Merge pull request #1 from Coding-Autopilot-System/audit/v0.1-integration-hardening

fix: harden v0.1 Foundry integration and contracts

Author: OgeonX-Ai

.dockerignore

@@ -1,10 +1,13 @@
 .git
 .github
 .planning
+.env
+.coverage
 .venv
 __pycache__
 .pytest_cache
+.mypy_cache
 .ruff_cache
+*.py[cod]
 tests
 docs
-

.gitattributes

@@ -10,3 +10,4 @@ Dockerfile text eol=lf
 *.md text eol=lf
 *.toml text eol=lf
 *.ps1 text eol=crlf
+tests/contracts/cas-contracts/v0.1.0/*.json -text -diff

Dockerfile

@@ -2,6 +2,7 @@ FROM python:3.12-slim AS runtime
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PORT=8080
 
 WORKDIR /app
@@ -10,12 +11,12 @@ RUN addgroup --system app && adduser --system --ingroup app app
 
 COPY pyproject.toml README.md ./
 COPY src ./src
-RUN pip install --no-cache-dir .
+RUN pip install --no-cache-dir --no-compile .
 
 USER app
 EXPOSE 8080
+STOPSIGNAL SIGTERM
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
   CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/live', timeout=2)"
 
 CMD ["uvicorn", "cas_reference_product.app:app", "--host", "0.0.0.0", "--port", "8080"]
-

deployment/cas-platform.interface.yaml

@@ -23,8 +23,3 @@ spec:
       - FOUNDRY_AGENT_NAME
     deploymentInjected:
       - APPLICATIONINSIGHTS_CONNECTION_STRING
-  outputsConsumed:
-    - workloadPrincipalId
-    - applicationInsightsId
-    - logAnalyticsWorkspaceId
-

docs/architecture.md

@@ -22,12 +22,18 @@ The Foundry call is isolated behind the `WorkflowAgentService` protocol. This ke
 
 ## Deployment Interface
 
-`deployment/cas-platform.interface.yaml` records the contract: Linux AMD64 image, port 8080, internal ingress by default, system-assigned identity, probes, non-secret identifiers, and platform outputs. It does not deploy resources.
+`deployment/cas-platform.interface.yaml` records the application contract: Linux AMD64 image, port
+8080, internal ingress by default, system-assigned identity, probes, and configuration inputs. It does
+not deploy resources.
+
+The application consumes only the environment values listed in that interface. Platform resource IDs
+and principal IDs remain deployment-orchestration outputs and are not application configuration.
 
 ## Observability Boundaries
 
 - Incoming HTTP requests are instrumented by Azure Monitor OpenTelemetry when configured.
 - `cas.workflow.execute` covers core orchestration.
 - `foundry.responses.create` covers the external Foundry call.
 - CAS correlation IDs are attached to workflow spans and canonical events preserve W3C trace context.
-
+- Broad Azure SDK and outbound HTTP auto-instrumentation is disabled to avoid capturing prompt or
+  output content. The application records only explicit boundary spans and safe identifiers.

docs/operations.md

@@ -9,13 +9,28 @@
 
 Submit `examples/prompt-envelope.json` to `POST /api/v1/workflows`. Liveness is `/health/live`; readiness is `/health/ready`.
 
+For a hardened local container run:
+
+```powershell
+docker run --rm --read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges `
+  -p 8080:8080 cas-reference-product:local
+```
+
 ## Foundry Mode
 
 Set `ENVIRONMENT` to `dev`, `test`, or `prod`; set `WORKFLOW_BACKEND=foundry`; provide the non-secret `FOUNDRY_PROJECT_ENDPOINT` and `FOUNDRY_AGENT_NAME`. The Azure-hosted workload uses its system-assigned managed identity. Do not configure API keys or client secrets.
 
 Readiness fails until required Foundry identifiers are present. Foundry connectivity is exercised only by workflow requests, not probes.
 
+When `APPLICATIONINSIGHTS_CONNECTION_STRING` is supplied, telemetry export also authenticates with
+the environment credential. Grant the system-assigned identity the minimum Azure Monitor publishing
+role required by the deployment. Retry-file storage and broad outbound HTTP/SDK auto-instrumentation
+are disabled; explicit spans do not record prompt or output content.
+
 ## Platform Handoff
 
 Build a Linux AMD64 image and pass its immutable image reference to the `containerImage` parameter of `cas-platform`. Review `deployment/cas-platform.interface.yaml` before platform changes. This repository intentionally contains no Azure deployment command.
 
+The Docker build context excludes local `.env` files and development artifacts. The application does
+not consume platform resource IDs; deployment orchestration retains those outputs for RBAC and
+operations workflows.

docs/threat-model.md

@@ -21,7 +21,7 @@
 | Credential disclosure | No keys or tokens in code; system-assigned `ManagedIdentityCredential` in Azure | Operators must maintain least-privilege RBAC |
 | Legacy API use | Adapter uses project Responses client with `agent_reference`; no Classic Assistants code | SDK behavior must be reviewed during upgrades |
 | Prompt injection | Workflow treats prompts as untrusted data and exposes no tools in v0.1 | Downstream agent policy remains product-specific |
-| Sensitive telemetry | Events contain identifiers and status, not prompt text or agent output | Operators must review SDK and platform log settings |
+| Sensitive telemetry | Explicit spans contain safe identifiers only; broad outbound HTTP/SDK auto-instrumentation and retry-file storage are disabled | Operators must review platform log settings |
 | Unauthorized invocation | External ingress disabled by default in platform interface | Authentication gateway is product-specific and out of scope |
 | Supply-chain compromise | Pinned CI actions, lint, tests, non-root container | Dependency update review remains required |
 | Denial of service | Platform scaling bounds and request validation | Product-specific quotas and rate limits are not included |
@@ -30,3 +30,5 @@
 
 Grant the Container App system-assigned identity only the minimum Foundry project role needed to invoke the selected agent, scoped to the narrowest resource. Do not assign subscription-wide roles.
 
+When Application Insights export is enabled, also grant the minimum Azure Monitor publishing role
+required by the deployment at the narrowest telemetry resource scope.

pyproject.toml

@@ -22,6 +22,7 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
   "httpx>=0.28.0",
+  "jsonschema>=4.23.0",
   "mypy>=1.14.0",
   "pytest>=8.3.0",
   "pytest-cov>=6.0.0",

src/cas_reference_product/app.py

@@ -7,7 +7,7 @@
 from .config import Settings, get_settings
 from .models import PromptEnvelope, WorkflowResult
 from .telemetry import configure_telemetry
-from .workflow import WorkflowOrchestrator, build_workflow_agent_service
+from .workflow import WorkflowAgentServiceError, WorkflowOrchestrator, build_workflow_agent_service
 
 
 def create_app(settings: Settings | None = None) -> FastAPI:
@@ -37,7 +37,10 @@ def execute(envelope: PromptEnvelope, request: Request) -> WorkflowResult:
             raise HTTPException(status_code=503, detail="Workflow backend is not ready")
         request.state.correlation_id = envelope.correlationId
         orchestrator = WorkflowOrchestrator(service, app_settings.repository)
-        return orchestrator.execute(envelope)
+        try:
+            return orchestrator.execute(envelope)
+        except WorkflowAgentServiceError:
+            raise HTTPException(status_code=502, detail="Workflow backend request failed") from None
 
     @app.get("/")
     def root() -> dict[str, Any]:

src/cas_reference_product/config.py

@@ -1,3 +1,4 @@
+import re
 from functools import lru_cache
 from typing import Literal
 
@@ -17,11 +18,21 @@ class Settings(BaseSettings):
     applicationinsights_connection_string: str | None = Field(default=None, repr=False)
 
     @property
-    def ready(self) -> bool:
-        return self.workflow_backend == "local" or bool(
-            self.foundry_project_endpoint and self.foundry_agent_name
+    def foundry_ready(self) -> bool:
+        return bool(
+            self.foundry_project_endpoint
+            and re.fullmatch(
+                r"https://[A-Za-z0-9.-]+\.services\.ai\.azure\.com/api/projects/[A-Za-z0-9_.-]+/?",
+                self.foundry_project_endpoint,
+            )
+            and self.foundry_agent_name
+            and self.foundry_agent_name.strip()
         )
 
+    @property
+    def ready(self) -> bool:
+        return self.workflow_backend == "local" or self.foundry_ready
+
 
 @lru_cache
 def get_settings() -> Settings: