ipai-platform

## Part 1: Index --- name: pulser-constitution description: Establish or update Pulser for Odoo governing principles. Use when starting a new feature, onboarding a new contributor, or when IPAI doctrine needs to be re-anchored. Triggers on "constitution", "governing principles", "architecture doctrine", or "platform rules". disable-model-invocation: false user-invocable: true --- # Pulser for Odoo — constitution enforcement You are anchoring all work to the Pulser for Odoo governing principles. Read `spec/pulser-odoo/constitution.md` if it exists. If it does not exist, create it from the template below. Then confirm all active work items are consistent with these principles. ## Non-negotiables to enforce ### Naming - Product name: **Pulser for Odoo** - Technical addon: `ipai_odoo_copilot` - Spec slug: `pulser-odoo` - Tenant terminology: a Pulser tenant is a customer organization — never an Odoo company, branch, or Entra tenant ### System-of-action rule Odoo CE/OCA 18 is the system of action. Pulser does not replace Odoo transactional truth. Pulser may: assist, route, summarize, validate, prepare, generate artifacts, enforce policy gates. Pulser may not bypass: Odoo record truth, RBAC, approval banding, evidence controls, mutation safety. ### Ingress rule Canonical public ingress: - Azure DNS - Direct custom-domain binding to Azure Container Apps origins - Certificate binding at the app edge Not canonical: Cloudflare, proxy-based ingress, Azure Front Door as main ingress layer. Front Door may exist only as a legacy or migration artifact. ### Runtime topology rule Pulser core runtime converges to three apps only: - `pulser-odoo-web` - `pulser-agent-api` - `pulser-worker` Additional apps require written justification (OCR, MCP bridge, public website portfolio). ERP must remain separate from public website runtime. ### Deployment stamp rule Pulser scales through deployment stamps. Each stamp: - Is independently deployable and recoverable - Has a dedicated Azure Database for PostgreSQL Flexible Server (no shared PG across stamps) - Is bounded in blast radius ### IaC rule All infrastructure converges into `infra/azure/` as Bicep modules. No critical infrastructure left as manual Azure-only state. ### Repo authority chain ``` Azure Boards → Spec Kit → GitHub → IaC/CI-CD → Azure runtime → observability/evals → feedback ``` ### RBAC rule Pulser behavior is resolved from: surface × domain × role groups × approval band × evidence scope × expertise mode × task type × risk level. Never infer RBAC from contact lists, email directories, or ad hoc naming conventions. ### Self-improvement bounds Allowed: structured run tracing, domain evaluation, replay-based optimization, narrow small-model training. Prohibited: uncontrolled online RL for finance, tax, approval, or operational mutation workflows. ## Template for spec/pulser-odoo/constitution.md If the file does not exist, write it verbatim from `$CLAUDE_SKILL_DIR/templates/constitution-template.md`. ## Verification checklist After creating or updating the constitution, confirm: - [ ] Product name and slug are correct throughout - [ ] Tenant terminology distinguishes Pulser tenant / Odoo company / Entra tenant - [ ] Direct ingress principle is stated (no Cloudflare, no proxy) - [ ] Odoo is named as system of action - [ ] Deployment stamp and dedicated PG per stamp are stated - [ ] IaC convergence target is `infra/azure/` - [ ] Self-improvement bounds prohibit uncontrolled online RL on finance/tax/approval - [ ] Repo authority chain is stated -e --- ## Part 2: IPAI Resource Map (Azure constants) --- name: ipai-resource-map description: > InsightPulseAI Azure resource constants and topology. Load whenever working with IPAI infrastructure, Odoo deployments, Foundry, agents, or any Azure resource. Provides exact subscription IDs, resource names, resource group topology, MI names, and IPAI-specific conventions — eliminating lookup round-trips and preventing wrong-version or wrong-resource errors. ALWAYS load this skill for any IPAI Azure, Odoo, Foundry, or agent work. Pairs with official azure-container-apps, microsoft-foundry, and azure-database-for-postgresql skills for implementation patterns. --- # IPAI Azure Resource Map Canonical reference for all InsightPulseAI Azure resources. Last updated: 2026-04-13. Source: Azure portal CSV export (116 resources). --- ## Subscriptions | Name | ID | Purpose | |---|---|---| | IPAI ISV Sponsored (canonical) | `eba824fb-332d-4623-9dfb-2c9f7ee83f4e` | All workloads (dev/staging/prod) | **Entra tenant:** `402de71a-87ec-4302-a609-fb76098d1da7` (`insightpulseai.com`) **Default region:** Southeast Asia (`southeastasia`) **Foundry region:** East US 2 (`eastus2`) — Foundry resource must be EUS2 --- ## Resource Group Topology ``` rg-ipai-dev-odoo-runtime (SEA) — PRIMARY runtime RG ACA environment, all Container Apps/Jobs, ACR, AFD, WAF, alerts, Redis, DNS zones, private endpoints, NSGs, VNet, Log Analytics, App Insights, Recovery Services vault, Function App, workbook, action groups rg-ipai-dev-odoo-data (SEA) — Data tier pg-ipai-odoo (PG Flex), stipaiodoodev (storage), private endpoint for PG rg-ipai-dev-platform (SEA) — Identity + secrets kv-ipai-dev-sea (canonical KV) kv-ipai-dev (STALE — consolidate and delete) id-ipai-agent-* (6 per-agent managed identities) rg-data-intel-ph (EUS2) — AI/data stack ipai-copilot-resource (Foundry) ipai-copilot project cosmos-ipai-dev (Cosmos DB NoSQL, serverless) srch-ipai-dev (AI Search, Basic) stipaiagentdev (Storage, ZRS — DEDICATED Foundry Agent Service) docai-ipai-dev (Document Intelligence) bing-ipai-grounding (Bing Resource) rg-ipai-financial-intel (EUS2) — Financial intel kv-admin845384060711840 stadmin8456a384060711840 rg-ipai-stg-odoo-runtime (SEA) — sponsored sub eba824fb (PrismaLab prod home + staging lane) la-ipai-stg (Log Analytics) ipai-odoo-stg-env (ACA env, domain whitedesert-54fce6ca) ipai-prismalab-web (serves prismalab.insightpulseai.com — moved here from prod sub 2026-04-13) id-ipai-stg (UAMI for ACA pulls; cross-sub AcrPull on acripaiodoo + Cognitive Services User on ipai-copilot-resource) rg-ipai-stg-odoo-data (SEA) — sponsored sub eba824fb — empty (PG Flex deferred) ``` **Sponsored-sub legacy/parallel stack (NOT touched, separate work):** ``` rg-ipai-dev-data-sea (SEA) — stdevipai (containers: bir-inbox, odoo-attachments) · stlkipaidev (lakehouse, empty bronze/silver/gold) · pg-ipai-odoo-dev (PG Flex) rg-ipai-dev-mon-sea (SEA) — log-ipai-dev-sea · appi-ipai-dev rg-ipai-dev-security-sea (SEA) — id-ipai-dev (DIFFERENT MI from prod — same name, different principalId) · kv-ipai-dev-sea rg-ipai-dev-odoo-sea (SEA) — sb-ipai-dev-sea (Service Bus) · acae-ipai-dev-sea (ACA env, EMPTY) rg-ipai-dev-ai-sea (SEA) — dbw-ipai-dev (Databricks) rg-ipai-dev-dbw-managed (SEA) — Databricks-managed (unity-catalog-access-connector, dbmanagedidentity, dbstorage*, workers-vnet, workers-sg) ``` **Deleted this session (zombies + duplicates):** `aif-ipai-dev` (empty Foundry shell, eus2) · `srch-dev-ipai` (wrong-named empty Search) · `stlkdevipai` (wrong-named empty lakehouse) · `ipai-prismalab-stg-web` (duplicate canary) · `rg-ipai-dev-ai-eus2` (RG was holding only `aif-ipai-dev`). --- ## Container Apps (23 running) **Odoo core (SOR):** - `ipai-odoo-dev-web` — Odoo web tier - `ipai-odoo-dev-cron` — Odoo cron worker - `ipai-odoo-dev-worker` — Odoo queue worker - ACA environment: `ipai-odoo-dev-env-v2` **AI/Agent tier:** - `ipai-copilot-gateway` — Foundry proxy / Pulser gateway - `ipai-odoo-mcp` — Odoo MCP Server (13 tools, FastMCP StreamableHTTP) ✅ LIVE - `ipai-release-manager` — MAF Release Manager agent ✅ LIVE - `ipai-bot-proxy-dev` — Bot Framework webhook proxy - `ipai-ocr-dev` — Document Intelligence OCR **Platform services:** - `ipai-mcp-dev` — General MCP server (→ rename: ipai-pg-mcp-server is separate) - `ipai-pg-mcp-server-q7d3v77xqx` — PostgreSQL MCP server (own env) - `ipai-odoo-connector` — Odoo integration connector **Dev tools:** - `ipai-code-server-dev` — VS Code server - `ipai-grafana-dev` — Grafana - `ipai-mailpit-dev` — Mail testing **Portals/websites:** - `ipai-login-dev`, `ipai-ops-dashboard`, `ipai-website-dev` - `ipai-workload-center`, `ipai-w9studio-dev`, `w9studio-landing-dev` **Research:** - `ipai-prismalab-dev`, `ipai-prismalab-gateway` **Evaluate for retirement:** - `ipai-superset-dev` — Superset deprecated; replace with Databricks/Fabric --- ## Container App Jobs **KEEP:** - `ipai-build-agent` — CI/CD build agent - `oca-audit-job` — OCA module audit - `oca-full-audit` — Full OCA audit **REVIEW before delete:** - `set-auth-mode` — keyless auth migration job (verify completed) - `clear-keys-job` — key clearing job (verify completed) **DELETE (9 stale cleanup jobs):** ```bash for job in asset-deep-fix asset-fix-job oauth-diag-job oauth-fix-job \ oauth-signup-fix oauth-verify-job url-fix-job \ pg-mcp-grant pg-mcp-entra-grant; do az containerapp job delete -n $job \ -g rg-ipai-dev-odoo-runtime --yes --no-wait done ``` --- ## Key Resources (exact names) | Resource | Name | RG | Region | |---|---|---|---| | Container registry | `acripaiodoo` | runtime | SEA | | Front Door | `afd-ipai-dev` | runtime | Global | | WAF policy | `wafipaidev` | runtime | Global | | Redis | `cache-ipai-dev` | runtime | SEA | | PG Flex | `pg-ipai-odoo` | data | SEA | | PG host | `pg-ipai-odoo.postgres.database.azure.com` | — | — | | KV (canonical) | `kv-ipai-dev-sea` | platform | SEA | | KV (stale) | `kv-ipai-dev` | platform | SEA | | Platform MI | `id-ipai-dev` | runtime | SEA | | App Insights | `appi-ipai-dev` | runtime | SEA | | Log Analytics | `la-ipai-odoo-dev` | runtime | SEA | | VNet | `vnet-ipai-dev` | runtime | SEA | | Foundry resource | `ipai-copilot-resource` | rg-data-intel-ph | EUS2 | | Foundry project | `ipai-copilot` | rg-data-intel-ph | EUS2 | | Foundry endpoint | `https://ipai-copilot-resource.services.ai.azure.com/api/projects/ipai-copilot` | — | — | | Cosmos DB | `cosmos-ipai-dev` | rg-data-intel-ph | EUS2 | | AI Search | `srch-ipai-dev` | rg-data-intel-ph | SEA (verified 2026-04-13; sponsored-sub `srch-dev-ipai` was a wrong-named duplicate, deleted) | | Agent storage | `stipaiagentdev` | rg-data-intel-ph | EUS2 | | App storage | `stipaidev` | runtime | SEA | | Document Intel | `docai-ipai-dev` | rg-data-intel-ph | EUS2 | | DNS zone | `insightpulseai.com` | runtime | Global | | ADO org | `insightpulseai` | — | SEA | *srch-ipai-dev shows SEA — verify should be EUS2 to match Foundry --- ## Managed Identities | Name | RG | Purpose | |---|---|---| | `id-ipai-dev` | runtime | Platform MI — all ACA apps use this | | `id-ipai-agent-ap-invoice-dev` | platform | AP Invoice agent | | `id-ipai-agent-bank-recon-dev` | platform | Bank Reconciliation agent | | `id-ipai-agent-doc-intel-dev` | platform | Document Intelligence agent | | `id-ipai-agent-finance-close-dev` | platform | Finance Close agent | | `id-ipai-agent-pulser-dev` | platform | Core Pulser agent | | `id-ipai-agent-tax-guru-dev` | platform | Tax Guru agent | **Auth pattern (always):** `DefaultAzureCredential` — never API keys in code. --- ## Azure Bots (6 registered — Teams surfaces) All in `rg-ipai-dev-odoo-runtime`, routed via `ipai-bot-proxy-dev`: - `ipai-ap-invoice-teams-bot-dev` - `ipai-bank-recon-teams-bot-dev` - `ipai-doc-intel-teams-bot-dev` - `ipai-finance-close-teams-bot-dev` - `ipai-pulser-teams-bot-dev` - `ipai-tax-guru-teams-bot-dev` --- ## Key Vault — Canonical Reference **Use `kv-ipai-dev-sea` for all secrets.** `kv-ipai-dev` is a duplicate from a naming collision — consolidate and delete. ```bash # Verify canonical KV az keyvault show -n kv-ipai-dev-sea -g rg-ipai-dev-platform --query id -o tsv ``` --- ## Microsoft Foundry — Naming (Feb 2026) **Rebranded from "Azure AI Foundry" → "Microsoft Foundry" (Feb 2026)** Resource type: `Microsoft.CognitiveServices/account` kind `AIServices` Portal: https://ai.azure.com (toggle "New Foundry" ON) Agent API: Responses API (v2) — not Assistants API (v1) SDK: `azure-ai-projects>=2.0.0` (unified — replaces azure-ai-inference, azure-ai-ml) Terminology: Threads→Conversations, Messages→Items, Runs→Responses --- ## Odoo Stack Constants ``` Odoo version: 18 CE (NEVER 19 — do not apply v19 patterns) Databases: odoo (prod) | odoo_staging | odoo_dev PG host: pg-ipai-odoo.postgres.database.azure.com RG (data): rg-ipai-dev-odoo-data RG (runtime): rg-ipai-dev-odoo-runtime View tag: <list> ONLY — never <tree> (deprecated in 18, error in 19) view_mode: "list,form" OCA path: oca_addons/ (vendored, pinned) Custom path: addons/ipai/ Module prefix: ipai_ Smart Delta order: config → OCA → ipai_*_delta → ipai_*_core ``` --- ## Monitoring Stack **Alerts (metric):** 13 rules — ACA CPU/restarts/replicas, PG CPU, HTTP 5xx **Alerts (log search):** 3 rules — agent latency P95, agent error rate, content safety blocks **Action groups:** `ag-ipai-ops-email`, `ag-ipai-platform` **Workbook:** `Odoo Platform Health` (in rg-ipai-dev-odoo-runtime) Missing alerts to add after Week 1 deploy: - Cosmos DB RU consumption threshold - AI Search query latency - Foundry token usage --- ## ISV + Partner Program ``` Partner ID: 7097326