then `d` |
-| List sessions | `aifabrix agent-kit list` |
+| List sessions; choose tmux to attach or Close | `aifabrix agent-kit list` |
 | Attach | `tmux attach -t <name>` |
-| Kill session | `aifabrix agent-kit kill <name>` |
+| Stop tmux by name | `aifabrix agent-kit kill <name>` |
+| Choose a tmux session or Codex app server to stop | `aifabrix agent-kit kill` |
 
 Use a different `--name` per workspace so several Claude or Codex sessions can run on the same host. Claude and Codex in the **same** folder also need two names.

package/templates/agent-kit/workspace/README.md

@@ -8,8 +8,21 @@ Vendor limits, credentials, designated test subjects, and PII live only in each
 
 ## How to start
 
+You can say **“Hi”** in a new agent chat. Describe the business process or
+role you want to improve and the result you need; a plain-language example is
+enough to start. The agent will map that context to Connected Systems, a Role
+Assistant, and a way to prove the result. It checks sign-in and existing
+systems before planning the work.
+
+| Claude Code / Cursor | Codex | What the skill guides |
+| --- | --- | --- |
+| `/aifabrix-plan` | `$aifabrix-plan` | Turn business context or a spec into a plan and identify missing facts |
+| `/aifabrix-connected-system` | `$aifabrix-connected-system` | Validate, build, test, and publish Connected Systems |
+| `/aifabrix-role-assistant` | `$aifabrix-role-assistant` | Create or update a catalog Role Assistant using published systems |
+| `/aifabrix-prove` | `$aifabrix-prove` | Prove a real business case and record the result |
+
 1. Open **this folder** in Cursor, Claude Code, or Codex. Host install and sign-in: **[AGENTKIT.md](./AGENTKIT.md)**.
-2. The agent checks `aifabrix auth status`. If you are not signed in, it asks for the Miso Controller URL and gives you a browser link. You do not need a terminal. Details: **[AGENTKIT.md](./AGENTKIT.md)**.
+2. Before planning or using online Builder commands, the agent checks `aifabrix auth status`. If you are not signed in, it asks for the Miso Controller URL and gives you a browser link. You do not need a terminal. Details: **[AGENTKIT.md](./AGENTKIT.md)**.
 3. In chat, either **invoke a skill** or **paste a prompt** from the tables below. Work in order. Wait for the gate (`PLAN_READY`, `READY`, `BUILT`, then `PASS` or `PASS_WITH_SKIPS`) before the next step.
 
 ### How to use prompts

package/templates/applications/builder-api/application.yaml

@@ -5,7 +5,7 @@ app:
   description: 'Business Transformation services — HTTP orchestration for connected-system workspace lifecycle via Dataplane Enterprise MCP and governance APIs.'
   type: webapp
   language: typescript
-  version: 1.0.0
+  version: 2.59.0
 
 # Image Configuration
 image:

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.70
+  version: 2.0.71
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.70
+VERSION=2.0.71
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.81'
+  version: '2.0.82'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).

package/templates/applications/miso-controller/env.template

@@ -46,7 +46,7 @@ SKIP_FIRST_TIME_SETUP=false
 ONBOARDING_CONTROLLER_KEY=miso-controller
 
 # Infrastructure/service name used by controller/onboarding flows
-INFRASTRUCTURE_NAME=aifabrix
+INFRASTRUCTURE_NAME=${DEV_USERNAME}.${DEV_ROOT_DOMAIN}
 
 # Azure region (required for first-time onboarding: controller record / provisioning metadata).
 # Use the region you deploy to (e.g. westeurope, eastus, northeurope). Single env name: LOCATION.

package/templates/external-system/external-datasource.yaml.hbs

@@ -98,7 +98,7 @@ openapi:
 
 # --- Optional sections: uncomment or delete as needed ---
 #
-# Query-time (v2.4): public list/get/filter are served from persisted Dataplane DB — not live external HTTP on every read (Plan 346 section 11).
+# Query-time: public list/get/filter are served from persisted Dataplane DB — not live external HTTP on every read.
 # External APIs: sync jobs and create/update/delete execution paths. CIP fetch→map is for ingestion, writes, or orchestration — populate storage before expecting query APIs.
 #
 # CIP (Composable Integration Pipeline): fetch → [paginate] → [map] → [filter] → output
@@ -106,12 +106,13 @@ openapi:
 # execution.cip requires version "1.0" and operations.<name>.steps ($defs.cipDefinition). Custom operation keys must match the same pattern as capabilities[].
 #
 {{#if (eq schemaEntityType "recordStorage")}}
-# sync: external APIs run during sync (Plan 346 section 11). Minimal contract: mode/schedule/batchSize per schema. FK fields on a record should update atomically in one logical write.
+# sync: external APIs run during synchronization. New automatic schedules default to calendar-month cadence in UTC.
+# Omit schedule to retain manual-only synchronization. Set enabled: false for total synchronization disable; retained schedule and incremental settings are preserved.
 # sync:
-#   pull:
-#     enabled: true
-#     schedule: "0 * * * *"
-#     batchSize: 500
+#   enabled: true
+#   mode: pull
+#   schedule: "@monthly"
+#   batchSize: 500
 # validation: structural / pre-persistence checks; quality: post-mapping acceptance (e.g. rejectIf) — see schema when you enable them.
 # capabilities: standard names list, get, create, update, delete + custom names matching ^[a-z][a-zA-Z0-9]*$; must match execution.cip.operations / openapi.operations you implement.
 # capabilities: [list, get]