Port Cursor rules/skills to GitHub Copilot instructions + Azure Container Apps deployment infra#376
Open
fabioc-aloha wants to merge 20 commits into
Open
Port Cursor rules/skills to GitHub Copilot instructions + Azure Container Apps deployment infra#376fabioc-aloha wants to merge 20 commits into
fabioc-aloha wants to merge 20 commits into
Conversation
… prompts, agents, scripts, config)
…on from network.bicep
- package nested demo assets and register modern image MIME types - stabilize model probes, reasoning compatibility, and error classification - align governed Azure model infrastructure with the live three-model set - add regression coverage, audit log, meditation, and session handoff Validation: Python compileall, Bicep build, Markdown lint, editor diagnostics, staged diff check, redacted secret scan, and live browser/API checks. Full pytest unavailable in the local environment.
Collaborator
|
the latest development is in dev! let's consolidated a bit and then put it into main together? |
Resolve the non-connector readiness backlog with bounded request and memory limits, safer loader lifecycle and persistence, OAuth state isolation, production serving, retry controls, and concurrency protection. Add focused regression coverage and connector implementation plans. Record that the single-replica source mitigation is validated but its live deployment remains blocked by unrelated infrastructure drift.
Preserve production Container App ingress, policy-managed network state, registry defaults, and model deployment settings during full Bicep provisioning. Add deployment safety tests and document the required what-if and post-deployment verification workflow.
Add connector-and-audience token isolation, token-free OAuth popup handling, ODBC access-token support, proxy-safe callbacks, and Driver 18 in the runtime image. Harden token persistence and concurrent state boundaries, repair the TypeScript and ESLint baseline, and update connector plans and operational documentation.
- upgrade ACT Edition assets and relocate heir-owned guidance into local paths - add delegated Azure SQL OAuth with managed identity federation and hardened ODBC handling - resolve OAuth state concurrency, repository hygiene, and backend/frontend test debt - document consent, deployment, audit evidence, and remaining session migration gates
- deploy ebada59 as healthy Container App revision 0000010 - record image provenance, OAuth, Driver 18, endpoint, and log checks - exclude local environments and paper archives from remote build contexts
- document audit and deployment status plus enterprise data-access decision - add Chenglong meeting brief, paper insights, and source artifacts
- clear persisted workspaces missing from server storage before autosave - remove unused image preloads and unconditional startup debug logs
- record revision, image digest, validation, and image-based rollback - update handoff, consent runbook, issue ledger, and meeting status
- lazily initialize no-auth connector loaders for catalog and status calls - bound LiteLLM attempts to 90 seconds and logical retries to 120 seconds - retry streams only before first output and preserve structured timeout errors - pin LiteLLM 1.91.1 and add DF-024/DF-025 regression evidence ACT: Considered one cohesive runtime-hardening commit versus splitting shared ledger changes. Going with H1: keep validated connector and model lifecycle changes atomic. Would revise if: staged paths include Agency files, tests fail, or remote main advances. Validation: 2032 passed, 13 skipped; uv lock check; staged diff and secret scan clean.
- validate installer inputs before any target writes - make verification failures enforce nonzero exit and version drift checks - preserve process PATH entries and keep verification-only mode read-only - ignore the generated local tool snapshot and remove broken target links ACT: Considered an independent Agency commit versus bundling deployment records. Going with H1: keep tooling synchronization independently reviewable and reversible. Would revise if: staged paths include deployment docs or validation/secret scans fail. Validation: PowerShell parse, disposable dry run, generated baseline, no-flag verifier, diagnostics, diff check, and secret scan pass.
- record revision azd-1784046335 and immutable image digest - mark DF-024 and DF-025 production verified - capture connector, Azure OpenAI, browser, replica, and cleanup evidence - retain recreate-11dfb1fd3d3c as the immediate rollback image ACT: Considered committing verified live state separately from Agency tooling. Going with H1: preserve deployment evidence as an independently auditable record. Would revise if: live revision/image/traffic changes or staged scope/secret scan fails. Validation: one ready replica, zero restarts, 100% traffic, catalog 16 nodes, LiteLLM 1.91.1, ODBC 18, all models connected, non-streaming and streaming tool paths pass, browser clean, smoke sessions empty.
- chronicle connector, model, client-state, deployment, and documentation work - record build-versus-rollout recovery and workspace-bound smoke patterns - map shipped commits, rollback state, validation, and owned remaining gates - index the session for future retrieval Validation: Markdown diagnostics, diff check, and no-context comprehension review pass.
- add profile contracts, internal FastMCP gateway, auth, approvals, and drift checks - add feature-gated gateway container and Bicep provisioning foundation - document Entra consent, Fabric fixture, rollout, and handoff state
Materiality: High - this changes authentication, authorization, approval, and governed data-access behavior on main. Hypothesis H1: ship the accumulated governed MCP increments together because their contracts, tests, and trackers form one coherent safety boundary. Alternative H2: split the increments because smaller commits are easier to review, but that would separate mutually dependent profile, client, approval, loader, and test contracts after the user explicitly requested committing all. Disconfirmers: would revise H1 if staged review found a blocking defect, tests failed, sensitive literals appeared, or origin/main had advanced. Audit priors: scope comes from the staged 37-file diff; verification comes from the local 273-test run, staged diff check, secret-pattern scan, and read-only code review. Severity: if H1 is false, the exact-audience token tests, same-subject approval races, immutable manifest tests, bounded result validation, and catalog lifecycle regressions should reveal the unsafe boundary. - add immutable governed profiles, source manifests, and offline bootstrap - add authenticated fixed-operation client and exact audience token isolation - harden same-subject approval confirmation, denial, races, and replay handling - add catalog-only governed loader with stable provenance and lifecycle coverage - update implementation plans, tracker evidence, and authentication guidance Tests: 273 passed Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- record the shipped governed MCP lifecycle and local production-composition plan - preserve external consent, deployment, fixture, and live-validation gates - fix cross-table false positives in the Markdown converter validator with regression coverage ACT pass: H1 - ship one behavior-tagged closeout commit because the validator fix was discovered by this documentation gate. H2 - split documentation and validator commits because they are independently revertible. Would revise H1 if staged review found runtime or infrastructure changes, credential-like literals, or failing validation. Prior audit - the user requested commit all and push; repository evidence limits the scope to documentation plus the validator regression. Severity - high because this updates main; remote divergence, staged review, tests, and post-push SHA comparison are the controls. Going with H1 because all staged changes are jointly validated and preserve the local-only boundary. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Commits