Dev

.github/workflows/cypress-dev.yml

@@ -16,7 +16,7 @@ on:
   workflow_dispatch:
     inputs:
       base_url:
-        description: "Override baseUrl (e.g. https://feature-branch.apps.silver.devops.gov.bc.ca/)"
+        description: "Override baseUrl (e.g. https://feature-branch.apps.gold.devops.gov.bc.ca/)"
         required: false
         type: string
 

.github/workflows/cypress-e2e-runner.yml

@@ -2,31 +2,20 @@ name: Cypress E2E (runner)
 
 # Shared job called by cypress-dev/test/uat/prod.yml.
 #
-# Unlike Grants, this doesn't run Cypress on the GitHub-hosted runner directly —
-# the Unity Grant Manager Route is IP-allowlisted to the BC Gov network, which
-# GitHub-hosted runners can't reach. Instead this job launches an OpenShift Job
+# Unity Grant Manager Route is IP-allowlisted to the BC Gov network, which
+# GitHub-hosted runners can't reach. This GitHub job launches an OpenShift Job
 # (from the unity-cypress-job Template in ce395f-tools) that runs the existing
 # Unity.AutoUI Cypress suite from inside the cluster, waits for it to finish,
 # and pulls the logs/screenshots back into this Actions run.
 #
-# This deliberately targets ce395f-tools on the Gold cluster, not d18498-tools
-# on Silver, even though the app environments (dev/test/uat/prod) still run on
-# Silver during the cluster migration — the Job's own baseUrl (via the
-# base_url input, or each cypress-config-*.json's default) is what it tests
-# against, independent of which cluster runs the Job itself. Building the CI
-# plumbing against the migration target now avoids redoing it later.
+# The Job pulls credentials from the unity-cypress-config Secret in ce395f-tools, 
+# synced from Vault (GH_UGM_CYPRESS_CONFIG) via External Secrets.
 #
-# Test credentials are NOT GitHub secrets — the Job pulls them from the
-# unity-cypress-config Secret in ce395f-tools, synced from Vault
-# (GH_UGM_CYPRESS_CONFIG) via External Secrets.
-#
-# OpenShift auth reuses the pipeline ServiceAccount (ce395f-tools), which
-# already holds ClusterRole/edit there — covers everything this job needs
-# (templates, processedtemplates, jobs, pods/log, pods/exec), no additional
-# RBAC required. Its token is CYPRESS_OPENSHIFT_TOKEN and its cluster is
-# CYPRESS_OPENSHIFT_CLUSTER — both repo-level (not tied to a GitHub
-# Environment, and deliberately separate from the shared OPENSHIFT_CLUSTER
-# var docker-build-*.yml uses, since that one still points at Silver).
+# OpenShift auth reuses the pipeline ServiceAccount (ce395f-tools), which already 
+# holds ClusterRole/edit this covers everything the job needs (templates, 
+# processedtemplates, jobs, pods/log, pods/exec), no additional RBAC required. 
+# 
+# Token is CYPRESS_OPENSHIFT_TOKEN and its cluster is CYPRESS_OPENSHIFT_CLUSTER.
 
 on:
   workflow_call:
@@ -91,22 +80,24 @@ jobs:
       - name: Wait for Cypress Job to finish
         id: wait
         run: |
-          # Don't use `oc wait --for=condition=complete/failed` here: a freshly
-          # created Job has no .status.conditions entries yet, and
-          # --for=condition=X (without an explicit =true) is satisfied the
-          # instant the condition is merely absent rather than false — so it
-          # can report "condition met" seconds after creation, long before the
-          # Job has actually run. Poll the numeric succeeded/failed fields
-          # instead, which are only set once a pod genuinely finishes.
+          # Wait for the Job to finish by polling the logs for a sentinel line
+          # the cypress container (see cypress-job-template.yaml in
+          # tenant-gitops-ce395f) prints a "CYPRESS_DONE exit_code=N"
+          # sentinel line when the test run finishes and, on failure,
+          # sleeps for 600s before actually exiting.
           JOB_REF="${{ steps.launch.outputs.job_ref }}"
+          JOB_NAME="${JOB_REF#job.batch/}"
           DEADLINE=$(( $(date +%s) + JOB_TIMEOUT_SECONDS ))
-          SUCCEEDED=0
-          FAILED=0
+          POD=""
+          EXIT_CODE=""
+
           while true; do
-            SUCCEEDED=$(oc get "$JOB_REF" -n $TOOLS_NAMESPACE -o jsonpath='{.status.succeeded}')
-            FAILED=$(oc get "$JOB_REF" -n $TOOLS_NAMESPACE -o jsonpath='{.status.failed}')
-            if [ "${SUCCEEDED:-0}" -ge 1 ] 2>/dev/null || [ "${FAILED:-0}" -ge 1 ] 2>/dev/null; then
-              break
+            POD=$(oc get pods -n $TOOLS_NAMESPACE -l job-name="$JOB_NAME" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+            if [ -n "$POD" ]; then
+              EXIT_CODE=$(oc logs "$POD" -n $TOOLS_NAMESPACE -c cypress 2>/dev/null | grep -o 'CYPRESS_DONE exit_code=[0-9]*' | tail -1 | cut -d= -f2 || true)
+              if [ -n "$EXIT_CODE" ]; then
+                break
+              fi
             fi
             if [ "$(date +%s)" -ge "$DEADLINE" ]; then
               echo "Timed out after ${JOB_TIMEOUT_SECONDS}s waiting for $JOB_REF"
@@ -115,7 +106,12 @@ jobs:
             sleep 10
           done
 
-          echo "succeeded=${SUCCEEDED:-0}" >> "$GITHUB_OUTPUT"
+          echo "pod=${POD:-}" >> "$GITHUB_OUTPUT"
+          if [ "${EXIT_CODE:-1}" = "0" ]; then
+            echo "succeeded=1" >> "$GITHUB_OUTPUT"
+          else
+            echo "succeeded=0" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Show Cypress logs
         if: always()
@@ -126,15 +122,13 @@ jobs:
       - name: Collect screenshots on failure
         if: steps.wait.outputs.succeeded != '1'
         run: |
-          JOB_NAME="${{ steps.launch.outputs.job_ref }}"
-          JOB_NAME="${JOB_NAME#job.batch/}"
-          POD=$(oc get pods -n $TOOLS_NAMESPACE -l job-name="$JOB_NAME" -o jsonpath='{.items[0].metadata.name}')
+          POD="${{ steps.wait.outputs.pod }}"
           mkdir -p cypress-screenshots
           oc cp "$TOOLS_NAMESPACE/$POD:/workspace/applications/Unity.AutoUI/cypress/screenshots" ./cypress-screenshots -c cypress || true
 
       - name: Upload screenshots on failure
         if: steps.wait.outputs.succeeded != '1'
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: cypress-screenshots-${{ inputs.env_name }}-${{ github.run_number }}
           path: cypress-screenshots

applications/Unity.AutoUI/CypressTestLauncher_README.md

@@ -21,7 +21,7 @@ But on your local system you still need to replace the tokens. These json files
 cypress.dev.env.json
 
 {
-  "webapp.url": "https://dev-unity.apps.silver.devops.gov.bc.ca/",
+  "webapp.url": "https://dev-unity.apps.gold.devops.gov.bc.ca/",
   "reporting.url": "{{reporting.url}}",
   "test1username": REQUIRED
   "test1password": REQUIRED
@@ -35,7 +35,7 @@ cypress.dev.env.json
 cypress.dev2.env.json
 
 {
-  "webapp.url": "https://dev2-unity.apps.silver.devops.gov.bc.ca/",,
+  "webapp.url": "https://dev2-unity.apps.gold.devops.gov.bc.ca/",,
   "reporting.url": "{{reporting.url}}",
   "test1username": REQUIRED
   "test1password": REQUIRED
@@ -49,7 +49,7 @@ cypress.dev2.env.json
 cypress.test.env.json
 
 {
-  "webapp.url": "https://test-unity.apps.silver.devops.gov.bc.ca/",
+  "webapp.url": "https://test-unity.apps.gold.devops.gov.bc.ca/",
   "reporting.url": "{{reporting.url}}",
   "test1username": REQUIRED
   "test1password": REQUIRED
@@ -63,7 +63,7 @@ cypress.test.env.json
 cypress.uat.env.json
 
 {
-  "webapp.url": "https://uat-unity.apps.silver.devops.gov.bc.ca/",
+  "webapp.url": "https://uat-unity.apps.gold.devops.gov.bc.ca/",
   "reporting.url": "{{reporting.url}}",
   "test1username": REQUIRED
   "test1password": REQUIRED
@@ -77,7 +77,7 @@ cypress.uat.env.json
 cypress.prod.env.json
 
 {
-  "webapp.url": "https://prod-unity.apps.silver.devops.gov.bc.ca/",
+  "webapp.url": "https://prod-unity.apps.gold.devops.gov.bc.ca/",
   "reporting.url": "{{reporting.url}}",
   "test1username": REQUIRED
   "test1password": REQUIRED

applications/Unity.AutoUI/cypress.config.ts

@@ -65,7 +65,7 @@ export default defineConfig({
       "cypress/scripts/**/*.cy.{js,jsx,ts,tsx}",
       "cypress/regression/**/*.cy.{js,jsx,ts,tsx}",
     ],
-    baseUrl: "https://dev-unity.apps.silver.devops.gov.bc.ca/",
+    baseUrl: "https://dev-unity.apps.gold.devops.gov.bc.ca/",
     defaultCommandTimeout: 20000, // Time, in milliseconds, to wait until most DOM based commands are considered timed out.
     viewportWidth: 1440, // Default width in pixels.
     viewportHeight: 900, // Default height in pixels.

applications/Unity.AutoUI/cypress/config/dev.json.example

@@ -1,5 +1,5 @@
 {
-    "webapp.url": "https://dev-unity.apps.silver.devops.gov.bc.ca/",
+    "webapp.url": "https://dev-unity.apps.gold.devops.gov.bc.ca/",
     "environment": "DEV",
     "test1username": "",
     "test1password": "",

applications/Unity.AutoUI/cypress/config/dev2.json.example

@@ -1,5 +1,5 @@
 {
-    "webapp.url": "https://dev2-unity.apps.silver.devops.gov.bc.ca/",
+    "webapp.url": "https://dev2-unity.apps.gold.devops.gov.bc.ca/",
     "environment": "DEV2",
     "test1username": "",
     "test1password": "",

applications/Unity.AutoUI/cypress/config/prod.json.example

@@ -1,5 +1,5 @@
 {
-    "webapp.url": "https://prod-unity.apps.silver.devops.gov.bc.ca/",
+    "webapp.url": "https://prod-unity.apps.gold.devops.gov.bc.ca/",
     "environment": "PROD",
     "test1username": "",
     "test1password": "",

applications/Unity.AutoUI/cypress/config/test.json.example

@@ -1,5 +1,5 @@
 {
-    "webapp.url": "https://test-unity.apps.silver.devops.gov.bc.ca/",
+    "webapp.url": "https://test-unity.apps.gold.devops.gov.bc.ca/",
     "environment": "TEST",
     "test1username": "",
     "test1password": "",

applications/Unity.AutoUI/cypress/config/uat.json.example

@@ -1,5 +1,5 @@
 {
-    "webapp.url": "https://uat-unity.apps.silver.devops.gov.bc.ca/",
+    "webapp.url": "https://uat-unity.apps.gold.devops.gov.bc.ca/",
     "environment": "UAT",
     "test1username": "",
     "test1password": "",

applications/Unity.AutoUI/cypress/fixtures/metabase.json

@@ -2,23 +2,23 @@
   "metabaseDetails": [
     {
       "unityEnv": "DEV",
-      "baseURL": "https://dev-unity-reporting.apps.silver.devops.gov.bc.ca/"
+      "baseURL": "https://dev-unity-reporting.apps.gold.devops.gov.bc.ca/"
     },
     {
       "unityEnv": "DEV2",
-      "baseURL": "https://dev-unity-reporting.apps.silver.devops.gov.bc.ca/"
+      "baseURL": "https://dev-unity-reporting.apps.gold.devops.gov.bc.ca/"
     },
     {
       "unityEnv": "TEST",
-      "baseURL": "https://test-unity-reporting.apps.silver.devops.gov.bc.ca/"
+      "baseURL": "https://test-unity-reporting.apps.gold.devops.gov.bc.ca/"
     },
     {
       "unityEnv": "UAT",
-      "baseURL": "https://uat-unity-reporting.apps.silver.devops.gov.bc.ca/"
+      "baseURL": "https://uat-unity-reporting.apps.gold.devops.gov.bc.ca/"
     },
     {
       "unityEnv": "PROD",
-      "baseURL": "https://unity-reporting.apps.silver.devops.gov.bc.ca/"
+      "baseURL": "https://unity-reporting.apps.gold.devops.gov.bc.ca/"
     }
   ]
 }

applications/Unity.GrantManager/common.props

@@ -20,6 +20,11 @@
     <!-- Add direct reference to the patched Scriban to ensure all projects importing common.props
          use the safe version (pins transitive consumers that do not specify a version). -->
     <PackageReference Include="Scriban" Version="7.2.5" />
+
+    <!-- System.Security.Cryptography.Xml 8.0.2 (pulled in transitively) has several known high
+         severity vulnerabilities; pin to the same patched version already used directly by
+         Unity.AI.Application so every project importing common.props gets the safe version. -->
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
   </ItemGroup>
 
 </Project>

applications/Unity.GrantManager/modules/Unity.AI/docs/index.md

@@ -30,17 +30,17 @@ UI-facing AI bits:
 
 ## Files
 ### Application
-- `AI/Operations` - validators and helpers
-- `AI/Runtime` - rendering, parsing, logging, provider calls
-- `AI/Prompts` - prompt types and template plumbing
+- `Operations` - validators and helpers
+- `Runtime/Execution` - rendering, parsing, logging, provider calls
+- `Runtime/Prompts` - prompt types and template plumbing
 - `DataSeed` - seeded prompt and operation data
 - `Generation/AIGenerationAppService.cs` - generation API
 
 ### Application.Contracts
-- `AI/IAIService.cs` - runtime contract
+- `IAIService.cs` - runtime contract
 - `Generation/IAIGenerationAppService.cs` - generation app service contract
 - `Generation/*ResultDto.cs` - queued result DTOs
-- `AI/Operations/IAIGenerationPrerequisiteValidator.cs` - queue prerequisites
+- `Operations/IAIGenerationPrerequisiteValidator.cs` - queue prerequisites
 - `Automation/IApplicationAIGenerationQueue.cs` - queue contract
 - `Permissions/*` - permissions
 

applications/Unity.GrantManager/modules/Unity.AI/docs/operation-pipeline.md

@@ -0,0 +1,16 @@
+# AI operation pipeline
+
+AI generation uses a shared operation catalog and queued lifecycle. The catalog owns the operation key, seeded operation name, feature gate, permissions, and whether a form version is required. Submission enters `IAIGenerationAppService.SubmitAsync`, and the Grant Manager queue preserves the existing duplicate-request lock and operation-specific validation.
+
+The generic background-job base owns tenant scope, structured logging, request state transitions, failure handling, and cooldown stamping. Operation-specific executors remain responsible for loading input, calling the AI contract, validating the response, and persisting the result.
+
+## Adding an operation
+
+1. Add an operation definition to `AIGenerationOperations`.
+2. Add the operation's submission payload fields only when shared fields are insufficient.
+3. Add the AI request/response contract and prompt/operation seed.
+4. Implement an `IAIGenerationOperationExecutor` for Grant Manager-specific input and persistence.
+5. Register the executor through the existing transient DI convention.
+6. Add focused catalog, lifecycle, executor, and persistence tests.
+
+Do not add another queue branch for shared lifecycle concerns. New operation behavior belongs in its executor; request locking, status transitions, tenant scope, logging, and cooldown behavior stay in the common pipeline.

applications/Unity.GrantManager/modules/Unity.AI/docs/prompt-map.md

@@ -8,9 +8,16 @@
 - `FormWorksheet` - worksheet generation
 
 ## Versions
-- `v0`, `v1`, `v2` live under `AI/Prompts/Versions`
+- `v0`, `v1`, `v2` live under `Runtime/Prompts/Versions`
 - The seeder loads built-in prompt rows from those versions
-- Runtime selects by prompt family and version
+- Runtime selects the newest active prompt by family.
+
+## Tenant selection
+- `AIOperation.Name` is the prompt family; operations do not pin a prompt row or version.
+- Host requests use the newest active global prompt in the family.
+- Tenant requests use the newest active prompt owned by that tenant, falling back to the newest active global prompt.
+- To roll back a tenant or global prompt, deactivate the active version and leave the prior version active.
+- Tenant prompt rows are administrator-created; deployments seed only global prompts and operations.
 
 ## Prompt rules
 - Versioned prompts are the source of truth.

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Attachments/AttachmentContentStream.cs

@@ -0,0 +1,20 @@
+using System;
+using System.IO;
+using System.Threading.Tasks;
+
+namespace Unity.AI.Attachments;
+
+public sealed class AttachmentContentStream(Stream content, string contentType) : IDisposable, IAsyncDisposable
+{
+    public Stream Content { get; } = content ?? throw new ArgumentNullException(nameof(content));
+
+    public string ContentType { get; } =
+        string.IsNullOrWhiteSpace(contentType) ? "application/octet-stream" : contentType;
+
+    public static AttachmentContentStream Empty { get; } =
+        new(Stream.Null, "application/octet-stream");
+
+    public void Dispose() => Content.Dispose();
+
+    public ValueTask DisposeAsync() => Content.DisposeAsync();
+}

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Attachments/AttachmentSummaryResultDto.cs

@@ -1,4 +1,4 @@
-namespace Unity.GrantManager.Attachments;
+namespace Unity.AI.Attachments;
 
 public class AttachmentSummaryResultDto
 {

applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Attachments/IAttachmentContentProvider.cs

@@ -0,0 +1,9 @@
+using System;
+using System.Threading.Tasks;
+
+namespace Unity.AI.Attachments;
+
+public interface IAttachmentContentProvider
+{
+    Task<AttachmentContentStream> OpenAttachmentAsync(Guid submissionId, Guid fileId, string name);
+}