@aifabrix/builder 2.59.0 → 2.61.2

package/templates/agent-kit/skills/shared/feedback.md

@@ -0,0 +1,31 @@
+# Feedback — where an observation goes
+
+`aifabrix agent-kit update` rewrites `.agents/skills/**`, `AGENTKIT.md`, and the
+managed sections of `AGENTS.md` and `CLAUDE.md` from the installed kit. Editing
+them blocks the next update as a conflict, and `--force` discards the edit with
+no diff to review. Improve the kit by filing a finding, not by editing a skill.
+
+| Observation | Where it goes |
+| --- | --- |
+| Generic CLI, skill, or platform gap | `BUILDER_IMPROVEMENT_FINDINGS.md` |
+| Manual EDS edit | `integration/<systemKey>/INTEGRATION_CHANGELOG.md` |
+| Vendor limits, tenant ids, PII stance | `integration/<systemKey>/README.md` |
+| Delivery learning for a role | `role-assistant/ra-<roleKey>/learning/learning.md` |
+
+## Writing a finding
+
+Newest first, under a `## YYYY-MM-DD — one line naming the gap` heading:
+
+- **Command** — the exact command, customer values replaced by placeholders.
+- **Observed** — what happened, with the error text and the verdict.
+- **Expected** — what should have happened, and why that is reasonable.
+- **Scope** — whether it reproduces outside this workspace, and what is still
+  unproven. Say so plainly when the root cause is not established.
+
+A finding is read outside this workspace, so leave out correlation ids, audit
+refs, internal URLs, tenant or record identifiers, hostnames, and customer
+names. Customer specifics belong in the package README or the role's
+`learning.md` instead.
+
+Never weaken a gate, assertion, or test to make a finding go away. A failing
+gate with a filed finding is a better outcome than a green run that hides one.

package/templates/agent-kit/skills/shared/hosts.md

@@ -18,7 +18,17 @@ permission settings; the standalone start defaults below remain separate.
 - Claude Code: `.claude/settings.local.json` (`permissions.defaultMode` = `bypassPermissions`, `allow` = `Bash(aifabrix *)` and `Read(~/**)`)
 - Codex: `.codex/config.toml` (`approval_policy = "never"`, `sandbox_mode = "workspace-write"`)
 
-Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. `agent-kit start claude|codex` writes only the selected host's file by default; `--skip-approve-all` opts out. Install/update retain their explicit approval prompts and flags. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
+Those files stay in **this workspace**; Builder never writes `~/.claude` or `~/.codex`, and neither file adds a sibling folder as an extra workspace.
+
+Understand what you are accepting for Claude Code. `bypassPermissions` stops the
+prompt for **every** tool call in this workspace, not only the two `allow`
+entries, which grant nothing extra while that mode is set. That includes
+`aifabrix` subcommands which change remote state, such as `deploy`, `upload`,
+`identity sync` and `protection upload`. Codex is narrower: `approval_policy`
+removes the prompt, while `sandbox_mode = "workspace-write"` still confines
+writes to this workspace.
+
+Use `--skip-approve-all` when you want the prompts, on a shared or production-connected installation. `agent-kit start claude|codex` writes only the selected host's file by default. Install/update retain their explicit approval prompts and flags. `--force` overwrites existing local files.
 
 ## Cursor
 
@@ -38,7 +48,7 @@ available from the same Claude account when supported.
 aifabrix agent-kit start claude
 ```
 
-tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder; `--no-remote-control` and `--skip-approve-all` opt out. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`. A duplicate `start` fails instead of attaching. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
+tmux session name is this folder (for example `acme-workspace`). Remote Control name is `hostname-user-folder` (for example `devhost-alice-acme-workspace`). `--name` overrides the folder; `--no-remote-control` and `--skip-approve-all` opt out. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t acme-workspace`. A duplicate `start` fails instead of attaching. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
 
 **Phone and PC.** Sign in with the same Claude Pro/Max/Team account (`claude auth login` — not an API key). After Remote Control starts, open **Code** in the Claude mobile app and/or [claude.ai/code](https://claude.ai/code) on the PC. In an already-running session, `/remote-control` or `/mobile`.
 
@@ -60,7 +70,7 @@ installer.
 aifabrix agent-kit start codex
 ```
 
-Default `--name` is the last folder. `--no-remote-control` skips that daemon; `--skip-approve-all` leaves Codex permissions unchanged. If that session already exists, `start` fails with list/kill guidance. Detach: `Ctrl-b` then `d`. Reattach with `tmux attach -t aifabrix-docs`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`. A separate Codex app server used by a desktop SSH chat appears in `agent-kit list` and the interactive `agent-kit kill` menu; stopping it requires confirmation and may disconnect the chat. `codex remote-control stop` only controls a standalone-managed daemon.
+Default `--name` is the last folder. `--no-remote-control` skips that daemon; `--skip-approve-all` leaves Codex permissions unchanged. If that session already exists, `start` fails with list/kill guidance. Detach: `Ctrl-b` then `d`. Reattach with `tmux attach -t acme-workspace`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`. A separate Codex app server used by a desktop SSH chat appears in `agent-kit list` and the interactive `agent-kit kill` menu; stopping it requires confirmation and may disconnect the chat. `codex remote-control stop` only controls a standalone-managed daemon.
 
 **Foreground only (no tmux).**
 

package/templates/agent-kit/skills/shared/interaction.md

@@ -0,0 +1,83 @@
+# Structured choices and phase gates
+
+This file owns interactive choices for every Agent Kit skill. Use the same behavior in
+Cursor, Claude, and Codex; host-specific tool names do not change the workflow.
+
+## Show choices in the host control
+
+When the user must choose between discrete actions, invoke the host's native structured
+question control instead of printing a `Choose:` block in chat:
+
+| Host | Native control |
+| --- | --- |
+| Cursor | `AskQuestion` |
+| Claude | `AskUserQuestion` |
+| Codex | `request_user_input` |
+
+Give the control a short header, one direct question, and mutually exclusive options.
+Put the recommended option first, label it `(Recommended)`, and add one short description
+of its effect. Keep the stable option ids below as the workflow result even when a host
+returns a label rather than an id.
+
+If the host supplies its own free-form **Other** choice, map that response to the matching
+`*-other` id. Otherwise include an explicit **Something else** option. If no structured
+question control is available, show the same choices as a numbered list and wait for one
+answer. Never continue merely because an option was recommended.
+
+Do not open a control when the user already made an unambiguous choice in the current
+turn. Treat that choice exactly like the corresponding control result.
+
+## Bare-invocation routes
+
+Ask once and proceed only on an explicit choice.
+
+| Option id | Control label | Means |
+| --- | --- | --- |
+| `route-normal` | Run normal path (Recommended) | Run the normal path for this skill through to its gate, stopping at each phase gate |
+| `route-check` | Inspect and test only | Run validation, checks, and status with no publish or promotion |
+| `route-other` | Something else | Collect the action in the control's free-form response |
+| `next-stop` | Stop here | End without further action |
+
+`route-normal` still stops at every phase gate and still needs `next-yes` to continue. It
+is a route, not permission to run the whole lifecycle unattended.
+
+## After success
+
+Offer the next eligible phase with the structured question control. Proceed only on
+`next-yes`.
+
+Shared option ids: `next-yes` · `next-no` · `next-stop`.
+
+| Completed | Next offer |
+| --- | --- |
+| aifabrix-plan PLAN_READY | connected-system validate |
+| connected-system READY | connected-system build |
+| connected-system BUILT | connected-system publish |
+| connected-system PASS or PASS_WITH_SKIPS | archive (separate) and/or prove validate |
+| prove READY / BUILT / UPDATED | prove next phase |
+| prove PASS or PASS_WITH_SKIPS | iterate validate/build |
+
+Archive is a distinct user decision (`archive-yes` / `archive-no`). Never archive as a
+side effect of PASS.
+
+## On gaps
+
+- NEEDS_DECISIONS: ask about every challenge row with the structured control. No
+  `cust-next`.
+- BLOCKED / FAIL / NEEDS_FIXES / ABORTED: do not offer the next phase as if success.
+
+A phase gate is per-gate, not overall. Offer the next phase only when the **Delivery** row
+supports it; a passing package gate beside `Delivery: NEEDS_FIXES` is not success and the
+offer must name what is still open.
+
+## Phase detection (connected-system and prove)
+
+1. Explicit phase from the user
+2. Ask with the structured control, offering the bare-invocation routes above
+
+There is no third step. Package and plan state decide what you *recommend*, never what you
+run: a bare invocation reports status and stops ([status.md](status.md)). Inferring "the
+safe next eligible phase" is what makes a skill start working before the user has said
+what they want.
+
+Never silently run the following phase after success.

package/templates/agent-kit/skills/shared/status.md

@@ -0,0 +1,76 @@
+# Status first — what a bare invocation does
+
+A skill named with no phase is a **question, not an instruction**. Report status, say what
+you would do next, and wait. This is the default for every lifecycle skill.
+
+## Read-only means read-only
+
+With no phase argument, you may read local packages, run `aifabrix auth status`, and run
+read-only inspection such as `show --online` and `list`. You may **not**:
+
+- upload, deploy, publish, or promote anything
+- advance a plan task or mark one done
+- create proof assets, Evidence, Knowledge, or tests
+- run assistant cases or any command that mutates external state
+
+Never infer a phase from "the safe next eligible one". Ambiguity is a reason to ask, not a
+licence to start. Read-only inspection is still allowed when the user names a phase that
+cannot run yet — report why instead of doing adjacent work.
+
+## Open by saying what you are about to do
+
+Before the first command of any phase, state in one line what the phase will change and
+what it will leave alone. A user who has not used this kit before cannot consent to work
+they cannot see coming.
+
+## Offer the route, do not choose it
+
+Use the host's native selection control and the canonical route options in
+[interaction.md](interaction.md). Proceed only on an explicit choice. Do not print a
+`Choose:` block when a structured question control is available.
+
+## Always report the combined matrix
+
+Report every row, in this order, for any status, phase result, or completion claim. Use
+`UNKNOWN` for anything not measured — never omit a row and never fill one by inference.
+[delivery-verdict.js](../aifabrix-connected-system/scripts/delivery-verdict.js) computes
+the verdict rows from what you observed.
+
+| Row | Where the value comes from |
+| --- | --- |
+| Package | `aifabrix validate <key>` — `Validation passed!` / `Validation failed!` (`--format json` gives `valid`) |
+| Online | `aifabrix show <key> --online` — `Draft` / `Published` / `Archived`; `--json` returns the raw lowercase status |
+| AI Readiness | **no CLI surface** — record what the portal shows, or report `UNKNOWN` |
+| Operations | `aifabrix verify-operations <key> --json` — `verdict`, `operationalReadinessPercent` |
+| Trust | `aifabrix verify-trust <key> --json` — `verdict`, `aiTrustPercent` |
+| Governance | `aifabrix verify-governance <key> --json` — `verdict`, `policyCoveragePercent` |
+| Role Assistant | `aifabrix role-assistant test <roleKey> --json` — `verdict`, `certification`. **Availability is an operator action with no CLI surface**: confirm it explicitly or report `UNKNOWN` |
+| Prove readiness | computed — READY or BLOCKED |
+| Delivery | computed — overall verdict |
+
+Pillar verdicts are `VERIFIED`, `FAILED`, `NOT_VERIFIED`, `NOT_APPLICABLE` — never `PASSED`.
+`NOT_VERIFIED` is **not** a pass: it is where a pillar sits until it has been proved.
+Certification is a separate axis (`BRONZE`…`PLATINUM`, `TECHNICALLY_READY`…), never a
+substitute for a verdict.
+
+`READY`, `BUILT`, `PASS`, `PASS_WITH_SKIPS`, `NEEDS_FIXES` and `BLOCKED` are this kit's
+delivery vocabulary, not CLI output. Never quote them as if a command printed them.
+
+## Never headline a success the verdict does not support
+
+When Delivery is `NEEDS_FIXES` or `BLOCKED`, do not open with a bare `READY`, `BUILT`,
+`PASS`, or "all checks passed". Qualify every claim with its scope:
+
+```text
+Package: BUILT · Online: Draft · Operations: FAILED 60% · Delivery: NEEDS_FIXES · Prove: BLOCKED
+```
+
+A green package gate is a statement about files on disk. It says nothing about whether the
+system is published, whether it behaves correctly, or whether the business case is proven.
+
+## A known failure stays open
+
+A runtime, governance, persistence, or E2E failure remains active until **that same
+concern** is rerun and passes. Later structural or integration success does not clear it,
+and neither does a rerun of a different layer. Carry open failures into every subsequent
+status report until they are genuinely resolved.

package/templates/agent-kit/workspace/BUILDER_IMPROVEMENT_FINDINGS.md

@@ -0,0 +1,27 @@
+# Builder improvement findings
+
+Generic gaps in the Builder CLI, the Agent Kit skills, or the platform. Created
+once by `aifabrix agent-kit install` and owned by this workspace from then on;
+update never rewrites it.
+
+File a finding here instead of editing `.agents/skills/**`, which
+`aifabrix agent-kit update` rewrites. Never weaken a gate, assertion, or test to
+make a finding go away.
+
+Keep customer specifics out: no correlation ids, audit refs, internal URLs,
+tenant or record identifiers, hostnames, or customer names. A reader outside
+this workspace should still be able to act on it. Anything customer-specific
+belongs in `integration/<systemKey>/README.md` or the role's `learning.md`.
+
+Newest first.
+
+## YYYY-MM-DD — One line naming the gap
+
+Command: the exact command, with customer values replaced by placeholders.
+
+Observed: what happened, including the error text and the verdict.
+
+Expected: what should have happened, and why that is the reasonable behavior.
+
+Scope: whether this reproduces outside this workspace, and what is still
+unproven. Say so plainly when the root cause is not established.

package/templates/applications/builder-api/application.yaml

@@ -5,7 +5,7 @@ app:
   description: 'Business Transformation services — HTTP orchestration for connected-system workspace lifecycle via Dataplane Enterprise MCP and governance APIs.'
   type: webapp
   language: typescript
-  version: 2.59.0
+  version: 2.61.2
 
 # Image Configuration
 image:

package/templates/applications/builder-api/env.template

@@ -23,11 +23,15 @@ MAX_UPLOAD_TIMEOUT_MS=300000
 # =============================================================================
 # url:// resolves after kv:// at resolve time (see docs/configuration/resolve-running-urls.md)
 
+# Governed configuration uses per-application client credentials by default. The SDK loads
+# its bootstrap snapshot and refreshes it automatically within two minutes; consumers decide
+# whether a changed key also requires an internal client or resource to be recreated.
+MISO_AUTH_MODE=client-credentials
 # Registered OAuth client (populated by aifabrix app register / bootstrap — same as dataplane)
 MISO_CLIENTID=kv://builder-api-client-idKeyVault
 MISO_CLIENTSECRET=kv://builder-api-client-secretKeyVault
 
-# Internal: controller API for token validation (supports all miso-controller auth modes)
+# Private service-to-service controller origin. Public or remote controller origins require HTTPS.
 MISO_CONTROLLER_URL=url://miso-controller-internal
 # Public: OAuth profile and remaining-step links shown to vendors (not Docker DNS)
 MISO_CONTROLLER_PUBLIC_URL=url://miso-controller-public

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.71
+  version: 2.0.79
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -98,7 +98,35 @@ build:
 #   (never product OPENAI_* / AZURE_OPENAI_*). ≥2 providers →
 #   ENTERPRISE_LLM_DEFAULT_SELECTOR (portal/env deploy default); Environment
 #   Settings ai.llmProvider overrides without redeploy.
-# - ENVIRONMENT → set by deployment target
+# - ENVIRONMENT → resolved per environment below
+
+# =============================================================================
+# Environment Resolution
+# =============================================================================
+# One installation runs dev, tst and pro Dataplanes side by side
+# (environmentScopedResources: true), so these values vary by environment, not by
+# resource group. There is no `platforms:` section: nothing here depends on which
+# stack the installation is. env.template consumes the names as {NAME}.
+environments:
+  - environment: dev
+    configuration:
+      - name: ENVIRONMENT
+        value: 'dev'
+      - name: PIPELINE_ENV_KEY
+        value: 'dev'
+  - environment: tst
+    configuration:
+      - name: ENVIRONMENT
+        value: 'tst'
+      - name: PIPELINE_ENV_KEY
+        value: 'tst'
+  - environment: pro
+    configuration:
+      - name: ENVIRONMENT
+        value: 'pro'
+      # Empty keeps the existing behaviour: derive the key from MISO_CLIENTID.
+      - name: PIPELINE_ENV_KEY
+        value: ''
 
 configuration:
   # -------------------------------------------------------------------------

package/templates/applications/dataplane/env.template

@@ -8,8 +8,8 @@
 
 # HTTP port for the app
 PORT=${PORT}
-# dev | tst | pro
-ENVIRONMENT=dev
+# dev | tst | pro. Resolved from the deployment environment; local Docker is dev.
+ENVIRONMENT={ENVIRONMENT}
 # Enable debug mode
 DEBUG=false
 # Logging level: DEBUG, INFO, WARNING, ERROR, CRITICAL
@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.71
+VERSION=2.0.79
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5
@@ -98,6 +98,15 @@ DB_3_PASSWORD=kv://databases-dataplane-3-passwordKeyVault
 # so Docker dataplane + miso-controller do not exhaust max_connections alongside make dev.
 # SAME_SERVER_POOL_BUDGET=24
 
+# Transaction lifetime guardrails (587.0). Loaders run remote/AI/file work outside
+# transactions; these are leak guards and telemetry, not the normal control path.
+# idle_in_transaction_session_timeout applied to every Dataplane engine (seconds, 0 = off).
+DB_IDLE_IN_TRANSACTION_TIMEOUT_SECONDS=60
+# Warn (sanitized: loader/phase/duration/counts/correlation only) when one transaction exceeds this.
+DB_SLOW_TRANSACTION_WARN_SECONDS=5
+# Upper bound of rows per Evidence bulk load request (atomic below the bound; larger fails before mutation).
+EVIDENCE_LOAD_MAX_ITEMS=500
+
 # =============================================================================
 # REDIS CONFIGURATION
 # =============================================================================
@@ -128,6 +137,18 @@ ABAC_POLICY_PARSE_CACHE_MAX_ENTRIES=2048
 # AUTHENTICATION CONFIGURATION
 # =============================================================================
 
+# MISO governed configuration runtime (583.0): client credentials are active by default.
+# The SDK uses the per-application credentials below to load its bootstrap snapshot and
+# refreshes it automatically within two minutes. Changed names invoke application refresh
+# handlers; a handler may still recreate an internal resource such as a DB or Redis client.
+# Override with MISO_AUTH_MODE=local only for an explicit .env/dotenv development flow.
+# Invalidation (denial/expiry) stops new secret-dependent work and makes health unhealthy.
+# Health: /health, /api/v1/health and /api/v1/health/platform return HTTP 503 with
+# reasonCode misoTokenUnavailable | misoTokenRejected | misoControllerUnreachable |
+# misoValidationTimeout whenever the Controller does not accept the live client
+# token — in LOCAL_MODE too. These endpoints measure usable application health,
+# not process liveness.
+MISO_AUTH_MODE=client-credentials
 # MISO Application Client Credentials (per application)
 # Backend-only: never expose MISO_CLIENTSECRET to the Vite frontend (use VITE_* in app-ui).
 MISO_CLIENTID=kv://dataplane-client-idKeyVault
@@ -143,7 +164,8 @@ KEYCLOAK_REALM=aifabrix
 # =============================================================================
 # Public: browser redirects and CORS (includes /controller front-door path from miso-controller application.yaml).
 MISO_WEB_SERVER_URL=url://miso-controller-public
-# Internal: server-to-controller API calls (Docker: service:port; local: host:port — no front-door path).
+# Private service-to-service controller origin. The SDK permits HTTP only for a local/private
+# target; public or remote controller origins still require HTTPS.
 MISO_CONTROLLER_URL=url://miso-controller-internal
 # Browser logout page on miso-controller (path relative to MISO_WEB_SERVER_URL; not dataplane /login).
 MISO_LOGOUT_URL=/logout
@@ -151,7 +173,7 @@ MISO_LOGOUT_URL=/logout
 # Environment key sent to miso-controller (e.g. environmentKey on RBAC/register) when not supplied in the payload.
 # Set MISO_PIPELINE_ENV_KEY=dev when the controller installation uses dev (e.g. MISO_CLIENTID=miso-controller-dev-dataplane).
 # If unset, derived from MISO_CLIENTID (e.g. dev from miso-controller-dev-dataplane).
-MISO_PIPELINE_ENV_KEY=
+MISO_PIPELINE_ENV_KEY={PIPELINE_ENV_KEY}
 
 # LLM: chat/embed route through governed enterprise-llm only. Provider credentials
 # live on LLM provider external systems + dataplane secret store (not product .env).
@@ -334,3 +356,12 @@ TRUST_AI_EXPOSURE_GATE_ENABLED=false
 # when 346.rules / §17 revisions must invalidate existing certificates without matching rulesVersion.
 CERTIFICATION_DATASOURCE_SCHEMA_VERSION=
 CERTIFICATION_RULES_VERSION=
+
+# =============================================================================
+# DIMENSION ABAC ENFORCEMENT (589.0)
+# =============================================================================
+# false (default): Stage 1 dimension ABAC scope services do not enforce
+# external-system/source assignment scope, client-principal system binding or
+# subscription owner scope (RBAC permissions still apply).
+# true: enforce the Dimension ABAC certification rules (2026-09-21).
+DIMENSION_ABAC_ENFORCEMENT_ENABLED=false

package/templates/applications/keycloak/application.yaml

@@ -9,7 +9,12 @@ app:
 # Image Configuration
 image:
   name: aifabrix/keycloak
-  tag: '26.7.3-aifabrix.1'
+  # `latest`, like every other app here. The Keycloak version lives in app.version above,
+  # which is what `aifabrix push --tag 'latest,{version}'` expands, so nothing is lost by
+  # not repeating it here. Pinning it made `aifabrix run` look for keycloak-dev1:<version>
+  # while `aifabrix build` only ever produces :latest, so dev-build-kc failed with
+  # "Docker image not found" on an image it had just built.
+  tag: latest
   registry: aifabrixacr.azurecr.io
   registryMode: external
 

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.82'
+  version: '2.0.89'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -75,6 +75,101 @@ repository:
 # - DATABASE_URL, REDIS_URL, KEYCLOAK_* → auto-generated during Azure install
 # - Other MISO_*, AZURE_*, kv:// → credentials and system parameters
 # - PORT, NODE_ENV, MISO_ENVIRONMENT → set by deployment target
+# - LOCATION → resolved from the platform match below
+
+# =============================================================================
+# Platform Resolution (target Azure resource group decides)
+# =============================================================================
+# One controller per installation (MISO_ENVIRONMENT=miso), so the values that vary
+# are stack-level, not per environment: there is no `environments:` section.
+# env.template consumes these names as {NAME}.
+platforms:
+  # Production is matched first and by its literal name, because its host is not the suffixed
+  # pattern the other platforms follow: `platform.aifabrix.dev`, not `platform-pro.aifabrix.dev`.
+  - resource: aifabrix-int-pro
+    name: aifabrix
+    platform: pro
+    configuration:
+      - name: LOCATION
+        value: 'swedencentral'
+      - name: MORI_BASE_URL
+        value: 'https://platform.aifabrix.dev/mori'
+
+  # Local Docker runs. No resource group is supplied, so `matchLocalPlatform` takes the FIRST entry
+  # declaring the local platform (`dev`) -- this one -- and the literal `aifabrix-local` can never
+  # match a real group, so Azure deployments fall through to the entries below.
+  #
+  # It MUST sit above `aifabrix-int-{platform}`: that entry also resolves to `dev`, so without this
+  # one a local stack took `https://platform-dev.aifabrix.dev/mori` -- a host that does not exist on
+  # a developer machine. Measured on dev01 2026-09-28: every Mori call failed with `socket hang up`,
+  # and `LicenseValidationService.pickupLicenseFromMori` maps that transport failure to
+  # `LicenseInvalidError`, which surfaces as **HTTP 403** on
+  # `POST /api/ide/onboarding/license/pickup`. A connection failure reported as Forbidden sent the
+  # investigation after api-key permissions for days (mori 48.0 `reproduce-license-pickup-403`).
+  #
+  # Service-to-service traffic has no reason to leave the cluster through the public edge, and the
+  # public host is not even resolvable from inside the container. Verified from the miso-controller
+  # container: `http://mori-controller:3004/api/v1/health` answers 200 while both
+  # `platform-dev.aifabrix.dev` and `dev01.aifabrix.dev` fail to connect.
+  #
+  # The value is the declarative `url://` form rather than a literal host, so the Builder resolves
+  # it from the platform topology the same way Mori's own env.template resolves
+  # `url://miso-controller-internal`. A literal would be a second place to edit whenever the local
+  # service address changes, and the whole point of `url://` is that there is one.
+  #
+  # Verified on dev01 that this is the reachable address and that the `/mori` prefix it carries is
+  # served: from the miso-controller container both `http://mori-controller:3004/api/v1/health` and
+  # `http://mori-controller:3004/mori/api/v1/health` answer 200. `moriApiBase()` appends `/api/v1`.
+  #
+  # NOT `kv://mori-controller-web-server-url`, which is what the entries below deliberately moved
+  # away from: that reads the application RECORD, and on aifabrix-ce-16 the record still held
+  # `http://localhost:3004`. `url://` is resolved from the topology at resolve time, not from a
+  # record an Azure deployment never overwrites.
+  - resource: aifabrix-local
+    name: aifabrix
+    platform: dev
+    configuration:
+      - name: LOCATION
+        value: 'swedencentral'
+      - name: MORI_BASE_URL
+        value: 'url://mori-controller-internal'
+
+  - resource: aifabrix-int-{platform}
+    name: aifabrix
+    options: [dev, tst]
+    configuration:
+      - name: LOCATION
+        value: 'swedencentral'
+      # Mori the installation talks to. Previously `kv://mori-controller-web-server-url`, which
+      # resolved to whatever the *application record* held — on aifabrix-ce-16 that was
+      # `http://localhost:3004`, because an Azure deployment never overwrites a stale URL, so every
+      # consumer of it was pointed at a loopback address that does not exist in the cluster.
+      - name: MORI_BASE_URL
+        value: 'https://platform-{platform}.aifabrix.dev/mori'
+
+  - resource: aifabrix-ce-*
+    name: '*'
+    # The group carries no dev|tst|pro token, so the platform is declared.
+    platform: dev
+    configuration:
+      - name: LOCATION
+        value: 'swedencentral'
+      # The App Service hostname, not the Front Door one, because only this is derivable.
+      #
+      # The Front Door endpoint carries an Azure-generated suffix (`fzahchbachcfbgaj`) that no
+      # template can spell: `{platform}`, `{platform.name}` and `{resourceGroup}` are the only
+      # tokens, and none of them yields it. The previous literal was aifabrix-ce-16's endpoint and
+      # was therefore wrong for every other `aifabrix-ce-*` installation -- the next one built would
+      # have pointed its Miso at ce-16's Mori.
+      #
+      # The web app is named `{resourceGroup}-miso-mori-controller` by the installer, so its default
+      # hostname IS derivable and is correct for every installation in the group. Verified on
+      # aifabrix-ce-16 2026-09-27: that host answers /mori/health with 200. This is also the better
+      # address for Miso->Mori traffic, which is service-to-service and has no reason to leave the
+      # cluster through the public edge. When the named platform hosts exist
+      # (`platform-dev.aifabrix.dev/mori`) this entry can follow the pattern used above.
+      - name: MORI_BASE_URL
+        value: 'https://{resourceGroup}-miso-mori-controller.azurewebsites.net/mori'
 
 configuration:
   # -------------------------------------------------------------------------