feat: establish cas platform v0.1 foundation

Author: Aitomates

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+* @OgeonX-Ai
+/.github/ @OgeonX-Ai
+/infra/ @OgeonX-Ai
+/scripts/ @OgeonX-Ai
+/docs/threat-model.md @OgeonX-Ai

.github/pull_request_template.md

@@ -0,0 +1,11 @@
+## Outcome
+
+## Security and operational impact
+
+## Validation
+
+- [ ] `./scripts/validate.ps1`
+- [ ] Azure what-if reviewed when infrastructure behavior changes
+- [ ] No secrets or tenant-specific values committed
+- [ ] Documentation and threat model updated
+

.github/workflows/validate.yml

@@ -0,0 +1,28 @@
+name: Validate platform
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: validate-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: windows-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Validate
+        shell: pwsh
+        run: ./scripts/validate.ps1
+

.gitignore

@@ -0,0 +1,7 @@
+.azure/
+.bicep/
+.tmp/
+*.local.bicepparam
+*.whatif.json
+*.whatif.txt
+

.planning/PROJECT.md

@@ -0,0 +1,67 @@
+# CAS Platform
+
+## What This Is
+
+CAS Platform is the Azure deployment and observability foundation for the
+Coding Autopilot System portfolio. It gives AI-native development workloads a
+repeatable, environment-isolated, identity-first platform that can be reviewed
+and validated safely before any Azure deployment.
+
+## Core Value
+
+An operator can confidently understand and validate a secure CAS Azure
+environment before deploying it.
+
+## Requirements
+
+### Validated
+
+(None yet - ship to validate)
+
+### Active
+
+- [ ] Provision environment-isolated Azure foundations from reusable Bicep.
+- [ ] Use system-assigned managed identity and no embedded secrets.
+- [ ] Provide centralized telemetry, cost controls, tags, and safe what-if.
+- [ ] Publish architecture, threat model, operations, and contribution evidence.
+
+### Out of Scope
+
+- Automatic Azure deployment - v0.1 stops at safe validation and what-if.
+- Workload business logic - owned by CAS workload repositories.
+- Static credentials - managed identity is mandatory.
+- Shared production networking - requires explicit landing-zone decisions.
+
+## Context
+
+The CAS portfolio needs a credible production platform connecting its
+orchestration and reference-product repositories. This repository owns Azure
+infrastructure definitions and operational proof, not application execution or
+developer workstation setup.
+
+## Constraints
+
+- **Identity**: System-assigned managed identities and least privilege only.
+- **Secrets**: No secrets, keys, or tokens in templates, parameters, or outputs.
+- **Compute**: Container Apps for container workloads; Flex Consumption Linux
+  for future event-driven Functions where appropriate.
+- **Safety**: No Azure resources may be deployed during v0.1 implementation.
+- **Portability**: One module graph must support dev, test, and production.
+
+## Key Decisions
+
+| Decision | Rationale | Outcome |
+|----------|-----------|---------|
+| Subscription-scope orchestrator | Creates isolated resource groups consistently | Pending |
+| Container Apps for v0.1 compute | Fits containerized CAS services and managed identity | Pending |
+| Azure Monitor diagnostics without shared keys | Preserves no-secret requirement | Pending |
+| Deployment workflow deferred | Identity and approvals must be designed first | Pending |
+
+## Evolution
+
+This document evolves at phase transitions and milestone boundaries. After each
+phase, requirements and decisions are updated from verification evidence.
+
+---
+*Last updated: 2026-06-11 after initialization*
+

.planning/REQUIREMENTS.md

@@ -0,0 +1,65 @@
+# Requirements: CAS Platform
+
+**Defined:** 2026-06-11
+**Core Value:** An operator can confidently understand and validate a secure CAS Azure environment before deploying it.
+
+## v1 Requirements
+
+### Infrastructure
+
+- [x] **INFRA-01**: Operator can build one subscription-scope Bicep entrypoint.
+- [x] **INFRA-02**: Operator can select isolated dev, test, or prod parameters.
+- [x] **INFRA-03**: Operator receives deterministic naming and mandatory tags.
+- [x] **INFRA-04**: Operator can host a container workload in Container Apps.
+
+### Security
+
+- [x] **SEC-01**: Workload uses a system-assigned managed identity.
+- [x] **SEC-02**: Templates and parameters contain no credentials or secrets.
+- [x] **SEC-03**: Public workload ingress is disabled by default.
+- [x] **SEC-04**: Repository publishes a threat model and security policy.
+
+### Operations
+
+- [x] **OPS-01**: Operator receives Log Analytics and Application Insights.
+- [x] **OPS-02**: Workload diagnostics route to Log Analytics.
+- [x] **OPS-03**: Operator can configure an optional environment budget.
+- [x] **OPS-04**: Operator can run a non-deploying Azure what-if.
+
+### Quality
+
+- [x] **QUAL-01**: Contributor can run Bicep and parameter validation locally.
+- [x] **QUAL-02**: Repository enforces infrastructure contract tests.
+- [x] **QUAL-03**: Repository documents architecture, operations, and contribution flow.
+- [x] **QUAL-04**: CI runs validation with least-privilege repository permissions.
+
+## v2 Requirements
+
+- **NET-01**: Operator can enable private networking and controlled egress.
+- **GOV-01**: Operator can apply Azure Policy and compliance reporting.
+- **DEL-01**: Authorized workload identity can promote reviewed infrastructure.
+- **OBS-01**: Operator receives SLO alerts, dashboards, and incident routing.
+- **SUP-01**: Releases include SBOM, signatures, and attestations.
+
+## Out of Scope
+
+| Feature | Reason |
+|---|---|
+| Azure deployment in v0.1 | User explicitly prohibited deployment |
+| Workload business logic | Owned by reference product and service repos |
+| Static credentials | Conflicts with identity-first architecture |
+
+## Traceability
+
+| Requirement | Phase | Status |
+|---|---|---|
+| INFRA-01, INFRA-02, INFRA-03, INFRA-04 | Phase 1 | Complete |
+| SEC-01, SEC-02, SEC-03, SEC-04 | Phase 1 | Complete |
+| OPS-01, OPS-02, OPS-03, OPS-04 | Phase 1 | Complete |
+| QUAL-01, QUAL-02, QUAL-03, QUAL-04 | Phase 1 | Complete |
+
+**Coverage:** 16 v1 requirements, 16 mapped, 0 unmapped.
+
+---
+*Last updated: 2026-06-11 after v0.1 foundation*
+

.planning/ROADMAP.md

@@ -0,0 +1,30 @@
+# Roadmap: CAS Platform
+
+## Phase 1: Safe Azure Foundation
+
+**Goal:** Deliver a useful, non-deploying v0.1 platform foundation.
+
+**Requirements:** INFRA-01 through INFRA-04, SEC-01 through SEC-04, OPS-01
+through OPS-04, QUAL-01 through QUAL-04.
+
+**Success criteria:**
+1. Bicep and all environment parameter files build successfully.
+2. Contract tests prove identity, ingress, environment, and what-if safeguards.
+3. Architecture and threat model accurately describe residual risk.
+4. Repository can be created publicly and CI can validate the foundation.
+
+## Phase 2: Network and Policy Guardrails
+
+Add private networking, controlled egress, Azure Policy, and compliance
+reporting after target subscription architecture is agreed.
+
+## Phase 3: Federated Delivery
+
+Add OIDC/managed-identity deployment workflows, approvals, evidence retention,
+and safe promotion between environments.
+
+## Phase 4: Production Operations
+
+Add alerts, SLOs, dashboards, incident routing, release attestations, and
+recovery exercises.
+

.planning/STATE.md

@@ -0,0 +1,14 @@
+# Project State
+
+## Project Reference
+
+See `.planning/PROJECT.md`.
+
+**Core value:** An operator can confidently understand and validate a secure CAS Azure environment before deploying it.
+**Current focus:** Phase 2 - Network and Policy Guardrails
+
+## Status
+
+- Phase 1 v0.1 foundation implemented and locally verified.
+- No Azure resources deployed.
+- Next planned phase: Network and Policy Guardrails.

.planning/config.json

@@ -0,0 +1,16 @@
+{
+  "mode": "yolo",
+  "granularity": "coarse",
+  "parallelization": true,
+  "commit_docs": true,
+  "model_profile": "quality",
+  "workflow": {
+    "research": true,
+    "plan_check": true,
+    "verifier": true,
+    "nyquist_validation": true,
+    "auto_advance": false,
+    "_auto_chain_active": false
+  }
+}
+

.planning/phases/01-safe-azure-foundation/01-01-PLAN.md

@@ -0,0 +1,16 @@
+# Plan 01-01: Safe Azure Foundation
+
+## Objective
+
+Deliver a useful, non-deploying Azure platform baseline with environment
+isolation, managed identity, observability, cost controls, and validation.
+
+## Tasks
+
+- [x] Establish subscription and module boundaries.
+- [x] Implement Bicep entrypoint, modules, and environment parameters.
+- [x] Add safe local validation and Azure what-if tooling.
+- [x] Add infrastructure contract tests and least-privilege CI.
+- [x] Publish architecture, threat model, operations, and community policies.
+- [x] Validate, commit, create the public repository, and push.
+