[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-agentops-workflow":3,"mdc-v22iop-key":35,"related-repo-azure-agentops-workflow":3862,"related-org-azure-agentops-workflow":3955},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"agentops-workflow","configure AgentOps release readiness workflows","Set up AgentOps release-readiness workflows: PR eval gates, Doctor\u002Fevidence artifacts, and safe deploy handoffs to azd or Foundry prompt-agent tooling. Trigger on CI, CD, pipeline, workflow, GitHub Actions, Azure DevOps, ADO, PR gate, deploy, environments, GitFlow, release branch, promote to prod, DevOps, can we ship.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,15,18,21],{"name":11,"slug":8,"type":14},"tag",{"name":16,"slug":17,"type":14},"GitHub Actions","github-actions",{"name":19,"slug":20,"type":14},"Deployment","deployment",{"name":22,"slug":23,"type":14},"CI\u002FCD","ci-cd",10,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fagentops","2026-07-15T06:02:51.371749",null,7,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"AgentOps Accelerator is an open source framework and CLI for adding continuous evaluation and observability to enterprise AI agents. It standardizes evaluation patterns, automates assessments in CI\u002FCD workflows, and generates structured signals that help teams monitor, control, and safely operate agentic systems at scale.","https:\u002F\u002Fgithub.com\u002FAzure\u002Fagentops\u002Ftree\u002FHEAD\u002Fplugins\u002Fagentops\u002Fskills\u002Fagentops-workflow","---\nname: agentops-workflow\ndescription: \"Set up AgentOps release-readiness workflows: PR eval gates, Doctor\u002Fevidence artifacts, and safe deploy handoffs to azd or Foundry prompt-agent tooling. Trigger on CI, CD, pipeline, workflow, GitHub Actions, Azure DevOps, ADO, PR gate, deploy, environments, GitFlow, release branch, promote to prod, DevOps, can we ship.\"\n---\n\n# AgentOps Workflow\n\nHelp the user wire AgentOps into the release path so every candidate has a\nclear gate and proof pack. The default starting point is a PR eval gate. Full\nDEV\u002FQA\u002FPROD workflows are useful only after Azure auth, environments, and a real\ndeployment owner are configured.\n\n**Pick the platform up front.** AgentOps supports two:\n\n- `--platform github` (default) - writes `.github\u002Fworkflows\u002F*.yml` using\n  GitHub Actions. Auth via OIDC + GitHub Environments.\n- `--platform azure-devops` - writes `.azuredevops\u002Fpipelines\u002F*.yml` using\n  Azure DevOps Pipelines. Auth via a Service Connection + a variable\n  group named `agentops`.\n\nThe conceptual workflows are identical: one PR gate and optional deploy stages\n(dev\u002Fqa\u002Fprod). The PR and production templates already run\n`agentops doctor --evidence-pack` so reviewers get `evidence.json` and\n`evidence.md` in artifacts and, for GitHub Actions, in the run summary with the\nDoctor finding summary. A separate scheduled Doctor workflow is optional for\nperiodic health checks, not the default release path.\n\nFor a new repository or tutorial, start with the PR gate only:\n`agentops workflow generate --kinds pr`. Generate DEV\u002FQA\u002FPROD deploy\nworkflows only after environments, Azure auth, and real build\u002Fdeploy\ncommands are configured.\n\nFor copied accelerators or unfamiliar repos (for example GPT-RAG, Live Voice\nPractice, AI Landing Zone\u002FBicep-based apps), run `agentops workflow analyze`\nfirst and use the findings as the implementation plan before generating or\nediting workflows.\n\nAgentOps reuses **azd** for app\u002Finfrastructure deployment when the repo already\nhas an azd project, and stays **Foundry-native** for prompt-agent candidate\nworkflows. Do not invent a parallel deployment system. AgentOps should gate\nquality and record proof; `azd provision`, `azd deploy`, azd hooks, Foundry\nToolkit, the `microsoft-foundry` skill, and project tooling manage lifecycle\nactions.\n\nFor Foundry prompt-agent configs (`agent: name:version`), the generated eval gate\nshould use **AgentOps cloud eval in Foundry**: a temporary cloud config plus\n`agentops eval run`, not the legacy official Action\u002Ftask. Foundry still executes\nthe managed eval; AgentOps enforces thresholds, writes `results.json` \u002F\n`report.md`, and makes PR failures explainable in the summary.\n\n## Fast path - generated GitHub setup\n\nUse this path when the user already generated GitHub workflows or asks to get\nthe PR gate running. Stay local-first and deterministic; do not start\nby discovering the whole Azure subscription.\n\n1. Inspect the repo before cloud discovery:\n   - `agentops init show --dir .` without `--reveal-secrets`.\n   - `agentops.yaml`.\n   - `.agentops\u002F.env`, plus `.azure\u002Fconfig.json` and active `.azure\u002F\u003Cenv>\u002F.env`\n     when the repo uses azd.\n   - `azd env get-values` when `azure.yaml` exists and azd is available.\n   - `.github\u002Fworkflows\u002Fagentops-*.yml`.\n2. Read the generated workflows to determine exactly which GitHub environments\n   and variables are needed. For prompt-agent PR gates, `pr` uses\n   `environment: sandbox`; deploy workflows use `dev`, `qa`, or `production`.\n3. Treat these as GitHub Actions environments for OIDC and variables. `sandbox`\n   points at the Foundry authoring project. `dev` points at the first shared\n   post-merge project.\n4. Proceed only when these values are known or deliberately chosen:\n   - GitHub `owner\u002Frepo`.\n   - workflow environment names from `jobs.*.environment`.\n   - `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`.\n   - `AZURE_AI_FOUNDRY_PROJECT_ENDPOINT`.\n   - `AZURE_OPENAI_DEPLOYMENT`.\n   - optional `APPLICATIONINSIGHTS_CONNECTION_STRING`.\n5. Prefer existing values and exact checks:\n   - `git remote get-url origin` and `gh repo view --json nameWithOwner`.\n   - `git branch -vv` to confirm the local trunk branch tracks\n     `origin\u002Fmain` when the tutorial uses trunk-based `main`.\n   - `gh variable list --env \u003Cenv>` and `gh secret list --env \u003Cenv>`.\n   - `agentops init show`, local `.agentops\u002F.env` or `.azure\u002F\u003Cenv>\u002F.env`, and\n     `azd env get-values` values before `az account show`.\n   - `az account show` only as a proposal for tenant\u002Fsubscription; confirm\n     before writing it to GitHub variables.\n6. For GitHub OIDC, treat `AZURE_TENANT_ID` as the tenant that owns the app\n   registration \u002F federated credential, not merely the tenant associated with\n   the subscription or a `managedByTenants` entry. Before writing\n   `AZURE_TENANT_ID`, verify the chosen tenant can see the app registration and\n   the exact federated credential:\n   - `az ad app show --id \u003CAZURE_CLIENT_ID>` in the active tenant, or an\n     equivalent Microsoft Graph query scoped to the proposed tenant.\n   - `az ad app federated-credential list --id \u003CAZURE_CLIENT_ID>` and confirm\n     the `subject`, `issuer`, and `audiences`.\n   If the app is visible in one tenant but the Azure subscription is associated\n   with another tenant, use the app\u002Ffederated-credential tenant for\n   `AZURE_TENANT_ID`; the subscription id remains `AZURE_SUBSCRIPTION_ID`.\n   Do not copy a `managedByTenants[*].tenantId` value into GitHub variables\n   unless the app and federated credential are verified there too.\n7. When creating or connecting the GitHub remote for the prompt-agent tutorial,\n   make sure the local trunk branch tracks the remote trunk before telling the\n   user to continue:\n   - If `main` is newly pushed, use `git push -u origin main`.\n   - If `origin\u002Fmain` already exists, use\n     `git branch --set-upstream-to=origin\u002Fmain main`.\n   - Verify with `git branch -vv`; `main` must show `[origin\u002Fmain]`.\n   Without this, a later `git pull` on `main` can fetch but not update the\n   local branch.\n8. Copy CI variables from local AgentOps\u002Fazd configuration into the GitHub\n   environment used by the workflow. Reuse local values for\n   `AZURE_AI_FOUNDRY_PROJECT_ENDPOINT`, `AZURE_OPENAI_ENDPOINT`,\n   `AZURE_OPENAI_DEPLOYMENT`, and optional\n   `APPLICATIONINSIGHTS_CONNECTION_STRING` instead of asking the user to type\n   them again. Explain `AZURE_OPENAI_DEPLOYMENT` only if it is missing: it is\n   the Azure OpenAI deployment used as the evaluator\u002Fjudge model, not the\n   user's agent.\n9. For prompt-agent tutorials that use Foundry trace sampling \u002F trace-to-dataset,\n   verify observability RBAC before telling the user step 18 is ready:\n   - Resolve the dev Foundry project managed identity principal id.\n   - Resolve the connected Application Insights resource.\n   - Grant or verify **Reader** on that Application Insights resource to the dev\n     Foundry project managed identity.\n   - If the App Insights component is workspace-based, also grant or verify\n     **Reader** on the backing Log Analytics workspace.\n   This is separate from GitHub OIDC and separate from the signed-in user's\n   portal access. Operate dashboards can still render while trace-to-dataset\n   fails if the project identity cannot read App Insights.\n10. Do not enumerate subscriptions, Foundry projects, Azure OpenAI resources, or\n   model deployments to guess missing values. If `AZURE_SUBSCRIPTION_ID`,\n   `AZURE_TENANT_ID`, `AZURE_AI_FOUNDRY_PROJECT_ENDPOINT`, or\n   `AZURE_OPENAI_DEPLOYMENT` is absent from AgentOps\u002Fazd\u002Flocal env, ask the user\n   to choose or provide it. Only run a scoped Azure query after the user confirms\n   the subscription and the exact missing value.\n11. For GitHub OIDC, derive the federated credential subject from the generated\n   workflow. If the job has `environment: dev`, the subject is normally\n   `repo:\u003Cowner>\u002F\u003Crepo>:environment:dev`. Do not assume branch or\n   `pull_request` subjects without reading the workflow.\n12. Before triggering a Foundry prompt-agent workflow, make sure the OIDC app \u002F\n   service principal has **two** RBAC assignments. Both are required; the eval\n   step fails silently (every metric returns `null`) if only one is in place.\n   1. **Foundry User** on the Foundry project (or the Foundry resource scope\n      if that is the team's standard). Role id\n      `53ca6127-db72-4b80-b1b0-d745d6d5456d` (formerly Azure AI User). Without\n      this the candidate-staging step fails on\n      `Microsoft.CognitiveServices\u002Faccounts\u002FAIServices\u002Fagents\u002Fread`.\n   2. **Cognitive Services OpenAI User** on the underlying Azure AI Services\n      account that hosts the evaluator model deployment\n      (typically the parent account of the Foundry project). Role id\n      `5e0bd9bd-7b93-4f28-af87-19fc36ad61bd`. Without this the Foundry\n      `azure_ai_evaluator` graders fail with a 401 `PermissionDenied` on\n      `Microsoft.CognitiveServices\u002Faccounts\u002FOpenAI\u002Fdeployments\u002Fchat\u002Fcompletions\u002Faction`\n      and every metric comes back `null` in the cloud eval report. AgentOps now\n      lifts that error into `results.json` and the orchestrator's \"0 usable\n      metric scores\" warning so the cause is visible in CI logs, but the\n      workflow still fails the gate. Grant this role **before** the first run.\n   Azure **Reader** is not enough for either step.\n13. If either RBAC assignment is missing, do not run the workflow yet.\n   Show the exact GitHub OIDC client ID \u002F service principal, desired role,\n   target scope (project for Foundry User, AI Services account for Cognitive\n   Services OpenAI User), then ask the user to approve the role assignment or\n   get an Azure\u002FFoundry admin to grant it. After assignment, read it back or ask\n   the user to confirm before dispatching the workflow.\n   When the user approves and you know the scopes, use the role ids to avoid\n   rename drift:\n   - `az ad sp show --id \u003CAZURE_CLIENT_ID> --query id -o tsv`\n   - `az role assignment list --assignee \u003Csp-object-id> --scope \u003Cfoundry-scope> --include-inherited`\n   - `az role assignment create --assignee-object-id \u003Csp-object-id> --assignee-principal-type ServicePrincipal --role 53ca6127-db72-4b80-b1b0-d745d6d5456d --scope \u003Cfoundry-scope>`\n   - `az role assignment create --assignee-object-id \u003Csp-object-id> --assignee-principal-type ServicePrincipal --role 5e0bd9bd-7b93-4f28-af87-19fc36ad61bd --scope \u003Cai-services-account-scope>`\n   The AI Services account scope looks like\n   `\u002Fsubscriptions\u002F\u003Csub>\u002FresourceGroups\u002F\u003Crg>\u002Fproviders\u002FMicrosoft.CognitiveServices\u002Faccounts\u002F\u003Cai-account-name>`\n   and can be derived from\n   `az cognitiveservices account list --resource-group \u003Cfoundry-project-rg> --query \"[?kind=='AIServices'].id\" -o tsv`.\n14. Ask before creating or updating GitHub repos, GitHub environments,\n   variables\u002Fsecrets, Entra app registrations\u002Fservice principals, federated\n   credentials, managed identities, or Azure RBAC assignments.\n15. When creating federated credentials from PowerShell, avoid fragile\n   interpolation. Do **not** write `\"repo:$repo:environment:$envName\"` because\n   `$repo:` can be parsed as a scoped variable. Use\n   `\"repo:${repo}:environment:${envName}\"` or\n   `(\"repo:{0}:environment:{1}\" -f $repo, $envName)`, then build JSON from a\n   PowerShell object with `ConvertTo-Json`.\n16. After creating or updating a federated credential, read it back and verify\n    before triggering a workflow:\n    - `subject` exactly matches the generated workflow subject.\n    - `issuer` is `https:\u002F\u002Ftoken.actions.githubusercontent.com`.\n    - `audiences` includes `api:\u002F\u002FAzureADTokenExchange`.\n    If any value differs, fix the credential before running GitHub Actions.\n17. After setting GitHub environment variables, read them back and verify\n    `AZURE_TENANT_ID` still matches the app\u002Ffederated-credential tenant before\n    triggering a run. If `azure\u002Flogin` fails with `AADSTS53003`, first re-check\n    this tenant\u002Fapp alignment before assuming Conditional Access is the root\n    cause.\n18. Do not dispatch `gh workflow run` as a surprise validation step. First show\n    that the GitHub environment, variables\u002Fsecrets, federated credential, and\n    Foundry RBAC are ready, then ask the user before triggering workflows.\n19. Avoid broad discovery unless local config is missing. Do **not** run broad\n   `az resource list`, `az graph query`, SDK inspection, or web search to find\n   the Foundry project when `agentops init show`, `.agentops\u002F.env`, or\n   `.azure\u002F\u003Cenv>\u002F.env` already has `AZURE_AI_FOUNDRY_PROJECT_ENDPOINT`. If the\n   endpoint is missing, say exactly what is missing and ask the user before\n   scanning the subscription.\n\n## Branch model assumed\n\n```\nfeature\u002F* ── PR ──▶ develop                 [agentops-pr]          gate\n                       │\n                       └── merge ─▶ develop  [agentops-deploy-dev]  build + eval + deploy DEV\nrelease\u002F* ── push                            [agentops-deploy-qa]   build + eval + deploy QA\nrelease\u002F* ── PR ──▶ main                     [agentops-pr]          gate\n                       │\n                       └── merge ─▶ main     [agentops-deploy-prod] safety eval + build + deploy PROD\n```\n\nIf the user is on trunk-based development, omit `qa` and `release\u002F**`\nand have them generate `--kinds pr,dev,prod`.\n\nThe PR workflow uses the eval step as the hard merge gate. Doctor also\nruns there and writes release evidence; by default the Doctor step blocks\nthe PR on critical findings such as regression detection (`--severity-fail\ncritical`, the default behavior of `agentops workflow generate\n--doctor-gate critical`). This catches metric drops (for example\ngroundedness going from 5.0 to 4.0) that would still pass the configured\neval thresholds. To restore the pre-1.x advisory behavior — Doctor writes\nrelease evidence but does not block the PR — generate with `--doctor-gate\nnone`. DEV\u002FQA\u002FPROD deploy workflows always keep Doctor as a critical\nrelease gate; the `--doctor-gate` flag only controls the PR template.\n\n## Step 0 - Prerequisites\n\n1. `pip install \"agentops-accelerator @ git+https:\u002F\u002Fgithub.com\u002FAzure\u002Fagentops.git@main\"` if `agentops` is missing.\n2. `agentops eval analyze` has been reviewed, `agentops.yaml` exists at the\n   project root, and `agentops eval run` works locally.\n3. The user's repo follows GitFlow (or is willing to). If not, ask which\n   branches map to dev\u002Fqa\u002Fprod and adjust the triggers after\n   generation.\n\n## Step 1 - Generate the workflows\n\nFirst analyze the repo shape:\n\n```bash\nagentops workflow analyze\nagentops workflow analyze --format markdown --out agentops-workflow-plan.md\n```\n\nUse the analysis to decide whether `--deploy-mode auto` is enough or whether\nyou need to adapt placeholders\u002Fproject-specific deployment. The analyzer is\nlocal-only and looks for `azure.yaml`, Bicep, AgentOps prompt-agent config,\nlanding-zone manifests, private-network signals, Docker\u002FContainer Apps signals,\nand existing CI folders. Treat README matches as hints only; structural files\ndrive the recommendation.\n\n**GitHub Actions (default):**\n\n```bash\nagentops workflow generate --kinds pr\n# or full scaffold:\nagentops workflow generate --kinds pr,dev,qa,prod --force\n```\n\n**Azure DevOps Pipelines:**\n\n```bash\nagentops workflow generate --platform azure-devops --kinds pr\n# or full scaffold:\nagentops workflow generate --platform azure-devops --kinds pr,dev,qa,prod --force\n```\n\nThe full scaffold writes:\n\n| Kind | GitHub Actions path | Azure DevOps path | Trigger | Environment |\n|---|---|---|---|---|\n| `pr` | `.github\u002Fworkflows\u002Fagentops-pr.yml` | `.azuredevops\u002Fpipelines\u002Fagentops-pr.yml` | PRs to `develop`, `release\u002F**`, `main` | `sandbox` for prompt-agent PR candidates, `dev` for generic PR gates |\n| `dev` | `.github\u002Fworkflows\u002Fagentops-deploy-dev.yml` | `.azuredevops\u002Fpipelines\u002Fagentops-deploy-dev.yml` | push to `develop` | `dev` |\n| `qa` | `.github\u002Fworkflows\u002Fagentops-deploy-qa.yml` | `.azuredevops\u002Fpipelines\u002Fagentops-deploy-qa.yml` | push to `release\u002F**` | `qa` |\n| `prod` | `.github\u002Fworkflows\u002Fagentops-deploy-prod.yml` | `.azuredevops\u002Fpipelines\u002Fagentops-deploy-prod.yml` | push to `main` | `production` |\n| `doctor` | `.github\u002Fworkflows\u002Fagentops-doctor.yml` | `.azuredevops\u002Fpipelines\u002Fagentops-doctor.yml` | daily cron (06:00 UTC) | `dev` |\n\nPR and PROD workflows upload release evidence. Explain that this is a\nprojection of existing eval\u002FDoctor\u002FFoundry\u002Fmonitoring signals, not a separate\nexit-code contract. Generate the optional scheduled Doctor workflow only when\nthe team explicitly wants periodic health-check artifacts outside PR\u002Frelease\nevents.\n\nUseful flags:\n\n- `--platform github | azure-devops` - pick the CI\u002FCD platform.\n- `--force` - overwrite existing workflow files.\n- `--kinds pr,dev,qa,prod` - generate a subset. Prefer `--kinds pr`\n  until deploy environments are configured.\n- `--kinds doctor` - optional scheduled Doctor-only workflow for periodic\n  checks. Do not use it as a substitute for the PR gate.\n- `--deploy-mode auto|placeholder|azd|prompt-agent` - `auto` uses azd\n  templates when `azure.yaml` exists, otherwise uses prompt-agent templates\n  when `agentops.yaml` targets a Foundry prompt agent; `azd` forces\n  `azd provision` \u002F `azd deploy`; `prompt-agent` stages\u002Fevaluates a Foundry\n  prompt candidate; `placeholder` keeps the generic stack-agnostic scaffold.\n- `--dir \u003Cpath>` - non-default repo root.\n\n## Step 2 - Configure environments and Azure auth\n\n### GitHub Actions\n\nRead the generated workflow files and create only the GitHub Environments used\nby `jobs.*.environment`. For prompt-agent PR gates, create **`sandbox`**. For the\nfull scaffold, create **`sandbox`**, **`dev`**, **`qa`**, and **`production`**.\n\n- **`sandbox`** - no extra protection. Store the PR candidate endpoint and OIDC variables here when generated jobs use `environment: sandbox`.\n- **`dev`** - no extra protection. Store the OIDC variables here when the\n  generated jobs use `environment: dev`.\n- **`qa`** - usually no required reviewers, but isolated variables for QA.\n- **`production`** - set required reviewers, optional wait timer, optional\n  deployment branch restriction to `main`, and production-specific variables.\n\nTell the user that environment-level variables override repository-level ones\ninside jobs that declare that environment.\n\n### Azure DevOps\n\nIn **Pipelines → Environments**, create three: `dev`, `qa`,\n`production`. On `production`, add a manual approval check (Approvals\nand checks → New check → Approvals).\n\nIn **Pipelines → Library**, create a variable group named `agentops`\nwith these variables (mark sensitive ones as secret if needed):\n\n- `AZURE_AI_FOUNDRY_PROJECT_ENDPOINT`\n- `AZURE_OPENAI_ENDPOINT`\n- `AZURE_OPENAI_DEPLOYMENT`\n- `APPLICATIONINSIGHTS_CONNECTION_STRING` - optional fallback if the\n  Foundry project's App Insights connection cannot be auto-discovered.\n\nIn **Project settings → Service connections**, create an Azure Resource\nManager service connection named `agentops-azure` scoped to the\nsubscription that hosts your Foundry project.\n\nGrant the build service \"Contribute to pull requests\" permission on the\nrepository (Project settings → Repositories → Security → `Build Service`)\nso the PR-comment step can post.\n\n## Step 3 - Configure Azure auth\n\n### GitHub Actions (OIDC)\n\nAt the GitHub Environment level when the workflow declares an environment\n(preferred for the tutorials), or at repository level when intentionally shared\nacross environments, set:\n\n- `AZURE_CLIENT_ID` - App registration \u002F managed identity used for OIDC.\n- `AZURE_TENANT_ID`\n- `AZURE_SUBSCRIPTION_ID`\n- `AZURE_AI_FOUNDRY_PROJECT_ENDPOINT` - Foundry project URL used by the\n  eval step.\n- `AZURE_OPENAI_DEPLOYMENT` - existing Azure OpenAI deployment used as the\n  evaluator\u002Fjudge model. Reuse the local AgentOps\u002Fazd value when available.\n- `APPLICATIONINSIGHTS_CONNECTION_STRING` - optional fallback as a\n  variable or secret. Generated workflows first try to auto-discover App\n  Insights from the Foundry project endpoint; this value makes eval and\n  Doctor telemetry explicit.\n\nFor Foundry prompt-agent projects that use trace sampling or\n**Create dataset → From traces**, also verify the Foundry project managed\nidentity can read telemetry: grant or verify **Reader** on the connected\nApplication Insights resource, and on the backing Log Analytics workspace when\nthe App Insights component is workspace-based. This permission is not covered by\nthe GitHub OIDC service principal roles above.\n\nThen configure Workload Identity Federation on the Azure side\n(`federated-credentials` on the app registration) for **each branch \u002F\nenvironment** the workflows will run from. See\n`docs\u002Fci-github-actions.md` for the exact `az` commands.\n\nAlso grant the same app registration \u002F service principal **two** Azure\nRBAC roles before the first workflow run; both are required and the eval\nstep fails silently (every metric returns `null`) if only one is in place:\n\n1. **Foundry User** on the Foundry project or Foundry resource. The PR gate\n   uses Foundry data-plane APIs to read prompt agents; Azure `Reader` only\n   proves ARM access and will still fail the eval step with\n   `Microsoft.CognitiveServices\u002Faccounts\u002FAIServices\u002Fagents\u002Fread`.\n2. **Cognitive Services OpenAI User** on the underlying Azure AI Services\n   account that hosts the evaluator model deployment. Without this, Foundry\n   `azure_ai_evaluator` graders fail with a 401 `PermissionDenied` on the\n   OpenAI `chat\u002Fcompletions\u002Faction` data action and every metric returns\n   `null` in the cloud eval report. AgentOps surfaces that error in\n   `results.json` and the orchestrator's \"0 usable metric scores\" warning,\n   but the workflow still fails the gate — fix the role before the run.\n\nTell the user that CI evals emit `agentops.eval.*` telemetry and scheduled\nDoctor runs emit `agentops.agent.finding.*` telemetry when App Insights is\nconfigured or auto-discovered. The Cockpit uses those signals for Azure\nMonitor deep links.\n\n### Azure DevOps (Service Connection)\n\nAlready done in Step 2 - the `agentops-azure` service connection\nhandles auth. Make sure the underlying service principal or managed\nidentity has **both** the **Foundry User** role on the Foundry project (or\nFoundry resource) **and** the **Cognitive Services OpenAI User** role on the\nunderlying Azure AI Services account that hosts the evaluator model. Both\nare required; without the OpenAI User role the Foundry graders fail with a\n401 `PermissionDenied` and every cloud eval metric returns `null`.\n\n## Step 4 - Use azd for deployment\n\nIf the repo already has `azure.yaml`, generate azd-backed deployment\nworkflows:\n\n```bash\nagentops workflow generate --kinds pr,dev,qa,prod --deploy-mode azd --force\n```\n\nThe deploy workflows will:\n\n1. run `azd env new ... || azd env select ...` in CI;\n2. run `azd provision --no-prompt` for DEV by default;\n3. run `azd provision --no-prompt` for QA\u002FPROD only when manually\n   requested (`provision=true` in GitHub Actions or\n   `RUN_AZD_PROVISION=true` in Azure DevOps);\n4. run `agentops eval run` as the quality\u002Fsafety gate;\n5. run `azd env refresh` on the deploy runner so a fresh CI workspace can\n   recover outputs from the previous infrastructure provision;\n6. run `azd deploy --no-prompt`.\n\nSet `AZURE_ENV_NAME` per GitHub Environment \u002F Azure DevOps variable\ngroup if the user's azd env names are not exactly `dev`, `qa`, and\n`production`. Set `AZURE_LOCATION` when the azd template needs an\nexplicit region.\n\n### If the user asks for \"zero-trust deployment\"\n\nDo **not** replicate azd. Do this instead:\n\n1. Inspect the app and ask only for missing critical choices (region,\n   target host, private networking yes\u002Fno if not obvious).\n2. Prefer an existing azd template or AVM-backed template that already\n   implements managed identity, RBAC-only data access, private endpoints\n   where required, and no secrets in source.\n3. Create or adapt `azure.yaml`, `infra\u002F`, and azd-native hooks declared\n   in `azure.yaml` (`preprovision`, `postprovision`, `predeploy`,\n   `postdeploy`) as needed.\n4. Run `azd provision` to validate the infrastructure path.\n5. Re-run `agentops workflow generate --deploy-mode azd --force` so CI\n   delegates provision\u002Fdeploy to azd.\n\nNever call ad-hoc hook scripts from the workflow (for example\n`.\u002Fagentops\u002Fdeploy.sh` or `.\u002F.azd\u002Fhooks\u002F*`). If custom behavior is\nneeded, put it behind azd's native hook mechanism in `azure.yaml`.\n\n### Copied accelerators \u002F AI Landing Zone apps\n\nFor Azure AI accelerators copied from templates, use AgentOps to make the\nlanding-zone path actionable:\n\n1. AgentOps handles eval gates, Doctor, reports, Cockpit readiness, and the\n   workflow guardrails around deployment.\n2. Foundry manages hosted agents, prompt-agent versions, evaluations, traces,\n   monitoring, datasets, and operations.\n3. azd\u002FBicep\u002FAILZ manages app and infrastructure deploy when `azure.yaml` or\n   `infra\u002F*.bicep` exists.\n4. Project-specific steps such as indexing, data seeding, model deployment,\n   container build\u002Fpush, App Config updates, or private-network post-provision\n   work stay in azd hooks or existing project tooling.\n\nIf `scripts\u002FInvoke-PreflightChecks.ps1` exists, keep it in the deployment path:\nAgentOps-generated azd workflows run it with `-Strict` before `azd provision`.\nDoctor surfaces the same path as `AI Landing Zone deployment readiness`, with\nevidence for preflight, `agentops.yaml`, azd workflow coverage, network\nisolation, and the private runner path.\n\nIf `agentops workflow analyze` reports network isolation, private endpoints,\njumpbox\u002FBastion, Azure Firewall, or ACR Tasks, do not assume GitHub-hosted\nrunners can deploy everything. Plan self-hosted runner, jumpbox handoff, or ACR\nTasks agent-pool execution before enabling DEV\u002FQA\u002FPROD deploy stages.\n\nIf `azure.yaml` is missing and the user is not asking to create the\ndeployment assets yet, check whether this is a Foundry prompt agent. If\n`agentops.yaml` has `agent: \"name:version\"`, prefer prompt-agent mode:\n\n```bash\nagentops workflow generate --kinds pr,dev,qa,prod --deploy-mode prompt-agent --force\n```\n\nPrompt-agent workflows:\n\n1. read `prompt_file` from `agentops.yaml` or\n   `AGENTOPS_AGENT_PROMPT_FILE`;\n2. look up the seed agent in the active environment's Foundry project;\n   if it does not exist (typical first deploy into dev \u002F qa \u002F prod),\n   read the optional `prompt_agent_bootstrap` block from\n   `agentops.yaml` (required `model`, optional `description`,\n   `model_parameters`, `tools`) plus `prompt_file` and create the\n   first version automatically (recorded as `action: \"bootstrapped\"`);\n3. otherwise create or reuse a candidate Foundry prompt-agent version\n   from `prompt_file`;\n4. generate `.agentops\u002Fdeployments\u002Fagentops.candidate.yaml`;\n5. run `agentops eval run` against the candidate version;\n6. record `.agentops\u002Fdeployments\u002Ffoundry-agent.json` as a deployment\n   artifact only when the gate passes.\n\nThis avoids the bad pattern of evaluating one agent version and deploying a\ndifferent prompt. The invariant is: **evaluated version == deployed version**.\nFoundry manages agent versions; AgentOps enforces the repo-side gate and\ndeployment record. For multi-environment prompt-agent workflows\n(sandbox → dev → qa → prod), strongly recommend adding the\n`prompt_agent_bootstrap` block so operators do not have to manually\nrecreate the seed agent in every Foundry project.\n\nIf this is not a Foundry prompt agent and azd is not ready, generate\n`--kinds pr` only or use `--deploy-mode placeholder`. Do not ship\nDEV\u002FQA\u002FPROD workflows that pretend deployment is wired.\n\n## Step 5 - Branch protection\n\nIn Settings → Branches, add a rule for both `develop` and `main`:\n\n- Require a pull request before merging.\n- Require status checks to pass: select **`AgentOps PR \u002F Eval (PR gate)`**\n  (the job name from `agentops-pr.yml`).\n- Optional: require linear history.\n\nThis makes the eval gate a hard merge requirement.\n\n## Step 6 - Iterate\n\nCommon follow-ups:\n\n- **Tighten thresholds for QA\u002FPROD** - copy `agentops.yaml` to\n  `agentops-qa.yaml` \u002F `agentops-prod.yaml` and tighten the\n  `thresholds:` block. Point each workflow at its own config via the\n  `inputs.config` default.\n- **Scheduled runs** - add a `schedule:` entry in `agentops-pr.yml` (or a\n  new `agentops-nightly.yml`) to evaluate against `main` nightly.\n- **Matrix per scenario** - if the user has multiple AgentOps config files,\n  extend the eval job with `strategy.matrix.config:` and reference\n  `${{ matrix.config }}`.\n- **Regression baseline** - wire the deploy templates to download the\n  previous run's `results.json` artifact and call\n  `agentops eval run --baseline \u003Cresults.json>`.\n\n## Guardrails\n\n- Do **not** invent CLI flags. The supported `workflow analyze` flags are\n  `--dir`, `--format`, and `--out`. The supported `workflow generate` flags are\n  `--force`, `--dir`, `--kinds`, `--platform`, `--deploy-mode`, and\n  `--doctor-gate`.\n- Do **not** push DEV\u002FQA\u002FPROD deploy workflows with placeholder\n  Build\u002FDeploy steps or missing OIDC variables; generate PR-only first.\n- Do **not** create parallel workflow files. Prefer editing the\n  generated ones.\n- Do **not** auto-fill app\u002Finfrastructure deployment with raw Azure CLI\n  steps that bypass azd. AgentOps gates; azd provisions and deploys. For\n  Foundry prompt agents, use `--deploy-mode prompt-agent` so the workflow\n  calls the Foundry SDK and evaluates the candidate version before marking\n  it deployed.\n- Do **not** use AgentOps workflows to create or deploy Foundry Hosted Agents.\n  Use Foundry Toolkit \u002F the `microsoft-foundry` skill \u002F the app's azd path,\n  then point AgentOps at the deployed URL for gates and evidence.\n- The four workflow names (`agentops-pr`, `agentops-deploy-dev`,\n  `agentops-deploy-qa`, `agentops-deploy-prod`) are fixed - don't rename\n  them or branch-protection wiring will break.\n",{"data":36,"body":37},{"name":4,"description":6},{"type":38,"children":39},"root",[40,48,54,65,117,146,159,172,215,259,266,271,1080,1136,1342,1348,1360,1386,1423,1429,1480,1486,1491,1559,1579,1587,1659,1667,1749,1754,2049,2054,2059,2194,2200,2205,2263,2337,2342,2348,2386,2404,2441,2460,2473,2479,2485,2490,2549,2567,2603,2621,2690,2711,2717,2767,2773,2785,2829,2834,2923,2963,2969,2980,3073,3099,3105,3110,3147,3189,3200,3226,3269,3274,3416,3435,3455,3461,3479,3516,3521,3527,3532,3672,3678,3856],{"type":41,"tag":42,"props":43,"children":44},"element","h1",{"id":4},[45],{"type":46,"value":47},"text","AgentOps Workflow",{"type":41,"tag":49,"props":50,"children":51},"p",{},[52],{"type":46,"value":53},"Help the user wire AgentOps into the release path so every candidate has a\nclear gate and proof pack. The default starting point is a PR eval gate. Full\nDEV\u002FQA\u002FPROD workflows are useful only after Azure auth, environments, and a real\ndeployment owner are configured.",{"type":41,"tag":49,"props":55,"children":56},{},[57,63],{"type":41,"tag":58,"props":59,"children":60},"strong",{},[61],{"type":46,"value":62},"Pick the platform up front.",{"type":46,"value":64}," AgentOps supports two:",{"type":41,"tag":66,"props":67,"children":68},"ul",{},[69,90],{"type":41,"tag":70,"props":71,"children":72},"li",{},[73,80,82,88],{"type":41,"tag":74,"props":75,"children":77},"code",{"className":76},[],[78],{"type":46,"value":79},"--platform github",{"type":46,"value":81}," (default) - writes ",{"type":41,"tag":74,"props":83,"children":85},{"className":84},[],[86],{"type":46,"value":87},".github\u002Fworkflows\u002F*.yml",{"type":46,"value":89}," using\nGitHub Actions. Auth via OIDC + GitHub Environments.",{"type":41,"tag":70,"props":91,"children":92},{},[93,99,101,107,109,115],{"type":41,"tag":74,"props":94,"children":96},{"className":95},[],[97],{"type":46,"value":98},"--platform azure-devops",{"type":46,"value":100}," - writes ",{"type":41,"tag":74,"props":102,"children":104},{"className":103},[],[105],{"type":46,"value":106},".azuredevops\u002Fpipelines\u002F*.yml",{"type":46,"value":108}," using\nAzure DevOps Pipelines. Auth via a Service Connection + a variable\ngroup named ",{"type":41,"tag":74,"props":110,"children":112},{"className":111},[],[113],{"type":46,"value":114},"agentops",{"type":46,"value":116},".",{"type":41,"tag":49,"props":118,"children":119},{},[120,122,128,130,136,138,144],{"type":46,"value":121},"The conceptual workflows are identical: one PR gate and optional deploy stages\n(dev\u002Fqa\u002Fprod). The PR and production templates already run\n",{"type":41,"tag":74,"props":123,"children":125},{"className":124},[],[126],{"type":46,"value":127},"agentops doctor --evidence-pack",{"type":46,"value":129}," so reviewers get ",{"type":41,"tag":74,"props":131,"children":133},{"className":132},[],[134],{"type":46,"value":135},"evidence.json",{"type":46,"value":137}," and\n",{"type":41,"tag":74,"props":139,"children":141},{"className":140},[],[142],{"type":46,"value":143},"evidence.md",{"type":46,"value":145}," in artifacts and, for GitHub Actions, in the run summary with the\nDoctor finding summary. A separate scheduled Doctor workflow is optional for\nperiodic health checks, not the default release path.",{"type":41,"tag":49,"props":147,"children":148},{},[149,151,157],{"type":46,"value":150},"For a new repository or tutorial, start with the PR gate only:\n",{"type":41,"tag":74,"props":152,"children":154},{"className":153},[],[155],{"type":46,"value":156},"agentops workflow generate --kinds pr",{"type":46,"value":158},". Generate DEV\u002FQA\u002FPROD deploy\nworkflows only after environments, Azure auth, and real build\u002Fdeploy\ncommands are configured.",{"type":41,"tag":49,"props":160,"children":161},{},[162,164,170],{"type":46,"value":163},"For copied accelerators or unfamiliar repos (for example GPT-RAG, Live Voice\nPractice, AI Landing Zone\u002FBicep-based apps), run ",{"type":41,"tag":74,"props":165,"children":167},{"className":166},[],[168],{"type":46,"value":169},"agentops workflow analyze",{"type":46,"value":171},"\nfirst and use the findings as the implementation plan before generating or\nediting workflows.",{"type":41,"tag":49,"props":173,"children":174},{},[175,177,182,184,189,191,197,199,205,207,213],{"type":46,"value":176},"AgentOps reuses ",{"type":41,"tag":58,"props":178,"children":179},{},[180],{"type":46,"value":181},"azd",{"type":46,"value":183}," for app\u002Finfrastructure deployment when the repo already\nhas an azd project, and stays ",{"type":41,"tag":58,"props":185,"children":186},{},[187],{"type":46,"value":188},"Foundry-native",{"type":46,"value":190}," for prompt-agent candidate\nworkflows. Do not invent a parallel deployment system. AgentOps should gate\nquality and record proof; ",{"type":41,"tag":74,"props":192,"children":194},{"className":193},[],[195],{"type":46,"value":196},"azd provision",{"type":46,"value":198},", ",{"type":41,"tag":74,"props":200,"children":202},{"className":201},[],[203],{"type":46,"value":204},"azd deploy",{"type":46,"value":206},", azd hooks, Foundry\nToolkit, the ",{"type":41,"tag":74,"props":208,"children":210},{"className":209},[],[211],{"type":46,"value":212},"microsoft-foundry",{"type":46,"value":214}," skill, and project tooling manage lifecycle\nactions.",{"type":41,"tag":49,"props":216,"children":217},{},[218,220,226,228,233,235,241,243,249,251,257],{"type":46,"value":219},"For Foundry prompt-agent configs (",{"type":41,"tag":74,"props":221,"children":223},{"className":222},[],[224],{"type":46,"value":225},"agent: name:version",{"type":46,"value":227},"), the generated eval gate\nshould use ",{"type":41,"tag":58,"props":229,"children":230},{},[231],{"type":46,"value":232},"AgentOps cloud eval in Foundry",{"type":46,"value":234},": a temporary cloud config plus\n",{"type":41,"tag":74,"props":236,"children":238},{"className":237},[],[239],{"type":46,"value":240},"agentops eval run",{"type":46,"value":242},", not the legacy official Action\u002Ftask. Foundry still executes\nthe managed eval; AgentOps enforces thresholds, writes ",{"type":41,"tag":74,"props":244,"children":246},{"className":245},[],[247],{"type":46,"value":248},"results.json",{"type":46,"value":250}," \u002F\n",{"type":41,"tag":74,"props":252,"children":254},{"className":253},[],[255],{"type":46,"value":256},"report.md",{"type":46,"value":258},", and makes PR failures explainable in the summary.",{"type":41,"tag":260,"props":261,"children":263},"h2",{"id":262},"fast-path-generated-github-setup",[264],{"type":46,"value":265},"Fast path - generated GitHub setup",{"type":41,"tag":49,"props":267,"children":268},{},[269],{"type":46,"value":270},"Use this path when the user already generated GitHub workflows or asks to get\nthe PR gate running. Stay local-first and deterministic; do not start\nby discovering the whole Azure subscription.",{"type":41,"tag":272,"props":273,"children":274},"ol",{},[275,367,410,430,518,636,733,820,860,901,932,961,981,1006,1075],{"type":41,"tag":70,"props":276,"children":277},{},[278,280],{"type":46,"value":279},"Inspect the repo before cloud discovery:\n",{"type":41,"tag":66,"props":281,"children":282},{},[283,301,311,338,357],{"type":41,"tag":70,"props":284,"children":285},{},[286,292,294,300],{"type":41,"tag":74,"props":287,"children":289},{"className":288},[],[290],{"type":46,"value":291},"agentops init show --dir .",{"type":46,"value":293}," without ",{"type":41,"tag":74,"props":295,"children":297},{"className":296},[],[298],{"type":46,"value":299},"--reveal-secrets",{"type":46,"value":116},{"type":41,"tag":70,"props":302,"children":303},{},[304,310],{"type":41,"tag":74,"props":305,"children":307},{"className":306},[],[308],{"type":46,"value":309},"agentops.yaml",{"type":46,"value":116},{"type":41,"tag":70,"props":312,"children":313},{},[314,320,322,328,330,336],{"type":41,"tag":74,"props":315,"children":317},{"className":316},[],[318],{"type":46,"value":319},".agentops\u002F.env",{"type":46,"value":321},", plus ",{"type":41,"tag":74,"props":323,"children":325},{"className":324},[],[326],{"type":46,"value":327},".azure\u002Fconfig.json",{"type":46,"value":329}," and active ",{"type":41,"tag":74,"props":331,"children":333},{"className":332},[],[334],{"type":46,"value":335},".azure\u002F\u003Cenv>\u002F.env",{"type":46,"value":337},"\nwhen the repo uses azd.",{"type":41,"tag":70,"props":339,"children":340},{},[341,347,349,355],{"type":41,"tag":74,"props":342,"children":344},{"className":343},[],[345],{"type":46,"value":346},"azd env get-values",{"type":46,"value":348}," when ",{"type":41,"tag":74,"props":350,"children":352},{"className":351},[],[353],{"type":46,"value":354},"azure.yaml",{"type":46,"value":356}," exists and azd is available.",{"type":41,"tag":70,"props":358,"children":359},{},[360,366],{"type":41,"tag":74,"props":361,"children":363},{"className":362},[],[364],{"type":46,"value":365},".github\u002Fworkflows\u002Fagentops-*.yml",{"type":46,"value":116},{"type":41,"tag":70,"props":368,"children":369},{},[370,372,378,380,386,388,394,395,401,403,409],{"type":46,"value":371},"Read the generated workflows to determine exactly which GitHub environments\nand variables are needed. For prompt-agent PR gates, ",{"type":41,"tag":74,"props":373,"children":375},{"className":374},[],[376],{"type":46,"value":377},"pr",{"type":46,"value":379}," uses\n",{"type":41,"tag":74,"props":381,"children":383},{"className":382},[],[384],{"type":46,"value":385},"environment: sandbox",{"type":46,"value":387},"; deploy workflows use ",{"type":41,"tag":74,"props":389,"children":391},{"className":390},[],[392],{"type":46,"value":393},"dev",{"type":46,"value":198},{"type":41,"tag":74,"props":396,"children":398},{"className":397},[],[399],{"type":46,"value":400},"qa",{"type":46,"value":402},", or ",{"type":41,"tag":74,"props":404,"children":406},{"className":405},[],[407],{"type":46,"value":408},"production",{"type":46,"value":116},{"type":41,"tag":70,"props":411,"children":412},{},[413,415,421,423,428],{"type":46,"value":414},"Treat these as GitHub Actions environments for OIDC and variables. ",{"type":41,"tag":74,"props":416,"children":418},{"className":417},[],[419],{"type":46,"value":420},"sandbox",{"type":46,"value":422},"\npoints at the Foundry authoring project. ",{"type":41,"tag":74,"props":424,"children":426},{"className":425},[],[427],{"type":46,"value":393},{"type":46,"value":429}," points at the first shared\npost-merge project.",{"type":41,"tag":70,"props":431,"children":432},{},[433,435],{"type":46,"value":434},"Proceed only when these values are known or deliberately chosen:\n",{"type":41,"tag":66,"props":436,"children":437},{},[438,450,462,486,496,506],{"type":41,"tag":70,"props":439,"children":440},{},[441,443,449],{"type":46,"value":442},"GitHub ",{"type":41,"tag":74,"props":444,"children":446},{"className":445},[],[447],{"type":46,"value":448},"owner\u002Frepo",{"type":46,"value":116},{"type":41,"tag":70,"props":451,"children":452},{},[453,455,461],{"type":46,"value":454},"workflow environment names from ",{"type":41,"tag":74,"props":456,"children":458},{"className":457},[],[459],{"type":46,"value":460},"jobs.*.environment",{"type":46,"value":116},{"type":41,"tag":70,"props":463,"children":464},{},[465,471,472,478,479,485],{"type":41,"tag":74,"props":466,"children":468},{"className":467},[],[469],{"type":46,"value":470},"AZURE_CLIENT_ID",{"type":46,"value":198},{"type":41,"tag":74,"props":473,"children":475},{"className":474},[],[476],{"type":46,"value":477},"AZURE_TENANT_ID",{"type":46,"value":198},{"type":41,"tag":74,"props":480,"children":482},{"className":481},[],[483],{"type":46,"value":484},"AZURE_SUBSCRIPTION_ID",{"type":46,"value":116},{"type":41,"tag":70,"props":487,"children":488},{},[489,495],{"type":41,"tag":74,"props":490,"children":492},{"className":491},[],[493],{"type":46,"value":494},"AZURE_AI_FOUNDRY_PROJECT_ENDPOINT",{"type":46,"value":116},{"type":41,"tag":70,"props":497,"children":498},{},[499,505],{"type":41,"tag":74,"props":500,"children":502},{"className":501},[],[503],{"type":46,"value":504},"AZURE_OPENAI_DEPLOYMENT",{"type":46,"value":116},{"type":41,"tag":70,"props":507,"children":508},{},[509,511,517],{"type":46,"value":510},"optional ",{"type":41,"tag":74,"props":512,"children":514},{"className":513},[],[515],{"type":46,"value":516},"APPLICATIONINSIGHTS_CONNECTION_STRING",{"type":46,"value":116},{"type":41,"tag":70,"props":519,"children":520},{},[521,523],{"type":46,"value":522},"Prefer existing values and exact checks:\n",{"type":41,"tag":66,"props":524,"children":525},{},[526,544,570,587,626],{"type":41,"tag":70,"props":527,"children":528},{},[529,535,537,543],{"type":41,"tag":74,"props":530,"children":532},{"className":531},[],[533],{"type":46,"value":534},"git remote get-url origin",{"type":46,"value":536}," and ",{"type":41,"tag":74,"props":538,"children":540},{"className":539},[],[541],{"type":46,"value":542},"gh repo view --json nameWithOwner",{"type":46,"value":116},{"type":41,"tag":70,"props":545,"children":546},{},[547,553,555,561,563,569],{"type":41,"tag":74,"props":548,"children":550},{"className":549},[],[551],{"type":46,"value":552},"git branch -vv",{"type":46,"value":554}," to confirm the local trunk branch tracks\n",{"type":41,"tag":74,"props":556,"children":558},{"className":557},[],[559],{"type":46,"value":560},"origin\u002Fmain",{"type":46,"value":562}," when the tutorial uses trunk-based ",{"type":41,"tag":74,"props":564,"children":566},{"className":565},[],[567],{"type":46,"value":568},"main",{"type":46,"value":116},{"type":41,"tag":70,"props":571,"children":572},{},[573,579,580,586],{"type":41,"tag":74,"props":574,"children":576},{"className":575},[],[577],{"type":46,"value":578},"gh variable list --env \u003Cenv>",{"type":46,"value":536},{"type":41,"tag":74,"props":581,"children":583},{"className":582},[],[584],{"type":46,"value":585},"gh secret list --env \u003Cenv>",{"type":46,"value":116},{"type":41,"tag":70,"props":588,"children":589},{},[590,596,598,603,605,610,612,617,619,625],{"type":41,"tag":74,"props":591,"children":593},{"className":592},[],[594],{"type":46,"value":595},"agentops init show",{"type":46,"value":597},", local ",{"type":41,"tag":74,"props":599,"children":601},{"className":600},[],[602],{"type":46,"value":319},{"type":46,"value":604}," or ",{"type":41,"tag":74,"props":606,"children":608},{"className":607},[],[609],{"type":46,"value":335},{"type":46,"value":611},", and\n",{"type":41,"tag":74,"props":613,"children":615},{"className":614},[],[616],{"type":46,"value":346},{"type":46,"value":618}," values before ",{"type":41,"tag":74,"props":620,"children":622},{"className":621},[],[623],{"type":46,"value":624},"az account show",{"type":46,"value":116},{"type":41,"tag":70,"props":627,"children":628},{},[629,634],{"type":41,"tag":74,"props":630,"children":632},{"className":631},[],[633],{"type":46,"value":624},{"type":46,"value":635}," only as a proposal for tenant\u002Fsubscription; confirm\nbefore writing it to GitHub variables.",{"type":41,"tag":70,"props":637,"children":638},{},[639,641,646,648,654,656,661,663],{"type":46,"value":640},"For GitHub OIDC, treat ",{"type":41,"tag":74,"props":642,"children":644},{"className":643},[],[645],{"type":46,"value":477},{"type":46,"value":647}," as the tenant that owns the app\nregistration \u002F federated credential, not merely the tenant associated with\nthe subscription or a ",{"type":41,"tag":74,"props":649,"children":651},{"className":650},[],[652],{"type":46,"value":653},"managedByTenants",{"type":46,"value":655}," entry. Before writing\n",{"type":41,"tag":74,"props":657,"children":659},{"className":658},[],[660],{"type":46,"value":477},{"type":46,"value":662},", verify the chosen tenant can see the app registration and\nthe exact federated credential:\n",{"type":41,"tag":66,"props":664,"children":665},{},[666,677],{"type":41,"tag":70,"props":667,"children":668},{},[669,675],{"type":41,"tag":74,"props":670,"children":672},{"className":671},[],[673],{"type":46,"value":674},"az ad app show --id \u003CAZURE_CLIENT_ID>",{"type":46,"value":676}," in the active tenant, or an\nequivalent Microsoft Graph query scoped to the proposed tenant.",{"type":41,"tag":70,"props":678,"children":679},{},[680,686,688,694,695,701,703,709,711,716,718,723,725,731],{"type":41,"tag":74,"props":681,"children":683},{"className":682},[],[684],{"type":46,"value":685},"az ad app federated-credential list --id \u003CAZURE_CLIENT_ID>",{"type":46,"value":687}," and confirm\nthe ",{"type":41,"tag":74,"props":689,"children":691},{"className":690},[],[692],{"type":46,"value":693},"subject",{"type":46,"value":198},{"type":41,"tag":74,"props":696,"children":698},{"className":697},[],[699],{"type":46,"value":700},"issuer",{"type":46,"value":702},", and ",{"type":41,"tag":74,"props":704,"children":706},{"className":705},[],[707],{"type":46,"value":708},"audiences",{"type":46,"value":710},".\nIf the app is visible in one tenant but the Azure subscription is associated\nwith another tenant, use the app\u002Ffederated-credential tenant for\n",{"type":41,"tag":74,"props":712,"children":714},{"className":713},[],[715],{"type":46,"value":477},{"type":46,"value":717},"; the subscription id remains ",{"type":41,"tag":74,"props":719,"children":721},{"className":720},[],[722],{"type":46,"value":484},{"type":46,"value":724},".\nDo not copy a ",{"type":41,"tag":74,"props":726,"children":728},{"className":727},[],[729],{"type":46,"value":730},"managedByTenants[*].tenantId",{"type":46,"value":732}," value into GitHub variables\nunless the app and federated credential are verified there too.",{"type":41,"tag":70,"props":734,"children":735},{},[736,738],{"type":46,"value":737},"When creating or connecting the GitHub remote for the prompt-agent tutorial,\nmake sure the local trunk branch tracks the remote trunk before telling the\nuser to continue:\n",{"type":41,"tag":66,"props":739,"children":740},{},[741,760,778],{"type":41,"tag":70,"props":742,"children":743},{},[744,746,751,753,759],{"type":46,"value":745},"If ",{"type":41,"tag":74,"props":747,"children":749},{"className":748},[],[750],{"type":46,"value":568},{"type":46,"value":752}," is newly pushed, use ",{"type":41,"tag":74,"props":754,"children":756},{"className":755},[],[757],{"type":46,"value":758},"git push -u origin main",{"type":46,"value":116},{"type":41,"tag":70,"props":761,"children":762},{},[763,764,769,771,777],{"type":46,"value":745},{"type":41,"tag":74,"props":765,"children":767},{"className":766},[],[768],{"type":46,"value":560},{"type":46,"value":770}," already exists, use\n",{"type":41,"tag":74,"props":772,"children":774},{"className":773},[],[775],{"type":46,"value":776},"git branch --set-upstream-to=origin\u002Fmain main",{"type":46,"value":116},{"type":41,"tag":70,"props":779,"children":780},{},[781,783,788,790,795,797,803,805,811,813,818],{"type":46,"value":782},"Verify with ",{"type":41,"tag":74,"props":784,"children":786},{"className":785},[],[787],{"type":46,"value":552},{"type":46,"value":789},"; ",{"type":41,"tag":74,"props":791,"children":793},{"className":792},[],[794],{"type":46,"value":568},{"type":46,"value":796}," must show ",{"type":41,"tag":74,"props":798,"children":800},{"className":799},[],[801],{"type":46,"value":802},"[origin\u002Fmain]",{"type":46,"value":804},".\nWithout this, a later ",{"type":41,"tag":74,"props":806,"children":808},{"className":807},[],[809],{"type":46,"value":810},"git pull",{"type":46,"value":812}," on ",{"type":41,"tag":74,"props":814,"children":816},{"className":815},[],[817],{"type":46,"value":568},{"type":46,"value":819}," can fetch but not update the\nlocal branch.",{"type":41,"tag":70,"props":821,"children":822},{},[823,825,830,831,837,839,844,846,851,853,858],{"type":46,"value":824},"Copy CI variables from local AgentOps\u002Fazd configuration into the GitHub\nenvironment used by the workflow. Reuse local values for\n",{"type":41,"tag":74,"props":826,"children":828},{"className":827},[],[829],{"type":46,"value":494},{"type":46,"value":198},{"type":41,"tag":74,"props":832,"children":834},{"className":833},[],[835],{"type":46,"value":836},"AZURE_OPENAI_ENDPOINT",{"type":46,"value":838},",\n",{"type":41,"tag":74,"props":840,"children":842},{"className":841},[],[843],{"type":46,"value":504},{"type":46,"value":845},", and optional\n",{"type":41,"tag":74,"props":847,"children":849},{"className":848},[],[850],{"type":46,"value":516},{"type":46,"value":852}," instead of asking the user to type\nthem again. Explain ",{"type":41,"tag":74,"props":854,"children":856},{"className":855},[],[857],{"type":46,"value":504},{"type":46,"value":859}," only if it is missing: it is\nthe Azure OpenAI deployment used as the evaluator\u002Fjudge model, not the\nuser's agent.",{"type":41,"tag":70,"props":861,"children":862},{},[863,865],{"type":46,"value":864},"For prompt-agent tutorials that use Foundry trace sampling \u002F trace-to-dataset,\nverify observability RBAC before telling the user step 18 is ready:\n",{"type":41,"tag":66,"props":866,"children":867},{},[868,873,878,890],{"type":41,"tag":70,"props":869,"children":870},{},[871],{"type":46,"value":872},"Resolve the dev Foundry project managed identity principal id.",{"type":41,"tag":70,"props":874,"children":875},{},[876],{"type":46,"value":877},"Resolve the connected Application Insights resource.",{"type":41,"tag":70,"props":879,"children":880},{},[881,883,888],{"type":46,"value":882},"Grant or verify ",{"type":41,"tag":58,"props":884,"children":885},{},[886],{"type":46,"value":887},"Reader",{"type":46,"value":889}," on that Application Insights resource to the dev\nFoundry project managed identity.",{"type":41,"tag":70,"props":891,"children":892},{},[893,895,899],{"type":46,"value":894},"If the App Insights component is workspace-based, also grant or verify\n",{"type":41,"tag":58,"props":896,"children":897},{},[898],{"type":46,"value":887},{"type":46,"value":900}," on the backing Log Analytics workspace.\nThis is separate from GitHub OIDC and separate from the signed-in user's\nportal access. Operate dashboards can still render while trace-to-dataset\nfails if the project identity cannot read App Insights.",{"type":41,"tag":70,"props":902,"children":903},{},[904,906,911,912,917,918,923,925,930],{"type":46,"value":905},"Do not enumerate subscriptions, Foundry projects, Azure OpenAI resources, or\nmodel deployments to guess missing values. If ",{"type":41,"tag":74,"props":907,"children":909},{"className":908},[],[910],{"type":46,"value":484},{"type":46,"value":838},{"type":41,"tag":74,"props":913,"children":915},{"className":914},[],[916],{"type":46,"value":477},{"type":46,"value":198},{"type":41,"tag":74,"props":919,"children":921},{"className":920},[],[922],{"type":46,"value":494},{"type":46,"value":924},", or\n",{"type":41,"tag":74,"props":926,"children":928},{"className":927},[],[929],{"type":46,"value":504},{"type":46,"value":931}," is absent from AgentOps\u002Fazd\u002Flocal env, ask the user\nto choose or provide it. Only run a scoped Azure query after the user confirms\nthe subscription and the exact missing value.",{"type":41,"tag":70,"props":933,"children":934},{},[935,937,943,945,951,953,959],{"type":46,"value":936},"For GitHub OIDC, derive the federated credential subject from the generated\nworkflow. If the job has ",{"type":41,"tag":74,"props":938,"children":940},{"className":939},[],[941],{"type":46,"value":942},"environment: dev",{"type":46,"value":944},", the subject is normally\n",{"type":41,"tag":74,"props":946,"children":948},{"className":947},[],[949],{"type":46,"value":950},"repo:\u003Cowner>\u002F\u003Crepo>:environment:dev",{"type":46,"value":952},". Do not assume branch or\n",{"type":41,"tag":74,"props":954,"children":956},{"className":955},[],[957],{"type":46,"value":958},"pull_request",{"type":46,"value":960}," subjects without reading the workflow.",{"type":41,"tag":70,"props":962,"children":963},{},[964,966,971,973,979],{"type":46,"value":965},"Before triggering a Foundry prompt-agent workflow, make sure the OIDC app \u002F\nservice principal has ",{"type":41,"tag":58,"props":967,"children":968},{},[969],{"type":46,"value":970},"two",{"type":46,"value":972}," RBAC assignments. Both are required; the eval\nstep fails silently (every metric returns ",{"type":41,"tag":74,"props":974,"children":976},{"className":975},[],[977],{"type":46,"value":978},"null",{"type":46,"value":980},") if only one is in place.",{"type":41,"tag":70,"props":982,"children":983},{},[984,989,991,997,999,1005],{"type":41,"tag":58,"props":985,"children":986},{},[987],{"type":46,"value":988},"Foundry User",{"type":46,"value":990}," on the Foundry project (or the Foundry resource scope\nif that is the team's standard). Role id\n",{"type":41,"tag":74,"props":992,"children":994},{"className":993},[],[995],{"type":46,"value":996},"53ca6127-db72-4b80-b1b0-d745d6d5456d",{"type":46,"value":998}," (formerly Azure AI User). Without\nthis the candidate-staging step fails on\n",{"type":41,"tag":74,"props":1000,"children":1002},{"className":1001},[],[1003],{"type":46,"value":1004},"Microsoft.CognitiveServices\u002Faccounts\u002FAIServices\u002Fagents\u002Fread",{"type":46,"value":116},{"type":41,"tag":70,"props":1007,"children":1008},{},[1009,1014,1016,1022,1024,1030,1032,1038,1040,1046,1048,1053,1055,1060,1062,1067,1069,1073],{"type":41,"tag":58,"props":1010,"children":1011},{},[1012],{"type":46,"value":1013},"Cognitive Services OpenAI User",{"type":46,"value":1015}," on the underlying Azure AI Services\naccount that hosts the evaluator model deployment\n(typically the parent account of the Foundry project). Role id\n",{"type":41,"tag":74,"props":1017,"children":1019},{"className":1018},[],[1020],{"type":46,"value":1021},"5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",{"type":46,"value":1023},". Without this the Foundry\n",{"type":41,"tag":74,"props":1025,"children":1027},{"className":1026},[],[1028],{"type":46,"value":1029},"azure_ai_evaluator",{"type":46,"value":1031}," graders fail with a 401 ",{"type":41,"tag":74,"props":1033,"children":1035},{"className":1034},[],[1036],{"type":46,"value":1037},"PermissionDenied",{"type":46,"value":1039}," on\n",{"type":41,"tag":74,"props":1041,"children":1043},{"className":1042},[],[1044],{"type":46,"value":1045},"Microsoft.CognitiveServices\u002Faccounts\u002FOpenAI\u002Fdeployments\u002Fchat\u002Fcompletions\u002Faction",{"type":46,"value":1047},"\nand every metric comes back ",{"type":41,"tag":74,"props":1049,"children":1051},{"className":1050},[],[1052],{"type":46,"value":978},{"type":46,"value":1054}," in the cloud eval report. AgentOps now\nlifts that error into ",{"type":41,"tag":74,"props":1056,"children":1058},{"className":1057},[],[1059],{"type":46,"value":248},{"type":46,"value":1061}," and the orchestrator's \"0 usable\nmetric scores\" warning so the cause is visible in CI logs, but the\nworkflow still fails the gate. Grant this role ",{"type":41,"tag":58,"props":1063,"children":1064},{},[1065],{"type":46,"value":1066},"before",{"type":46,"value":1068}," the first run.\nAzure ",{"type":41,"tag":58,"props":1070,"children":1071},{},[1072],{"type":46,"value":887},{"type":46,"value":1074}," is not enough for either step.",{"type":41,"tag":70,"props":1076,"children":1077},{},[1078],{"type":46,"value":1079},"If either RBAC assignment is missing, do not run the workflow yet.\nShow the exact GitHub OIDC client ID \u002F service principal, desired role,\ntarget scope (project for Foundry User, AI Services account for Cognitive\nServices OpenAI User), then ask the user to approve the role assignment or\nget an Azure\u002FFoundry admin to grant it. After assignment, read it back or ask\nthe user to confirm before dispatching the workflow.\nWhen the user approves and you know the scopes, use the role ids to avoid\nrename drift:",{"type":41,"tag":66,"props":1081,"children":1082},{},[1083,1092,1101,1110],{"type":41,"tag":70,"props":1084,"children":1085},{},[1086],{"type":41,"tag":74,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":46,"value":1091},"az ad sp show --id \u003CAZURE_CLIENT_ID> --query id -o tsv",{"type":41,"tag":70,"props":1093,"children":1094},{},[1095],{"type":41,"tag":74,"props":1096,"children":1098},{"className":1097},[],[1099],{"type":46,"value":1100},"az role assignment list --assignee \u003Csp-object-id> --scope \u003Cfoundry-scope> --include-inherited",{"type":41,"tag":70,"props":1102,"children":1103},{},[1104],{"type":41,"tag":74,"props":1105,"children":1107},{"className":1106},[],[1108],{"type":46,"value":1109},"az role assignment create --assignee-object-id \u003Csp-object-id> --assignee-principal-type ServicePrincipal --role 53ca6127-db72-4b80-b1b0-d745d6d5456d --scope \u003Cfoundry-scope>",{"type":41,"tag":70,"props":1111,"children":1112},{},[1113,1119,1121,1127,1129,1135],{"type":41,"tag":74,"props":1114,"children":1116},{"className":1115},[],[1117],{"type":46,"value":1118},"az role assignment create --assignee-object-id \u003Csp-object-id> --assignee-principal-type ServicePrincipal --role 5e0bd9bd-7b93-4f28-af87-19fc36ad61bd --scope \u003Cai-services-account-scope>",{"type":46,"value":1120},"\nThe AI Services account scope looks like\n",{"type":41,"tag":74,"props":1122,"children":1124},{"className":1123},[],[1125],{"type":46,"value":1126},"\u002Fsubscriptions\u002F\u003Csub>\u002FresourceGroups\u002F\u003Crg>\u002Fproviders\u002FMicrosoft.CognitiveServices\u002Faccounts\u002F\u003Cai-account-name>",{"type":46,"value":1128},"\nand can be derived from\n",{"type":41,"tag":74,"props":1130,"children":1132},{"className":1131},[],[1133],{"type":46,"value":1134},"az cognitiveservices account list --resource-group \u003Cfoundry-project-rg> --query \"[?kind=='AIServices'].id\" -o tsv",{"type":46,"value":116},{"type":41,"tag":272,"props":1137,"children":1139},{"start":1138},14,[1140,1145,1196,1249,1277,1290],{"type":41,"tag":70,"props":1141,"children":1142},{},[1143],{"type":46,"value":1144},"Ask before creating or updating GitHub repos, GitHub environments,\nvariables\u002Fsecrets, Entra app registrations\u002Fservice principals, federated\ncredentials, managed identities, or Azure RBAC assignments.",{"type":41,"tag":70,"props":1146,"children":1147},{},[1148,1150,1155,1157,1163,1165,1171,1173,1179,1181,1187,1189,1195],{"type":46,"value":1149},"When creating federated credentials from PowerShell, avoid fragile\ninterpolation. Do ",{"type":41,"tag":58,"props":1151,"children":1152},{},[1153],{"type":46,"value":1154},"not",{"type":46,"value":1156}," write ",{"type":41,"tag":74,"props":1158,"children":1160},{"className":1159},[],[1161],{"type":46,"value":1162},"\"repo:$repo:environment:$envName\"",{"type":46,"value":1164}," because\n",{"type":41,"tag":74,"props":1166,"children":1168},{"className":1167},[],[1169],{"type":46,"value":1170},"$repo:",{"type":46,"value":1172}," can be parsed as a scoped variable. Use\n",{"type":41,"tag":74,"props":1174,"children":1176},{"className":1175},[],[1177],{"type":46,"value":1178},"\"repo:${repo}:environment:${envName}\"",{"type":46,"value":1180}," or\n",{"type":41,"tag":74,"props":1182,"children":1184},{"className":1183},[],[1185],{"type":46,"value":1186},"(\"repo:{0}:environment:{1}\" -f $repo, $envName)",{"type":46,"value":1188},", then build JSON from a\nPowerShell object with ",{"type":41,"tag":74,"props":1190,"children":1192},{"className":1191},[],[1193],{"type":46,"value":1194},"ConvertTo-Json",{"type":46,"value":116},{"type":41,"tag":70,"props":1197,"children":1198},{},[1199,1201],{"type":46,"value":1200},"After creating or updating a federated credential, read it back and verify\nbefore triggering a workflow:\n",{"type":41,"tag":66,"props":1202,"children":1203},{},[1204,1214,1231],{"type":41,"tag":70,"props":1205,"children":1206},{},[1207,1212],{"type":41,"tag":74,"props":1208,"children":1210},{"className":1209},[],[1211],{"type":46,"value":693},{"type":46,"value":1213}," exactly matches the generated workflow subject.",{"type":41,"tag":70,"props":1215,"children":1216},{},[1217,1222,1224,1230],{"type":41,"tag":74,"props":1218,"children":1220},{"className":1219},[],[1221],{"type":46,"value":700},{"type":46,"value":1223}," is ",{"type":41,"tag":74,"props":1225,"children":1227},{"className":1226},[],[1228],{"type":46,"value":1229},"https:\u002F\u002Ftoken.actions.githubusercontent.com",{"type":46,"value":116},{"type":41,"tag":70,"props":1232,"children":1233},{},[1234,1239,1241,1247],{"type":41,"tag":74,"props":1235,"children":1237},{"className":1236},[],[1238],{"type":46,"value":708},{"type":46,"value":1240}," includes ",{"type":41,"tag":74,"props":1242,"children":1244},{"className":1243},[],[1245],{"type":46,"value":1246},"api:\u002F\u002FAzureADTokenExchange",{"type":46,"value":1248},".\nIf any value differs, fix the credential before running GitHub Actions.",{"type":41,"tag":70,"props":1250,"children":1251},{},[1252,1254,1259,1261,1267,1269,1275],{"type":46,"value":1253},"After setting GitHub environment variables, read them back and verify\n",{"type":41,"tag":74,"props":1255,"children":1257},{"className":1256},[],[1258],{"type":46,"value":477},{"type":46,"value":1260}," still matches the app\u002Ffederated-credential tenant before\ntriggering a run. If ",{"type":41,"tag":74,"props":1262,"children":1264},{"className":1263},[],[1265],{"type":46,"value":1266},"azure\u002Flogin",{"type":46,"value":1268}," fails with ",{"type":41,"tag":74,"props":1270,"children":1272},{"className":1271},[],[1273],{"type":46,"value":1274},"AADSTS53003",{"type":46,"value":1276},", first re-check\nthis tenant\u002Fapp alignment before assuming Conditional Access is the root\ncause.",{"type":41,"tag":70,"props":1278,"children":1279},{},[1280,1282,1288],{"type":46,"value":1281},"Do not dispatch ",{"type":41,"tag":74,"props":1283,"children":1285},{"className":1284},[],[1286],{"type":46,"value":1287},"gh workflow run",{"type":46,"value":1289}," as a surprise validation step. First show\nthat the GitHub environment, variables\u002Fsecrets, federated credential, and\nFoundry RBAC are ready, then ask the user before triggering workflows.",{"type":41,"tag":70,"props":1291,"children":1292},{},[1293,1295,1299,1301,1307,1308,1314,1316,1321,1322,1327,1328,1333,1335,1340],{"type":46,"value":1294},"Avoid broad discovery unless local config is missing. Do ",{"type":41,"tag":58,"props":1296,"children":1297},{},[1298],{"type":46,"value":1154},{"type":46,"value":1300}," run broad\n",{"type":41,"tag":74,"props":1302,"children":1304},{"className":1303},[],[1305],{"type":46,"value":1306},"az resource list",{"type":46,"value":198},{"type":41,"tag":74,"props":1309,"children":1311},{"className":1310},[],[1312],{"type":46,"value":1313},"az graph query",{"type":46,"value":1315},", SDK inspection, or web search to find\nthe Foundry project when ",{"type":41,"tag":74,"props":1317,"children":1319},{"className":1318},[],[1320],{"type":46,"value":595},{"type":46,"value":198},{"type":41,"tag":74,"props":1323,"children":1325},{"className":1324},[],[1326],{"type":46,"value":319},{"type":46,"value":924},{"type":41,"tag":74,"props":1329,"children":1331},{"className":1330},[],[1332],{"type":46,"value":335},{"type":46,"value":1334}," already has ",{"type":41,"tag":74,"props":1336,"children":1338},{"className":1337},[],[1339],{"type":46,"value":494},{"type":46,"value":1341},". If the\nendpoint is missing, say exactly what is missing and ask the user before\nscanning the subscription.",{"type":41,"tag":260,"props":1343,"children":1345},{"id":1344},"branch-model-assumed",[1346],{"type":46,"value":1347},"Branch model assumed",{"type":41,"tag":1349,"props":1350,"children":1354},"pre",{"className":1351,"code":1353,"language":46},[1352],"language-text","feature\u002F* ── PR ──▶ develop                 [agentops-pr]          gate\n                       │\n                       └── merge ─▶ develop  [agentops-deploy-dev]  build + eval + deploy DEV\nrelease\u002F* ── push                            [agentops-deploy-qa]   build + eval + deploy QA\nrelease\u002F* ── PR ──▶ main                     [agentops-pr]          gate\n                       │\n                       └── merge ─▶ main     [agentops-deploy-prod] safety eval + build + deploy PROD\n",[1355],{"type":41,"tag":74,"props":1356,"children":1358},{"__ignoreMap":1357},"",[1359],{"type":46,"value":1353},{"type":41,"tag":49,"props":1361,"children":1362},{},[1363,1365,1370,1371,1377,1379,1385],{"type":46,"value":1364},"If the user is on trunk-based development, omit ",{"type":41,"tag":74,"props":1366,"children":1368},{"className":1367},[],[1369],{"type":46,"value":400},{"type":46,"value":536},{"type":41,"tag":74,"props":1372,"children":1374},{"className":1373},[],[1375],{"type":46,"value":1376},"release\u002F**",{"type":46,"value":1378},"\nand have them generate ",{"type":41,"tag":74,"props":1380,"children":1382},{"className":1381},[],[1383],{"type":46,"value":1384},"--kinds pr,dev,prod",{"type":46,"value":116},{"type":41,"tag":49,"props":1387,"children":1388},{},[1389,1391,1397,1399,1405,1407,1413,1415,1421],{"type":46,"value":1390},"The PR workflow uses the eval step as the hard merge gate. Doctor also\nruns there and writes release evidence; by default the Doctor step blocks\nthe PR on critical findings such as regression detection (",{"type":41,"tag":74,"props":1392,"children":1394},{"className":1393},[],[1395],{"type":46,"value":1396},"--severity-fail critical",{"type":46,"value":1398},", the default behavior of ",{"type":41,"tag":74,"props":1400,"children":1402},{"className":1401},[],[1403],{"type":46,"value":1404},"agentops workflow generate --doctor-gate critical",{"type":46,"value":1406},"). This catches metric drops (for example\ngroundedness going from 5.0 to 4.0) that would still pass the configured\neval thresholds. To restore the pre-1.x advisory behavior — Doctor writes\nrelease evidence but does not block the PR — generate with ",{"type":41,"tag":74,"props":1408,"children":1410},{"className":1409},[],[1411],{"type":46,"value":1412},"--doctor-gate none",{"type":46,"value":1414},". DEV\u002FQA\u002FPROD deploy workflows always keep Doctor as a critical\nrelease gate; the ",{"type":41,"tag":74,"props":1416,"children":1418},{"className":1417},[],[1419],{"type":46,"value":1420},"--doctor-gate",{"type":46,"value":1422}," flag only controls the PR template.",{"type":41,"tag":260,"props":1424,"children":1426},{"id":1425},"step-0-prerequisites",[1427],{"type":46,"value":1428},"Step 0 - Prerequisites",{"type":41,"tag":272,"props":1430,"children":1431},{},[1432,1450,1475],{"type":41,"tag":70,"props":1433,"children":1434},{},[1435,1441,1443,1448],{"type":41,"tag":74,"props":1436,"children":1438},{"className":1437},[],[1439],{"type":46,"value":1440},"pip install \"agentops-accelerator @ git+https:\u002F\u002Fgithub.com\u002FAzure\u002Fagentops.git@main\"",{"type":46,"value":1442}," if ",{"type":41,"tag":74,"props":1444,"children":1446},{"className":1445},[],[1447],{"type":46,"value":114},{"type":46,"value":1449}," is missing.",{"type":41,"tag":70,"props":1451,"children":1452},{},[1453,1459,1461,1466,1468,1473],{"type":41,"tag":74,"props":1454,"children":1456},{"className":1455},[],[1457],{"type":46,"value":1458},"agentops eval analyze",{"type":46,"value":1460}," has been reviewed, ",{"type":41,"tag":74,"props":1462,"children":1464},{"className":1463},[],[1465],{"type":46,"value":309},{"type":46,"value":1467}," exists at the\nproject root, and ",{"type":41,"tag":74,"props":1469,"children":1471},{"className":1470},[],[1472],{"type":46,"value":240},{"type":46,"value":1474}," works locally.",{"type":41,"tag":70,"props":1476,"children":1477},{},[1478],{"type":46,"value":1479},"The user's repo follows GitFlow (or is willing to). If not, ask which\nbranches map to dev\u002Fqa\u002Fprod and adjust the triggers after\ngeneration.",{"type":41,"tag":260,"props":1481,"children":1483},{"id":1482},"step-1-generate-the-workflows",[1484],{"type":46,"value":1485},"Step 1 - Generate the workflows",{"type":41,"tag":49,"props":1487,"children":1488},{},[1489],{"type":46,"value":1490},"First analyze the repo shape:",{"type":41,"tag":1349,"props":1492,"children":1496},{"className":1493,"code":1494,"language":1495,"meta":1357,"style":1357},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","agentops workflow analyze\nagentops workflow analyze --format markdown --out agentops-workflow-plan.md\n","bash",[1497],{"type":41,"tag":74,"props":1498,"children":1499},{"__ignoreMap":1357},[1500,1522],{"type":41,"tag":1501,"props":1502,"children":1505},"span",{"class":1503,"line":1504},"line",1,[1506,1511,1517],{"type":41,"tag":1501,"props":1507,"children":1509},{"style":1508},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1510],{"type":46,"value":114},{"type":41,"tag":1501,"props":1512,"children":1514},{"style":1513},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1515],{"type":46,"value":1516}," workflow",{"type":41,"tag":1501,"props":1518,"children":1519},{"style":1513},[1520],{"type":46,"value":1521}," analyze\n",{"type":41,"tag":1501,"props":1523,"children":1525},{"class":1503,"line":1524},2,[1526,1530,1534,1539,1544,1549,1554],{"type":41,"tag":1501,"props":1527,"children":1528},{"style":1508},[1529],{"type":46,"value":114},{"type":41,"tag":1501,"props":1531,"children":1532},{"style":1513},[1533],{"type":46,"value":1516},{"type":41,"tag":1501,"props":1535,"children":1536},{"style":1513},[1537],{"type":46,"value":1538}," analyze",{"type":41,"tag":1501,"props":1540,"children":1541},{"style":1513},[1542],{"type":46,"value":1543}," --format",{"type":41,"tag":1501,"props":1545,"children":1546},{"style":1513},[1547],{"type":46,"value":1548}," markdown",{"type":41,"tag":1501,"props":1550,"children":1551},{"style":1513},[1552],{"type":46,"value":1553}," --out",{"type":41,"tag":1501,"props":1555,"children":1556},{"style":1513},[1557],{"type":46,"value":1558}," agentops-workflow-plan.md\n",{"type":41,"tag":49,"props":1560,"children":1561},{},[1562,1564,1570,1572,1577],{"type":46,"value":1563},"Use the analysis to decide whether ",{"type":41,"tag":74,"props":1565,"children":1567},{"className":1566},[],[1568],{"type":46,"value":1569},"--deploy-mode auto",{"type":46,"value":1571}," is enough or whether\nyou need to adapt placeholders\u002Fproject-specific deployment. The analyzer is\nlocal-only and looks for ",{"type":41,"tag":74,"props":1573,"children":1575},{"className":1574},[],[1576],{"type":46,"value":354},{"type":46,"value":1578},", Bicep, AgentOps prompt-agent config,\nlanding-zone manifests, private-network signals, Docker\u002FContainer Apps signals,\nand existing CI folders. Treat README matches as hints only; structural files\ndrive the recommendation.",{"type":41,"tag":49,"props":1580,"children":1581},{},[1582],{"type":41,"tag":58,"props":1583,"children":1584},{},[1585],{"type":46,"value":1586},"GitHub Actions (default):",{"type":41,"tag":1349,"props":1588,"children":1590},{"className":1493,"code":1589,"language":1495,"meta":1357,"style":1357},"agentops workflow generate --kinds pr\n# or full scaffold:\nagentops workflow generate --kinds pr,dev,qa,prod --force\n",[1591],{"type":41,"tag":74,"props":1592,"children":1593},{"__ignoreMap":1357},[1594,1620,1629],{"type":41,"tag":1501,"props":1595,"children":1596},{"class":1503,"line":1504},[1597,1601,1605,1610,1615],{"type":41,"tag":1501,"props":1598,"children":1599},{"style":1508},[1600],{"type":46,"value":114},{"type":41,"tag":1501,"props":1602,"children":1603},{"style":1513},[1604],{"type":46,"value":1516},{"type":41,"tag":1501,"props":1606,"children":1607},{"style":1513},[1608],{"type":46,"value":1609}," generate",{"type":41,"tag":1501,"props":1611,"children":1612},{"style":1513},[1613],{"type":46,"value":1614}," --kinds",{"type":41,"tag":1501,"props":1616,"children":1617},{"style":1513},[1618],{"type":46,"value":1619}," pr\n",{"type":41,"tag":1501,"props":1621,"children":1622},{"class":1503,"line":1524},[1623],{"type":41,"tag":1501,"props":1624,"children":1626},{"style":1625},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1627],{"type":46,"value":1628},"# or full scaffold:\n",{"type":41,"tag":1501,"props":1630,"children":1632},{"class":1503,"line":1631},3,[1633,1637,1641,1645,1649,1654],{"type":41,"tag":1501,"props":1634,"children":1635},{"style":1508},[1636],{"type":46,"value":114},{"type":41,"tag":1501,"props":1638,"children":1639},{"style":1513},[1640],{"type":46,"value":1516},{"type":41,"tag":1501,"props":1642,"children":1643},{"style":1513},[1644],{"type":46,"value":1609},{"type":41,"tag":1501,"props":1646,"children":1647},{"style":1513},[1648],{"type":46,"value":1614},{"type":41,"tag":1501,"props":1650,"children":1651},{"style":1513},[1652],{"type":46,"value":1653}," pr,dev,qa,prod",{"type":41,"tag":1501,"props":1655,"children":1656},{"style":1513},[1657],{"type":46,"value":1658}," --force\n",{"type":41,"tag":49,"props":1660,"children":1661},{},[1662],{"type":41,"tag":58,"props":1663,"children":1664},{},[1665],{"type":46,"value":1666},"Azure DevOps Pipelines:",{"type":41,"tag":1349,"props":1668,"children":1670},{"className":1493,"code":1669,"language":1495,"meta":1357,"style":1357},"agentops workflow generate --platform azure-devops --kinds pr\n# or full scaffold:\nagentops workflow generate --platform azure-devops --kinds pr,dev,qa,prod --force\n",[1671],{"type":41,"tag":74,"props":1672,"children":1673},{"__ignoreMap":1357},[1674,1707,1714],{"type":41,"tag":1501,"props":1675,"children":1676},{"class":1503,"line":1504},[1677,1681,1685,1689,1694,1699,1703],{"type":41,"tag":1501,"props":1678,"children":1679},{"style":1508},[1680],{"type":46,"value":114},{"type":41,"tag":1501,"props":1682,"children":1683},{"style":1513},[1684],{"type":46,"value":1516},{"type":41,"tag":1501,"props":1686,"children":1687},{"style":1513},[1688],{"type":46,"value":1609},{"type":41,"tag":1501,"props":1690,"children":1691},{"style":1513},[1692],{"type":46,"value":1693}," --platform",{"type":41,"tag":1501,"props":1695,"children":1696},{"style":1513},[1697],{"type":46,"value":1698}," azure-devops",{"type":41,"tag":1501,"props":1700,"children":1701},{"style":1513},[1702],{"type":46,"value":1614},{"type":41,"tag":1501,"props":1704,"children":1705},{"style":1513},[1706],{"type":46,"value":1619},{"type":41,"tag":1501,"props":1708,"children":1709},{"class":1503,"line":1524},[1710],{"type":41,"tag":1501,"props":1711,"children":1712},{"style":1625},[1713],{"type":46,"value":1628},{"type":41,"tag":1501,"props":1715,"children":1716},{"class":1503,"line":1631},[1717,1721,1725,1729,1733,1737,1741,1745],{"type":41,"tag":1501,"props":1718,"children":1719},{"style":1508},[1720],{"type":46,"value":114},{"type":41,"tag":1501,"props":1722,"children":1723},{"style":1513},[1724],{"type":46,"value":1516},{"type":41,"tag":1501,"props":1726,"children":1727},{"style":1513},[1728],{"type":46,"value":1609},{"type":41,"tag":1501,"props":1730,"children":1731},{"style":1513},[1732],{"type":46,"value":1693},{"type":41,"tag":1501,"props":1734,"children":1735},{"style":1513},[1736],{"type":46,"value":1698},{"type":41,"tag":1501,"props":1738,"children":1739},{"style":1513},[1740],{"type":46,"value":1614},{"type":41,"tag":1501,"props":1742,"children":1743},{"style":1513},[1744],{"type":46,"value":1653},{"type":41,"tag":1501,"props":1746,"children":1747},{"style":1513},[1748],{"type":46,"value":1658},{"type":41,"tag":49,"props":1750,"children":1751},{},[1752],{"type":46,"value":1753},"The full scaffold writes:",{"type":41,"tag":1755,"props":1756,"children":1757},"table",{},[1758,1792],{"type":41,"tag":1759,"props":1760,"children":1761},"thead",{},[1762],{"type":41,"tag":1763,"props":1764,"children":1765},"tr",{},[1766,1772,1777,1782,1787],{"type":41,"tag":1767,"props":1768,"children":1769},"th",{},[1770],{"type":46,"value":1771},"Kind",{"type":41,"tag":1767,"props":1773,"children":1774},{},[1775],{"type":46,"value":1776},"GitHub Actions path",{"type":41,"tag":1767,"props":1778,"children":1779},{},[1780],{"type":46,"value":1781},"Azure DevOps path",{"type":41,"tag":1767,"props":1783,"children":1784},{},[1785],{"type":46,"value":1786},"Trigger",{"type":41,"tag":1767,"props":1788,"children":1789},{},[1790],{"type":46,"value":1791},"Environment",{"type":41,"tag":1793,"props":1794,"children":1795},"tbody",{},[1796,1866,1913,1959,2006],{"type":41,"tag":1763,"props":1797,"children":1798},{},[1799,1808,1817,1826,1849],{"type":41,"tag":1800,"props":1801,"children":1802},"td",{},[1803],{"type":41,"tag":74,"props":1804,"children":1806},{"className":1805},[],[1807],{"type":46,"value":377},{"type":41,"tag":1800,"props":1809,"children":1810},{},[1811],{"type":41,"tag":74,"props":1812,"children":1814},{"className":1813},[],[1815],{"type":46,"value":1816},".github\u002Fworkflows\u002Fagentops-pr.yml",{"type":41,"tag":1800,"props":1818,"children":1819},{},[1820],{"type":41,"tag":74,"props":1821,"children":1823},{"className":1822},[],[1824],{"type":46,"value":1825},".azuredevops\u002Fpipelines\u002Fagentops-pr.yml",{"type":41,"tag":1800,"props":1827,"children":1828},{},[1829,1831,1837,1838,1843,1844],{"type":46,"value":1830},"PRs to ",{"type":41,"tag":74,"props":1832,"children":1834},{"className":1833},[],[1835],{"type":46,"value":1836},"develop",{"type":46,"value":198},{"type":41,"tag":74,"props":1839,"children":1841},{"className":1840},[],[1842],{"type":46,"value":1376},{"type":46,"value":198},{"type":41,"tag":74,"props":1845,"children":1847},{"className":1846},[],[1848],{"type":46,"value":568},{"type":41,"tag":1800,"props":1850,"children":1851},{},[1852,1857,1859,1864],{"type":41,"tag":74,"props":1853,"children":1855},{"className":1854},[],[1856],{"type":46,"value":420},{"type":46,"value":1858}," for prompt-agent PR candidates, ",{"type":41,"tag":74,"props":1860,"children":1862},{"className":1861},[],[1863],{"type":46,"value":393},{"type":46,"value":1865}," for generic PR gates",{"type":41,"tag":1763,"props":1867,"children":1868},{},[1869,1877,1886,1895,1905],{"type":41,"tag":1800,"props":1870,"children":1871},{},[1872],{"type":41,"tag":74,"props":1873,"children":1875},{"className":1874},[],[1876],{"type":46,"value":393},{"type":41,"tag":1800,"props":1878,"children":1879},{},[1880],{"type":41,"tag":74,"props":1881,"children":1883},{"className":1882},[],[1884],{"type":46,"value":1885},".github\u002Fworkflows\u002Fagentops-deploy-dev.yml",{"type":41,"tag":1800,"props":1887,"children":1888},{},[1889],{"type":41,"tag":74,"props":1890,"children":1892},{"className":1891},[],[1893],{"type":46,"value":1894},".azuredevops\u002Fpipelines\u002Fagentops-deploy-dev.yml",{"type":41,"tag":1800,"props":1896,"children":1897},{},[1898,1900],{"type":46,"value":1899},"push to ",{"type":41,"tag":74,"props":1901,"children":1903},{"className":1902},[],[1904],{"type":46,"value":1836},{"type":41,"tag":1800,"props":1906,"children":1907},{},[1908],{"type":41,"tag":74,"props":1909,"children":1911},{"className":1910},[],[1912],{"type":46,"value":393},{"type":41,"tag":1763,"props":1914,"children":1915},{},[1916,1924,1933,1942,1951],{"type":41,"tag":1800,"props":1917,"children":1918},{},[1919],{"type":41,"tag":74,"props":1920,"children":1922},{"className":1921},[],[1923],{"type":46,"value":400},{"type":41,"tag":1800,"props":1925,"children":1926},{},[1927],{"type":41,"tag":74,"props":1928,"children":1930},{"className":1929},[],[1931],{"type":46,"value":1932},".github\u002Fworkflows\u002Fagentops-deploy-qa.yml",{"type":41,"tag":1800,"props":1934,"children":1935},{},[1936],{"type":41,"tag":74,"props":1937,"children":1939},{"className":1938},[],[1940],{"type":46,"value":1941},".azuredevops\u002Fpipelines\u002Fagentops-deploy-qa.yml",{"type":41,"tag":1800,"props":1943,"children":1944},{},[1945,1946],{"type":46,"value":1899},{"type":41,"tag":74,"props":1947,"children":1949},{"className":1948},[],[1950],{"type":46,"value":1376},{"type":41,"tag":1800,"props":1952,"children":1953},{},[1954],{"type":41,"tag":74,"props":1955,"children":1957},{"className":1956},[],[1958],{"type":46,"value":400},{"type":41,"tag":1763,"props":1960,"children":1961},{},[1962,1971,1980,1989,1998],{"type":41,"tag":1800,"props":1963,"children":1964},{},[1965],{"type":41,"tag":74,"props":1966,"children":1968},{"className":1967},[],[1969],{"type":46,"value":1970},"prod",{"type":41,"tag":1800,"props":1972,"children":1973},{},[1974],{"type":41,"tag":74,"props":1975,"children":1977},{"className":1976},[],[1978],{"type":46,"value":1979},".github\u002Fworkflows\u002Fagentops-deploy-prod.yml",{"type":41,"tag":1800,"props":1981,"children":1982},{},[1983],{"type":41,"tag":74,"props":1984,"children":1986},{"className":1985},[],[1987],{"type":46,"value":1988},".azuredevops\u002Fpipelines\u002Fagentops-deploy-prod.yml",{"type":41,"tag":1800,"props":1990,"children":1991},{},[1992,1993],{"type":46,"value":1899},{"type":41,"tag":74,"props":1994,"children":1996},{"className":1995},[],[1997],{"type":46,"value":568},{"type":41,"tag":1800,"props":1999,"children":2000},{},[2001],{"type":41,"tag":74,"props":2002,"children":2004},{"className":2003},[],[2005],{"type":46,"value":408},{"type":41,"tag":1763,"props":2007,"children":2008},{},[2009,2018,2027,2036,2041],{"type":41,"tag":1800,"props":2010,"children":2011},{},[2012],{"type":41,"tag":74,"props":2013,"children":2015},{"className":2014},[],[2016],{"type":46,"value":2017},"doctor",{"type":41,"tag":1800,"props":2019,"children":2020},{},[2021],{"type":41,"tag":74,"props":2022,"children":2024},{"className":2023},[],[2025],{"type":46,"value":2026},".github\u002Fworkflows\u002Fagentops-doctor.yml",{"type":41,"tag":1800,"props":2028,"children":2029},{},[2030],{"type":41,"tag":74,"props":2031,"children":2033},{"className":2032},[],[2034],{"type":46,"value":2035},".azuredevops\u002Fpipelines\u002Fagentops-doctor.yml",{"type":41,"tag":1800,"props":2037,"children":2038},{},[2039],{"type":46,"value":2040},"daily cron (06:00 UTC)",{"type":41,"tag":1800,"props":2042,"children":2043},{},[2044],{"type":41,"tag":74,"props":2045,"children":2047},{"className":2046},[],[2048],{"type":46,"value":393},{"type":41,"tag":49,"props":2050,"children":2051},{},[2052],{"type":46,"value":2053},"PR and PROD workflows upload release evidence. Explain that this is a\nprojection of existing eval\u002FDoctor\u002FFoundry\u002Fmonitoring signals, not a separate\nexit-code contract. Generate the optional scheduled Doctor workflow only when\nthe team explicitly wants periodic health-check artifacts outside PR\u002Frelease\nevents.",{"type":41,"tag":49,"props":2055,"children":2056},{},[2057],{"type":46,"value":2058},"Useful flags:",{"type":41,"tag":66,"props":2060,"children":2061},{},[2062,2073,2084,2103,2114,2183],{"type":41,"tag":70,"props":2063,"children":2064},{},[2065,2071],{"type":41,"tag":74,"props":2066,"children":2068},{"className":2067},[],[2069],{"type":46,"value":2070},"--platform github | azure-devops",{"type":46,"value":2072}," - pick the CI\u002FCD platform.",{"type":41,"tag":70,"props":2074,"children":2075},{},[2076,2082],{"type":41,"tag":74,"props":2077,"children":2079},{"className":2078},[],[2080],{"type":46,"value":2081},"--force",{"type":46,"value":2083}," - overwrite existing workflow files.",{"type":41,"tag":70,"props":2085,"children":2086},{},[2087,2093,2095,2101],{"type":41,"tag":74,"props":2088,"children":2090},{"className":2089},[],[2091],{"type":46,"value":2092},"--kinds pr,dev,qa,prod",{"type":46,"value":2094}," - generate a subset. Prefer ",{"type":41,"tag":74,"props":2096,"children":2098},{"className":2097},[],[2099],{"type":46,"value":2100},"--kinds pr",{"type":46,"value":2102},"\nuntil deploy environments are configured.",{"type":41,"tag":70,"props":2104,"children":2105},{},[2106,2112],{"type":41,"tag":74,"props":2107,"children":2109},{"className":2108},[],[2110],{"type":46,"value":2111},"--kinds doctor",{"type":46,"value":2113}," - optional scheduled Doctor-only workflow for periodic\nchecks. Do not use it as a substitute for the PR gate.",{"type":41,"tag":70,"props":2115,"children":2116},{},[2117,2123,2125,2131,2133,2138,2140,2145,2147,2152,2154,2159,2161,2166,2167,2173,2175,2181],{"type":41,"tag":74,"props":2118,"children":2120},{"className":2119},[],[2121],{"type":46,"value":2122},"--deploy-mode auto|placeholder|azd|prompt-agent",{"type":46,"value":2124}," - ",{"type":41,"tag":74,"props":2126,"children":2128},{"className":2127},[],[2129],{"type":46,"value":2130},"auto",{"type":46,"value":2132}," uses azd\ntemplates when ",{"type":41,"tag":74,"props":2134,"children":2136},{"className":2135},[],[2137],{"type":46,"value":354},{"type":46,"value":2139}," exists, otherwise uses prompt-agent templates\nwhen ",{"type":41,"tag":74,"props":2141,"children":2143},{"className":2142},[],[2144],{"type":46,"value":309},{"type":46,"value":2146}," targets a Foundry prompt agent; ",{"type":41,"tag":74,"props":2148,"children":2150},{"className":2149},[],[2151],{"type":46,"value":181},{"type":46,"value":2153}," forces\n",{"type":41,"tag":74,"props":2155,"children":2157},{"className":2156},[],[2158],{"type":46,"value":196},{"type":46,"value":2160}," \u002F ",{"type":41,"tag":74,"props":2162,"children":2164},{"className":2163},[],[2165],{"type":46,"value":204},{"type":46,"value":789},{"type":41,"tag":74,"props":2168,"children":2170},{"className":2169},[],[2171],{"type":46,"value":2172},"prompt-agent",{"type":46,"value":2174}," stages\u002Fevaluates a Foundry\nprompt candidate; ",{"type":41,"tag":74,"props":2176,"children":2178},{"className":2177},[],[2179],{"type":46,"value":2180},"placeholder",{"type":46,"value":2182}," keeps the generic stack-agnostic scaffold.",{"type":41,"tag":70,"props":2184,"children":2185},{},[2186,2192],{"type":41,"tag":74,"props":2187,"children":2189},{"className":2188},[],[2190],{"type":46,"value":2191},"--dir \u003Cpath>",{"type":46,"value":2193}," - non-default repo root.",{"type":41,"tag":260,"props":2195,"children":2197},{"id":2196},"step-2-configure-environments-and-azure-auth",[2198],{"type":46,"value":2199},"Step 2 - Configure environments and Azure auth",{"type":41,"tag":2201,"props":2202,"children":2203},"h3",{"id":17},[2204],{"type":46,"value":16},{"type":41,"tag":49,"props":2206,"children":2207},{},[2208,2210,2215,2217,2225,2227,2235,2236,2244,2245,2253,2254,2262],{"type":46,"value":2209},"Read the generated workflow files and create only the GitHub Environments used\nby ",{"type":41,"tag":74,"props":2211,"children":2213},{"className":2212},[],[2214],{"type":46,"value":460},{"type":46,"value":2216},". For prompt-agent PR gates, create ",{"type":41,"tag":58,"props":2218,"children":2219},{},[2220],{"type":41,"tag":74,"props":2221,"children":2223},{"className":2222},[],[2224],{"type":46,"value":420},{"type":46,"value":2226},". For the\nfull scaffold, create ",{"type":41,"tag":58,"props":2228,"children":2229},{},[2230],{"type":41,"tag":74,"props":2231,"children":2233},{"className":2232},[],[2234],{"type":46,"value":420},{"type":46,"value":198},{"type":41,"tag":58,"props":2237,"children":2238},{},[2239],{"type":41,"tag":74,"props":2240,"children":2242},{"className":2241},[],[2243],{"type":46,"value":393},{"type":46,"value":198},{"type":41,"tag":58,"props":2246,"children":2247},{},[2248],{"type":41,"tag":74,"props":2249,"children":2251},{"className":2250},[],[2252],{"type":46,"value":400},{"type":46,"value":702},{"type":41,"tag":58,"props":2255,"children":2256},{},[2257],{"type":41,"tag":74,"props":2258,"children":2260},{"className":2259},[],[2261],{"type":46,"value":408},{"type":46,"value":116},{"type":41,"tag":66,"props":2264,"children":2265},{},[2266,2285,2304,2317],{"type":41,"tag":70,"props":2267,"children":2268},{},[2269,2277,2279,2284],{"type":41,"tag":58,"props":2270,"children":2271},{},[2272],{"type":41,"tag":74,"props":2273,"children":2275},{"className":2274},[],[2276],{"type":46,"value":420},{"type":46,"value":2278}," - no extra protection. Store the PR candidate endpoint and OIDC variables here when generated jobs use ",{"type":41,"tag":74,"props":2280,"children":2282},{"className":2281},[],[2283],{"type":46,"value":385},{"type":46,"value":116},{"type":41,"tag":70,"props":2286,"children":2287},{},[2288,2296,2298,2303],{"type":41,"tag":58,"props":2289,"children":2290},{},[2291],{"type":41,"tag":74,"props":2292,"children":2294},{"className":2293},[],[2295],{"type":46,"value":393},{"type":46,"value":2297}," - no extra protection. Store the OIDC variables here when the\ngenerated jobs use ",{"type":41,"tag":74,"props":2299,"children":2301},{"className":2300},[],[2302],{"type":46,"value":942},{"type":46,"value":116},{"type":41,"tag":70,"props":2305,"children":2306},{},[2307,2315],{"type":41,"tag":58,"props":2308,"children":2309},{},[2310],{"type":41,"tag":74,"props":2311,"children":2313},{"className":2312},[],[2314],{"type":46,"value":400},{"type":46,"value":2316}," - usually no required reviewers, but isolated variables for QA.",{"type":41,"tag":70,"props":2318,"children":2319},{},[2320,2328,2330,2335],{"type":41,"tag":58,"props":2321,"children":2322},{},[2323],{"type":41,"tag":74,"props":2324,"children":2326},{"className":2325},[],[2327],{"type":46,"value":408},{"type":46,"value":2329}," - set required reviewers, optional wait timer, optional\ndeployment branch restriction to ",{"type":41,"tag":74,"props":2331,"children":2333},{"className":2332},[],[2334],{"type":46,"value":568},{"type":46,"value":2336},", and production-specific variables.",{"type":41,"tag":49,"props":2338,"children":2339},{},[2340],{"type":46,"value":2341},"Tell the user that environment-level variables override repository-level ones\ninside jobs that declare that environment.",{"type":41,"tag":2201,"props":2343,"children":2345},{"id":2344},"azure-devops",[2346],{"type":46,"value":2347},"Azure DevOps",{"type":41,"tag":49,"props":2349,"children":2350},{},[2351,2353,2358,2360,2365,2366,2371,2372,2377,2379,2384],{"type":46,"value":2352},"In ",{"type":41,"tag":58,"props":2354,"children":2355},{},[2356],{"type":46,"value":2357},"Pipelines → Environments",{"type":46,"value":2359},", create three: ",{"type":41,"tag":74,"props":2361,"children":2363},{"className":2362},[],[2364],{"type":46,"value":393},{"type":46,"value":198},{"type":41,"tag":74,"props":2367,"children":2369},{"className":2368},[],[2370],{"type":46,"value":400},{"type":46,"value":838},{"type":41,"tag":74,"props":2373,"children":2375},{"className":2374},[],[2376],{"type":46,"value":408},{"type":46,"value":2378},". On ",{"type":41,"tag":74,"props":2380,"children":2382},{"className":2381},[],[2383],{"type":46,"value":408},{"type":46,"value":2385},", add a manual approval check (Approvals\nand checks → New check → Approvals).",{"type":41,"tag":49,"props":2387,"children":2388},{},[2389,2390,2395,2397,2402],{"type":46,"value":2352},{"type":41,"tag":58,"props":2391,"children":2392},{},[2393],{"type":46,"value":2394},"Pipelines → Library",{"type":46,"value":2396},", create a variable group named ",{"type":41,"tag":74,"props":2398,"children":2400},{"className":2399},[],[2401],{"type":46,"value":114},{"type":46,"value":2403},"\nwith these variables (mark sensitive ones as secret if needed):",{"type":41,"tag":66,"props":2405,"children":2406},{},[2407,2415,2423,2431],{"type":41,"tag":70,"props":2408,"children":2409},{},[2410],{"type":41,"tag":74,"props":2411,"children":2413},{"className":2412},[],[2414],{"type":46,"value":494},{"type":41,"tag":70,"props":2416,"children":2417},{},[2418],{"type":41,"tag":74,"props":2419,"children":2421},{"className":2420},[],[2422],{"type":46,"value":836},{"type":41,"tag":70,"props":2424,"children":2425},{},[2426],{"type":41,"tag":74,"props":2427,"children":2429},{"className":2428},[],[2430],{"type":46,"value":504},{"type":41,"tag":70,"props":2432,"children":2433},{},[2434,2439],{"type":41,"tag":74,"props":2435,"children":2437},{"className":2436},[],[2438],{"type":46,"value":516},{"type":46,"value":2440}," - optional fallback if the\nFoundry project's App Insights connection cannot be auto-discovered.",{"type":41,"tag":49,"props":2442,"children":2443},{},[2444,2445,2450,2452,2458],{"type":46,"value":2352},{"type":41,"tag":58,"props":2446,"children":2447},{},[2448],{"type":46,"value":2449},"Project settings → Service connections",{"type":46,"value":2451},", create an Azure Resource\nManager service connection named ",{"type":41,"tag":74,"props":2453,"children":2455},{"className":2454},[],[2456],{"type":46,"value":2457},"agentops-azure",{"type":46,"value":2459}," scoped to the\nsubscription that hosts your Foundry project.",{"type":41,"tag":49,"props":2461,"children":2462},{},[2463,2465,2471],{"type":46,"value":2464},"Grant the build service \"Contribute to pull requests\" permission on the\nrepository (Project settings → Repositories → Security → ",{"type":41,"tag":74,"props":2466,"children":2468},{"className":2467},[],[2469],{"type":46,"value":2470},"Build Service",{"type":46,"value":2472},")\nso the PR-comment step can post.",{"type":41,"tag":260,"props":2474,"children":2476},{"id":2475},"step-3-configure-azure-auth",[2477],{"type":46,"value":2478},"Step 3 - Configure Azure auth",{"type":41,"tag":2201,"props":2480,"children":2482},{"id":2481},"github-actions-oidc",[2483],{"type":46,"value":2484},"GitHub Actions (OIDC)",{"type":41,"tag":49,"props":2486,"children":2487},{},[2488],{"type":46,"value":2489},"At the GitHub Environment level when the workflow declares an environment\n(preferred for the tutorials), or at repository level when intentionally shared\nacross environments, set:",{"type":41,"tag":66,"props":2491,"children":2492},{},[2493,2503,2511,2519,2529,2539],{"type":41,"tag":70,"props":2494,"children":2495},{},[2496,2501],{"type":41,"tag":74,"props":2497,"children":2499},{"className":2498},[],[2500],{"type":46,"value":470},{"type":46,"value":2502}," - App registration \u002F managed identity used for OIDC.",{"type":41,"tag":70,"props":2504,"children":2505},{},[2506],{"type":41,"tag":74,"props":2507,"children":2509},{"className":2508},[],[2510],{"type":46,"value":477},{"type":41,"tag":70,"props":2512,"children":2513},{},[2514],{"type":41,"tag":74,"props":2515,"children":2517},{"className":2516},[],[2518],{"type":46,"value":484},{"type":41,"tag":70,"props":2520,"children":2521},{},[2522,2527],{"type":41,"tag":74,"props":2523,"children":2525},{"className":2524},[],[2526],{"type":46,"value":494},{"type":46,"value":2528}," - Foundry project URL used by the\neval step.",{"type":41,"tag":70,"props":2530,"children":2531},{},[2532,2537],{"type":41,"tag":74,"props":2533,"children":2535},{"className":2534},[],[2536],{"type":46,"value":504},{"type":46,"value":2538}," - existing Azure OpenAI deployment used as the\nevaluator\u002Fjudge model. Reuse the local AgentOps\u002Fazd value when available.",{"type":41,"tag":70,"props":2540,"children":2541},{},[2542,2547],{"type":41,"tag":74,"props":2543,"children":2545},{"className":2544},[],[2546],{"type":46,"value":516},{"type":46,"value":2548}," - optional fallback as a\nvariable or secret. Generated workflows first try to auto-discover App\nInsights from the Foundry project endpoint; this value makes eval and\nDoctor telemetry explicit.",{"type":41,"tag":49,"props":2550,"children":2551},{},[2552,2554,2559,2561,2565],{"type":46,"value":2553},"For Foundry prompt-agent projects that use trace sampling or\n",{"type":41,"tag":58,"props":2555,"children":2556},{},[2557],{"type":46,"value":2558},"Create dataset → From traces",{"type":46,"value":2560},", also verify the Foundry project managed\nidentity can read telemetry: grant or verify ",{"type":41,"tag":58,"props":2562,"children":2563},{},[2564],{"type":46,"value":887},{"type":46,"value":2566}," on the connected\nApplication Insights resource, and on the backing Log Analytics workspace when\nthe App Insights component is workspace-based. This permission is not covered by\nthe GitHub OIDC service principal roles above.",{"type":41,"tag":49,"props":2568,"children":2569},{},[2570,2572,2578,2580,2585,2587,2593,2595,2601],{"type":46,"value":2571},"Then configure Workload Identity Federation on the Azure side\n(",{"type":41,"tag":74,"props":2573,"children":2575},{"className":2574},[],[2576],{"type":46,"value":2577},"federated-credentials",{"type":46,"value":2579}," on the app registration) for ",{"type":41,"tag":58,"props":2581,"children":2582},{},[2583],{"type":46,"value":2584},"each branch \u002F\nenvironment",{"type":46,"value":2586}," the workflows will run from. See\n",{"type":41,"tag":74,"props":2588,"children":2590},{"className":2589},[],[2591],{"type":46,"value":2592},"docs\u002Fci-github-actions.md",{"type":46,"value":2594}," for the exact ",{"type":41,"tag":74,"props":2596,"children":2598},{"className":2597},[],[2599],{"type":46,"value":2600},"az",{"type":46,"value":2602}," commands.",{"type":41,"tag":49,"props":2604,"children":2605},{},[2606,2608,2612,2614,2619],{"type":46,"value":2607},"Also grant the same app registration \u002F service principal ",{"type":41,"tag":58,"props":2609,"children":2610},{},[2611],{"type":46,"value":970},{"type":46,"value":2613}," Azure\nRBAC roles before the first workflow run; both are required and the eval\nstep fails silently (every metric returns ",{"type":41,"tag":74,"props":2615,"children":2617},{"className":2616},[],[2618],{"type":46,"value":978},{"type":46,"value":2620},") if only one is in place:",{"type":41,"tag":272,"props":2622,"children":2623},{},[2624,2646],{"type":41,"tag":70,"props":2625,"children":2626},{},[2627,2631,2633,2638,2640,2645],{"type":41,"tag":58,"props":2628,"children":2629},{},[2630],{"type":46,"value":988},{"type":46,"value":2632}," on the Foundry project or Foundry resource. The PR gate\nuses Foundry data-plane APIs to read prompt agents; Azure ",{"type":41,"tag":74,"props":2634,"children":2636},{"className":2635},[],[2637],{"type":46,"value":887},{"type":46,"value":2639}," only\nproves ARM access and will still fail the eval step with\n",{"type":41,"tag":74,"props":2641,"children":2643},{"className":2642},[],[2644],{"type":46,"value":1004},{"type":46,"value":116},{"type":41,"tag":70,"props":2647,"children":2648},{},[2649,2653,2655,2660,2661,2666,2668,2674,2676,2681,2683,2688],{"type":41,"tag":58,"props":2650,"children":2651},{},[2652],{"type":46,"value":1013},{"type":46,"value":2654}," on the underlying Azure AI Services\naccount that hosts the evaluator model deployment. Without this, Foundry\n",{"type":41,"tag":74,"props":2656,"children":2658},{"className":2657},[],[2659],{"type":46,"value":1029},{"type":46,"value":1031},{"type":41,"tag":74,"props":2662,"children":2664},{"className":2663},[],[2665],{"type":46,"value":1037},{"type":46,"value":2667}," on the\nOpenAI ",{"type":41,"tag":74,"props":2669,"children":2671},{"className":2670},[],[2672],{"type":46,"value":2673},"chat\u002Fcompletions\u002Faction",{"type":46,"value":2675}," data action and every metric returns\n",{"type":41,"tag":74,"props":2677,"children":2679},{"className":2678},[],[2680],{"type":46,"value":978},{"type":46,"value":2682}," in the cloud eval report. AgentOps surfaces that error in\n",{"type":41,"tag":74,"props":2684,"children":2686},{"className":2685},[],[2687],{"type":46,"value":248},{"type":46,"value":2689}," and the orchestrator's \"0 usable metric scores\" warning,\nbut the workflow still fails the gate — fix the role before the run.",{"type":41,"tag":49,"props":2691,"children":2692},{},[2693,2695,2701,2703,2709],{"type":46,"value":2694},"Tell the user that CI evals emit ",{"type":41,"tag":74,"props":2696,"children":2698},{"className":2697},[],[2699],{"type":46,"value":2700},"agentops.eval.*",{"type":46,"value":2702}," telemetry and scheduled\nDoctor runs emit ",{"type":41,"tag":74,"props":2704,"children":2706},{"className":2705},[],[2707],{"type":46,"value":2708},"agentops.agent.finding.*",{"type":46,"value":2710}," telemetry when App Insights is\nconfigured or auto-discovered. The Cockpit uses those signals for Azure\nMonitor deep links.",{"type":41,"tag":2201,"props":2712,"children":2714},{"id":2713},"azure-devops-service-connection",[2715],{"type":46,"value":2716},"Azure DevOps (Service Connection)",{"type":41,"tag":49,"props":2718,"children":2719},{},[2720,2722,2727,2729,2734,2736,2740,2742,2747,2748,2752,2754,2759,2761,2766],{"type":46,"value":2721},"Already done in Step 2 - the ",{"type":41,"tag":74,"props":2723,"children":2725},{"className":2724},[],[2726],{"type":46,"value":2457},{"type":46,"value":2728}," service connection\nhandles auth. Make sure the underlying service principal or managed\nidentity has ",{"type":41,"tag":58,"props":2730,"children":2731},{},[2732],{"type":46,"value":2733},"both",{"type":46,"value":2735}," the ",{"type":41,"tag":58,"props":2737,"children":2738},{},[2739],{"type":46,"value":988},{"type":46,"value":2741}," role on the Foundry project (or\nFoundry resource) ",{"type":41,"tag":58,"props":2743,"children":2744},{},[2745],{"type":46,"value":2746},"and",{"type":46,"value":2735},{"type":41,"tag":58,"props":2749,"children":2750},{},[2751],{"type":46,"value":1013},{"type":46,"value":2753}," role on the\nunderlying Azure AI Services account that hosts the evaluator model. Both\nare required; without the OpenAI User role the Foundry graders fail with a\n401 ",{"type":41,"tag":74,"props":2755,"children":2757},{"className":2756},[],[2758],{"type":46,"value":1037},{"type":46,"value":2760}," and every cloud eval metric returns ",{"type":41,"tag":74,"props":2762,"children":2764},{"className":2763},[],[2765],{"type":46,"value":978},{"type":46,"value":116},{"type":41,"tag":260,"props":2768,"children":2770},{"id":2769},"step-4-use-azd-for-deployment",[2771],{"type":46,"value":2772},"Step 4 - Use azd for deployment",{"type":41,"tag":49,"props":2774,"children":2775},{},[2776,2778,2783],{"type":46,"value":2777},"If the repo already has ",{"type":41,"tag":74,"props":2779,"children":2781},{"className":2780},[],[2782],{"type":46,"value":354},{"type":46,"value":2784},", generate azd-backed deployment\nworkflows:",{"type":41,"tag":1349,"props":2786,"children":2788},{"className":1493,"code":2787,"language":1495,"meta":1357,"style":1357},"agentops workflow generate --kinds pr,dev,qa,prod --deploy-mode azd --force\n",[2789],{"type":41,"tag":74,"props":2790,"children":2791},{"__ignoreMap":1357},[2792],{"type":41,"tag":1501,"props":2793,"children":2794},{"class":1503,"line":1504},[2795,2799,2803,2807,2811,2815,2820,2825],{"type":41,"tag":1501,"props":2796,"children":2797},{"style":1508},[2798],{"type":46,"value":114},{"type":41,"tag":1501,"props":2800,"children":2801},{"style":1513},[2802],{"type":46,"value":1516},{"type":41,"tag":1501,"props":2804,"children":2805},{"style":1513},[2806],{"type":46,"value":1609},{"type":41,"tag":1501,"props":2808,"children":2809},{"style":1513},[2810],{"type":46,"value":1614},{"type":41,"tag":1501,"props":2812,"children":2813},{"style":1513},[2814],{"type":46,"value":1653},{"type":41,"tag":1501,"props":2816,"children":2817},{"style":1513},[2818],{"type":46,"value":2819}," --deploy-mode",{"type":41,"tag":1501,"props":2821,"children":2822},{"style":1513},[2823],{"type":46,"value":2824}," azd",{"type":41,"tag":1501,"props":2826,"children":2827},{"style":1513},[2828],{"type":46,"value":1658},{"type":41,"tag":49,"props":2830,"children":2831},{},[2832],{"type":46,"value":2833},"The deploy workflows will:",{"type":41,"tag":272,"props":2835,"children":2836},{},[2837,2850,2862,2889,2900,2912],{"type":41,"tag":70,"props":2838,"children":2839},{},[2840,2842,2848],{"type":46,"value":2841},"run ",{"type":41,"tag":74,"props":2843,"children":2845},{"className":2844},[],[2846],{"type":46,"value":2847},"azd env new ... || azd env select ...",{"type":46,"value":2849}," in CI;",{"type":41,"tag":70,"props":2851,"children":2852},{},[2853,2854,2860],{"type":46,"value":2841},{"type":41,"tag":74,"props":2855,"children":2857},{"className":2856},[],[2858],{"type":46,"value":2859},"azd provision --no-prompt",{"type":46,"value":2861}," for DEV by default;",{"type":41,"tag":70,"props":2863,"children":2864},{},[2865,2866,2871,2873,2879,2881,2887],{"type":46,"value":2841},{"type":41,"tag":74,"props":2867,"children":2869},{"className":2868},[],[2870],{"type":46,"value":2859},{"type":46,"value":2872}," for QA\u002FPROD only when manually\nrequested (",{"type":41,"tag":74,"props":2874,"children":2876},{"className":2875},[],[2877],{"type":46,"value":2878},"provision=true",{"type":46,"value":2880}," in GitHub Actions or\n",{"type":41,"tag":74,"props":2882,"children":2884},{"className":2883},[],[2885],{"type":46,"value":2886},"RUN_AZD_PROVISION=true",{"type":46,"value":2888}," in Azure DevOps);",{"type":41,"tag":70,"props":2890,"children":2891},{},[2892,2893,2898],{"type":46,"value":2841},{"type":41,"tag":74,"props":2894,"children":2896},{"className":2895},[],[2897],{"type":46,"value":240},{"type":46,"value":2899}," as the quality\u002Fsafety gate;",{"type":41,"tag":70,"props":2901,"children":2902},{},[2903,2904,2910],{"type":46,"value":2841},{"type":41,"tag":74,"props":2905,"children":2907},{"className":2906},[],[2908],{"type":46,"value":2909},"azd env refresh",{"type":46,"value":2911}," on the deploy runner so a fresh CI workspace can\nrecover outputs from the previous infrastructure provision;",{"type":41,"tag":70,"props":2913,"children":2914},{},[2915,2916,2922],{"type":46,"value":2841},{"type":41,"tag":74,"props":2917,"children":2919},{"className":2918},[],[2920],{"type":46,"value":2921},"azd deploy --no-prompt",{"type":46,"value":116},{"type":41,"tag":49,"props":2924,"children":2925},{},[2926,2928,2934,2936,2941,2942,2947,2948,2953,2955,2961],{"type":46,"value":2927},"Set ",{"type":41,"tag":74,"props":2929,"children":2931},{"className":2930},[],[2932],{"type":46,"value":2933},"AZURE_ENV_NAME",{"type":46,"value":2935}," per GitHub Environment \u002F Azure DevOps variable\ngroup if the user's azd env names are not exactly ",{"type":41,"tag":74,"props":2937,"children":2939},{"className":2938},[],[2940],{"type":46,"value":393},{"type":46,"value":198},{"type":41,"tag":74,"props":2943,"children":2945},{"className":2944},[],[2946],{"type":46,"value":400},{"type":46,"value":611},{"type":41,"tag":74,"props":2949,"children":2951},{"className":2950},[],[2952],{"type":46,"value":408},{"type":46,"value":2954},". Set ",{"type":41,"tag":74,"props":2956,"children":2958},{"className":2957},[],[2959],{"type":46,"value":2960},"AZURE_LOCATION",{"type":46,"value":2962}," when the azd template needs an\nexplicit region.",{"type":41,"tag":2201,"props":2964,"children":2966},{"id":2965},"if-the-user-asks-for-zero-trust-deployment",[2967],{"type":46,"value":2968},"If the user asks for \"zero-trust deployment\"",{"type":41,"tag":49,"props":2970,"children":2971},{},[2972,2974,2978],{"type":46,"value":2973},"Do ",{"type":41,"tag":58,"props":2975,"children":2976},{},[2977],{"type":46,"value":1154},{"type":46,"value":2979}," replicate azd. Do this instead:",{"type":41,"tag":272,"props":2981,"children":2982},{},[2983,2988,2993,3048,3060],{"type":41,"tag":70,"props":2984,"children":2985},{},[2986],{"type":46,"value":2987},"Inspect the app and ask only for missing critical choices (region,\ntarget host, private networking yes\u002Fno if not obvious).",{"type":41,"tag":70,"props":2989,"children":2990},{},[2991],{"type":46,"value":2992},"Prefer an existing azd template or AVM-backed template that already\nimplements managed identity, RBAC-only data access, private endpoints\nwhere required, and no secrets in source.",{"type":41,"tag":70,"props":2994,"children":2995},{},[2996,2998,3003,3004,3010,3012,3017,3019,3025,3026,3032,3033,3039,3040,3046],{"type":46,"value":2997},"Create or adapt ",{"type":41,"tag":74,"props":2999,"children":3001},{"className":3000},[],[3002],{"type":46,"value":354},{"type":46,"value":198},{"type":41,"tag":74,"props":3005,"children":3007},{"className":3006},[],[3008],{"type":46,"value":3009},"infra\u002F",{"type":46,"value":3011},", and azd-native hooks declared\nin ",{"type":41,"tag":74,"props":3013,"children":3015},{"className":3014},[],[3016],{"type":46,"value":354},{"type":46,"value":3018}," (",{"type":41,"tag":74,"props":3020,"children":3022},{"className":3021},[],[3023],{"type":46,"value":3024},"preprovision",{"type":46,"value":198},{"type":41,"tag":74,"props":3027,"children":3029},{"className":3028},[],[3030],{"type":46,"value":3031},"postprovision",{"type":46,"value":198},{"type":41,"tag":74,"props":3034,"children":3036},{"className":3035},[],[3037],{"type":46,"value":3038},"predeploy",{"type":46,"value":838},{"type":41,"tag":74,"props":3041,"children":3043},{"className":3042},[],[3044],{"type":46,"value":3045},"postdeploy",{"type":46,"value":3047},") as needed.",{"type":41,"tag":70,"props":3049,"children":3050},{},[3051,3053,3058],{"type":46,"value":3052},"Run ",{"type":41,"tag":74,"props":3054,"children":3056},{"className":3055},[],[3057],{"type":46,"value":196},{"type":46,"value":3059}," to validate the infrastructure path.",{"type":41,"tag":70,"props":3061,"children":3062},{},[3063,3065,3071],{"type":46,"value":3064},"Re-run ",{"type":41,"tag":74,"props":3066,"children":3068},{"className":3067},[],[3069],{"type":46,"value":3070},"agentops workflow generate --deploy-mode azd --force",{"type":46,"value":3072}," so CI\ndelegates provision\u002Fdeploy to azd.",{"type":41,"tag":49,"props":3074,"children":3075},{},[3076,3078,3084,3085,3091,3093,3098],{"type":46,"value":3077},"Never call ad-hoc hook scripts from the workflow (for example\n",{"type":41,"tag":74,"props":3079,"children":3081},{"className":3080},[],[3082],{"type":46,"value":3083},".\u002Fagentops\u002Fdeploy.sh",{"type":46,"value":604},{"type":41,"tag":74,"props":3086,"children":3088},{"className":3087},[],[3089],{"type":46,"value":3090},".\u002F.azd\u002Fhooks\u002F*",{"type":46,"value":3092},"). If custom behavior is\nneeded, put it behind azd's native hook mechanism in ",{"type":41,"tag":74,"props":3094,"children":3096},{"className":3095},[],[3097],{"type":46,"value":354},{"type":46,"value":116},{"type":41,"tag":2201,"props":3100,"children":3102},{"id":3101},"copied-accelerators-ai-landing-zone-apps",[3103],{"type":46,"value":3104},"Copied accelerators \u002F AI Landing Zone apps",{"type":41,"tag":49,"props":3106,"children":3107},{},[3108],{"type":46,"value":3109},"For Azure AI accelerators copied from templates, use AgentOps to make the\nlanding-zone path actionable:",{"type":41,"tag":272,"props":3111,"children":3112},{},[3113,3118,3123,3142],{"type":41,"tag":70,"props":3114,"children":3115},{},[3116],{"type":46,"value":3117},"AgentOps handles eval gates, Doctor, reports, Cockpit readiness, and the\nworkflow guardrails around deployment.",{"type":41,"tag":70,"props":3119,"children":3120},{},[3121],{"type":46,"value":3122},"Foundry manages hosted agents, prompt-agent versions, evaluations, traces,\nmonitoring, datasets, and operations.",{"type":41,"tag":70,"props":3124,"children":3125},{},[3126,3128,3133,3134,3140],{"type":46,"value":3127},"azd\u002FBicep\u002FAILZ manages app and infrastructure deploy when ",{"type":41,"tag":74,"props":3129,"children":3131},{"className":3130},[],[3132],{"type":46,"value":354},{"type":46,"value":1180},{"type":41,"tag":74,"props":3135,"children":3137},{"className":3136},[],[3138],{"type":46,"value":3139},"infra\u002F*.bicep",{"type":46,"value":3141}," exists.",{"type":41,"tag":70,"props":3143,"children":3144},{},[3145],{"type":46,"value":3146},"Project-specific steps such as indexing, data seeding, model deployment,\ncontainer build\u002Fpush, App Config updates, or private-network post-provision\nwork stay in azd hooks or existing project tooling.",{"type":41,"tag":49,"props":3148,"children":3149},{},[3150,3151,3157,3159,3165,3167,3172,3174,3180,3182,3187],{"type":46,"value":745},{"type":41,"tag":74,"props":3152,"children":3154},{"className":3153},[],[3155],{"type":46,"value":3156},"scripts\u002FInvoke-PreflightChecks.ps1",{"type":46,"value":3158}," exists, keep it in the deployment path:\nAgentOps-generated azd workflows run it with ",{"type":41,"tag":74,"props":3160,"children":3162},{"className":3161},[],[3163],{"type":46,"value":3164},"-Strict",{"type":46,"value":3166}," before ",{"type":41,"tag":74,"props":3168,"children":3170},{"className":3169},[],[3171],{"type":46,"value":196},{"type":46,"value":3173},".\nDoctor surfaces the same path as ",{"type":41,"tag":74,"props":3175,"children":3177},{"className":3176},[],[3178],{"type":46,"value":3179},"AI Landing Zone deployment readiness",{"type":46,"value":3181},", with\nevidence for preflight, ",{"type":41,"tag":74,"props":3183,"children":3185},{"className":3184},[],[3186],{"type":46,"value":309},{"type":46,"value":3188},", azd workflow coverage, network\nisolation, and the private runner path.",{"type":41,"tag":49,"props":3190,"children":3191},{},[3192,3193,3198],{"type":46,"value":745},{"type":41,"tag":74,"props":3194,"children":3196},{"className":3195},[],[3197],{"type":46,"value":169},{"type":46,"value":3199}," reports network isolation, private endpoints,\njumpbox\u002FBastion, Azure Firewall, or ACR Tasks, do not assume GitHub-hosted\nrunners can deploy everything. Plan self-hosted runner, jumpbox handoff, or ACR\nTasks agent-pool execution before enabling DEV\u002FQA\u002FPROD deploy stages.",{"type":41,"tag":49,"props":3201,"children":3202},{},[3203,3204,3209,3211,3216,3218,3224],{"type":46,"value":745},{"type":41,"tag":74,"props":3205,"children":3207},{"className":3206},[],[3208],{"type":46,"value":354},{"type":46,"value":3210}," is missing and the user is not asking to create the\ndeployment assets yet, check whether this is a Foundry prompt agent. If\n",{"type":41,"tag":74,"props":3212,"children":3214},{"className":3213},[],[3215],{"type":46,"value":309},{"type":46,"value":3217}," has ",{"type":41,"tag":74,"props":3219,"children":3221},{"className":3220},[],[3222],{"type":46,"value":3223},"agent: \"name:version\"",{"type":46,"value":3225},", prefer prompt-agent mode:",{"type":41,"tag":1349,"props":3227,"children":3229},{"className":1493,"code":3228,"language":1495,"meta":1357,"style":1357},"agentops workflow generate --kinds pr,dev,qa,prod --deploy-mode prompt-agent --force\n",[3230],{"type":41,"tag":74,"props":3231,"children":3232},{"__ignoreMap":1357},[3233],{"type":41,"tag":1501,"props":3234,"children":3235},{"class":1503,"line":1504},[3236,3240,3244,3248,3252,3256,3260,3265],{"type":41,"tag":1501,"props":3237,"children":3238},{"style":1508},[3239],{"type":46,"value":114},{"type":41,"tag":1501,"props":3241,"children":3242},{"style":1513},[3243],{"type":46,"value":1516},{"type":41,"tag":1501,"props":3245,"children":3246},{"style":1513},[3247],{"type":46,"value":1609},{"type":41,"tag":1501,"props":3249,"children":3250},{"style":1513},[3251],{"type":46,"value":1614},{"type":41,"tag":1501,"props":3253,"children":3254},{"style":1513},[3255],{"type":46,"value":1653},{"type":41,"tag":1501,"props":3257,"children":3258},{"style":1513},[3259],{"type":46,"value":2819},{"type":41,"tag":1501,"props":3261,"children":3262},{"style":1513},[3263],{"type":46,"value":3264}," prompt-agent",{"type":41,"tag":1501,"props":3266,"children":3267},{"style":1513},[3268],{"type":46,"value":1658},{"type":41,"tag":49,"props":3270,"children":3271},{},[3272],{"type":46,"value":3273},"Prompt-agent workflows:",{"type":41,"tag":272,"props":3275,"children":3276},{},[3277,3304,3369,3380,3392,3403],{"type":41,"tag":70,"props":3278,"children":3279},{},[3280,3282,3288,3290,3295,3296,3302],{"type":46,"value":3281},"read ",{"type":41,"tag":74,"props":3283,"children":3285},{"className":3284},[],[3286],{"type":46,"value":3287},"prompt_file",{"type":46,"value":3289}," from ",{"type":41,"tag":74,"props":3291,"children":3293},{"className":3292},[],[3294],{"type":46,"value":309},{"type":46,"value":1180},{"type":41,"tag":74,"props":3297,"children":3299},{"className":3298},[],[3300],{"type":46,"value":3301},"AGENTOPS_AGENT_PROMPT_FILE",{"type":46,"value":3303},";",{"type":41,"tag":70,"props":3305,"children":3306},{},[3307,3309,3315,3317,3322,3324,3330,3332,3338,3339,3345,3346,3352,3354,3359,3361,3367],{"type":46,"value":3308},"look up the seed agent in the active environment's Foundry project;\nif it does not exist (typical first deploy into dev \u002F qa \u002F prod),\nread the optional ",{"type":41,"tag":74,"props":3310,"children":3312},{"className":3311},[],[3313],{"type":46,"value":3314},"prompt_agent_bootstrap",{"type":46,"value":3316}," block from\n",{"type":41,"tag":74,"props":3318,"children":3320},{"className":3319},[],[3321],{"type":46,"value":309},{"type":46,"value":3323}," (required ",{"type":41,"tag":74,"props":3325,"children":3327},{"className":3326},[],[3328],{"type":46,"value":3329},"model",{"type":46,"value":3331},", optional ",{"type":41,"tag":74,"props":3333,"children":3335},{"className":3334},[],[3336],{"type":46,"value":3337},"description",{"type":46,"value":838},{"type":41,"tag":74,"props":3340,"children":3342},{"className":3341},[],[3343],{"type":46,"value":3344},"model_parameters",{"type":46,"value":198},{"type":41,"tag":74,"props":3347,"children":3349},{"className":3348},[],[3350],{"type":46,"value":3351},"tools",{"type":46,"value":3353},") plus ",{"type":41,"tag":74,"props":3355,"children":3357},{"className":3356},[],[3358],{"type":46,"value":3287},{"type":46,"value":3360}," and create the\nfirst version automatically (recorded as ",{"type":41,"tag":74,"props":3362,"children":3364},{"className":3363},[],[3365],{"type":46,"value":3366},"action: \"bootstrapped\"",{"type":46,"value":3368},");",{"type":41,"tag":70,"props":3370,"children":3371},{},[3372,3374,3379],{"type":46,"value":3373},"otherwise create or reuse a candidate Foundry prompt-agent version\nfrom ",{"type":41,"tag":74,"props":3375,"children":3377},{"className":3376},[],[3378],{"type":46,"value":3287},{"type":46,"value":3303},{"type":41,"tag":70,"props":3381,"children":3382},{},[3383,3385,3391],{"type":46,"value":3384},"generate ",{"type":41,"tag":74,"props":3386,"children":3388},{"className":3387},[],[3389],{"type":46,"value":3390},".agentops\u002Fdeployments\u002Fagentops.candidate.yaml",{"type":46,"value":3303},{"type":41,"tag":70,"props":3393,"children":3394},{},[3395,3396,3401],{"type":46,"value":2841},{"type":41,"tag":74,"props":3397,"children":3399},{"className":3398},[],[3400],{"type":46,"value":240},{"type":46,"value":3402}," against the candidate version;",{"type":41,"tag":70,"props":3404,"children":3405},{},[3406,3408,3414],{"type":46,"value":3407},"record ",{"type":41,"tag":74,"props":3409,"children":3411},{"className":3410},[],[3412],{"type":46,"value":3413},".agentops\u002Fdeployments\u002Ffoundry-agent.json",{"type":46,"value":3415}," as a deployment\nartifact only when the gate passes.",{"type":41,"tag":49,"props":3417,"children":3418},{},[3419,3421,3426,3428,3433],{"type":46,"value":3420},"This avoids the bad pattern of evaluating one agent version and deploying a\ndifferent prompt. The invariant is: ",{"type":41,"tag":58,"props":3422,"children":3423},{},[3424],{"type":46,"value":3425},"evaluated version == deployed version",{"type":46,"value":3427},".\nFoundry manages agent versions; AgentOps enforces the repo-side gate and\ndeployment record. For multi-environment prompt-agent workflows\n(sandbox → dev → qa → prod), strongly recommend adding the\n",{"type":41,"tag":74,"props":3429,"children":3431},{"className":3430},[],[3432],{"type":46,"value":3314},{"type":46,"value":3434}," block so operators do not have to manually\nrecreate the seed agent in every Foundry project.",{"type":41,"tag":49,"props":3436,"children":3437},{},[3438,3440,3445,3447,3453],{"type":46,"value":3439},"If this is not a Foundry prompt agent and azd is not ready, generate\n",{"type":41,"tag":74,"props":3441,"children":3443},{"className":3442},[],[3444],{"type":46,"value":2100},{"type":46,"value":3446}," only or use ",{"type":41,"tag":74,"props":3448,"children":3450},{"className":3449},[],[3451],{"type":46,"value":3452},"--deploy-mode placeholder",{"type":46,"value":3454},". Do not ship\nDEV\u002FQA\u002FPROD workflows that pretend deployment is wired.",{"type":41,"tag":260,"props":3456,"children":3458},{"id":3457},"step-5-branch-protection",[3459],{"type":46,"value":3460},"Step 5 - Branch protection",{"type":41,"tag":49,"props":3462,"children":3463},{},[3464,3466,3471,3472,3477],{"type":46,"value":3465},"In Settings → Branches, add a rule for both ",{"type":41,"tag":74,"props":3467,"children":3469},{"className":3468},[],[3470],{"type":46,"value":1836},{"type":46,"value":536},{"type":41,"tag":74,"props":3473,"children":3475},{"className":3474},[],[3476],{"type":46,"value":568},{"type":46,"value":3478},":",{"type":41,"tag":66,"props":3480,"children":3481},{},[3482,3487,3511],{"type":41,"tag":70,"props":3483,"children":3484},{},[3485],{"type":46,"value":3486},"Require a pull request before merging.",{"type":41,"tag":70,"props":3488,"children":3489},{},[3490,3492,3501,3503,3509],{"type":46,"value":3491},"Require status checks to pass: select ",{"type":41,"tag":58,"props":3493,"children":3494},{},[3495],{"type":41,"tag":74,"props":3496,"children":3498},{"className":3497},[],[3499],{"type":46,"value":3500},"AgentOps PR \u002F Eval (PR gate)",{"type":46,"value":3502},"\n(the job name from ",{"type":41,"tag":74,"props":3504,"children":3506},{"className":3505},[],[3507],{"type":46,"value":3508},"agentops-pr.yml",{"type":46,"value":3510},").",{"type":41,"tag":70,"props":3512,"children":3513},{},[3514],{"type":46,"value":3515},"Optional: require linear history.",{"type":41,"tag":49,"props":3517,"children":3518},{},[3519],{"type":46,"value":3520},"This makes the eval gate a hard merge requirement.",{"type":41,"tag":260,"props":3522,"children":3524},{"id":3523},"step-6-iterate",[3525],{"type":46,"value":3526},"Step 6 - Iterate",{"type":41,"tag":49,"props":3528,"children":3529},{},[3530],{"type":46,"value":3531},"Common follow-ups:",{"type":41,"tag":66,"props":3533,"children":3534},{},[3535,3583,3623,3648],{"type":41,"tag":70,"props":3536,"children":3537},{},[3538,3543,3545,3550,3552,3558,3559,3565,3567,3573,3575,3581],{"type":41,"tag":58,"props":3539,"children":3540},{},[3541],{"type":46,"value":3542},"Tighten thresholds for QA\u002FPROD",{"type":46,"value":3544}," - copy ",{"type":41,"tag":74,"props":3546,"children":3548},{"className":3547},[],[3549],{"type":46,"value":309},{"type":46,"value":3551}," to\n",{"type":41,"tag":74,"props":3553,"children":3555},{"className":3554},[],[3556],{"type":46,"value":3557},"agentops-qa.yaml",{"type":46,"value":2160},{"type":41,"tag":74,"props":3560,"children":3562},{"className":3561},[],[3563],{"type":46,"value":3564},"agentops-prod.yaml",{"type":46,"value":3566}," and tighten the\n",{"type":41,"tag":74,"props":3568,"children":3570},{"className":3569},[],[3571],{"type":46,"value":3572},"thresholds:",{"type":46,"value":3574}," block. Point each workflow at its own config via the\n",{"type":41,"tag":74,"props":3576,"children":3578},{"className":3577},[],[3579],{"type":46,"value":3580},"inputs.config",{"type":46,"value":3582}," default.",{"type":41,"tag":70,"props":3584,"children":3585},{},[3586,3591,3593,3599,3601,3606,3608,3614,3616,3621],{"type":41,"tag":58,"props":3587,"children":3588},{},[3589],{"type":46,"value":3590},"Scheduled runs",{"type":46,"value":3592}," - add a ",{"type":41,"tag":74,"props":3594,"children":3596},{"className":3595},[],[3597],{"type":46,"value":3598},"schedule:",{"type":46,"value":3600}," entry in ",{"type":41,"tag":74,"props":3602,"children":3604},{"className":3603},[],[3605],{"type":46,"value":3508},{"type":46,"value":3607}," (or a\nnew ",{"type":41,"tag":74,"props":3609,"children":3611},{"className":3610},[],[3612],{"type":46,"value":3613},"agentops-nightly.yml",{"type":46,"value":3615},") to evaluate against ",{"type":41,"tag":74,"props":3617,"children":3619},{"className":3618},[],[3620],{"type":46,"value":568},{"type":46,"value":3622}," nightly.",{"type":41,"tag":70,"props":3624,"children":3625},{},[3626,3631,3633,3639,3641,3647],{"type":41,"tag":58,"props":3627,"children":3628},{},[3629],{"type":46,"value":3630},"Matrix per scenario",{"type":46,"value":3632}," - if the user has multiple AgentOps config files,\nextend the eval job with ",{"type":41,"tag":74,"props":3634,"children":3636},{"className":3635},[],[3637],{"type":46,"value":3638},"strategy.matrix.config:",{"type":46,"value":3640}," and reference\n",{"type":41,"tag":74,"props":3642,"children":3644},{"className":3643},[],[3645],{"type":46,"value":3646},"${{ matrix.config }}",{"type":46,"value":116},{"type":41,"tag":70,"props":3649,"children":3650},{},[3651,3656,3658,3663,3665,3671],{"type":41,"tag":58,"props":3652,"children":3653},{},[3654],{"type":46,"value":3655},"Regression baseline",{"type":46,"value":3657}," - wire the deploy templates to download the\nprevious run's ",{"type":41,"tag":74,"props":3659,"children":3661},{"className":3660},[],[3662],{"type":46,"value":248},{"type":46,"value":3664}," artifact and call\n",{"type":41,"tag":74,"props":3666,"children":3668},{"className":3667},[],[3669],{"type":46,"value":3670},"agentops eval run --baseline \u003Cresults.json>",{"type":46,"value":116},{"type":41,"tag":260,"props":3673,"children":3675},{"id":3674},"guardrails",[3676],{"type":46,"value":3677},"Guardrails",{"type":41,"tag":66,"props":3679,"children":3680},{},[3681,3767,3777,3787,3805,3822],{"type":41,"tag":70,"props":3682,"children":3683},{},[3684,3685,3689,3691,3697,3699,3705,3706,3712,3713,3719,3721,3727,3728,3733,3734,3739,3740,3746,3747,3753,3754,3760,3761,3766],{"type":46,"value":2973},{"type":41,"tag":58,"props":3686,"children":3687},{},[3688],{"type":46,"value":1154},{"type":46,"value":3690}," invent CLI flags. The supported ",{"type":41,"tag":74,"props":3692,"children":3694},{"className":3693},[],[3695],{"type":46,"value":3696},"workflow analyze",{"type":46,"value":3698}," flags are\n",{"type":41,"tag":74,"props":3700,"children":3702},{"className":3701},[],[3703],{"type":46,"value":3704},"--dir",{"type":46,"value":198},{"type":41,"tag":74,"props":3707,"children":3709},{"className":3708},[],[3710],{"type":46,"value":3711},"--format",{"type":46,"value":702},{"type":41,"tag":74,"props":3714,"children":3716},{"className":3715},[],[3717],{"type":46,"value":3718},"--out",{"type":46,"value":3720},". The supported ",{"type":41,"tag":74,"props":3722,"children":3724},{"className":3723},[],[3725],{"type":46,"value":3726},"workflow generate",{"type":46,"value":3698},{"type":41,"tag":74,"props":3729,"children":3731},{"className":3730},[],[3732],{"type":46,"value":2081},{"type":46,"value":198},{"type":41,"tag":74,"props":3735,"children":3737},{"className":3736},[],[3738],{"type":46,"value":3704},{"type":46,"value":198},{"type":41,"tag":74,"props":3741,"children":3743},{"className":3742},[],[3744],{"type":46,"value":3745},"--kinds",{"type":46,"value":198},{"type":41,"tag":74,"props":3748,"children":3750},{"className":3749},[],[3751],{"type":46,"value":3752},"--platform",{"type":46,"value":198},{"type":41,"tag":74,"props":3755,"children":3757},{"className":3756},[],[3758],{"type":46,"value":3759},"--deploy-mode",{"type":46,"value":611},{"type":41,"tag":74,"props":3762,"children":3764},{"className":3763},[],[3765],{"type":46,"value":1420},{"type":46,"value":116},{"type":41,"tag":70,"props":3768,"children":3769},{},[3770,3771,3775],{"type":46,"value":2973},{"type":41,"tag":58,"props":3772,"children":3773},{},[3774],{"type":46,"value":1154},{"type":46,"value":3776}," push DEV\u002FQA\u002FPROD deploy workflows with placeholder\nBuild\u002FDeploy steps or missing OIDC variables; generate PR-only first.",{"type":41,"tag":70,"props":3778,"children":3779},{},[3780,3781,3785],{"type":46,"value":2973},{"type":41,"tag":58,"props":3782,"children":3783},{},[3784],{"type":46,"value":1154},{"type":46,"value":3786}," create parallel workflow files. Prefer editing the\ngenerated ones.",{"type":41,"tag":70,"props":3788,"children":3789},{},[3790,3791,3795,3797,3803],{"type":46,"value":2973},{"type":41,"tag":58,"props":3792,"children":3793},{},[3794],{"type":46,"value":1154},{"type":46,"value":3796}," auto-fill app\u002Finfrastructure deployment with raw Azure CLI\nsteps that bypass azd. AgentOps gates; azd provisions and deploys. For\nFoundry prompt agents, use ",{"type":41,"tag":74,"props":3798,"children":3800},{"className":3799},[],[3801],{"type":46,"value":3802},"--deploy-mode prompt-agent",{"type":46,"value":3804}," so the workflow\ncalls the Foundry SDK and evaluates the candidate version before marking\nit deployed.",{"type":41,"tag":70,"props":3806,"children":3807},{},[3808,3809,3813,3815,3820],{"type":46,"value":2973},{"type":41,"tag":58,"props":3810,"children":3811},{},[3812],{"type":46,"value":1154},{"type":46,"value":3814}," use AgentOps workflows to create or deploy Foundry Hosted Agents.\nUse Foundry Toolkit \u002F the ",{"type":41,"tag":74,"props":3816,"children":3818},{"className":3817},[],[3819],{"type":46,"value":212},{"type":46,"value":3821}," skill \u002F the app's azd path,\nthen point AgentOps at the deployed URL for gates and evidence.",{"type":41,"tag":70,"props":3823,"children":3824},{},[3825,3827,3833,3834,3840,3841,3847,3848,3854],{"type":46,"value":3826},"The four workflow names (",{"type":41,"tag":74,"props":3828,"children":3830},{"className":3829},[],[3831],{"type":46,"value":3832},"agentops-pr",{"type":46,"value":198},{"type":41,"tag":74,"props":3835,"children":3837},{"className":3836},[],[3838],{"type":46,"value":3839},"agentops-deploy-dev",{"type":46,"value":838},{"type":41,"tag":74,"props":3842,"children":3844},{"className":3843},[],[3845],{"type":46,"value":3846},"agentops-deploy-qa",{"type":46,"value":198},{"type":41,"tag":74,"props":3849,"children":3851},{"className":3850},[],[3852],{"type":46,"value":3853},"agentops-deploy-prod",{"type":46,"value":3855},") are fixed - don't rename\nthem or branch-protection wiring will break.",{"type":41,"tag":3857,"props":3858,"children":3859},"style",{},[3860],{"type":46,"value":3861},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3863,"total":28},[3864,3884,3897,3910,3920,3935,3948],{"slug":3865,"name":3865,"fn":3866,"description":3867,"org":3868,"tags":3869,"stars":24,"repoUrl":25,"updatedAt":3883},"agentops-agent","diagnose agent performance with AgentOps","AgentOps Doctor - surface release-readiness findings, regressions, latency spikes, error rates, and safety hits across AgentOps eval history, Azure Monitor traces, and Foundry control plane.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3870,3873,3874,3877,3880],{"name":3871,"slug":3872,"type":14},"Agents","agents",{"name":11,"slug":8,"type":14},{"name":3875,"slug":3876,"type":14},"Debugging","debugging",{"name":3878,"slug":3879,"type":14},"Evals","evals",{"name":3881,"slug":3882,"type":14},"Observability","observability","2026-07-12T08:19:05.564606",{"slug":3885,"name":3885,"fn":3886,"description":3887,"org":3888,"tags":3889,"stars":24,"repoUrl":25,"updatedAt":3896},"agentops-config","configure AgentOps release-readiness gates","Generate or update agentops.yaml (flat 1.0 schema) for AgentOps release-readiness gates. Trigger on \"configure agentops\", \"agentops.yaml\", \"set up evaluation\", \"what should I evaluate\". Infer the agent target and dataset from the codebase; ask only when nothing can be found.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3890,3891,3892,3895],{"name":3871,"slug":3872,"type":14},{"name":11,"slug":8,"type":14},{"name":3893,"slug":3894,"type":14},"Configuration","configuration",{"name":3878,"slug":3879,"type":14},"2026-07-12T08:19:06.790378",{"slug":3898,"name":3898,"fn":3899,"description":3900,"org":3901,"tags":3902,"stars":24,"repoUrl":25,"updatedAt":3909},"agentops-dataset","create datasets for AgentOps release readiness","Create or extend a small JSONL dataset for AgentOps release-readiness gates. Trigger on \"create dataset\", \"generate test data\", \"JSONL\", \"more eval rows\". Infer the agent's domain from the codebase and produce realistic rows; never fabricate data when the domain is unclear.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3903,3904,3905,3908],{"name":3871,"slug":3872,"type":14},{"name":11,"slug":8,"type":14},{"name":3906,"slug":3907,"type":14},"Datasets","datasets",{"name":3878,"slug":3879,"type":14},"2026-07-12T08:19:08.00408",{"slug":3911,"name":3911,"fn":3912,"description":3913,"org":3914,"tags":3915,"stars":24,"repoUrl":25,"updatedAt":3919},"agentops-eval","run release-readiness evaluations for agents","Run AgentOps release-readiness evaluations against Foundry prompt agents, Foundry hosted endpoints, HTTP\u002FJSON agents, or raw model deployments. Trigger on phrases like \"run eval\", \"evaluate my agent\", \"benchmark\", \"agentops eval\", \"compare runs\", \"can we ship\". Uses the flat agentops.yaml schema.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3916,3917,3918],{"name":3871,"slug":3872,"type":14},{"name":11,"slug":8,"type":14},{"name":3878,"slug":3879,"type":14},"2026-07-15T06:02:50.097169",{"slug":3921,"name":3921,"fn":3922,"description":3923,"org":3924,"tags":3925,"stars":24,"repoUrl":25,"updatedAt":3934},"agentops-governance","draft governance evidence for AI agents","Scaffold ASSERT and Red Team runners for the release gate, and draft reviewable governance evidence for ASSERT, Agent Control Specification (ACS), Guided Guardrail readiness, and red-team planning. Trigger on \"ASSERT\", \"ACS\", \"agent control\", \"guardrail\", \"red team\", \"governance\", \"release evidence\", \"scaffold assert\", \"set up red team\", \"add safety gate\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3926,3927,3928,3931],{"name":3871,"slug":3872,"type":14},{"name":11,"slug":8,"type":14},{"name":3929,"slug":3930,"type":14},"Compliance","compliance",{"name":3932,"slug":3933,"type":14},"Governance","governance","2026-07-12T08:19:04.026045",{"slug":3936,"name":3936,"fn":3937,"description":3938,"org":3939,"tags":3940,"stars":24,"repoUrl":25,"updatedAt":3947},"agentops-report","generate and explain AgentOps release-gate reports","Read, regenerate, and explain AgentOps release-gate reports. Trigger on \"show report\", \"explain scores\", \"regenerate report\", \"what do these metrics mean\", \"where is the proof\". Operates on results.json and report.md produced by `agentops eval run`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3941,3942,3943,3944],{"name":3871,"slug":3872,"type":14},{"name":11,"slug":8,"type":14},{"name":3881,"slug":3882,"type":14},{"name":3945,"slug":3946,"type":14},"Reporting","reporting","2026-07-12T08:19:09.241071",{"slug":4,"name":4,"fn":5,"description":6,"org":3949,"tags":3950,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3951,3952,3953,3954],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":19,"slug":20,"type":14},{"name":16,"slug":17,"type":14},{"items":3956,"total":4125},[3957,3972,3989,4008,4023,4038,4049,4064,4075,4089,4100,4113],{"slug":3958,"name":3958,"fn":3959,"description":3960,"org":3961,"tags":3962,"stars":3969,"repoUrl":3970,"updatedAt":3971},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3963,3964,3965,3966],{"name":11,"slug":8,"type":14},{"name":3929,"slug":3930,"type":14},{"name":3932,"slug":3933,"type":14},{"name":3967,"slug":3968,"type":14},"Policy","policy",1686,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":3973,"name":3973,"fn":3974,"description":3975,"org":3976,"tags":3977,"stars":3986,"repoUrl":3987,"updatedAt":3988},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3978,3979,3980,3983],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":3981,"slug":3982,"type":14},"Infrastructure as Code","infrastructure-as-code",{"name":3984,"slug":3985,"type":14},"Migration","migration",260,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-07-12T08:17:49.646405",{"slug":3990,"name":3990,"fn":3991,"description":3992,"org":3993,"tags":3994,"stars":4005,"repoUrl":4006,"updatedAt":4007},"apiview-feedback-resolution","resolve APIView feedback on Azure SDKs","Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_typespec_customized_code_update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3995,3998,3999,4002],{"name":3996,"slug":3997,"type":14},"API Development","api-development",{"name":11,"slug":8,"type":14},{"name":4000,"slug":4001,"type":14},"Code Review","code-review",{"name":4003,"slug":4004,"type":14},"Documentation","documentation",133,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-tools","2026-07-12T08:17:43.350876",{"slug":4009,"name":4009,"fn":4010,"description":4011,"org":4012,"tags":4013,"stars":4005,"repoUrl":4006,"updatedAt":4022},"azsdk-common-live-and-recorded-tests","deploy resources and run Azure SDK tests","Deploy test resources and run Azure SDK tests in live, record, or playback mode. WHEN: \"run live tests\", \"run recorded tests\", \"deploy test resources\", \"record tests\", \"run tests in record mode\", \"clean up test resources\", \"run tests against live resources\". DO NOT USE FOR: writing new tests, authoring Bicep templates, playback-only test runs without resource deployment. INVOKES: azure-sdk-mcp:azsdk_package_run_tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4014,4015,4016,4019],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":4017,"slug":4018,"type":14},"SDK","sdk",{"name":4020,"slug":4021,"type":14},"Testing","testing","2026-07-12T08:17:44.718943",{"slug":4024,"name":4024,"fn":4025,"description":4026,"org":4027,"tags":4028,"stars":4005,"repoUrl":4006,"updatedAt":4037},"azsdk-common-prepare-release-plan","manage Azure SDK release plan work items","Create, get, update, abandon, and link SDK PRs to release plan work items for Azure SDK releases. **UTILITY SKILL**. USE FOR: \"create release plan\", \"get release plan\", \"update release plan\", \"update API spec in release plan\", \"update SDK details in release plan\", \"abandon release plan\", \"link SDK PR to plan\", \"namespace approval\", \"check release plan status\". DO NOT USE FOR: SDK code generation, pipeline troubleshooting, API review feedback. INVOKES: azure-sdk-mcp:azsdk_create_release_plan, azure-sdk-mcp:azsdk_get_release_plan, azure-sdk-mcp:azsdk_get_release_plan_for_spec_pr, azure-sdk-mcp:azsdk_update_release_plan, azure-sdk-mcp:azsdk_update_api_spec_pull_request_in_release_plan, azure-sdk-mcp:azsdk_update_sdk_details_in_release_plan, azure-sdk-mcp:azsdk_abandon_release_plan, azure-sdk-mcp:azsdk_link_sdk_pull_request_to_release_plan, azure-sdk-mcp:azsdk_link_namespace_approval_issue.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4029,4030,4033,4036],{"name":11,"slug":8,"type":14},{"name":4031,"slug":4032,"type":14},"GitHub","github",{"name":4034,"slug":4035,"type":14},"Project Management","project-management",{"name":4017,"slug":4018,"type":14},"2026-07-12T08:17:38.345387",{"slug":4039,"name":4039,"fn":4040,"description":4041,"org":4042,"tags":4043,"stars":4005,"repoUrl":4006,"updatedAt":4048},"azsdk-common-sdk-release","release Azure SDK packages","Check release readiness and trigger the release pipeline for Azure SDK packages. **UTILITY SKILL**. USE FOR: \"release SDK\", \"trigger release\", \"check release readiness\", \"release pipeline\", \"publish package\", \"ship SDK\". DO NOT USE FOR: SDK development, code generation, pipeline debugging, release plan creation. INVOKES: azure-sdk-mcp:azsdk_release_sdk.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4044,4045,4046,4047],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":19,"slug":20,"type":14},{"name":4017,"slug":4018,"type":14},"2026-07-12T08:17:34.27607",{"slug":4050,"name":4050,"fn":4051,"description":4052,"org":4053,"tags":4054,"stars":4005,"repoUrl":4006,"updatedAt":4063},"azure-typespec-author","author and modify Azure TypeSpec API specifications","Authors and modifies Azure TypeSpec (.tsp) API specifications. USE FOR: any TypeSpec\u002Ftsp change — api versions (add, bump, preview, stable, promote), resources, operations, models, properties, decorators, visibility, constraints, breaking changes, LRO, suppressions, operationId, spread model. Covers ARM resource-manager and data-plane services. DO NOT USE FOR: SDK generation, releasing SDK packages, or single MCP tool calls. INVOKES: azure-sdk-mcp:azsdk_typespec_generate_authoring_plan, azure-sdk-mcp:azsdk_run_typespec_validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4055,4056,4057,4060],{"name":3996,"slug":3997,"type":14},{"name":11,"slug":8,"type":14},{"name":4058,"slug":4059,"type":14},"OpenAPI","openapi",{"name":4061,"slug":4062,"type":14},"Technical Writing","technical-writing","2026-07-12T08:17:39.603232",{"slug":4065,"name":4065,"fn":4066,"description":4067,"org":4068,"tags":4069,"stars":4005,"repoUrl":4006,"updatedAt":4074},"generate-sdk-locally","generate and test Azure SDKs locally","Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: \"generate SDK locally\", \"build SDK\", \"run SDK tests\", \"run CI checks\", \"validate package\", \"run checks\", \"update changelog\", \"fix SDK build errors\", \"fix breaking changes\", \"resolve SDK generation errors\", \"customize TypeSpec\", \"rename SDK client\", \"rename SDK model\", \"hide operation from SDK\", \"fix analyzer errors\", \"resolve customization drift\", \"create subclient\", \"update metadata\", \"update version\". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4070,4071,4072,4073],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":4017,"slug":4018,"type":14},{"name":4020,"slug":4021,"type":14},"2026-07-12T08:17:37.08523",{"slug":4076,"name":4076,"fn":4077,"description":4078,"org":4079,"tags":4080,"stars":4005,"repoUrl":4006,"updatedAt":4088},"markdown-token-optimizer","optimize markdown files for token efficiency","Analyze markdown files for token efficiency and reduce context-window bloat. **UTILITY SKILL**. DO NOT USE FOR: code optimization, general file editing, non-markdown files. TRIGGERS: optimize markdown, reduce tokens, token count, token bloat, too many tokens, make concise, shrink file, file too large, optimize for AI, token efficiency, verbose markdown, reduce file size. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4081,4084,4087],{"name":4082,"slug":4083,"type":14},"LLM","llm",{"name":4085,"slug":4086,"type":14},"Performance","performance",{"name":4061,"slug":4062,"type":14},"2026-07-12T08:17:42.080413",{"slug":4090,"name":4090,"fn":4091,"description":4092,"org":4093,"tags":4094,"stars":4005,"repoUrl":4006,"updatedAt":4099},"pipeline-troubleshooting","troubleshoot Azure SDK CI pipelines","Diagnose and resolve failures in Azure SDK CI and generation pipelines. **UTILITY SKILL**. USE FOR: \"pipeline failed\", \"build failure\", \"CI check failing\", \"SDK generation error\", \"reproduce pipeline locally\", \"debug SDK pipeline\". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4095,4096,4097,4098],{"name":11,"slug":8,"type":14},{"name":22,"slug":23,"type":14},{"name":3875,"slug":3876,"type":14},{"name":4017,"slug":4018,"type":14},"2026-07-12T08:17:40.821512",{"slug":4101,"name":4101,"fn":4102,"description":4103,"org":4104,"tags":4105,"stars":4005,"repoUrl":4006,"updatedAt":4112},"sensei","improve skill frontmatter compliance","**WORKFLOW SKILL** — Iteratively improve skill frontmatter compliance using the Ralph loop pattern. WHEN: \"run sensei\", \"sensei help\", \"improve skill\", \"fix frontmatter\", \"skill compliance\", \"frontmatter audit\", \"score skill\", \"check skill tokens\". INVOKES: token counting tools, test runners, git commands. FOR SINGLE OPERATIONS: use token CLI directly for counts\u002Fchecks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4106,4107,4108,4111],{"name":11,"slug":8,"type":14},{"name":3929,"slug":3930,"type":14},{"name":4109,"slug":4110,"type":14},"Process Optimization","process-optimization",{"name":4061,"slug":4062,"type":14},"2026-07-12T08:17:32.970921",{"slug":4114,"name":4114,"fn":4115,"description":4116,"org":4117,"tags":4118,"stars":4005,"repoUrl":4006,"updatedAt":4124},"skill-authoring","author agent skills for agentskills.io","Write Agent Skills that comply with the agentskills.io specification. WHEN: \"create a skill\", \"new skill\", \"write a skill\", \"skill template\", \"skill structure\", \"review skill\", \"skill PR\", \"skill compliance\", \"SKILL.md format\", \"skill frontmatter\", \"skill best practices\". DO NOT USE FOR: improving existing skills (use sensei), general documentation. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4119,4120,4123],{"name":4003,"slug":4004,"type":14},{"name":4121,"slug":4122,"type":14},"Plugin Development","plugin-development",{"name":4061,"slug":4062,"type":14},"2026-07-12T08:17:35.873862",109]