Add identity-first Flex ingress and loop telemetry - #5
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a665e97d9e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| httpsOnly: true | ||
| publicNetworkAccess: 'Enabled' | ||
| siteConfig: { | ||
| linuxFxVersion: 'Python|3.12' |
There was a problem hiding this comment.
For the FC1 Flex Consumption plan declared just above, siteConfig.linuxFxVersion is the legacy Linux stack setting and isn't valid for Flex apps; Flex takes the language runtime from properties.functionAppConfig.runtime and package storage from functionAppConfig.deployment. When infra/main.bicep is deployed, ARM rejects this function app or leaves it without the required runtime/deployment configuration, so the new ingress cannot be created or published reliably.
Useful? React with 👍 / 👎.
| { | ||
| "version": "2.0", |
There was a problem hiding this comment.
When this Python function app is published, submit_workflow depends on @app.queue_output, but this host.json doesn't load an extension bundle. For Python/non-.NET Functions apps, the Storage Queues binding is provided by the Microsoft.Azure.Functions.ExtensionBundle; without it the host can't load/index the queue output binding, so valid workflow submissions won't enqueue work in Azure or Core Tools.
Useful? React with 👍 / 👎.
1 participant
Summary\nAdds the Azure Functions Flex Consumption ingress boundary, privacy-safe loop telemetry, and modular identity-first Bicep.\n\n## Changes\n- Add Python 3.12 Linux Flex Consumption HTTP ingress\n- Validate canonical envelopes and enqueue work instead of executing reasoning in-process\n- Add system-assigned identity, queue RBAC, Foundry project RBAC, and observability modules\n- Correlate control plane, worker, tool, verifier, and Foundry spans without prompt/output attributes\n- Harden the Windows validation script\n\n## Why\nCloud ingress must remain short-lived and identity-first while long-running or sandboxed execution stays behind an explicit worker boundary.\n\n## Validation\n- Ruff passed\n- Strict mypy passed\n- 51 tests passed with 92.48% coverage\n- Bicep compilation passed\n- No Azure deployment was performed\n\n## Risks\n- Public ingress and storage networking require environment-specific hardening before production\n- Azure what-if and live managed-identity smoke tests remain pending deployment authorization\n\n## Related\nCAS Loop Engineering milestone v1.\n\n## Reviewer notes\nStart with infra/main.bicep, infra/modules/function-ingress.bicep, and src/cas_reference_product/telemetry.py.