Dev

applications/Unity.GrantManager/common.props

@@ -20,6 +20,11 @@
     <!-- Add direct reference to the patched Scriban to ensure all projects importing common.props
          use the safe version (pins transitive consumers that do not specify a version). -->
     <PackageReference Include="Scriban" Version="7.2.5" />
+
+    <!-- System.Security.Cryptography.Xml 8.0.2 (pulled in transitively) has several known high
+         severity vulnerabilities; pin to the same patched version already used directly by
+         Unity.AI.Application so every project importing common.props gets the safe version. -->
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
   </ItemGroup>
 
 </Project>

applications/Unity.GrantManager/modules/Unity.AI/docs/index.md

@@ -30,17 +30,17 @@ UI-facing AI bits:
 
 ## Files
 ### Application
-- `AI/Operations` - validators and helpers
-- `AI/Runtime` - rendering, parsing, logging, provider calls
-- `AI/Prompts` - prompt types and template plumbing
+- `Operations` - validators and helpers
+- `Runtime/Execution` - rendering, parsing, logging, provider calls
+- `Runtime/Prompts` - prompt types and template plumbing
 - `DataSeed` - seeded prompt and operation data
 - `Generation/AIGenerationAppService.cs` - generation API
 
 ### Application.Contracts
-- `AI/IAIService.cs` - runtime contract
+- `IAIService.cs` - runtime contract
 - `Generation/IAIGenerationAppService.cs` - generation app service contract
 - `Generation/*ResultDto.cs` - queued result DTOs
-- `AI/Operations/IAIGenerationPrerequisiteValidator.cs` - queue prerequisites
+- `Operations/IAIGenerationPrerequisiteValidator.cs` - queue prerequisites
 - `Automation/IApplicationAIGenerationQueue.cs` - queue contract
 - `Permissions/*` - permissions
 

applications/Unity.GrantManager/modules/Unity.AI/docs/operation-pipeline.md

@@ -0,0 +1,16 @@
+# AI operation pipeline
+
+AI generation uses a shared operation catalog and queued lifecycle. The catalog owns the operation key, seeded operation name, feature gate, permissions, and whether a form version is required. Submission enters `IAIGenerationAppService.SubmitAsync`, and the Grant Manager queue preserves the existing duplicate-request lock and operation-specific validation.
+
+The generic background-job base owns tenant scope, structured logging, request state transitions, failure handling, and cooldown stamping. Operation-specific executors remain responsible for loading input, calling the AI contract, validating the response, and persisting the result.
+
+## Adding an operation
+
+1. Add an operation definition to `AIGenerationOperations`.
+2. Add the operation's submission payload fields only when shared fields are insufficient.
+3. Add the AI request/response contract and prompt/operation seed.
+4. Implement an `IAIGenerationOperationExecutor` for Grant Manager-specific input and persistence.
+5. Register the executor through the existing transient DI convention.
+6. Add focused catalog, lifecycle, executor, and persistence tests.
+
+Do not add another queue branch for shared lifecycle concerns. New operation behavior belongs in its executor; request locking, status transitions, tenant scope, logging, and cooldown behavior stay in the common pipeline.

applications/Unity.GrantManager/modules/Unity.AI/docs/prompt-map.md

@@ -8,9 +8,16 @@
 - `FormWorksheet` - worksheet generation
 
 ## Versions
-- `v0`, `v1`, `v2` live under `AI/Prompts/Versions`
+- `v0`, `v1`, `v2` live under `Runtime/Prompts/Versions`
 - The seeder loads built-in prompt rows from those versions
-- Runtime selects by prompt family and version
+- Runtime selects the newest active prompt by family.
+
+## Tenant selection
+- `AIOperation.Name` is the prompt family; operations do not pin a prompt row or version.
+- Host requests use the newest active global prompt in the family.
+- Tenant requests use the newest active prompt owned by that tenant, falling back to the newest active global prompt.
+- To roll back a tenant or global prompt, deactivate the active version and leave the prior version active.
+- Tenant prompt rows are administrator-created; deployments seed only global prompts and operations.
 
 ## Prompt rules
 - Versioned prompts are the source of truth.

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Generation/AIGenerationOperationDefinition.cs

@@ -0,0 +1,104 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Unity.AI.Features;
+using Unity.AI.Localization;
+using Unity.AI.Permissions;
+
+namespace Unity.AI.Generation;
+
+public sealed record AIGenerationOperationDefinition(
+    string OperationType,
+    string OperationName,
+    string FeatureName,
+    string DisabledLocalizationKey,
+    string GeneratePermission,
+    string ViewPermission,
+    bool RequiresFormVersion);
+
+public static class AIGenerationOperations
+{
+    public const string AttachmentSummary = "attachment-summary";
+    public const string ApplicationAnalysis = "application-analysis";
+    public const string ApplicationScoring = "application-scoring";
+    public const string FormMapping = "form-mapping";
+    public const string FormWorksheet = "form-worksheet";
+    public const string FormScoresheet = "form-scoresheet";
+
+    private static readonly IReadOnlyDictionary<string, AIGenerationOperationDefinition> Definitions =
+        new Dictionary<string, AIGenerationOperationDefinition>(StringComparer.Ordinal)
+        {
+            [AttachmentSummary] = new(
+                AttachmentSummary,
+                "AttachmentSummary",
+                AIFeatures.AttachmentSummaries,
+                AILocalizationKeys.AttachmentSummariesDisabled,
+                AIPermissions.Analysis.GenerateAttachmentSummaries,
+                AIPermissions.Analysis.ViewAttachmentSummary,
+                false),
+            [ApplicationAnalysis] = new(
+                ApplicationAnalysis,
+                "ApplicationAnalysis",
+                AIFeatures.ApplicationAnalysis,
+                AILocalizationKeys.ApplicationAnalysisDisabled,
+                AIPermissions.Analysis.GenerateApplicationAnalysis,
+                AIPermissions.Analysis.ViewApplicationAnalysis,
+                false),
+            [ApplicationScoring] = new(
+                ApplicationScoring,
+                "ApplicationScoring",
+                AIFeatures.Scoring,
+                AILocalizationKeys.ScoringDisabled,
+                AIPermissions.Analysis.GenerateScoring,
+                AIPermissions.Analysis.ViewScoringResult,
+                false),
+            [FormMapping] = new(
+                FormMapping,
+                "FormMapping",
+                AIFeatures.FormMapping,
+                AILocalizationKeys.FormMappingDisabled,
+                AIPermissions.Analysis.GenerateFormMapping,
+                AIPermissions.Analysis.ViewFormMapping,
+                true),
+            [FormWorksheet] = new(
+                FormWorksheet,
+                "FormWorksheet",
+                AIFeatures.FormWorksheet,
+                AILocalizationKeys.FormWorksheetDisabled,
+                AIPermissions.Analysis.GenerateFormWorksheet,
+                AIPermissions.Analysis.ViewFormWorksheet,
+                true),
+            [FormScoresheet] = new(
+                FormScoresheet,
+                "FormScoresheet",
+                AIFeatures.FormScoresheet,
+                AILocalizationKeys.FormScoresheetDisabled,
+                AIPermissions.Analysis.GenerateFormScoresheet,
+                AIPermissions.Analysis.ViewFormScoresheet,
+                true)
+        };
+
+    public static IReadOnlyCollection<AIGenerationOperationDefinition> All => Definitions.Values.ToArray();
+
+    public static AIGenerationOperationDefinition Get(string operationType)
+    {
+        if (!Definitions.TryGetValue(operationType, out var definition))
+        {
+            throw new ArgumentException($"Unsupported AI generation operation type: {operationType}", nameof(operationType));
+        }
+
+        return definition;
+    }
+
+    public static bool TryGet(string? operationType, out AIGenerationOperationDefinition? definition)
+    {
+        if (operationType is not null && Definitions.TryGetValue(operationType, out var resolved))
+        {
+            definition = resolved;
+            return true;
+        }
+
+        definition = null;
+        return false;
+    }
+}

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Generation/AIGenerationOperationKeyHelper.cs

@@ -2,24 +2,15 @@ namespace Unity.AI.Generation;
 
 public static class AIGenerationOperationKeyHelper
 {
-    public const string AttachmentSummaryOperationType = "attachment-summary";
-    public const string ApplicationAnalysisOperationType = "application-analysis";
-    public const string ApplicationScoringOperationType = "application-scoring";
-    public const string FormMappingOperationType = "form-mapping";
-    public const string FormWorksheetOperationType = "form-worksheet";
-    public const string FormScoresheetOperationType = "form-scoresheet";
+    public const string AttachmentSummaryOperationType = AIGenerationOperations.AttachmentSummary;
+    public const string ApplicationAnalysisOperationType = AIGenerationOperations.ApplicationAnalysis;
+    public const string ApplicationScoringOperationType = AIGenerationOperations.ApplicationScoring;
+    public const string FormMappingOperationType = AIGenerationOperations.FormMapping;
+    public const string FormWorksheetOperationType = AIGenerationOperations.FormWorksheet;
+    public const string FormScoresheetOperationType = AIGenerationOperations.FormScoresheet;
 
     public static string? ResolveOperationName(string operationType)
-    {
-        return operationType switch
-        {
-            ApplicationAnalysisOperationType => "ApplicationAnalysis",
-            AttachmentSummaryOperationType => "AttachmentSummary",
-            ApplicationScoringOperationType => "ApplicationScoring",
-            FormMappingOperationType => "FormMapping",
-            FormWorksheetOperationType => "FormWorksheet",
-            FormScoresheetOperationType => "FormScoresheet",
-            _ => null
-        };
-    }
+        => AIGenerationOperations.TryGet(operationType, out var definition)
+            ? definition!.OperationName
+            : null;
 }

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Generation/AIGenerationRequestDto.cs

@@ -0,0 +1,15 @@
+using System;
+using System.Collections.Generic;
+
+namespace Unity.AI.Generation;
+
+public sealed class AIGenerationSubmissionDto
+{
+    public Guid ApplicationId { get; set; }
+
+    public Guid? ApplicationFormVersionId { get; set; }
+
+    public List<Guid> AttachmentIds { get; set; } = [];
+
+    public string? PromptVersion { get; set; }
+}

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Generation/IAIGenerationAppService.cs

@@ -8,6 +8,8 @@ public interface IAIGenerationAppService : IApplicationService
 {
     Task GenerateApplicationAttachmentSummariesAsync(AttachmentSummaryGenerationRequestDto request);
 
+    Task SubmitAsync(string operationType, AIGenerationSubmissionDto request);
+
     Task GenerateApplicationAnalysisAsync(Guid applicationId, string? promptVersion = null);
 
     Task GenerateApplicationScoringAsync(Guid applicationId, string? promptVersion = null);

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/AI/Operations/IAIGenerationPrerequisiteValidator.cs → applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Operations/IAIGenerationPrerequisiteValidator.cs

@@ -1,10 +1,13 @@
 using System;
 using System.Threading.Tasks;
+using Unity.AI.Generation;
 
 namespace Unity.AI.Operations;
 
 public interface IAIGenerationPrerequisiteValidator
 {
+    Task EnsureAvailableAsync(string operationType, AIGenerationSubmissionDto request);
+
     Task EnsureAttachmentSummaryAvailableAsync(Guid applicationId);
 
     Task EnsureApplicationAnalysisAvailableAsync(Guid applicationId);

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/RateLimit/IAIRateLimiter.cs

@@ -11,6 +11,12 @@ public interface IAIRateLimiter
     /// </summary>
     Task EnsureAsync();
 
+    /// <summary>
+    /// Throws if the supplied user is still inside their AI generate cooldown window.
+    /// No-op when userId is null.
+    /// </summary>
+    Task EnsureAsync(Guid? userId);
+
     /// <summary>
     /// Starts a fresh cooldown for the current user. No-op for callers without a user.
     /// </summary>

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIOperationDataSeeder.cs

@@ -5,7 +5,7 @@
 using System.Threading.Tasks;
 using Unity.AI.Operations;
 using Unity.AI.Domain;
-using Unity.AI.Prompts;
+using Unity.AI.Runtime.Prompts;
 using Volo.Abp.Data;
 using Volo.Abp.DependencyInjection;
 using Volo.Abp.Domain.Repositories;
@@ -16,20 +16,19 @@ namespace Unity.AI.DataSeed;
 public class AIOperationDataSeeder(
     IRepository<AIOperation, Guid> operationRepository,
     IRepository<AIModel, Guid> modelRepository,
-    IRepository<AIPrompt, Guid> promptRepository,
     ICurrentTenant currentTenant,
     ILogger<AIOperationDataSeeder> logger) : ITransientDependency
 {
     private const string DefaultModelName = "Gpt5Mini";
 
     private static readonly BuiltInOperationDefinition[] BuiltInOperations =
     [
-        new(AIPromptTypes.ApplicationAnalysis, AIPromptTypes.ApplicationAnalysis, 1, 4000),
-        new(AIPromptTypes.AttachmentSummary, AIPromptTypes.AttachmentSummary, 1, 2000),
-        new(AIPromptTypes.ApplicationScoring, AIPromptTypes.ApplicationScoring, 1, 8000),
-        new(AIPromptTypes.FormMapping, AIPromptTypes.FormMapping, 2, 2000),
-        new(AIPromptTypes.FormWorksheet, AIPromptTypes.FormWorksheet, 2, 4000),
-        new(AIPromptTypes.FormScoresheet, AIPromptTypes.FormScoresheet, 2, 4000)
+        new(AIPromptTypes.ApplicationAnalysis, 4000),
+        new(AIPromptTypes.AttachmentSummary, 2000),
+        new(AIPromptTypes.ApplicationScoring, 8000),
+        new(AIPromptTypes.FormMapping, 2000),
+        new(AIPromptTypes.FormWorksheet, 4000),
+        new(AIPromptTypes.FormScoresheet, 4000)
     ];
 
     public async Task SeedAsync(DataSeedContext context)
@@ -57,22 +56,10 @@ public async Task SeedAsync(DataSeedContext context)
 
     private async Task EnsureOperationAsync(BuiltInOperationDefinition definition, AIModel model)
     {
-        var prompt = await ResolvePromptAsync(definition.PromptName, definition.PromptVersionNumber);
-        if (prompt == null)
-        {
-            logger.LogWarning(
-                "AI operation seeding skipped: no active prompt found for operation '{OperationName}' and prompt '{PromptName}' version '{PromptVersionNumber}'.",
-                definition.OperationName,
-                definition.PromptName,
-                definition.PromptVersionNumber);
-            return;
-        }
-
         var existing = await operationRepository.FirstOrDefaultAsync(op => op.Name == definition.OperationName);
         if (existing != null)
         {
             existing.AIModelId = model.Id;
-            existing.AIPromptId = prompt.Id;
             existing.ExecutionMode = definition.ExecutionMode;
             existing.CompletionTokens = definition.CompletionTokens;
             existing.IsActive = true;
@@ -81,7 +68,7 @@ private async Task EnsureOperationAsync(BuiltInOperationDefinition definition, A
         }
 
         await operationRepository.InsertAsync(
-            new AIOperation(Guid.CreateVersion7(), definition.OperationName, model.Id, prompt.Id)
+            new AIOperation(Guid.CreateVersion7(), definition.OperationName, model.Id)
             {
                 ExecutionMode = definition.ExecutionMode,
                 CompletionTokens = definition.CompletionTokens,
@@ -96,18 +83,8 @@ await operationRepository.InsertAsync(
         return models.FirstOrDefault();
     }
 
-    private async Task<AIPrompt?> ResolvePromptAsync(string promptName, int promptVersionNumber)
-    {
-        return await promptRepository.FirstOrDefaultAsync(item =>
-            item.Name == promptName &&
-            item.VersionNumber == promptVersionNumber &&
-            item.IsActive);
-    }
-
     private sealed record BuiltInOperationDefinition(
         string OperationName,
-        string PromptName,
-        int PromptVersionNumber,
         int CompletionTokens,
         AIExecutionMode ExecutionMode = AIExecutionMode.Sequential);
 }

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIPromptDataSeeder.cs

@@ -3,7 +3,7 @@
 using System.Text.Json;
 using System.Threading.Tasks;
 using Unity.AI.Domain;
-using Unity.AI.Prompts;
+using Unity.AI.Runtime.Prompts;
 using Volo.Abp.Data;
 using Volo.Abp.DependencyInjection;
 using Volo.Abp.Domain.Repositories;
@@ -177,7 +177,7 @@ await promptRepository.InsertAsync(new AIPrompt(
     }
 
     // ═════════════════════════════════════════════════════════════════════════
-    // PROMPT CONTENT — mirrors AI/Prompts/Versions/ text files verbatim
+    // PROMPT CONTENT — mirrors Runtime/Prompts/Versions/ text files verbatim
     // ═════════════════════════════════════════════════════════════════════════
 
     // ── v0/analysis.system.txt ───────────────────────────────────────────────

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Domain/AIOperation.cs

@@ -12,10 +12,6 @@ public class AIOperation : AuditedAggregateRoot<Guid>
 
     public AIModel AIModel { get; set; } = default!;
 
-    public Guid AIPromptId { get; set; }
-
-    public AIPrompt? AIPrompt { get; set; }
-
     public AIExecutionMode ExecutionMode { get; set; } = AIExecutionMode.Sequential;
 
     public int CompletionTokens { get; set; }
@@ -26,11 +22,11 @@ protected AIOperation()
     {
     }
 
-    public AIOperation(Guid id, string name, Guid aiModelId, Guid aiPromptId)
+    public AIOperation(Guid id, string name, Guid aiModelId)
     {
         Id = id;
         Name = name;
         AIModelId = aiModelId;
-        AIPromptId = aiPromptId;
     }
+
 }