@aifabrix/builder 2.61.2 → 2.62.0

package/templates/applications/miso-controller/env.template

@@ -11,7 +11,8 @@
 #   [saasDirect]    eSystems-hosted SaaS activation (four-step wizard)
 #   [customerOwned] Azure-in-tenant activation (existing TA wizard)
 #
-# ONBOARDING_MODE selects the onboarding step list. It is orthogonal to DEPLOYMENT,
+# ONBOARDING_MODE selects the onboarding step list. saasDirect also enables the local wizard.
+# It is orthogonal to DEPLOYMENT,
 # which selects Azure SDK vs local execution. There is NO fifth DEPLOYMENT value:
 # eSystems-hosted SaaS still runs DEPLOYMENT=azure. See the DEPLOYMENT TYPE and
 # ONBOARDING MODE sections below.
@@ -40,14 +41,28 @@
 # Optional custom controller key for onboarding (default: miso-controller)
 ONBOARDING_CONTROLLER_KEY=miso-controller
 
-# Infrastructure/service name used by controller/onboarding flows
-INFRASTRUCTURE_NAME=${DEV_USERNAME}.${DEV_ROOT_DOMAIN}
-
 # Azure region (required for first-time onboarding: controller record / provisioning metadata).
 # Use the region you deploy to (e.g. westeurope, eastus, northeurope). Single env name: LOCATION.
 # Resolved from the platform match; see `platforms` in application.yaml.
 LOCATION={LOCATION}
 
+# Which kind of installation this is, for licence binding. Declared, never inferred.
+#
+# `resolveCloudVendor` falls back to "AZURE_SUBSCRIPTION_ID is set, therefore Azure", and every
+# developer box has that variable from the shared development service principal. A local stack was
+# then bound as an Azure installation, which requires a directory tenant AND a resource group; a
+# developer box has no resource group, so licence binding refused and the licence guard returned
+# HTTP 403 for every guarded operation — `app rotate-secret` included, which is precisely the
+# command needed to recover a credential the controller had re-minted.
+#
+# Resolved from the platform match: `docker` locally, `azure` for every real resource group.
+CLOUD_VENDOR={CLOUD_VENDOR}
+
+# The one installation name the licence binds to (plan 266.0). Not a label: Miso sends it to Mori
+# as `resourceGroupName`, and docker requires exactly `local-dev{NN}` or registration refuses.
+# `${DEV_USERNAME}` yields `local-dev03`. It is the only name a local install declares.
+MISO_INSTALLATION_NAME=local-${DEV_USERNAME}
+
 # Required for admin user creation during onboarding
 # Password for the initial administrator user (username: admin)
 ONBOARDING_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
@@ -151,7 +166,6 @@ KEYCLOAK_CLIENT_ID=kv://keycloak-client-idKeyVault
 KEYCLOAK_CLIENT_SECRET=kv://keycloak-client-secretKeyVault
 KEYCLOAK_ADMIN_USERNAME=admin
 KEYCLOAK_ADMIN_PASSWORD=kv://keycloak-admin-passwordKeyVault
-KEYCLOAK_PUBLIC_KEY=
 KEYCLOAK_VERIFY_AUDIENCE=false
 KEYCLOAK_TOKEN_TIMEOUT=5000
 KEYCLOAK_DEFAULT_PASSWORD=kv://keycloak-default-passwordKeyVault
@@ -291,12 +305,12 @@ DEPLOYMENT=database
 #
 # customerOwned = Azure-in-tenant wizard
 #                 consent → identity → size → access-model → endpoint → validation
-# saasDirect    = eSystems-hosted activation
-#                 consent → identity → endpoint (domain only) → review
+# saasDirect    = hosted or local Docker guided activation
+#                 consent → endpoint (local browser URL or optional domain) → identity → review
 #                 Omits size, access-model, customer deploy and platform-apps.
 #
 # Unset defaults to customerOwned. An unknown value fails closed with HTTP 400.
-ONBOARDING_MODE=customerOwned
+ONBOARDING_MODE=saasDirect
 
 # Dev/test: show TA Entra "Completing setup" countdown (120s cap). Default false.
 # Exposed to UI via GET /api/v1/tenant/status → showTaCountdown (restart controller after change).
@@ -311,9 +325,10 @@ SHOW_TA_COUNT_DOWN=false
 ENCRYPTION_KEY=kv://miso-controller-secrets-encryptionKeyVault
 
 # Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only).
-# Environment placement is a separate controller rule: workloads (dataplane, builder-api) install into
-# dev/tst/pro but never `miso`; miso-controller and keycloak only into `miso`; mori-controller anywhere.
-BOOTSTRAP_APPKEYS=dataplane,builder-api,mori-controller
+# Environment placement is a separate controller rule: workloads (dataplane, customer apps) install
+# into dev/tst/pro but never `miso`; miso-controller, keycloak, builder-api, and integration-server
+# only into `miso`; mori-controller anywhere.
+BOOTSTRAP_APPKEYS=dataplane,builder-api,integration-server,mori-controller
 
 # Key Vault Integration (for security parameter encryption)
 # Set to true to enable Azure Key Vault for storing security parameters
@@ -384,6 +399,25 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=url://mori-controller-public/entra-graph-dele
 # MORI_API_KEY is per-installation and is minted by POST /marketplace/bootstrap; it is written
 # here by the controller after registration, not provisioned ahead of it.
 MORI_BASE_URL={MORI_BASE_URL}
+
+# Mori's policy signing ANCHOR, public half. Verifies the signed enforcement bundle.
+#
+# Mori holds the private half and signs with it; this is the key the bundle is checked against, so
+# an installation that could write it could trust a bundle it signed itself. It is supplied, never
+# generated: on Azure the deployment template writes `mori-policy-public-keyKeyVault` into the
+# installation vault. Locally it is per developer, because each box's Mori holds its own pair.
+#
+# `pnpm license:sign:local` reads it from here so the command needs no arguments. Export the public
+# half from the local Mori once:
+#
+#   docker exec aifabrix-dev${NN}-mori-controller node -e "const {createPublicKey}=require('crypto');\
+#     process.stdout.write(createPublicKey(process.env.MORI_POLICY_PRIVATE_KEY.replace(/\\n/g,'\n'))\
+#     .export({type:'spki',format:'pem'}).toString())"
+#
+# Empty is valid: an installation with no anchor cannot verify a bundle and says so, rather than
+# accepting one signed by any key.
+MORI_POLICY_PUBLIC_KEY=
+MORI_POLICY_KEY_ID={POLICY_KEY_ID}
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
 # Ask Mori for a container-registry credential when the installation was given none.
 # Off by default: the call has a 30s timeout inside credential resolution, so enabling it on an
@@ -417,37 +451,9 @@ APPLICATIONINSIGHTS_CONNECTION_STRING=kv://appinsights-connectionStringKeyVault
 # OpenTelemetry service name (optional, defaults to miso-controller)
 OTEL_SERVICE_NAME=miso-controller
 
-# OpenTelemetry service version (optional, defaults to npm_package_version or 1.0.0)
-OTEL_SERVICE_VERSION=
-
 # =============================================================================
 # STORAGE CONFIGURATION
 # =============================================================================
 
 # Mount Volume Configuration
 MOUNT_VOLUME=/mnt/data/
-
-# Image registry this installation deploys from.
-#
-# `pipeline-validation-flow.helper.ts` resolves the deploy registry as ACR_LOGIN_SERVER first, then
-# the controller record's `configuration.imageRegistry`. Azure installations get the record from the
-# installer, so this stays EMPTY there and behaviour is unchanged. A local installation matches no
-# platform (`allowLocalPlatform` is false for the controller) and has no record, so without this key
-# every `aifabrix deploy` fails with "Image registry is not configured on the controller
-# installation".
-#
-# EMPTY on purpose. The controller record is read AFTER this and overwrites it, so an Azure
-# installation ignores whatever stands here; only a local installation consumes it.
-#
-# This briefly shipped as `aifabrixce16.azurecr.io` — one test installation's registry, committed
-# into the product, so every developer who did not override it would have pushed and pulled
-# against ce-16 without being told. A `{ACR_LOGIN_SERVER}` token was tried instead and is worse
-# still: nothing resolves it without a resource group, so it breaks `aifabrix build` outright
-# ("no platform or environment configuration resolves it for environment dev").
-#
-# Empty is the honest third answer. An Azure installation is unaffected, and a local
-# `aifabrix deploy` fails with "Image registry is not configured on the controller installation",
-# which names the missing thing. Its proper home is the Builder run tooling, which already knows
-# the answer (`aifabrix dev print-registry`) and should inject it per developer rather than have
-# Miso ship one installation's registry to everybody.
-ACR_LOGIN_SERVER=

package/templates/marketplace/createUiDefinition.json

@@ -5,19 +5,44 @@
   "parameters": {
     "config": {
       "basics": {
-        "description": "Choose subscription, resource group, and region above. Under **Application resources Resource group name**, enter your install id (for example `aifabrixpoc02`). That managed resource group name is the naming prefix: resources become `{rg}-miso-asp`, `{rg}-miso-miso`, and so on. Set the Azure **Application name** to the same id when the portal asks. Enter the initial platform administrator password and choose the license below. Container images are pulled with the web apps' managed identities; no registry credential is needed."
+        "description": "Choose subscription, resource group, and region above. Under **Application resources Resource group name**, enter your install id (for example `aifabrixpoc02`), using at most 16 lowercase characters. That managed resource group name is the naming prefix: resources become `{rg}-miso-asp`, `{rg}-miso-miso`, and so on. Set the Azure **Application name** to the same id when the portal asks. Enter the initial platform administrator password and choose the license below. Container images are pulled with the web apps' managed identities; no registry credential is needed.",
+        "resourceGroup": {
+          "constraints": {
+            "validations": [
+              {
+                "regex": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$",
+                "message": "Use lowercase letters, digits and single hyphens, starting with a letter. The name becomes the prefix for every resource, and the Key Vault created as {name}-miso-kv must start with a letter and cannot contain consecutive or trailing hyphens."
+              },
+              {
+                "regex": "^.{1,16}$",
+                "message": "Use at most 16 characters. The name becomes the prefix for every resource: the Key Vault is created as {name}-miso-kv, and Azure limits a Key Vault name to 24 characters."
+              }
+            ]
+          }
+        }
       }
     },
     "basics": [
+      {
+        "name": "adminEmail",
+        "type": "Microsoft.Common.TextBox",
+        "label": "Administrator email",
+        "toolTip": "Email for the initial platform administrator and installation welcome.",
+        "constraints": {
+          "required": true,
+          "regex": "^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$",
+          "validationMessage": "Enter a valid email address."
+        }
+      },
       {
         "name": "adminPassword",
         "type": "Microsoft.Common.PasswordBox",
         "label": "Administrator password",
-        "toolTip": "Password for the initial AI Fabrix platform administrator (user admin). PostgreSQL, Keycloak, and encryption secrets are generated automatically and stored in Key Vault — do not reuse this password for infrastructure.",
+        "toolTip": "Password for the initial AI Fabrix platform administrator (user admin). PostgreSQL, Keycloak, and encryption secrets are generated automatically and stored in Key Vault \u2014 do not reuse this password for infrastructure.",
         "constraints": {
           "required": true,
           "regex": "^.{8,128}$",
-          "validationMessage": "Password must be 8–128 characters."
+          "validationMessage": "Password must be 8\u2013128 characters."
         },
         "options": {
           "hideConfirmation": false
@@ -63,6 +88,27 @@
           "regex": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
           "validationMessage": "Enter the Marketplace subscription ID as a GUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)."
         }
+      },
+      {
+        "name": "installationResourceModel",
+        "type": "Microsoft.Common.DropDown",
+        "label": "Initial infrastructure",
+        "toolTip": "Choose Shared for Community or Standard. Choose Dedicated DEV for Enterprise. This provisions infrastructure before licence issuance; it does not grant licence entitlements.",
+        "defaultValue": "Shared (Community / Standard)",
+        "constraints": {
+          "required": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]",
+          "allowedValues": [
+            {
+              "label": "Shared (Community / Standard)",
+              "value": "shared"
+            },
+            {
+              "label": "Dedicated DEV (Enterprise)",
+              "value": "dedicated"
+            }
+          ]
+        },
+        "visible": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]"
       }
     ],
     "steps": [],
@@ -71,7 +117,9 @@
       "deploymentEnvironment": "evaluation",
       "adminPassword": "[basics('adminPassword')]",
       "licenseEdition": "[if(equals(basics('licenseChoice'), 'SUBSCRIPTION_ID'), basics('licenseSubscriptionKey'), basics('licenseChoice'))]",
-      "acrResourceId": "__MARKETPLACE_ACR_RESOURCE_ID__"
+      "acrResourceId": "__MARKETPLACE_ACR_RESOURCE_ID__",
+      "installationResourceModel": "[if(equals(basics('licenseChoice'), 'SUBSCRIPTION_ID'), basics('installationResourceModel'), if(equals(basics('licenseChoice'), 'ENTERPRISE'), 'dedicated', 'shared'))]",
+      "adminEmail": "[basics('adminEmail')]"
     }
   }
 }

package/templates/marketplace/main.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.47.16.16243",
-      "templateHash": "8811550299172477333"
+      "templateHash": "703508813427294425"
     }
   },
   "parameters": {
@@ -165,6 +165,13 @@
         "description": "Mori licence issuer public key in SPKI PEM form. Empty leaves the installation unpinned, and Miso then refuses a licence rather than trusting a key carried inside it."
       }
     },
+    "moriPolicyPublicKey": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Mori policy signing anchor public key in SPKI PEM form. A different pair from the licence key. Empty leaves the policy bundle without an independent anchor, so it can only be checked against the key it carries."
+      }
+    },
     "moriLicenseIssuer": {
       "type": "string",
       "defaultValue": "mori-controller",
@@ -214,6 +221,21 @@
         "description": "License the installation requests from Mori during tenant activation: an edition name (COMMUNITY, STANDARD, ENTERPRISE) or an Azure Marketplace subscription ID (UUID). Plain string — Miso validates it. Emitted as LICENSE_EDITION."
       }
     },
+    "adminEmail": {
+      "type": "string",
+      "minLength": 3,
+      "metadata": {
+        "description": "Email of the initial platform administrator, used for the installation welcome."
+      }
+    },
+    "installationResourceModel": {
+      "type": "string",
+      "defaultValue": "shared",
+      "allowedValues": ["shared", "dedicated"],
+      "metadata": {
+        "description": "Initial installation topology, protected by Azure application configuration: shared for CE/SE; dedicated for EE DEV. Does not grant later licence entitlements."
+      }
+    },
     "onboardingMode": {
       "type": "string",
       "defaultValue": "customerOwned",
@@ -2216,7 +2238,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "10929433789276981779"
+              "templateHash": "6426728474798954933"
             }
           },
           "parameters": {
@@ -2409,7 +2431,7 @@
                   "appCommandLine": "start --optimized=false",
                   "healthCheckPath": "[variables('keycloakHealthCheckPath')]",
                   "alwaysOn": true,
-                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_PORT', 'value', '8080'), createObject('name', 'KEYCLOAK_ADMIN', 'value', parameters('keycloakAdminUser')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(SecretUri={0})', reference(resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-keycloak-admin-password', parameters('prefix'))), '2023-07-01').secretUriWithVersion)), createObject('name', 'KC_DB', 'value', 'postgres'), createObject('name', 'KC_DB_URL_HOST', 'value', parameters('postgresServerFqdn')), createObject('name', 'KC_DB_URL_DATABASE', 'value', parameters('postgresDatabaseName')), createObject('name', 'KC_DB_URL_PORT', 'value', '5432'), createObject('name', 'KC_DB_URL', 'value', format('jdbc:postgresql://{0}:5432/{1}', parameters('postgresServerFqdn'), parameters('postgresDatabaseName'))), createObject('name', 'KC_DB_USERNAME', 'value', parameters('postgresAdminLogin')), createObject('name', 'KC_DB_PASSWORD', 'value', format('@Microsoft.KeyVault(SecretUri={0})', reference(resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-postgres-admin-password', parameters('prefix'))), '2023-07-01').secretUriWithVersion)), createObject('name', 'KC_HOSTNAME', 'value', format('{0}.azurewebsites.net', parameters('name'))), createObject('name', 'KC_HOSTNAME_URL', 'value', format('https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'KC_HOSTNAME_ADMIN_URL', 'value', format('https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'KC_HOSTNAME_STRICT', 'value', 'false'), createObject('name', 'KC_HOSTNAME_STRICT_BACKEND', 'value', 'false'), createObject('name', 'KC_HOSTNAME_STRICT_HTTPS', 'value', 'false'), createObject('name', 'KC_HTTP_ENABLED', 'value', 'true'), createObject('name', 'KC_HTTP_RELATIVE_PATH', 'value', variables('keycloakHttpRelativePath')), createObject('name', 'KC_HTTP_MANAGEMENT_ENABLED', 'value', 'true'), createObject('name', 'KC_HTTP_MANAGEMENT_PORT', 'value', '9000'), createObject('name', 'KC_HTTP_MANAGEMENT_HEALTH_ENABLED', 'value', 'false'), createObject('name', 'KC_PROXY', 'value', 'edge'), createObject('name', 'KC_PROXY_HEADERS', 'value', 'xforwarded'), createObject('name', 'KC_PROXY_HEADERS_FORWARDED', 'value', 'true'), createObject('name', 'KC_HEALTH_ENABLED', 'value', 'true'), createObject('name', 'KC_CACHE', 'value', 'local'), createObject('name', 'KC_FEATURES', 'value', 'preview,cimd'), createObject('name', 'KC_SPI_EMAIL_SENDER__PROVIDER', 'value', 'mori'), createObject('name', 'KC_METRICS_ENABLED', 'value', 'true'), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'KC_LOG', 'value', 'console'), createObject('name', 'KC_LOG_LEVEL', 'value', 'INFO')), variables('appInsightsAppSettings'), variables('acrRegistryUrlAppSettings'), variables('acrRegistryCredentialAppSettings'))]",
+                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_PORT', 'value', '8080'), createObject('name', 'KEYCLOAK_ADMIN', 'value', parameters('keycloakAdminUser')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(SecretUri={0})', reference(resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-keycloak-admin-password', parameters('prefix'))), '2023-07-01').secretUriWithVersion)), createObject('name', 'KC_DB', 'value', 'postgres'), createObject('name', 'KC_DB_URL_HOST', 'value', parameters('postgresServerFqdn')), createObject('name', 'KC_DB_URL_DATABASE', 'value', parameters('postgresDatabaseName')), createObject('name', 'KC_DB_URL_PORT', 'value', '5432'), createObject('name', 'KC_DB_URL', 'value', format('jdbc:postgresql://{0}:5432/{1}', parameters('postgresServerFqdn'), parameters('postgresDatabaseName'))), createObject('name', 'KC_DB_USERNAME', 'value', parameters('postgresAdminLogin')), createObject('name', 'KC_DB_PASSWORD', 'value', format('@Microsoft.KeyVault(SecretUri={0})', reference(resourceId('Microsoft.KeyVault/vaults/secrets', last(split(parameters('keyVaultId'), '/')), format('{0}-postgres-admin-password', parameters('prefix'))), '2023-07-01').secretUriWithVersion)), createObject('name', 'KC_HOSTNAME_STRICT', 'value', 'false'), createObject('name', 'KC_HOSTNAME_BACKCHANNEL_DYNAMIC', 'value', 'false'), createObject('name', 'KC_HOSTNAME_STRICT_BACKEND', 'value', 'false'), createObject('name', 'KC_HOSTNAME_STRICT_HTTPS', 'value', 'false'), createObject('name', 'KC_HTTP_ENABLED', 'value', 'true'), createObject('name', 'KC_HTTP_RELATIVE_PATH', 'value', variables('keycloakHttpRelativePath')), createObject('name', 'KC_HTTP_MANAGEMENT_ENABLED', 'value', 'true'), createObject('name', 'KC_HTTP_MANAGEMENT_PORT', 'value', '9000'), createObject('name', 'KC_HTTP_MANAGEMENT_HEALTH_ENABLED', 'value', 'false'), createObject('name', 'KC_PROXY', 'value', 'edge'), createObject('name', 'KC_PROXY_HEADERS', 'value', 'xforwarded'), createObject('name', 'KC_PROXY_HEADERS_FORWARDED', 'value', 'true'), createObject('name', 'KC_HEALTH_ENABLED', 'value', 'true'), createObject('name', 'KC_CACHE', 'value', 'local'), createObject('name', 'KC_FEATURES', 'value', 'preview,cimd'), createObject('name', 'KC_SPI_EMAIL_SENDER__PROVIDER', 'value', 'mori'), createObject('name', 'KC_METRICS_ENABLED', 'value', 'true'), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'KC_LOG', 'value', 'console'), createObject('name', 'KC_LOG_LEVEL', 'value', 'INFO')), variables('appInsightsAppSettings'), variables('acrRegistryUrlAppSettings'), variables('acrRegistryCredentialAppSettings'))]",
                   "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
                 },
                 "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
@@ -2524,6 +2546,9 @@
           "moriLicensePublicKey": {
             "value": "[parameters('moriLicensePublicKey')]"
           },
+          "moriPolicyPublicKey": {
+            "value": "[parameters('moriPolicyPublicKey')]"
+          },
           "moriBaseUrl": {
             "value": "[parameters('moriBaseUrl')]"
           }
@@ -2535,7 +2560,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "445562478593270876"
+              "templateHash": "4650500285752133401"
             }
           },
           "parameters": {
@@ -2618,6 +2643,13 @@
                 "description": "Mori licence issuer public key (SPKI PEM). Empty leaves the installation unpinned."
               }
             },
+            "moriPolicyPublicKey": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori policy signing anchor public key (SPKI PEM). Empty leaves the policy bundle without an independent anchor."
+              }
+            },
             "moriBaseUrl": {
               "type": "string",
               "defaultValue": "",
@@ -2735,6 +2767,15 @@
                 "value": "[parameters('moriLicensePublicKey')]"
               }
             },
+            {
+              "condition": "[not(empty(parameters('moriPolicyPublicKey')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-policy-public-keyKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriPolicyPublicKey')]"
+              }
+            },
             {
               "condition": "[not(empty(parameters('moriBaseUrl')))]",
               "type": "Microsoft.KeyVault/vaults/secrets",
@@ -2856,9 +2897,15 @@
           "entraIdTenantId": {
             "value": "[variables('effectiveEntraIdTenantId')]"
           },
+          "adminEmail": {
+            "value": "[parameters('adminEmail')]"
+          },
           "licenseEdition": {
             "value": "[parameters('licenseEdition')]"
           },
+          "installationResourceModel": {
+            "value": "[parameters('installationResourceModel')]"
+          },
           "onboardingMode": {
             "value": "[parameters('onboardingMode')]"
           },
@@ -2879,7 +2926,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "13342696621269025420"
+              "templateHash": "9991546815810387946"
             }
           },
           "parameters": {
@@ -3110,6 +3157,21 @@
                 "description": "Requested license: edition name (COMMUNITY, STANDARD, ENTERPRISE) or Azure Marketplace subscription ID (UUID). Validated by Miso. Emitted as LICENSE_EDITION."
               }
             },
+            "adminEmail": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Initial platform administrator email."
+              }
+            },
+            "installationResourceModel": {
+              "type": "string",
+              "defaultValue": "shared",
+              "allowedValues": ["shared", "dedicated"],
+              "metadata": {
+                "description": "Initial installation topology, protected by Azure application configuration: shared for CE/SE; dedicated for EE DEV. Does not grant later licence entitlements."
+              }
+            },
             "onboardingMode": {
               "type": "string",
               "defaultValue": "customerOwned",
@@ -3206,7 +3268,7 @@
                   "acrUseManagedIdentityCreds": "[not(parameters('registryPasswordConfigured'))]",
                   "healthCheckPath": "/health",
                   "alwaysOn": true,
-                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'DEPLOYMENT', 'value', 'azure'), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode')), createObject('name', 'INSTALLATION_CAPACITY_PROFILE', 'value', parameters('capacityProfile'))), variables('registryCredentialAppSettings'))]",
+                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_EMAIL', 'value', parameters('adminEmail')), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'DEPLOYMENT', 'value', 'azure'), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'INSTALLATION_RESOURCE_MODEL', 'value', parameters('installationResourceModel')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode')), createObject('name', 'INSTALLATION_CAPACITY_PROFILE', 'value', parameters('capacityProfile'))), variables('registryCredentialAppSettings'))]",
                   "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
                 },
                 "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
@@ -3613,7 +3675,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "445562478593270876"
+              "templateHash": "4650500285752133401"
             }
           },
           "parameters": {
@@ -3696,6 +3758,13 @@
                 "description": "Mori licence issuer public key (SPKI PEM). Empty leaves the installation unpinned."
               }
             },
+            "moriPolicyPublicKey": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori policy signing anchor public key (SPKI PEM). Empty leaves the policy bundle without an independent anchor."
+              }
+            },
             "moriBaseUrl": {
               "type": "string",
               "defaultValue": "",
@@ -3813,6 +3882,15 @@
                 "value": "[parameters('moriLicensePublicKey')]"
               }
             },
+            {
+              "condition": "[not(empty(parameters('moriPolicyPublicKey')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-policy-public-keyKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriPolicyPublicKey')]"
+              }
+            },
             {
               "condition": "[not(empty(parameters('moriBaseUrl')))]",
               "type": "Microsoft.KeyVault/vaults/secrets",