From 8d83005cbed47fca444628e6dfd1e1d7e86ee068 Mon Sep 17 00:00:00 2001 From: Paulo Lacerda Date: Wed, 7 Oct 2026 21:39:04 -0300 Subject: [PATCH 1/9] =?UTF-8?q?Ajustes=20documenta=C3=A7=C3=A3o=20Agent=20?= =?UTF-8?q?Landing=20Zone?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .azure/deployment-plan.md | 20 ++++++------- .github/agents/architecture.agent.md | 4 +-- .github/agents/implementation.agent.md | 4 +-- .github/copilot-instructions.md | 4 +-- .../instructions/deployment.instructions.md | 2 +- .github/skills/architecture-decision/SKILL.md | 4 +-- .../references/adr-template.md | 2 +- .../skills/documentation-consistency/SKILL.md | 6 ++-- .../skills/engineering-principles/SKILL.md | 4 +-- .../references/orchestrator-architecture.md | 8 +++--- .github/skills/orchestrator-release/SKILL.md | 4 +-- .github/skills/release/SKILL.md | 2 +- AGENTS.md | 14 +++++----- README.md | 28 +++++++++---------- docs/pull_request_template.md | 8 +++--- evaluations/README.md | 2 +- frontend/index.html | 2 +- frontend/src/App.tsx | 4 +-- pyproject.toml | 2 +- scripts/deploy.ps1 | 2 +- scripts/preProvision.ps1 | 2 +- scripts/preProvision.sh | 2 +- src/api/config_settings.py | 12 ++++---- src/api/hosted_entrypoint.py | 2 +- src/connectors/appconfig.py | 2 +- src/connectors/foundry_iq.py | 18 ++++++------ src/connectors/search.py | 4 +-- src/main.py | 8 +++--- src/strategies/agent_provider_v2.py | 2 +- src/strategies/context_shaping.py | 2 +- src/strategies/foundry_iq_context_provider.py | 4 +-- src/strategies/hosted_strategies.py | 2 +- src/strategies/multimodal_strategy.py | 2 +- .../single_agent_rag_strategy_v2.py | 2 +- src/util/blob_sas.py | 4 +-- src/util/foundry_platform.py | 2 +- src/util/metadata.py | 4 +-- src/util/retrieval_backend.py | 2 +- 38 files changed, 101 insertions(+), 101 deletions(-) diff --git a/.azure/deployment-plan.md b/.azure/deployment-plan.md index 56af32f8..703fda7a 100644 --- a/.azure/deployment-plan.md +++ b/.azure/deployment-plan.md @@ -27,16 +27,16 @@ This plan does not authorize deployment, merge, release, deletion, or Azure/Entr ## Workspace analysis -- Repository: `Azure/gpt-rag-orchestrator` +- Repository: `Azure/agent-app-orchestrator` - Branch: `feature/dashboard-msal-signin` -- PR: `Azure/gpt-rag-orchestrator#260` +- PR: `Azure/agent-app-orchestrator#260` - Base branch: `develop` - Application: Python 3.12 FastAPI orchestrator with a Vite/React admin dashboard served from `/dashboard/`. - Deployment artifacts already present: - `Dockerfile` builds the dashboard bundle in a Node 20 stage and copies it into the Python runtime image. - - `azure.yaml` exists and points to azd hooks/scripts, but this repository does not carry standalone `infra/` files. Full GPT-RAG environment creation is owned by the main GPT-RAG infrastructure repository. + - `azure.yaml` exists and points to azd hooks/scripts, but this repository does not carry standalone `infra/` files. Full Agent Landing Zone environment creation is owned by the main Agent Landing Zone infrastructure repository. - Preparation mode: MODIFY existing application and validate a PR image against a real tenant. -- Recipe: use existing GPT-RAG deployment flow for environment provisioning, then deploy the orchestrator container image/revision from this branch. If no reusable environment exists, recreate a controlled validation environment from the main GPT-RAG infrastructure instead of modifying unrelated resource groups. +- Recipe: use existing Agent Landing Zone deployment flow for environment provisioning, then deploy the orchestrator container image/revision from this branch. If no reusable environment exists, recreate a controlled validation environment from the main Agent Landing Zone infrastructure instead of modifying unrelated resource groups. ## Current environment inventory @@ -45,7 +45,7 @@ The previously planned resource group `rg-gptrag-546val` is not present in subsc - `az group show --name rg-gptrag-546val` returned `ResourceGroupNotFound`. - No matching Container Apps or App Configuration stores were found by read-only resource listing in this subscription. -Candidate GPT-RAG resource groups found in the subscription: +Candidate Agent Landing Zone resource groups found in the subscription: | Resource group | Location | Tags | Read-only finding | | --- | --- | --- | --- | @@ -57,8 +57,8 @@ Candidate GPT-RAG resource groups found in the subscription: Conclusion: do not assume the old validation environment is available. Validation should either: -1. Recreate a new exact validation environment, for example `rg-gptrag-546val2`, from the main GPT-RAG infrastructure, or -2. Use a user-approved existing environment only after confirming it has the orchestrator Container App, ACR, App Configuration, managed identity, Cosmos, and required GPT-RAG dependencies. +1. Recreate a new exact validation environment, for example `rg-gptrag-546val2`, from the main Agent Landing Zone infrastructure, or +2. Use a user-approved existing environment only after confirming it has the orchestrator Container App, ACR, App Configuration, managed identity, Cosmos, and required Agent Landing Zone dependencies. ## Entra application inventory @@ -104,7 +104,7 @@ Restart or create a new Container App revision after changing `ENABLE_DASHBOARD` ## Validation deployment approach 1. Confirm the target environment choice with Paulo: - - Recreate a new validation environment from GPT-RAG infrastructure, or + - Recreate a new validation environment from Agent Landing Zone infrastructure, or - Use an existing complete environment after read-only inventory confirms it is safe. 2. Build an orchestrator image from the rebased PR branch. 3. Push the image to the environment ACR. @@ -176,9 +176,9 @@ README dashboard guidance now explains: 1. Complete Azure E2E validation and record results in PR #260. 2. Mark PR #260 ready for review if validation passes. 3. Merge PR #260 into `develop`. -4. Prepare the next `Azure/gpt-rag-orchestrator` release branch from `develop`, following this repository's `AGENTS.md` release rules. +4. Prepare the next `Azure/agent-app-orchestrator` release branch from `develop`, following this repository's `AGENTS.md` release rules. 5. Tag and publish the orchestrator release with the GitHub Release title exactly equal to the tag, for example `vX.Y.Z`. -6. If the parent `Azure/gpt-rag` repository pins or consumes the orchestrator version, update it in a follow-up PR/release after the orchestrator release is available. +6. If the parent `Azure/agent-landing-zone` repository pins or consumes the orchestrator version, update it in a follow-up PR/release after the orchestrator release is available. ## Planning checklist diff --git a/.github/agents/architecture.agent.md b/.github/agents/architecture.agent.md index 0d0f1b16..c1c2f92f 100644 --- a/.github/agents/architecture.agent.md +++ b/.github/agents/architecture.agent.md @@ -1,10 +1,10 @@ --- name: architecture -description: Analyzes GPT-RAG Orchestrator boundaries, runtime strategy contracts, Azure security, deployment, and trade-offs. Use for structural or hard-to-reverse changes; do not use for local implementation with settled requirements. +description: Analyzes Agent Landing Zone Orchestrator boundaries, runtime strategy contracts, Azure security, deployment, and trade-offs. Use for structural or hard-to-reverse changes; do not use for local implementation with settled requirements. tools: ["read", "search", "edit"] --- -# GPT-RAG Orchestrator architecture +# Agent Landing Zone Orchestrator architecture Follow `AGENTS.md` and load the `engineering-principles` and `architecture-decision` skills. diff --git a/.github/agents/implementation.agent.md b/.github/agents/implementation.agent.md index 4d6631e1..20fbe3fa 100644 --- a/.github/agents/implementation.agent.md +++ b/.github/agents/implementation.agent.md @@ -1,10 +1,10 @@ --- name: implementation -description: Implements, tests, and documents scoped GPT-RAG Orchestrator changes after requirements are clear. Do not use to decide broad architecture or publish releases. +description: Implements, tests, and documents scoped Agent Landing Zone Orchestrator changes after requirements are clear. Do not use to decide broad architecture or publish releases. tools: ["read", "search", "edit", "execute"] --- -# GPT-RAG Orchestrator implementation +# Agent Landing Zone Orchestrator implementation Follow `AGENTS.md`, `.github/copilot-instructions.md`, and every scoped instruction that applies to the changed files. diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 2c688982..0942fd19 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -1,4 +1,4 @@ -# GPT-RAG Orchestrator engineering core +# Agent Landing Zone Orchestrator engineering core Read `AGENTS.md` and every scoped instruction that applies before changing a file. The assets under `.github/agents/` and `.github/skills/` are GitHub @@ -64,7 +64,7 @@ are in `.github/instructions/release.instructions.md`. Load the ## Documentation consistency -User-facing documentation lives on the `docs` branch of `Azure/GPT-RAG` and +User-facing documentation lives on the `docs` branch of `Azure/agent-landing-zone` and is published at https://azure.github.io/AI-Landing-Zones/agent-landing-zone/. When behavior, a configuration key, a default, deployment, operation, or user diff --git a/.github/instructions/deployment.instructions.md b/.github/instructions/deployment.instructions.md index 8eea5321..553fbabb 100644 --- a/.github/instructions/deployment.instructions.md +++ b/.github/instructions/deployment.instructions.md @@ -8,7 +8,7 @@ applyTo: "scripts/**/*.ps1,scripts/**/*.sh,.azure/**,azure.yaml,Dockerfile,infra - Treat lifecycle ordering, `azd` environment reuse, and environment-variable propagation as public deployment behavior. - Preserve compatibility with the infrastructure provisioned by - `Azure/GPT-RAG`. + `Azure/agent-landing-zone`. - Do not edit generated infrastructure content when an owning source or template exists; change the authoritative input instead. - Quote paths and external input safely. Never echo credentials, tokens, diff --git a/.github/skills/architecture-decision/SKILL.md b/.github/skills/architecture-decision/SKILL.md index 09231aef..a66ea944 100644 --- a/.github/skills/architecture-decision/SKILL.md +++ b/.github/skills/architecture-decision/SKILL.md @@ -1,9 +1,9 @@ --- name: architecture-decision -description: Conducts and records a verifiable GPT-RAG Orchestrator architectural decision. Use when a choice alters runtime strategy boundaries, contracts, identity, data, deployment, or operation with meaningful reversal cost. +description: Conducts and records a verifiable Agent Landing Zone Orchestrator architectural decision. Use when a choice alters runtime strategy boundaries, contracts, identity, data, deployment, or operation with meaningful reversal cost. --- -# GPT-RAG Orchestrator architectural decision +# Agent Landing Zone Orchestrator architectural decision 1. Load the relevant `engineering-principles` references. 2. Define the user or operator outcome, constraints, affected repositories, diff --git a/.github/skills/architecture-decision/references/adr-template.md b/.github/skills/architecture-decision/references/adr-template.md index d5f7785e..b8bb68f4 100644 --- a/.github/skills/architecture-decision/references/adr-template.md +++ b/.github/skills/architecture-decision/references/adr-template.md @@ -62,7 +62,7 @@ fitness functions.] ## Documentation impact -[README and pages on the `Azure/GPT-RAG` docs branch that must change.] +[README and pages on the `Azure/agent-landing-zone` docs branch that must change.] ## Review trigger diff --git a/.github/skills/documentation-consistency/SKILL.md b/.github/skills/documentation-consistency/SKILL.md index 23dab42b..cd291b85 100644 --- a/.github/skills/documentation-consistency/SKILL.md +++ b/.github/skills/documentation-consistency/SKILL.md @@ -1,11 +1,11 @@ --- name: documentation-consistency -description: Keeps GPT-RAG Orchestrator user and operator documentation aligned with shipped behavior. Use for runtime strategies, APIs, configuration keys, deployment, defaults, operations, or breaking changes. +description: Keeps Agent Landing Zone Orchestrator user and operator documentation aligned with shipped behavior. Use for runtime strategies, APIs, configuration keys, deployment, defaults, operations, or breaking changes. --- -# GPT-RAG Orchestrator documentation consistency +# Agent Landing Zone Orchestrator documentation consistency -User-facing documentation lives on the `docs` branch of `Azure/GPT-RAG` and +User-facing documentation lives on the `docs` branch of `Azure/agent-landing-zone` and is published at https://azure.github.io/AI-Landing-Zones/agent-landing-zone/. 1. Identify the user or operator behavior that changed. diff --git a/.github/skills/engineering-principles/SKILL.md b/.github/skills/engineering-principles/SKILL.md index 937f2413..1ceeeada 100644 --- a/.github/skills/engineering-principles/SKILL.md +++ b/.github/skills/engineering-principles/SKILL.md @@ -1,9 +1,9 @@ --- name: engineering-principles -description: GPT-RAG Orchestrator architecture and implementation principles. Use for design, review, meaningful refactoring, runtime strategies, FastAPI, Azure integration, security, testing, or operations. +description: Agent Landing Zone Orchestrator architecture and implementation principles. Use for design, review, meaningful refactoring, runtime strategies, FastAPI, Azure integration, security, testing, or operations. --- -# GPT-RAG Orchestrator engineering principles +# Agent Landing Zone Orchestrator engineering principles Load only the references needed for the task: diff --git a/.github/skills/engineering-principles/references/orchestrator-architecture.md b/.github/skills/engineering-principles/references/orchestrator-architecture.md index 7b12d798..2005a32e 100644 --- a/.github/skills/engineering-principles/references/orchestrator-architecture.md +++ b/.github/skills/engineering-principles/references/orchestrator-architecture.md @@ -1,9 +1,9 @@ -# GPT-RAG Orchestrator architecture +# Agent Landing Zone Orchestrator architecture ## Purpose and runtime flow -GPT-RAG Orchestrator is the Python 3.12 FastAPI runtime component of the -GPT-RAG solution. At a high level it: +Agent Landing Zone Orchestrator is the Python 3.12 FastAPI runtime component of the +Agent Landing Zone solution. At a high level it: 1. validates the HTTP request and identity; 2. creates an `Orchestrator` for the conversation; @@ -59,4 +59,4 @@ implicit dictionaries or duplicated configuration knowledge. - Read API behavior from FastAPI routes and Pydantic schemas. - Read audit semantics from `contracts/` and their tests. - Read release state from `VERSION` and `CHANGELOG.md`. -- Read user-facing product documentation from the `Azure/GPT-RAG` docs branch. +- Read user-facing product documentation from the `Azure/agent-landing-zone` docs branch. diff --git a/.github/skills/orchestrator-release/SKILL.md b/.github/skills/orchestrator-release/SKILL.md index 6bd2a6b8..42bed2ea 100644 --- a/.github/skills/orchestrator-release/SKILL.md +++ b/.github/skills/orchestrator-release/SKILL.md @@ -1,9 +1,9 @@ --- name: orchestrator-release -description: Prepares and validates GPT-RAG Orchestrator releases. Use for VERSION, changelog entries, release branches, tags, GitHub Release notes, and synchronized develop follow-up. +description: Prepares and validates Agent Landing Zone Orchestrator releases. Use for VERSION, changelog entries, release branches, tags, GitHub Release notes, and synchronized develop follow-up. --- -# GPT-RAG Orchestrator release +# Agent Landing Zone Orchestrator release Read `.github/copilot-instructions.md` and `.github/instructions/release.instructions.md` completely before changing a diff --git a/.github/skills/release/SKILL.md b/.github/skills/release/SKILL.md index 8b3d5fa1..e325970b 100644 --- a/.github/skills/release/SKILL.md +++ b/.github/skills/release/SKILL.md @@ -1,6 +1,6 @@ --- name: release -description: Prepare and reconcile GPT-RAG Orchestrator releases, including authoritative version discovery, semantic version selection, release branches, VERSION and CHANGELOG updates, release notes, tags, GitHub Releases, and publication approval gates. Use when asked to prepare, version, tag, publish, roll back, or reconcile a release. +description: Prepare and reconcile Agent Landing Zone Orchestrator releases, including authoritative version discovery, semantic version selection, release branches, VERSION and CHANGELOG updates, release notes, tags, GitHub Releases, and publication approval gates. Use when asked to prepare, version, tag, publish, roll back, or reconcile a release. --- # Release diff --git a/AGENTS.md b/AGENTS.md index 7f8537f2..398c1823 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,4 +1,4 @@ -# GPT-RAG Orchestrator engineering-agent contract +# Agent Landing Zone Orchestrator engineering-agent contract This is the stable repository-wide contract for GitHub Copilot engineering agents. Detailed procedures belong in `.github/skills/`, and file-specific @@ -27,7 +27,7 @@ human decision when the missing information cannot be established safely. ## What this repository is -GPT-RAG Orchestrator is the Python 3.12 FastAPI service in the GPT-RAG +Agent Landing Zone Orchestrator is the Python 3.12 FastAPI service in the Agent Landing Zone solution. It accepts authenticated or anonymous orchestration requests, selects a configured runtime strategy, streams responses over SSE, persists conversation state in Cosmos DB, retrieves grounding from Azure AI Search or @@ -42,7 +42,7 @@ Configuration is loaded with service-specific and shared labels, and secrets are resolved through Key Vault references. This component participates in a multi-repository solution. User-facing -product documentation lives on the `docs` branch of `Azure/GPT-RAG` and is +product documentation lives on the `docs` branch of `Azure/agent-landing-zone` and is published at https://azure.github.io/AI-Landing-Zones/agent-landing-zone/. ## Repository boundaries @@ -132,7 +132,7 @@ instructions before meaningful changes in these areas. ### Python quality policy (bootstrap under review) -The quality bootstrap for Azure/GPT-RAG#681 is not an activated merge rule. +The quality bootstrap for Azure/agent-landing-zone#681 is not an activated merge rule. Use Python 3.12 and an isolated environment: ```powershell @@ -450,8 +450,8 @@ This component remains compatible by contract with UI `v2.6.2` and ingestion `v2.7.3`; no wire/audit/auth/configuration migration is introduced. Live Azure compatibility and recovery are separate, unperformed acceptance steps. Recovery is the preceding orchestrator artifact (shipped `v4.1.1`), without -data migration or peer changes. Coordination is Azure/GPT-RAG#689; published -contributor documentation is being coordinated in Azure/GPT-RAG#688 on `docs`. +data migration or peer changes. Coordination is Azure/agent-landing-zone#689; published +contributor documentation is being coordinated in Azure/agent-landing-zone#688 on `docs`. - Discover existing commands from `pyproject.toml`, package manifests, and workflows; do not invent validation commands. @@ -489,7 +489,7 @@ The repository-specific rules in `.github/copilot-instructions.md` and Release titles follow the repository's exact version rules; - `[Unreleased]` exists only on `develop`, never on a release branch or `main`; -- user-visible changes update the published GPT-RAG documentation in the same +- user-visible changes update the published Agent Landing Zone documentation in the same coordinated change. Load `orchestrator-release` for release work and diff --git a/README.md b/README.md index dc66526e..d2f15012 100644 --- a/README.md +++ b/README.md @@ -9,15 +9,15 @@ products: - azure-ai-foundry - azure-openai - azure-ai-search -urlFragment: GPT-RAG +urlFragment: agent-app-orchestrator name: Multi-repo ChatGPT and Enterprise data with Azure OpenAI and AI Search -description: GPT-RAG core is a Retrieval-Augmented Generation pattern running in Azure, using Azure AI Search for retrieval and Azure OpenAI large language models to power ChatGPT-style and Q&A experiences. +description: Agent Landing Zone core is a Retrieval-Augmented Generation pattern running in Azure, using Azure AI Search for retrieval and Azure OpenAI large language models to power ChatGPT-style and Q&A experiences. --> -# GPT-RAG Orchestrator +# Agent Landing Zone Orchestrator -Part of the [GPT-RAG](https://github.com/Azure/gpt-rag) solution. +Part of the [Agent Landing Zone](https://github.com/Azure/agent-landing-zone) solution. -The **GPT-RAG Orchestrator** service is an agentic orchestration layer built on Azure AI Foundry Agent Service and the Microsoft Agent Framework. It enables agent-based RAG workflows by coordinating multiple specialized agents—each with a defined role—to collaboratively generate accurate, context-aware responses for complex user queries. +The **Agent Landing Zone Orchestrator** service is an agentic orchestration layer built on Azure AI Foundry Agent Service and the Microsoft Agent Framework. It enables agent-based RAG workflows by coordinating multiple specialized agents—each with a defined role—to collaboratively generate accurate, context-aware responses for complex user queries. ### Available Strategies @@ -83,7 +83,7 @@ When the orchestrator runs as a Microsoft Foundry hosted agent (`api.hosted_entrypoint`, canonical `POST /responses`) with `AGENT_STRATEGY=mcp`, document-security identity is established solely through the Foundry hosted-agent protocol 2.0 call context — per -[Azure/GPT-RAG ADR-0001](https://github.com/Azure/GPT-RAG/blob/main/docs/adr/ADR-0001-hosted-agents.md), +[Azure/agent-landing-zone ADR-0001](https://github.com/Azure/agent-landing-zone/blob/main/docs/adr/ADR-0001-hosted-agents.md), Toolbox OAuth identity passthrough is the required native path and a manual group-filter fallback is never the default. @@ -348,7 +348,7 @@ Work IQ is opt-in and off by default: - ACL is enforced natively by Microsoft 365 via the forwarded user token — no `filterAddOn` is emitted for Work IQ. - Remote kinds can take 40–60 seconds end-to-end; set `FOUNDRY_IQ_MAX_RUNTIME_SECONDS` (default `120`) to control the retrieve runtime ceiling. The value is only emitted when a remote kind is enabled, so Pattern A / Pattern B requests stay byte-identical. -Work IQ is currently a gated preview and requires admin consent plus a Work IQ knowledge source provisioned on the same Azure AI Search service. See the enablement guide in the [Azure/GPT-RAG](https://github.com/Azure/GPT-RAG) repo for the end-to-end setup ([issue #543](https://github.com/Azure/GPT-RAG/issues/543)). +Work IQ is currently a gated preview and requires admin consent plus a Work IQ knowledge source provisioned on the same Azure AI Search service. See the enablement guide in the [Azure/agent-landing-zone](https://github.com/Azure/agent-landing-zone) repo for the end-to-end setup ([issue #543](https://github.com/Azure/agent-landing-zone/issues/543)). #### Generic MCP Server knowledge sources (Preview) @@ -425,7 +425,7 @@ and sends no header. MCP retrieval also validates configuration stops retrieval instead of skipping a source. Track cross-repository provisioning and canonical documentation work in -[Azure/gpt-rag#567](https://github.com/Azure/GPT-RAG/issues/567). +[Azure/agent-landing-zone#567](https://github.com/Azure/agent-landing-zone/issues/567). ## Documentation @@ -479,7 +479,7 @@ The dev server proxies `/api` to `http://localhost:9000`, which is where the orc ## Prerequisites -Before deploying the application, you must provision the infrastructure as described in the [GPT-RAG](https://github.com/azure/gpt-rag) repo. This includes creating all necessary Azure resources required to support the application runtime. +Before deploying the application, you must provision the infrastructure as described in the [Agent Landing Zone](https://github.com/Azure/agent-landing-zone) repo. This includes creating all necessary Azure resources required to support the application runtime.
Click to view software prerequisites @@ -506,7 +506,7 @@ az login Initialize the template: ```shell -azd init -t azure/gpt-rag-orchestrator +azd init -t Azure/agent-app-orchestrator ``` > [!IMPORTANT] > Use the **same environment name** with `azd init` as in the infrastructure deployment to keep components consistent. @@ -528,15 +528,15 @@ To deploy using a script, first clone the repository, set the App Configuration ##### PowerShell (Windows) ```powershell -git clone https://github.com/Azure/gpt-rag-orchestrator.git +git clone https://github.com/Azure/agent-app-orchestrator.git $env:APP_CONFIG_ENDPOINT = "https://.azconfig.io" -cd gpt-rag-orchestrator +cd agent-app-orchestrator .\scripts\deploy.ps1 ``` ## Found an Issue? -Encountered an error or bug? Help us improve the quality of this accelerator by reporting issues or suggesting enhancements on our **[GitHub Issues page](https://github.com/Azure/GPT-RAG/issues)**. Your feedback helps make GPT-RAG better for everyone! +Encountered an error or bug? Help us improve the quality of this accelerator by reporting issues or suggesting enhancements on our **[GitHub Issues page](https://github.com/Azure/agent-landing-zone/issues)**. Your feedback helps make Agent Landing Zone better for everyone! ## Previous Releases @@ -545,7 +545,7 @@ Encountered an error or bug? Help us improve the quality of this accelerator by ## 🤝 Contributing -We appreciate contributions! See [CONTRIBUTING](https://github.com/Azure/gpt-rag/blob/main/CONTRIBUTING.md) for guidelines on submitting pull requests. +We appreciate contributions! See [CONTRIBUTING](https://github.com/Azure/agent-landing-zone/blob/main/CONTRIBUTING.md) for guidelines on submitting pull requests. ## Trademarks diff --git a/docs/pull_request_template.md b/docs/pull_request_template.md index dc8b45f9..4fd51402 100644 --- a/docs/pull_request_template.md +++ b/docs/pull_request_template.md @@ -34,10 +34,10 @@ If deploying this change could impact existing applications, please specify. If this change depends on pull requests in other repositories within the solution, provide the links below. -- [ ] [gpt-rag](https://github.com/azure/gpt-rag) -- [ ] [gpt-rag-orchestrator](https://github.com/azure/gpt-rag-orchestrator) -- [ ] [gpt-rag-ingestion](https://github.com/azure/gpt-rag-ingestion) -- [ ] [gpt-rag-ui](https://github.com/azure/gpt-rag-ui) +- [ ] [gpt-rag](https://github.com/Azure/agent-landing-zone) +- [ ] [agent-app-orchestrator](https://github.com/Azure/agent-app-orchestrator) +- [ ] [agent-app-ingestion](https://github.com/Azure/agent-app-ingestion) +- [ ] [agent-app-ui](https://github.com/Azure/agent-app-ui) ## Does this require changes to project documentation? diff --git a/evaluations/README.md b/evaluations/README.md index 043a4145..7c58e713 100644 --- a/evaluations/README.md +++ b/evaluations/README.md @@ -1,7 +1,7 @@ # Evaluations (deprecated) The standalone evaluation scripts that used to live in this folder have been -removed. Evaluation for GPT-RAG agents now runs through the AgentOps Accelerator, +removed. Evaluation for Agent Landing Zone agents now runs through the AgentOps Accelerator, which scores the live orchestrator endpoint with Foundry's built-in evaluators and turns the result into a pull request gate. diff --git a/frontend/index.html b/frontend/index.html index 4b364945..eb7f0ec9 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -4,7 +4,7 @@ - GPT-RAG Orchestrator + Agent Landing Zone Orchestrator
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx index f90dac6d..bbe6fe5e 100644 --- a/frontend/src/App.tsx +++ b/frontend/src/App.tsx @@ -78,9 +78,9 @@ function Dashboard({ authConfig }: { authConfig: AuthConfig }) {
- GPT-RAG + Agent Landing Zone
-

GPT-RAG Orchestrator

+

Agent Landing Zone Orchestrator

{version && ( v{version} )} diff --git a/pyproject.toml b/pyproject.toml index 2735da4a..57b27653 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,7 +1,7 @@ [project] name = "gpt-rag-orchestrator" version = "0.1.0" -description = "GPT-RAG Orchestrator" +description = "Agent Landing Zone Orchestrator" requires-python = ">=3.12" dependencies = [ # Agent framework diff --git a/scripts/deploy.ps1 b/scripts/deploy.ps1 index 891ec6ac..4f9a3a6a 100755 --- a/scripts/deploy.ps1 +++ b/scripts/deploy.ps1 @@ -1,6 +1,6 @@ <# .SYNOPSIS - Deploys the GPT-RAG orchestrator Container App image. + Deploys the Agent Landing Zone orchestrator Container App image. #> $utf8NoBom = [System.Text.UTF8Encoding]::new($false) diff --git a/scripts/preProvision.ps1 b/scripts/preProvision.ps1 index 016c9694..5c1ec097 100755 --- a/scripts/preProvision.ps1 +++ b/scripts/preProvision.ps1 @@ -1,7 +1,7 @@ Write-Host "" Write-Host "------------- NOTE -------------" Write-Host "azd provision and azd up are not allowed for this project." -Write-Host "Infrastructure is defined in https://github.com/Azure/GPT-RAG." +Write-Host "Infrastructure is defined in https://github.com/Azure/agent-landing-zone." Write-Host "After deploying infrastructure, run azd env refresh with the same environment name, subscription and location." Write-Host "Then run azd deploy" diff --git a/scripts/preProvision.sh b/scripts/preProvision.sh index 8079c591..24563c17 100755 --- a/scripts/preProvision.sh +++ b/scripts/preProvision.sh @@ -6,7 +6,7 @@ NC='\033[0m' # No Color echo "" echo "------------- NOTE -------------" echo "azd provision and azd up are ${YELLOW}not allowed${NC} for this project." -echo "Infrastructure is defined in https://github.com/Azure/GPT-RAG." +echo "Infrastructure is defined in https://github.com/Azure/agent-landing-zone." echo "After deploying infrastructure, run ${BLUE}azd env refresh${NC} with the same environment name, subscription and location." echo "Then run ${BLUE}azd deploy${NC}" diff --git a/src/api/config_settings.py b/src/api/config_settings.py index 292238e5..84cd85d3 100644 --- a/src/api/config_settings.py +++ b/src/api/config_settings.py @@ -158,7 +158,7 @@ class SettingSection: SettingOption( "searchIndex", "Existing Azure AI Search index", - "Legacy Pattern B: register the GPT-RAG generated search index and optionally apply filterAddOn.", + "Legacy Pattern B: register the Agent Landing Zone generated search index and optionally apply filterAddOn.", ), SettingOption( "workIQ", @@ -335,7 +335,7 @@ class SettingSection: description=( "Knowledge source to target when RETRIEVAL_BACKEND=foundry_iq. " "By default this is the native Blob/ADLS source created by the " - "deployment. For Pattern B, set it to the registered GPT-RAG " + "deployment. For Pattern B, set it to the registered Agent Landing Zone " "Azure AI Search index knowledge source." ), ), @@ -358,7 +358,7 @@ class SettingSection: label="Enable Pattern B filterAddOn", description=( "When enabled, Foundry IQ retrieve requests add a " - "filterAddOn OData expression for GPT-RAG custom security " + "filterAddOn OData expression for Agent Landing Zone custom security " "fields. This is distinct from x-ms-query-source-authorization, " "which is used for native Foundry IQ permission-aware sources." ), @@ -370,8 +370,8 @@ class SettingSection: label="Pattern B security field", description=( "Collection field used by the registered Azure AI Search " - "index for GPT-RAG security trimming. Keep the default for " - "standard GPT-RAG indexes." + "index for Agent Landing Zone security trimming. Keep the default for " + "standard Agent Landing Zone indexes." ), ), SettingSpec( @@ -395,7 +395,7 @@ class SettingSection: description=( "When RETRIEVAL_BACKEND=foundry_iq and the primary knowledge " "source is the native azureBlob corpus, also query a second " - "searchIndex source built over the existing GPT-RAG index so " + "searchIndex source built over the existing Agent Landing Zone index so " "files uploaded in the chat UI are grounded alongside the " "shared corpus. The upload source is trimmed by a " "conversationId plus caller-ownership filterAddOn, so " diff --git a/src/api/hosted_entrypoint.py b/src/api/hosted_entrypoint.py index 75faa9b2..a0751300 100644 --- a/src/api/hosted_entrypoint.py +++ b/src/api/hosted_entrypoint.py @@ -359,7 +359,7 @@ async def _create_hosted_streaming_response( raise HTTPException(status_code=422, detail=str(exc)) from exc # Toolbox-integrated strategies must carry a validated, platform-injected - # call id (ADR-0001, Azure/GPT-RAG#591). Never trust Authorization, + # call id (ADR-0001, Azure/agent-landing-zone#591). Never trust Authorization, # caller/model identity fields, or x-client group claims here. foundry_call_id: Optional[str] = None if strategy_key in HOSTED_TOOLBOX_STRATEGIES: diff --git a/src/connectors/appconfig.py b/src/connectors/appconfig.py index c0cd7e94..1c32f836 100644 --- a/src/connectors/appconfig.py +++ b/src/connectors/appconfig.py @@ -236,7 +236,7 @@ def set_value(self, key: str, value: Any, label: str = "gpt-rag-orchestrator") - write_client.set_configuration_setting(setting) -# Agent Landing Zone (Azure/GPT-RAG#695): only the 'agent-lz' base label is read. +# Agent Landing Zone (Azure/agent-landing-zone#695): only the 'agent-lz' base label is read. AGENTLZ_LABEL = "agent-lz" LOADED_LABELS = ("orchestrator", "gpt-rag-orchestrator", AGENTLZ_LABEL, "") diff --git a/src/connectors/foundry_iq.py b/src/connectors/foundry_iq.py index e16cd857..d96e9418 100644 --- a/src/connectors/foundry_iq.py +++ b/src/connectors/foundry_iq.py @@ -11,13 +11,13 @@ Pattern A vs Pattern B is mostly a *server-side* knowledge base configuration concern: the client always targets the configured knowledge base name. The one query-time difference is Pattern B security-field trimming. When enabled, -GPT-RAG injects a ``filterAddOn`` OData filter under ``knowledgeSourceParams``. +Agent Landing Zone injects a ``filterAddOn`` OData filter under ``knowledgeSourceParams``. That filter is deliberately separate from the native OBO header. The OBO header drives Foundry IQ permission-aware sources such as ADLS Gen2 ACLs, SharePoint, -Purview, OneLake, and Fabric. The Pattern B filter narrows the registered GPT-RAG +Purview, OneLake, and Fabric. The Pattern B filter narrows the registered Agent Landing Zone Azure AI Search index that carries custom security fields. -Introduced for Azure/GPT-RAG#526. Per-user security on the retrieve action is a +Introduced for Azure/agent-landing-zone#526. Per-user security on the retrieve action is a preview capability, so the API version is pinned to a single configurable constant (see :data:`DEFAULT_FOUNDRY_IQ_API_VERSION`). """ @@ -80,7 +80,7 @@ class _FoundryIQRecord(dict[str, str]): # Hybrid file-upload sidecar (Pattern A + UI upload). When enabled, and the # primary knowledge source is the native azureBlob corpus, the retrieve action # also queries a second searchIndex knowledge source built over the existing -# GPT-RAG index (SEARCH_RAG_INDEX_NAME). That second source carries the runtime +# Agent Landing Zone index (SEARCH_RAG_INDEX_NAME). That second source carries the runtime # uploads and is trimmed by a conversationId plus caller-ownership filterAddOn # so uploaded files are only visible to their uploader inside the conversation # that created them. Off by default. @@ -153,7 +153,7 @@ class _FoundryIQRecord(dict[str, str]): # the remote kinds (workIQ / fabricOntology / fabricDataAgent), Foundry IQ # manages the underlying Azure AI Search index internally: at KS registration # time it is bound to a Fabric workspace + lakehouse and provisions the -# datasource, skillset, index, and indexer transparently. GPT-RAG therefore +# datasource, skillset, index, and indexer transparently. Agent Landing Zone therefore # does not maintain a Bicep AI Search sidecar for OneLake; the KS itself # owns the pipeline. The retrieve-time entry only needs the knowledge source # name and reference flags; workspace / lakehouse identifiers are used only @@ -340,9 +340,9 @@ def build_pattern_b_filter_add_on( user_context: Optional[Mapping[str, Any]], security_field_name: str = "metadata_security_id", ) -> str: - """Build the Pattern B ``filterAddOn`` for GPT-RAG security fields. + """Build the Pattern B ``filterAddOn`` for Agent Landing Zone security fields. - Pattern B registers GPT-RAG's existing Azure AI Search index as a Foundry IQ + Pattern B registers Agent Landing Zone's existing Azure AI Search index as a Foundry IQ ``searchIndex`` knowledge source. The custom security fields on that index are not enforced by ``x-ms-query-source-authorization``. They must be expressed as an OData ``filterAddOn`` on the retrieve request. The filter @@ -1261,7 +1261,7 @@ def _build_conversation_source_params( - no conversation knowledge source name was provisioned. When it does apply, the source is a ``searchIndex`` knowledge source over - the existing GPT-RAG index, always trimmed by a conversationId plus + the existing Agent Landing Zone index, always trimmed by a conversationId plus caller-ownership ``filterAddOn``; it is skipped when the caller principal is unknown. ``failOnError`` is ``false`` so an empty or missing upload index degrades gracefully to the shared corpus @@ -1931,7 +1931,7 @@ async def retrieve( if conversation_id: logging.debug("[FoundryIQClient] conversation_id=%s", conversation_id) - # GPT-RAG configures the knowledge base with minimal reasoning, which + # Agent Landing Zone configures the knowledge base with minimal reasoning, which # requires explicit intents rather than chat messages. if self.mcp_config.enabled: body: Dict[str, Any] = { diff --git a/src/connectors/search.py b/src/connectors/search.py index 2f2e2d2d..bcd9c82b 100644 --- a/src/connectors/search.py +++ b/src/connectors/search.py @@ -25,7 +25,7 @@ # Standardized log markers for retrieval/auth failure paths. Operators can grep # these to spot swallowed errors that would otherwise return empty results -# silently. See issue Azure/GPT-RAG#508. +# silently. See issue Azure/agent-landing-zone#508. _RETRIEVAL_AUTH_FAILURE_MARKER = "[Retrieval][AUTH_FAILURE]" _RETRIEVAL_ERROR_MARKER = "[Retrieval][ERROR]" @@ -589,7 +589,7 @@ async def search_knowledge_base(self, query: str) -> str: :param query: The search query to find relevant documents. :return: Search results as a JSON string containing a list of documents with title, link and content. """ - # Backend selector (Azure/GPT-RAG#526). The default 'ai_search' keeps the + # Backend selector (Azure/agent-landing-zone#526). The default 'ai_search' keeps the # exact path below; 'foundry_iq' delegates to the knowledge base retrieve # action and maps into the identical return contract. if get_retrieval_backend() == RETRIEVAL_BACKEND_FOUNDRY_IQ: diff --git a/src/main.py b/src/main.py index 3ad0c41d..f4c2f852 100644 --- a/src/main.py +++ b/src/main.py @@ -94,7 +94,7 @@ def _startup_banner() -> None: - name = "GPT-RAG Orchestrator" + name = "Agent Landing Zone Orchestrator" version = None try: if VERSION_FILE.exists(): @@ -243,7 +243,7 @@ async def lifespan(app: FastAPI): Telemetry.configure_monitoring( cfg, APPLICATION_INSIGHTS_CONNECTION_STRING, - "agentlz.orchestrator", # OTel service.name (Azure/GPT-RAG#695) + "agentlz.orchestrator", # OTel service.name (Azure/agent-landing-zone#695) APP_VERSION, ) @@ -290,8 +290,8 @@ async def lifespan(app: FastAPI): # cleanup logic after shutdown app = FastAPI( - title="GPT-RAG Orchestrator", - description="GPT-RAG Orchestrator FastAPI", + title="Agent Landing Zone Orchestrator", + description="Agent Landing Zone Orchestrator FastAPI", version=APP_VERSION, lifespan=lifespan ) diff --git a/src/strategies/agent_provider_v2.py b/src/strategies/agent_provider_v2.py index c0a9e45c..be9bf964 100644 --- a/src/strategies/agent_provider_v2.py +++ b/src/strategies/agent_provider_v2.py @@ -350,7 +350,7 @@ async def ensure_conversation_id(conv: dict) -> str: chains the tool output to the wrong response: the resumed turn id overrides the in-loop response that actually holds the ``function_call``, so the service rejects the tool result with ``400 No tool call found for function - call output`` (Azure/GPT-RAG#505). Backing the thread with a conversation + call output`` (Azure/agent-landing-zone#505). Backing the thread with a conversation object keeps the ``function_call`` and its output in the same conversation, so chaining resolves on every turn. diff --git a/src/strategies/context_shaping.py b/src/strategies/context_shaping.py index 5df0755f..c1819a6d 100644 --- a/src/strategies/context_shaping.py +++ b/src/strategies/context_shaping.py @@ -7,7 +7,7 @@ preamble and per-document formatting here guarantees both providers produce byte-identical context. -Introduced for Azure/GPT-RAG#526. +Introduced for Azure/agent-landing-zone#526. """ from typing import List diff --git a/src/strategies/foundry_iq_context_provider.py b/src/strategies/foundry_iq_context_provider.py index 636f87ae..466ebccf 100644 --- a/src/strategies/foundry_iq_context_provider.py +++ b/src/strategies/foundry_iq_context_provider.py @@ -9,9 +9,9 @@ Per-request OBO permission trimming is forwarded by :class:`FoundryIQClient` in the ``x-ms-query-source-authorization`` header. That OBO header is a distinct mechanism from the Pattern B ``filterAddOn`` security filter, which narrows a -registered GPT-RAG Azure AI Search index using its custom security fields. +registered Agent Landing Zone Azure AI Search index using its custom security fields. -Introduced for Azure/GPT-RAG#526. +Introduced for Azure/agent-landing-zone#526. """ import logging diff --git a/src/strategies/hosted_strategies.py b/src/strategies/hosted_strategies.py index d6d4b487..4f25cf88 100644 --- a/src/strategies/hosted_strategies.py +++ b/src/strategies/hosted_strategies.py @@ -21,7 +21,7 @@ from agent_framework import ChatMessage, Role # Strategies that call out to the Toolbox MCP server for retrieval and must -# therefore carry a validated Foundry call id (ADR-0001, Azure/GPT-RAG#591). +# therefore carry a validated Foundry call id (ADR-0001, Azure/agent-landing-zone#591). # Other hosted-eligible strategies use the classic Foundry IQ / OBO retrieval # path and are out of scope for this passthrough. HOSTED_TOOLBOX_STRATEGIES: frozenset[str] = frozenset({ diff --git a/src/strategies/multimodal_strategy.py b/src/strategies/multimodal_strategy.py index b8554d04..93da8bd3 100644 --- a/src/strategies/multimodal_strategy.py +++ b/src/strategies/multimodal_strategy.py @@ -302,7 +302,7 @@ async def _get_obo_token() -> str | None: else None ) - # Decision #5 (Azure/GPT-RAG#526): multimodal stays on Azure AI Search + # Decision #5 (Azure/agent-landing-zone#526): multimodal stays on Azure AI Search # for v3.0.0 — Pattern A captioning/image parity for Foundry IQ is # deferred. The selector is still honored for consistency: when # foundry_iq is configured, retrieval is text-only via diff --git a/src/strategies/single_agent_rag_strategy_v2.py b/src/strategies/single_agent_rag_strategy_v2.py index 94d9fe35..cd296ffc 100644 --- a/src/strategies/single_agent_rag_strategy_v2.py +++ b/src/strategies/single_agent_rag_strategy_v2.py @@ -529,7 +529,7 @@ async def _stream_agent(self, user_message: str): # Resuming from the previous turn's response id instead # breaks tool-call chaining on follow-up turns, which fail # with "400 No tool call found for function call output" - # (Azure/GPT-RAG#505). + # (Azure/agent-landing-zone#505). thread_id = await agent_provider_v2.ensure_conversation_id(conv) thread = agent.get_new_thread(service_thread_id=thread_id) run_input = user_message diff --git a/src/util/blob_sas.py b/src/util/blob_sas.py index 6bfe3a85..57f2bc40 100644 --- a/src/util/blob_sas.py +++ b/src/util/blob_sas.py @@ -6,7 +6,7 @@ ``PublicAccessNotPermitted`` whenever public blob access is disabled — which is the secure default and is commonly enforced by tenant Azure Policy. -The Chainlit frontend solves this at render time (Azure/gpt-rag-ui#79), but that +The Chainlit frontend solves this at render time (Azure/agent-app-ui#79), but that hook only exists for the frontend. Surfaces that consume the hosted agent directly — the Foundry portal Playground, "Call agent", or any custom client — render the model's markdown verbatim and have nowhere to sign the href. Signing @@ -16,7 +16,7 @@ Signing is best effort: every failure path returns the original URL so a citation is never dropped from an otherwise good answer. -Introduced for Azure/GPT-RAG#660. +Introduced for Azure/agent-landing-zone#660. """ import asyncio diff --git a/src/util/foundry_platform.py b/src/util/foundry_platform.py index 4c02188e..0dc4d0bd 100644 --- a/src/util/foundry_platform.py +++ b/src/util/foundry_platform.py @@ -15,7 +15,7 @@ user from this call id server-side -- where the real OAuth context lives -- and applies native, per-user document trimming. -ADR-0001 (Azure/GPT-RAG) freezes this passthrough as the required hosted +ADR-0001 (Azure/agent-landing-zone) freezes this passthrough as the required hosted document-security path: a group-filter or manual ``metadata_security_id`` fallback is not a hosted default. When the call id is absent or malformed, hosted retrieval must fail closed instead of silently falling back to diff --git a/src/util/metadata.py b/src/util/metadata.py index 0c1d3080..2fd74b9a 100644 --- a/src/util/metadata.py +++ b/src/util/metadata.py @@ -1,9 +1,9 @@ """Formatting helpers for surfacing indexed ``custom_metadata`` into context. The ``custom_metadata`` field is populated during ingestion (see -Azure/GPT-RAG#487) and already lives in the AI Search index. These helpers turn +Azure/agent-landing-zone#487) and already lives in the AI Search index. These helpers turn that raw field into a compact, deterministic text block that retrieval paths can -prepend to each document's content before it reaches the LLM (Azure/GPT-RAG#506). +prepend to each document's content before it reaches the LLM (Azure/agent-landing-zone#506). This module is intentionally dependency-free: it imports only the standard library so it can be reused by connectors and strategies without creating import diff --git a/src/util/retrieval_backend.py b/src/util/retrieval_backend.py index 84b8df67..40ed12d1 100644 --- a/src/util/retrieval_backend.py +++ b/src/util/retrieval_backend.py @@ -9,7 +9,7 @@ instead of calling ``cfg.get`` per request. ``reset_retrieval_backend_cache`` is provided for tests that need to flip the value. -Introduced for Azure/GPT-RAG#526 (Foundry IQ as a first-class retrieval +Introduced for Azure/agent-landing-zone#526 (Foundry IQ as a first-class retrieval backend). The default stays ``ai_search`` so enabling the seam changes no runtime behavior until an operator opts in. """ From 5c50ebc9f0baa7873b05386e6ff1df873dc132c6 Mon Sep 17 00:00:00 2001 From: Paulo Lacerda Date: Wed, 7 Oct 2026 21:56:05 -0300 Subject: [PATCH 2/9] =?UTF-8?q?Ajustes=20documenta=C3=A7=C3=A3o=20Agent=20?= =?UTF-8?q?Landing=20Zone=20(#387)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- docs/pull_request_template.md | 122 +++++++++++++++++----------------- infra/README.md | 6 +- 2 files changed, 64 insertions(+), 64 deletions(-) diff --git a/docs/pull_request_template.md b/docs/pull_request_template.md index 4fd51402..19be3d0d 100644 --- a/docs/pull_request_template.md +++ b/docs/pull_request_template.md @@ -1,61 +1,61 @@ -## Purpose - - - -> ⚠️ **Important:** All pull requests must target the `develop` branch, not `main`. PRs targeting `main` will be automatically blocked. - -## Contributing guidelines - -Please see [Contributing Guidelines](../CONTRIBUTING.md) before creating your Pull Request. - -## Type of change - -- [ ] Bugfix -- [ ] Feature -- [ ] Code style update (formatting, local variables) -- [ ] Refactoring (no functional changes, no api changes) -- [ ] Documentation content changes -- [ ] Other... Please describe: - -## Related Backlog Item or Issue - -If applicable, provide a link to the relevant backlog item or issue. - - - -## Is this change disruptive or does it break existing applications? - -If deploying this change could impact existing applications, please specify. - -- [ ] Yes -- [ ] No - -## Cross-Repository Dependencies - -If this change depends on pull requests in other repositories within the solution, provide the links below. - -- [ ] [gpt-rag](https://github.com/Azure/agent-landing-zone) -- [ ] [agent-app-orchestrator](https://github.com/Azure/agent-app-orchestrator) -- [ ] [agent-app-ingestion](https://github.com/Azure/agent-app-ingestion) -- [ ] [agent-app-ui](https://github.com/Azure/agent-app-ui) - -## Does this require changes to project documentation? - -If the changes add new functionality, update the documentation accordingly. - -- [ ] Yes -- [ ] No - -## Documentation Link - -If this change adds a new functionality, provide a link to its documentation. - - - -## Code quality checklist - -- [ ] I verified the changes locally to ensure they work as expected -- [ ] I have tested the new functionality and ensured existing features still work -- [ ] I have updated the CHANGELOG.md file to document these changes -- [ ] I have reviewed the code for readability, maintainability, and adherence to project conventions -- [ ] I have added at least two reviewers to the Pull Request +## Purpose + + + +> ⚠️ **Important:** All pull requests must target the `develop` branch, not `main`. PRs targeting `main` will be automatically blocked. + +## Contributing guidelines + +Please see [Contributing Guidelines](../CONTRIBUTING.md) before creating your Pull Request. + +## Type of change + +- [ ] Bugfix +- [ ] Feature +- [ ] Code style update (formatting, local variables) +- [ ] Refactoring (no functional changes, no api changes) +- [ ] Documentation content changes +- [ ] Other... Please describe: + +## Related Backlog Item or Issue + +If applicable, provide a link to the relevant backlog item or issue. + + + +## Is this change disruptive or does it break existing applications? + +If deploying this change could impact existing applications, please specify. + +- [ ] Yes +- [ ] No + +## Cross-Repository Dependencies + +If this change depends on pull requests in other repositories within the solution, provide the links below. + +- [ ] [agent-landing-zone](https://github.com/Azure/agent-landing-zone) +- [ ] [agent-app-orchestrator](https://github.com/Azure/agent-app-orchestrator) +- [ ] [agent-app-ingestion](https://github.com/Azure/agent-app-ingestion) +- [ ] [agent-app-ui](https://github.com/Azure/agent-app-ui) + +## Does this require changes to project documentation? + +If the changes add new functionality, update the documentation accordingly. + +- [ ] Yes +- [ ] No + +## Documentation Link + +If this change adds a new functionality, provide a link to its documentation. + + + +## Code quality checklist + +- [ ] I verified the changes locally to ensure they work as expected +- [ ] I have tested the new functionality and ensured existing features still work +- [ ] I have updated the CHANGELOG.md file to document these changes +- [ ] I have reviewed the code for readability, maintainability, and adherence to project conventions +- [ ] I have added at least two reviewers to the Pull Request diff --git a/infra/README.md b/infra/README.md index bd11f5d6..c488bbbc 100644 --- a/infra/README.md +++ b/infra/README.md @@ -1,3 +1,3 @@ -The infrastructure for this project is defined in: https://github.com/Azure/GPT-RAG - -After deploying the infrastructure, you can use `azd env refresh` and `azd deploy` to deploy the data ingestion. +The infrastructure for this project is defined in: https://github.com/Azure/agent-landing-zone + +After deploying the infrastructure, you can use `azd env refresh` and `azd deploy` to deploy the data ingestion. From ba241b3f71c784a94e3636343b959fbd9c3875b7 Mon Sep 17 00:00:00 2001 From: Paulo Lacerda Date: Wed, 7 Oct 2026 22:09:03 -0300 Subject: [PATCH 3/9] =?UTF-8?q?Ajustes=20documenta=C3=A7=C3=A3o=20Agent=20?= =?UTF-8?q?Landing=20Zone=20(#390)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .azure/deployment-plan.md | 193 -------------------------------------- 1 file changed, 193 deletions(-) delete mode 100644 .azure/deployment-plan.md diff --git a/.azure/deployment-plan.md b/.azure/deployment-plan.md deleted file mode 100644 index 703fda7a..00000000 --- a/.azure/deployment-plan.md +++ /dev/null @@ -1,193 +0,0 @@ -# Azure Deployment Preparation Plan - -## Status - -Ready for Validation - -## Scope - -Prepare real Microsoft Entra tenant validation for PR #260, which adds MSAL sign-in and `Admin` app-role authorization to the orchestrator admin dashboard. - -This plan does not authorize deployment, merge, release, deletion, or Azure/Entra mutation. The next step is explicit validation approval, then `azure-validate`, then `azure-deploy`. - -## Azure context - -- Subscription: `9788a92c-2f71-4629-8173-7ad449cb50e1` (`mcaps-paulolacerda`) -- Tenant: `16b3c013-d300-468d-ac64-7eda0820b6d3` -- Preferred validation location: `australiaeast`, matching the existing Entra redirect URI and prior validation endpoint. - -## Safety constraints - -- No resource-group deletion is authorized by this plan. -- Before any future deletion consideration, run: - - `az group show --subscription 9788a92c-2f71-4629-8173-7ad449cb50e1 --name --query tags` -- Never delete a resource group tagged `keep=true`. -- Never delete resource groups by substring matching such as `gpt-rag` or `gptrag`. -- Only delete a validation environment by exact resource group name after explicit approval. - -## Workspace analysis - -- Repository: `Azure/agent-app-orchestrator` -- Branch: `feature/dashboard-msal-signin` -- PR: `Azure/agent-app-orchestrator#260` -- Base branch: `develop` -- Application: Python 3.12 FastAPI orchestrator with a Vite/React admin dashboard served from `/dashboard/`. -- Deployment artifacts already present: - - `Dockerfile` builds the dashboard bundle in a Node 20 stage and copies it into the Python runtime image. - - `azure.yaml` exists and points to azd hooks/scripts, but this repository does not carry standalone `infra/` files. Full Agent Landing Zone environment creation is owned by the main Agent Landing Zone infrastructure repository. -- Preparation mode: MODIFY existing application and validate a PR image against a real tenant. -- Recipe: use existing Agent Landing Zone deployment flow for environment provisioning, then deploy the orchestrator container image/revision from this branch. If no reusable environment exists, recreate a controlled validation environment from the main Agent Landing Zone infrastructure instead of modifying unrelated resource groups. - -## Current environment inventory - -The previously planned resource group `rg-gptrag-546val` is not present in subscription `mcaps-paulolacerda` as of this preparation pass: - -- `az group show --name rg-gptrag-546val` returned `ResourceGroupNotFound`. -- No matching Container Apps or App Configuration stores were found by read-only resource listing in this subscription. - -Candidate Agent Landing Zone resource groups found in the subscription: - -| Resource group | Location | Tags | Read-only finding | -| --- | --- | --- | --- | -| `rg-gptrag-fiqzt2-sdc06291745` | `swedencentral` | `azd-env-name=gptrag-fiqzt2-sdc06291745` | Candidate only, not selected. | -| `rg-gptrag-az700-zta-063014` | `swedencentral` | `azd-env-name=gptrag-az700-zta-063014` | Candidate only, not selected. | -| `rg-gptrag-fiqzt2-06290951` | `switzerlandnorth` | `azd-env-name=gptrag-fiqzt2-06290951` | Candidate only, not selected. | -| `rg-gptrag-fiqzt-aue-06291815` | `australiaeast` | `azd-env-name=gptrag-fiqzt-aue-06291815` | Contains only `srch-2sud2hrjnye46`; not a complete orchestrator validation environment. | -| `rg-gptragv342val` | `australiaeast` | `azd-env-name=gptragv342val` | Contains network/search resources; no Container App/App Configuration inventory was found in this pass. | - -Conclusion: do not assume the old validation environment is available. Validation should either: - -1. Recreate a new exact validation environment, for example `rg-gptrag-546val2`, from the main Agent Landing Zone infrastructure, or -2. Use a user-approved existing environment only after confirming it has the orchestrator Container App, ACR, App Configuration, managed identity, Cosmos, and required Agent Landing Zone dependencies. - -## Entra application inventory - -Use the existing single-tenant app registration: - -- Display name: `gpt-rag-546val-dashboard` -- Application (client) id: `b621d3a9-03e7-4cf1-80f6-47a263b751c1` -- Application object id: `1c50cdd8-d331-4916-9279-80336bef98d2` -- Enterprise application object id: `737526d9-dbae-4e28-934c-c582005cce94` -- Tenant: `16b3c013-d300-468d-ac64-7eda0820b6d3` -- Supported accounts: single tenant -- Application ID URI: `api://b621d3a9-03e7-4cf1-80f6-47a263b751c1` -- Scope: `access_as_user` -- App role: value `Admin`, case-sensitive, users/groups, enabled -- Enterprise Application `Assignment required?`: `No` -- Known redirect URI: - - `https://ca-5hhmdzbxo4x4q-orchestrator.thankfulwave-c9aba52a.australiaeast.azurecontainerapps.io/dashboard/` - -Before E2E, update the SPA redirect URI if the recreated Container App gets a different FQDN. The redirect URI must exactly match the browser URL and include the trailing slash. - -## Runtime configuration required - -Set these Azure App Configuration key-values under label `gpt-rag-orchestrator` in the selected validation environment: - -| Key | Value | -| --- | --- | -| `ENABLE_DASHBOARD` | `true` | -| `OAUTH_AZURE_AD_TENANT_ID` | `16b3c013-d300-468d-ac64-7eda0820b6d3` | -| `OAUTH_AZURE_AD_CLIENT_ID` | `b621d3a9-03e7-4cf1-80f6-47a263b751c1` | -| `OAUTH_AZURE_AD_API_SCOPE` | `api://b621d3a9-03e7-4cf1-80f6-47a263b751c1/access_as_user` | - -Also confirm the orchestrator Container App has: - -- `APP_CONFIG_ENDPOINT=https://.azconfig.io` -- `AZURE_CLIENT_ID=` if a user-assigned managed identity is used -- Managed identity permission to read App Configuration -- If testing dashboard Configuration writes, managed identity permission equivalent to App Configuration Data Owner - -Important: check whether the legacy label `orchestrator` contains any of the same keys. If it does, remove or align those values only with explicit approval, because legacy label precedence can override `gpt-rag-orchestrator`. - -Restart or create a new Container App revision after changing `ENABLE_DASHBOARD`, because the dashboard route registration is evaluated at startup. - -## Validation deployment approach - -1. Confirm the target environment choice with Paulo: - - Recreate a new validation environment from Agent Landing Zone infrastructure, or - - Use an existing complete environment after read-only inventory confirms it is safe. -2. Build an orchestrator image from the rebased PR branch. -3. Push the image to the environment ACR. -4. Deploy a new orchestrator Container App revision using that image. -5. Set or verify the App Configuration key-values above. -6. Update the Entra SPA redirect URI to the final `/dashboard/` URL if needed. -7. Run E2E checks below. - -## E2E test matrix - -### Baseline auth opt-out - -Temporarily omit `OAUTH_AZURE_AD_TENANT_ID` in a non-production validation revision. - -Expected: - -- `/dashboard/` loads without MSAL sign-in. -- `GET /api/dashboard/auth-config` returns `auth_enabled:false` or equivalent disabled state. - -### Admin user - -Use Paulo's tenant account with the `Admin` app role assigned. - -Expected: - -- Sign-in redirects back to `/dashboard/`. -- `/api/dashboard/overview`, `/api/dashboard/conversations`, and `/api/dashboard/config` send `Authorization: Bearer ` and return 200. -- Local JWT inspection shows: - - `aud` is `b621d3a9-03e7-4cf1-80f6-47a263b751c1` or `api://b621d3a9-03e7-4cf1-80f6-47a263b751c1` - - `scp` contains `access_as_user` - - `roles` contains `Admin` -- Sign out clears the session and returns to the sign-in state. - -Do not paste tokens into external sites. Decode locally only. - -### Non-admin user - -Use Gonzalo Becerra or another test user without the `Admin` app role. If Gonzalo currently has `Admin`, remove the assignment only for the test and restore it afterward with explicit approval. - -Expected with Enterprise Application `Assignment required? = No`: - -- Entra sign-in succeeds. -- The first protected dashboard API call returns 403. -- The SPA shows `Access denied`, the signed-in account, and `Sign out and try another account`. -- No administrative dashboard data is rendered. - -### Optional 401 path - -Expire or invalidate the MSAL session and call a protected endpoint. - -Expected: - -- The SPA shows session-expired/sign-in-again behavior or redirects through MSAL. -- The app never downgrades to an anonymous dashboard API call. - -## Documentation updates included in this PR - -README dashboard guidance now explains: - -- The required single App Registration model for SPA and API. -- Where to define app roles: App registrations > application > App roles. -- Where to assign app roles: Enterprise applications > application > Users and groups. -- Why only `Admin` exists and why the value is case-sensitive. -- Why `Assignment required? = No` is needed to test the app-level 403 path. -- Why users must fully sign out and sign in after role assignment changes. - -## Merge and release sequence after validation - -1. Complete Azure E2E validation and record results in PR #260. -2. Mark PR #260 ready for review if validation passes. -3. Merge PR #260 into `develop`. -4. Prepare the next `Azure/agent-app-orchestrator` release branch from `develop`, following this repository's `AGENTS.md` release rules. -5. Tag and publish the orchestrator release with the GitHub Release title exactly equal to the tag, for example `vX.Y.Z`. -6. If the parent `Azure/agent-landing-zone` repository pins or consumes the orchestrator version, update it in a follow-up PR/release after the orchestrator release is available. - -## Planning checklist - -- [x] Analyze workspace and deployment recipe. -- [x] Inspect Azure context and prior environment read-only. -- [x] Inventory reusable resources, tags, configuration, identity, and endpoints where available. -- [x] Define Entra SPA/API and Admin-role prerequisites. -- [x] Define admin, non-admin, and optional 401 E2E scenarios. -- [x] Incorporate operator documentation improvements. -- [x] Confirm that the prior `rg-gptrag-546val` environment is not currently available. -- [x] Draft merge and release sequence. -- [x] Finalize this plan for explicit approval before validation/deployment. From 0e67231f008dcd1cd67503e2f5de9f9741d32a71 Mon Sep 17 00:00:00 2001 From: Paulo Lacerda Date: Thu, 8 Oct 2026 00:10:21 -0300 Subject: [PATCH 4/9] =?UTF-8?q?Ajustes=20documenta=C3=A7=C3=A3o=20Agent=20?= =?UTF-8?q?Landing=20Zone=20(#392)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .env.sample | 2 +- AGENTS.md | 2 +- README.md | 10 +++++----- scripts/deploy.ps1 | 2 +- scripts/deploy.sh | 2 +- src/schemas.py | 2 +- src/strategies/multimodal_search_context_provider.py | 2 +- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.env.sample b/.env.sample index ba069e53..40e178dd 100644 --- a/.env.sample +++ b/.env.sample @@ -148,7 +148,7 @@ SEARCH_MEASURES_INDEX_NAME=nl2sql--measures SEARCH_QUERIES_INDEX_NAME=nl2sql--queries SEARCH_TABLES_INDEX_NAME=nl2sql--tables -# Retrieval backend selector (Azure/GPT-RAG#526) +# Retrieval backend selector (Azure/agent-landing-zone#526) # ai_search (default) = Azure AI Search RAG index; foundry_iq = Foundry IQ knowledge base. RETRIEVAL_BACKEND=ai_search diff --git a/AGENTS.md b/AGENTS.md index 398c1823..dcaf6804 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -123,7 +123,7 @@ instructions before meaningful changes in these areas. endpoints outside local development, explicit credentials, bounded timeouts/output, strict schemas, and safe logging. - Keep App Configuration label precedence and the - `gpt-rag-orchestrator` write label explicit. A new runtime setting is a + `agent-app-orchestrator` write label explicit. A new runtime setting is a contract that may also require infrastructure and documentation changes. - Do not claim legal or regulatory compliance from telemetry or audit evidence. diff --git a/README.md b/README.md index d2f15012..a5d386bd 100644 --- a/README.md +++ b/README.md @@ -10,8 +10,8 @@ products: - azure-openai - azure-ai-search urlFragment: agent-app-orchestrator -name: Multi-repo ChatGPT and Enterprise data with Azure OpenAI and AI Search -description: Agent Landing Zone core is a Retrieval-Augmented Generation pattern running in Azure, using Azure AI Search for retrieval and Azure OpenAI large language models to power ChatGPT-style and Q&A experiences. +name: Agent Landing Zone Orchestrator +description: Multi-agent RAG orchestrator for Agent Landing Zone, built on Microsoft Foundry Agent Service, Microsoft Agent Framework, and Azure AI Search. --> # Agent Landing Zone Orchestrator @@ -37,8 +37,8 @@ and the existing MCP configuration keys. The default transport is still `sse`, and the streamed response contract is unchanged. Configure these values in Azure App Configuration. Use the -`gpt-rag-orchestrator` label for an orchestrator-specific override, or the -shared `gpt-rag` label when every component should use the same value: +`agent-app-orchestrator` label for an orchestrator-specific override, or the +shared `agent-lz` label when every component should use the same value: | Key | Default | Purpose | | --- | --- | --- | @@ -445,7 +445,7 @@ The data comes from the existing conversation/history Cosmos DB container used b **Access control.** When authentication is on (`OAUTH_AZURE_AD_TENANT_ID` is configured), the entire `/api/dashboard/*` surface — except the small `/api/dashboard/version` and `/api/dashboard/auth-config` endpoints used by the SPA at bootstrap — requires the caller's bearer token to include the `Admin` app role. The `/dashboard` HTML page itself is served openly so the SPA can load, call `/api/dashboard/auth-config`, and either sign the user in via MSAL (Authorization Code + PKCE) or render an access-denied state on a 403 response. When authentication is off, the dashboard is open like the rest of the app in development. -**Sign-in configuration.** The SPA reads its runtime auth configuration from `GET /api/dashboard/auth-config`, which is derived from these App Configuration keys under the `gpt-rag-orchestrator` label: +**Sign-in configuration.** The SPA reads its runtime auth configuration from `GET /api/dashboard/auth-config`, which is derived from these App Configuration keys under the `agent-app-orchestrator` label: | Key | Required | Purpose | | --- | --- | --- | diff --git a/scripts/deploy.ps1 b/scripts/deploy.ps1 index 4f9a3a6a..c612c99d 100755 --- a/scripts/deploy.ps1 +++ b/scripts/deploy.ps1 @@ -11,7 +11,7 @@ $env:PYTHONUTF8 = '1' $ProgressPreference = 'SilentlyContinue' $label = if ($env:APP_CONFIG_LABEL) { $env:APP_CONFIG_LABEL } else { 'agent-lz' } -$labels = @($label, 'agent-lz', 'gpt-rag') | Select-Object -Unique +$labels = @($label, 'agent-lz') | Select-Object -Unique $imageRepository = 'orchestrator' $appConfigKey = 'ORCHESTRATOR_APP_NAME' $identitySuffix = 'orchestrator' diff --git a/scripts/deploy.sh b/scripts/deploy.sh index 2345211b..7ae43507 100755 --- a/scripts/deploy.sh +++ b/scripts/deploy.sh @@ -14,7 +14,7 @@ NC='\033[0m' label="${APP_CONFIG_LABEL:-agent-lz}" config_labels=("$label") -for _l in agent-lz gpt-rag; do if [[ "$_l" != "$label" ]]; then config_labels+=("$_l"); fi; done +for _l in agent-lz; do if [[ "$_l" != "$label" ]]; then config_labels+=("$_l"); fi; done imageRepository="orchestrator" appConfigKey="ORCHESTRATOR_APP_NAME" identitySuffix="orchestrator" diff --git a/src/schemas.py b/src/schemas.py index 0bd6c51b..9dba23bc 100644 --- a/src/schemas.py +++ b/src/schemas.py @@ -356,7 +356,7 @@ class DashboardConfigApplyResponse(BaseModel): "description": "OK — successful stream response (SSE). Each SSE 'data:' line contains a JSON object.", "content": { "text/event-stream": { - "example": "gpt-rag answer" + "example": "agent answer" } } }, diff --git a/src/strategies/multimodal_search_context_provider.py b/src/strategies/multimodal_search_context_provider.py index f88d64ff..859bac8e 100644 --- a/src/strategies/multimodal_search_context_provider.py +++ b/src/strategies/multimodal_search_context_provider.py @@ -7,7 +7,7 @@ ``MultimodalChatClient`` detects this encoding and converts it to OpenAI's vision content array. -Index fields used (set by gpt-rag-ingestion multimodal chunker): +Index fields used (set by agent-app-ingestion multimodal chunker): - contentVector — text embedding - captionVector — image-caption embedding - relatedImages — list of blob URLs for figures From e31ad1e21eaad9c6ea5469003655bfe6e32848ea Mon Sep 17 00:00:00 2001 From: Paulo Lacerda Date: Thu, 8 Oct 2026 09:38:55 -0300 Subject: [PATCH 5/9] =?UTF-8?q?Ajustes=20documenta=C3=A7=C3=A3o=20Agent=20?= =?UTF-8?q?Landing=20Zone=20(#394)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ajustes documentação Agent Landing Zone Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- src/api/dashboard_config.py | 2 +- src/connectors/appconfig.py | 22 +++++++++++++++++---- src/dependencies.py | 4 ++-- tests/test_appconfig_agentlz_single_read.py | 2 +- tests/test_dashboard_config.py | 6 +++--- tests/test_http_boundary_dispositions.py | 4 ++-- 6 files changed, 27 insertions(+), 13 deletions(-) diff --git a/src/api/dashboard_config.py b/src/api/dashboard_config.py index 2f1e9cc6..fe5ed347 100644 --- a/src/api/dashboard_config.py +++ b/src/api/dashboard_config.py @@ -49,7 +49,7 @@ # The App Configuration label all dashboard writes target. Picked to match the # orchestrator-specific selector loaded by :class:`AppConfigClient`, so values # set here take precedence over the shared ``gpt-rag`` baseline. -WRITE_LABEL = "gpt-rag-orchestrator" +WRITE_LABEL = "agent-app-orchestrator" router = APIRouter(prefix="/api/dashboard", tags=["dashboard-config"]) diff --git a/src/connectors/appconfig.py b/src/connectors/appconfig.py index 1c32f836..8b138acb 100644 --- a/src/connectors/appconfig.py +++ b/src/connectors/appconfig.py @@ -15,6 +15,15 @@ from tenacity import retry, wait_random_exponential, stop_after_attempt, RetryError + +def _with_legacy_app_label(extra_selector): + """Return a provider loader that also reads the legacy app label after the current one.""" + def _load(*args, selects, **kwargs): + merged = list(selects) + merged.insert(min(2, len(merged)), extra_selector) + return load(*args, selects=merged, **kwargs) + return _load + class AppConfigClient: credential = None @@ -24,7 +33,8 @@ def __init__(self): """ Bulk-loads all keys into an in-memory dict from the most common labels used by Agent Landing Zone: - 'orchestrator' (legacy / shared deployments) - - 'gpt-rag-orchestrator' (service-specific) + - 'agent-app-orchestrator' (service-specific) + - 'gpt-rag-orchestrator' (legacy service-specific) - 'agent-lz' (base / shared) Precedence is determined by the order of selectors (earlier wins for duplicate keys). @@ -64,9 +74,11 @@ def __init__(self): # Prefer more specific labels first. loaded_labels = list(LOADED_LABELS) legacy_orchestrator_label_selector = SettingSelector(label_filter='orchestrator', key_filter='*') - orchestrator_label_selector = SettingSelector(label_filter='gpt-rag-orchestrator', key_filter='*') + orchestrator_label_selector = SettingSelector(label_filter=APP_LABEL, key_filter='*') + legacy_app_label_selector = SettingSelector(label_filter=LEGACY_APP_LABEL, key_filter='*') base_label_selector = SettingSelector(label_filter=AGENTLZ_LABEL, key_filter='*') no_label_selector = SettingSelector(label_filter=None, key_filter='*') + load = _with_legacy_app_label(legacy_app_label_selector) logging.info( "Azure App Configuration init: endpoint_host=%s identity=%s allow_env_vars=%s labels=%s", @@ -197,7 +209,7 @@ def read_env_boolean(self, var_name, default=False): # Write support (used by the admin dashboard Configuration tab) # ----------------------------------------------------------------- - def set_value(self, key: str, value: Any, label: str = "gpt-rag-orchestrator") -> None: + def set_value(self, key: str, value: Any, label: str = "agent-app-orchestrator") -> None: """Write a single key/value pair back to Azure App Configuration. The read-side of this class uses the provider's bulk ``load`` helper, @@ -238,7 +250,9 @@ def set_value(self, key: str, value: Any, label: str = "gpt-rag-orchestrator") - # Agent Landing Zone (Azure/agent-landing-zone#695): only the 'agent-lz' base label is read. AGENTLZ_LABEL = "agent-lz" -LOADED_LABELS = ("orchestrator", "gpt-rag-orchestrator", AGENTLZ_LABEL, "") +APP_LABEL = "agent-app-orchestrator" +LEGACY_APP_LABEL = "gpt-rag-orchestrator" +LOADED_LABELS = ("orchestrator", APP_LABEL, LEGACY_APP_LABEL, AGENTLZ_LABEL, "") def candidate_keys(key: str) -> list[str]: diff --git a/src/dependencies.py b/src/dependencies.py index f8be5ef2..055e67c3 100644 --- a/src/dependencies.py +++ b/src/dependencies.py @@ -59,7 +59,7 @@ def _log_app_config_state(cfg: AppConfigClient, keys_to_check: Optional[List[str for k in keys_to_check: presence[k] = "present" if k in client_dict else "missing" - labels = "orchestrator,gpt-rag-orchestrator,agent-lz," + labels = "orchestrator,agent-app-orchestrator,gpt-rag-orchestrator,agent-lz," logging.warning( "%s AppConfig state: endpoint_set=%s endpoint_host=%s disabled=%s auth_failed=%s allow_env_vars=%s keys_loaded=%d labels=%s key_presence=%s", prefix, @@ -514,7 +514,7 @@ def _b64url_decode_len(segment: str) -> int: "[Auth] Missing tenant configuration in Azure App Configuration. " "Confirm: (1) APP_CONFIG_ENDPOINT is set for the orchestrator app, " "(2) Managed Identity has App Configuration Data Reader, " - "(3) key exists under an included label (e.g. 'agent-lz' / 'gpt-rag-orchestrator' / 'orchestrator')." + "(3) key exists under an included label (e.g. 'agent-lz' / 'agent-app-orchestrator' / 'orchestrator')." ) raise HTTPException( status_code=500, diff --git a/tests/test_appconfig_agentlz_single_read.py b/tests/test_appconfig_agentlz_single_read.py index 40044720..b5c6ecec 100644 --- a/tests/test_appconfig_agentlz_single_read.py +++ b/tests/test_appconfig_agentlz_single_read.py @@ -24,7 +24,7 @@ def _client(monkeypatch, mock_identity_manager, values, env_enabled=False): def test_label_selectors_read_agent_lz_only(monkeypatch, mock_identity_manager): _, load = _client(monkeypatch, mock_identity_manager, {}) labels = [s.label_filter for s in load.call_args.kwargs["selects"]] - assert labels == ["orchestrator", "gpt-rag-orchestrator", "agent-lz", None] + assert labels == ["orchestrator", "agent-app-orchestrator", "gpt-rag-orchestrator", "agent-lz", None] @pytest.mark.parametrize("key", ["AGENTLZ_FOO", "GPT_RAG_FOO", "SEARCH_SERVICE_NAME"]) diff --git a/tests/test_dashboard_config.py b/tests/test_dashboard_config.py index b78d3f07..2e4bdb0a 100644 --- a/tests/test_dashboard_config.py +++ b/tests/test_dashboard_config.py @@ -37,7 +37,7 @@ def _get_value(key: str, default: Any = None, allow_none: bool = False, type: An return None return default - def _set_value(key: str, value: Any, label: str = "gpt-rag-orchestrator"): + def _set_value(key: str, value: Any, label: str = "agent-app-orchestrator"): store[key] = str(value).lower() if isinstance(value, bool) else str(value) cfg.get_value = MagicMock(side_effect=_get_value) @@ -89,7 +89,7 @@ def test_get_config_returns_every_allowlisted_key(): r = client.get("/api/dashboard/config") assert r.status_code == 200, r.text body = r.json() - assert body["label"] == "gpt-rag-orchestrator" + assert body["label"] == "agent-app-orchestrator" returned_keys: set[str] = set() returned_section_ids: set[str] = set() @@ -200,7 +200,7 @@ def test_put_config_happy_path_writes_and_refreshes_cache(): assert written["AGENT_STRATEGY"] == "maf_lite" assert written["CHAT_TEMPERATURE"] == 1.2 for call in cfg.set_value.call_args_list: - assert call.args[2] == "gpt-rag-orchestrator" + assert call.args[2] == "agent-app-orchestrator" body = r.json() agent_field = next( diff --git a/tests/test_http_boundary_dispositions.py b/tests/test_http_boundary_dispositions.py index 63ae2442..eadd6d6f 100644 --- a/tests/test_http_boundary_dispositions.py +++ b/tests/test_http_boundary_dispositions.py @@ -241,7 +241,7 @@ def write(key, value, label): }) assert response.status_code == 500 assert [item[0] for item in writes] == ["AGENT_STRATEGY", "REASONING_EFFORT"] - assert all(item[2] == "gpt-rag-orchestrator" for item in writes) + assert all(item[2] == "agent-app-orchestrator" for item in writes) assert response.json()["detail"]["errors"][0]["key"] == "CHAT_TEMPERATURE" assert response.json()["detail"]["errors"][0]["error"] assert MARKER not in response.text + caplog.text @@ -309,7 +309,7 @@ def test_actual_appconfig_write_consumer_never_reports_failed_update_as_applied( assert response.status_code == 500 sdk.set_configuration_setting.assert_called_once() setting = sdk.set_configuration_setting.call_args.args[0] - assert (setting.key, setting.value, setting.label) == ("CHAT_TEMPERATURE", "0.7", "gpt-rag-orchestrator") + assert (setting.key, setting.value, setting.label) == ("CHAT_TEMPERATURE", "0.7", "agent-app-orchestrator") if failure_stage == "write": refresh.assert_not_called() assert response.json()["detail"]["errors"] == [ From 2c0cd6e05c08b9cd0e951c08fdfdbdc826830f04 Mon Sep 17 00:00:00 2001 From: Paulo Lacerda Date: Thu, 8 Oct 2026 11:47:58 -0300 Subject: [PATCH 6/9] chore: prefix issue redirect link with 1- (#399) --- .github/ISSUE_TEMPLATE/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 0c546ba0..e884711d 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,5 +1,5 @@ blank_issues_enabled: false contact_links: - - name: Report an issue in Agent Landing Zone + - name: 1- Report an issue in Agent Landing Zone url: https://github.com/Azure/agent-landing-zone/issues/new/choose about: Please create all bug reports, feature requests, and support questions in the main Azure/agent-landing-zone repository. From f736178c7a6096d6b77245944464a2b54a4d71ff Mon Sep 17 00:00:00 2001 From: Paulo Lacerda Date: Thu, 8 Oct 2026 11:56:45 -0300 Subject: [PATCH 7/9] chore: highlight issue redirect link with emoji (#401) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/ISSUE_TEMPLATE/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index e884711d..7cf7fef0 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,5 +1,5 @@ blank_issues_enabled: false contact_links: - - name: 1- Report an issue in Agent Landing Zone + - name: 👉 Report an issue in Agent Landing Zone url: https://github.com/Azure/agent-landing-zone/issues/new/choose about: Please create all bug reports, feature requests, and support questions in the main Azure/agent-landing-zone repository. From 62dc02f24b3fec8f8c7f04caf535f16900534543 Mon Sep 17 00:00:00 2001 From: Paulo Lacerda Date: Thu, 8 Oct 2026 14:27:13 -0300 Subject: [PATCH 8/9] docs: position README around conversational agent experiences (#403) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a5d386bd..0a6fbcbe 100644 --- a/README.md +++ b/README.md @@ -11,13 +11,13 @@ products: - azure-ai-search urlFragment: agent-app-orchestrator name: Agent Landing Zone Orchestrator -description: Multi-agent RAG orchestrator for Agent Landing Zone, built on Microsoft Foundry Agent Service, Microsoft Agent Framework, and Azure AI Search. +description: Conversational agent orchestrator for Agent Landing Zone, built on Microsoft Foundry Agent Service and Microsoft Agent Framework. --> # Agent Landing Zone Orchestrator Part of the [Agent Landing Zone](https://github.com/Azure/agent-landing-zone) solution. -The **Agent Landing Zone Orchestrator** service is an agentic orchestration layer built on Azure AI Foundry Agent Service and the Microsoft Agent Framework. It enables agent-based RAG workflows by coordinating multiple specialized agents—each with a defined role—to collaboratively generate accurate, context-aware responses for complex user queries. +The **Agent Landing Zone Orchestrator** service is an agentic orchestration layer built on Azure AI Foundry Agent Service and the Microsoft Agent Framework. It powers conversational agent experiences by coordinating specialized agents—each with a defined role—that combine grounded knowledge retrieval, NL2SQL, and MCP tools to produce accurate, context-aware responses. ### Available Strategies From 49d4c79b0732535e1a7c40d21e0faf4fed4691c8 Mon Sep 17 00:00:00 2001 From: Paulo Lacerda Date: Wed, 14 Oct 2026 12:59:42 -0300 Subject: [PATCH 9/9] fix: retain the validated provider adapter after stable-history merge Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- src/connectors/appconfig.py | 8 -------- 1 file changed, 8 deletions(-) diff --git a/src/connectors/appconfig.py b/src/connectors/appconfig.py index 20364dc4..a9221660 100644 --- a/src/connectors/appconfig.py +++ b/src/connectors/appconfig.py @@ -127,14 +127,6 @@ def _load( return _load -def _with_legacy_app_label(extra_selector): - """Return a provider loader that also reads the legacy app label after the current one.""" - def _load(*args, selects, **kwargs): - merged = list(selects) - merged.insert(min(2, len(merged)), extra_selector) - return load(*args, selects=merged, **kwargs) - return _load - class AppConfigClient: credential: TokenCredential | None = None