Skip to content

README.md

Latest commit

 

History

History
86 lines (58 loc) · 3.85 KB

README.md

File metadata and controls

86 lines (58 loc) · 3.85 KB
Raw

CAS Reference Product

CI CodeQL

Public v0.1 reference application for the Coding Autopilot System and Microsoft Foundry Next Gen Agents.

It runs a useful deterministic workflow locally, emits canonical cas-contracts v0.1 lifecycle events, and includes a Foundry adapter that invokes a Next Gen agent reference through the project Responses client. It is designed for the Container Apps and managed identity boundary supplied by cas-platform.

What It Demonstrates

  • WorkflowAgentService application boundary with local and Foundry Next Gen adapters.
  • System-assigned managed identity in Azure; no embedded secrets, keys, or tokens.
  • Canonical PromptEnvelope input and RunEvent lifecycle output.
  • OpenTelemetry spans and optional Application Insights export.
  • Liveness, readiness, tests, Dockerfile, CI, architecture, threat model, and operations.
  • Explicit non-deploying interface for cas-platform.

This project does not use Classic Assistants APIs and does not deploy Azure resources.

Azure deployment is locked workspace-wide until a future milestone (the CAS workspace's NO-AZURE-deploy hard lock). cas-platform, the deployment target this project's interface is designed for, is maintained "bicep-ready" (linted, parameterized, pinned) per Phase 33 but is not itself deployed. This repository's Foundry Next Gen adapter is exercised only through local runs and CI's Docker health-check smoke test — never a live Azure deploy.

Run Locally

Prerequisites: Python 3.12 and PowerShell.

./scripts/validate.ps1
./scripts/run-local.ps1

In another terminal:

Invoke-RestMethod `
  -Method Post `
  -Uri http://127.0.0.1:8080/api/v1/workflows `
  -ContentType application/json `
  -InFile examples/prompt-envelope.json

The local backend returns deterministic output and two canonical lifecycle events. It requires no Azure account.

Foundry Next Gen Mode

The cloud adapter uses AIProjectClient(...).get_openai_client().responses.create(...) with an agent_reference. Configure only resource identifiers:

ENVIRONMENT=dev
WORKFLOW_BACKEND=foundry
FOUNDRY_PROJECT_ENDPOINT=https://<resource>.services.ai.azure.com/api/projects/<project>
FOUNDRY_AGENT_NAME=<next-gen-agent-name>

In Azure, the application selects ManagedIdentityCredential() with no client ID, which binds to the Container App system-assigned identity. Grant that principal the minimum role needed at the Foundry project scope. Local development selects DefaultAzureCredential().

Container

docker build --platform linux/amd64 -t cas-reference-product:local .
docker run --rm -p 8080:8080 cas-reference-product:local

The image runs as a non-root user, listens on port 8080, and provides /health/live and /health/ready.

Documentation

Security

Report vulnerabilities through GitHub private vulnerability reporting. Do not include credentials or sensitive prompt data in issues.

Wiki

For a docs-as-code wiki (Home, Architecture, Operations, Decisions), see docs/wiki/.