aiappsgbb

Read the plant-floor Azure IoT surface — device twins (spindles, conveyors, robotic arms, vision systems), time-series telemetry with pre-annotated alarms, downtime events with cause codes and lot ids, and per-line OEE rollups (Availability × Performance × Quality).

Share generated files (PDFs, charts, CSVs) with Frank by writing them to /tmp and referencing the absolute path. The frontend auto-converts /tmp paths into download links.

Build the downloadable incident brief PDF — cover + KPI strip + OEE chart + downtime timeline + root-cause narrative + supplier/material signals + recommended actions + sign-off, per SOP §7.1. Renders via the inline HTML template + Playwright.

Microsoft 365 surface — READ Frank's mailbox / Wes's calendar / OneDrive (shift reports, SOPs) AND a strict H-I-T-L workflow to draft and send an email (e.g. brief Wes on the morning incident).

Compute and plot OEE — a 7-day trend chart with target/threshold lines, an overlay of telemetry alarms and downtime stops, plus a flat CSV export. Saves /tmp/oee-trend-<plant>-line-<N>-<date>.png + .csv.

The Olympus Cleveland-plant Standard Operating Procedure — alarm thresholds, escalation matrix, supplier quality-hold rules, OEE definitions, incident-brief template requirements. Cite the section number when answering.

Read SAP S/4HANA manufacturing data — production orders, materials, vendors, plants, lines. Pivot here once the IoT signal names a `related_po_id` to find the order, the material, and the (possibly QA-blocked) vendor.

ServiceNow surface — READ existing tickets/CMDB/KB/agents for plant-floor context AND a strict H-I-T-L workflow to log a maintenance work order against a piece of equipment.

Build enterprise RAG with Foundry IQ and Azure AI Search Knowledge Bases using agentic retrieval, multi-hop reasoning, query planning, and citation-backed responses. Distinguishes the stable 2026-04-01 programmatic API from preview portal experiences and preview-only knowledge-source integrations. USE FOR: knowledge base, RAG, agentic retrieval, policy assistant, citations, multi-hop QA, Knowledge Agent, AI Search Knowledge Base, document grounding, semantic retrieval, foundry-iq, knowledge index, hybrid search, vector search, kb-mcp, web iq boundary, serverless knowledge base boundary, purview acl knowledge. DO NOT USE FOR: structured-document extraction (use foundry-doc-vision-speech), standalone Work IQ, Fabric IQ, or Web IQ workloads, MCP server deployment (use foundry-mcp-aca), agent runtime (use foundry-hosted-agents).

Deploy + manage Foundry hosted agents — container deploy via unified azure.yaml is GA; source-code --deploy-mode code is still preview. MAF 1.8.0, azd ext install microsoft.foundry, implicit agent access (no default role grant). Read the body for patterns, identity, runtime, rollout, troubleshooting. USE FOR: deploy foundry agent, hosted agent, container agent, azure.yaml, azd ai agent, microsoft.foundry, MAF, FoundryChatClient, ResponsesHostServer, ACR push, batch eval, agent identity, Foundry User role, entra-agent-id, Responses/Invocations protocols, Activity protocol, blue-green deploy, canary rollout, version rollback, traffic routing, version_selector, agent_endpoint, update_details. DO NOT USE FOR: prompt agents (use foundry-prompt-agents), ACA MCP (use foundry-mcp-aca), GHCP coding agent (use ghcp-hosted-agents), Citadel hub/spoke (use citadel-hub-deploy), pilot pipeline (use threadlight-deploy), continuous eval (use foundry-evals), Routines (use foundry-routines), A2A wiring (use foundry-toolbox).

Tips and patterns for Azure Developer CLI (azd) workflows, ACA job deployment, and infrastructure scripting conventions. USE FOR: azd hooks, postdeploy, postprovision, ACA job deployment, container app job image update, publish_aca, deploy_job, azure.yaml hooks, cross-platform deployment scripts, uv run, azd env, azd conventions, infra scripts, MCAPS subscription, SecurityControl Ignore tag, resource group tagging, Defender for Cloud noise, Azure Policy auto-remediation, AZURE_TAGS, pilot posture, demo subscription tagging, AcrPull, ImagePullError, JSON array param, BCP186, FetchingKeyVaultSecretFailed, dependsOn rbac, image-pull credential, ACA placeholder image, azd env set triple-escape. DO NOT USE FOR: az login, tenant switching, subscription isolation (use azure-tenant-isolation), Foundry agents (use microsoft-foundry).

Deploy custom MCP servers as Azure Container Apps or Azure Functions for use with Foundry hosted agents. Covers Cosmos DB MCPToolKit, Playwright MCP, custom MCP servers, protocol requirements, ACA configuration, and authentication + hardening (ACA built-in auth / Easy Auth, OAuth, managed identity). USE FOR: deploy MCP server, MCP on ACA, Cosmos MCP, Playwright MCP in Foundry, custom MCP server, Azure Functions MCP, MCP ACA deployment, remote MCP endpoint, MCP for hosted agent, connect hosted agent to MCP, secure MCP server, harden MCP server, MCP authentication, MCP OAuth, ACA Easy Auth for MCP. DO NOT USE FOR: deploying the hosted agent itself (use threadlight-deploy), local MCP development (use mcp-config.json directly), general Azure deploy.

Deploy Foundry hosted agents using GitHub Copilot SDK (GHCP) with BYOK authentication and Invocations protocol. Alternative to MAF (Agent + FoundryChatClient + ResponsesHostServer). Use when you need streaming SSE output, progressive skill discovery, or long tool loops (>120s) that hit Foundry gateway timeout with Responses protocol. USE FOR: ghcp sdk, copilot sdk, github copilot agent, CopilotClient, InvocationAgentServerHost, BYOK, bring your own key, invocations protocol, SSE streaming agent, long running agent, send_and_wait timeout, ghcp hosted agent, copilot client foundry. DO NOT USE FOR: MAF agents (use foundry-hosted-agents), prompt agents, declarative agents, general Azure deploy.

Use Microsoft Foundry Toolbox GA to manage versioned multi-tool bundles behind a single MCP endpoint and connect them to hosted agents. Covers stable AIProjectClient.toolboxes CRUD, Toolbox-specific SDK models, agent_framework_foundry_hosting.FoundryToolbox, authentication, immutable-version promotion and rollback, the azd ai toolbox declarative path, and preview Tool Search. Distinguishes the GA Toolbox core from preview A2A, Work IQ, Fabric IQ, Browser Automation, Reminder, skills, and Tool Search; explains that azure_ai_search wraps an index, not a Foundry IQ knowledge base. USE FOR: foundry toolbox, toolbox MCP endpoint, AIProjectClient toolboxes, FoundryToolbox, toolbox version promote, multi-tool MCP endpoint, ToolboxSearchPreviewToolboxTool, kind toolbox, host azure.ai.toolbox, toolbox.yaml. DO NOT USE FOR: building MCP servers (use foundry-mcp-aca), KB-only RAG (use foundry-iq), generic hosted-agent runtime (use foundry-hosted-agents), cross-resource models (use foundry-cross-resource).

Onboard a Foundry project as a spoke into an AI Citadel Governance Hub. Covers Access Contracts, APIM connections, product policies, JWT auth. USE FOR: citadel spoke onboarding, access contract, connect foundry to citadel, APIM connection, bring your own ai gateway, govern agent, citadel JWT auth, citadel product policy, unified ai api, citadel AGT, vnet-isolated citadel spoke, foundry-vnet-deploy spoke onboarding. DO NOT USE FOR: deploying the Citadel hub itself, APIM infrastructure, hub networking, hub provisioning, hub sizing, llm backend onboarding, deploying model backends, apim backend pools, hub policy fragment deployment, spoke-side VNet/peering creation (use foundry-vnet-deploy).

Add vision (gpt-5.4 family), Document Intelligence v4, and Azure Speech (STT/TTS) capabilities to a Foundry hosted agent. Covers tool contracts, Bicep modules, runtime client code, and model selection for vision workloads. USE FOR: vision tool, image analysis, damage photo analysis, blueprint annotation, document extraction, structured doc parsing, OCR, voice intake, FNOL voice claim, STT, TTS, gpt-5.4-mini vision, gpt-5.4 vision, Document Intelligence prebuilt, custom doc model, Azure Speech, transcription. DO NOT USE FOR: deploying the agent itself (use threadlight-deploy), MCP server deployment (use foundry-mcp-aca), Foundry IQ knowledge retrieval (use foundry-iq), real-time voice / Voice Live (use foundry-voice-live).

Emit the final triage decision (approve_refund / deny_refund / escalate_to_supervisor / request_more_info), recommend a warehouse disposition, and write the audit record. USE FOR producing and persisting the final outcome. DO NOT USE FOR gathering data (intake-validation) or the raw eligibility/risk checks.

Apply the value ceiling and serial-returner / flagged-account risk gates and route cases to a human supervisor. USE FOR deciding whether a return must be escalated to the returns supervisor. DO NOT USE FOR the base eligibility check (policy-eligibility).

Correlate a return case with its order and customer profile, and validate completeness. USE FOR intake of a new return, matching an RMA to an order, checking required fields/photos. DO NOT USE FOR the eligibility or refund decision (that is policy-eligibility / disposition-decision).

Check a return against Contoso Retail return policy — 30-day window, final-sale rules, item condition — and cite the governing clause. USE FOR deciding whether a return is eligible for refund. DO NOT USE FOR high-value/fraud gating (fraud-escalation) or writing the final decision (disposition-decision).

Spec out a business process or customer use case for an enterprise pilot, then generate agent architecture (AGENTS.md + Skills) — a durable SpecKit specification first (process flow, business rules, data models, tool contracts, mock data, KPIs, governance), then implementation artifacts derived from the spec. Targets named LOB processes in regulated industries (FSI, Mfg, Retail, Telco, Healthcare, Utilities) where a customer SME will judge the SPEC on industry realism before the demo even runs. USE FOR: design a process, spec out a use case, create agent architecture, automate a regulated workflow, threadlight design, skill factory, business process specification, speckit, define a customer scenario, mock backend systems, seller prep guide, demo script, demo prompts, lock the stack/model/hosting foundation. DO NOT USE FOR: running existing skills, executing code, deploying (use threadlight-deploy), general Q&A, internal Microsoft tooling automation, generic chatbot prototyping.

PROTECT-leg for threadlight pilots: makes the Microsoft Agent Governance Toolkit (AGT) actually govern a deployed agent — not just document it. Scaffolds a real, schema-valid, versioned `policy.yaml`, commits `agt test` fixtures, gates CI on `agt lint-policy` + `agt verify` (OWASP ASI 2026 attestation), and emits `specs/govern-manifest.json` for threadlight-production-ready pillars 2 and 7. USE FOR: agent action governance, AGT policy, agt lint-policy, agt test, agt verify, tool allow/deny, excessive-agency guardrail, default-deny policy, OWASP ASI 2026, governance CI gate, policy attestation, responsible-ai policy, PROTECT stage, govern leg, govern-manifest. DO NOT USE FOR: content filtering at the model edge (Azure AI Content Safety) — AGT governs actions; adversarial scanning (threadlight-redteam); quality evals (threadlight-evals); completeness gate (threadlight-safe-check); deep AGT authoring upstream (foundry-agt).

Use after threadlight-safe-check post-deploy returns green to take a deployed pilot from lab to ready for customer architecture review / CISO sign-off / paved path to production. Reads SPEC § 12 (posture, must-have pillars, residency, RTO/RPO, SLA, incident owner) and probes Azure to produce an advisory production-readiness scorecard + uplift plan + customer hand-off package across 13 pillars. Soft advisory — never fails a build. USE FOR: production readiness, prod-ready gate, customer architecture review, CISO sign-off prep, pilot-to-prod handover, paved path to production, citadel uplift, AGT uplift, AI gateway uplift, go-live readiness, hand-off package, SRE handover, Kratos export readiness. DO NOT USE FOR: deployment itself (threadlight-deploy), structural completeness gate (threadlight-safe-check), invocation testing (foundry-evals), middleware authoring (foundry-agt), citadel hub provisioning (citadel-hub-deploy), access contracts (citadel-spoke-onboarding).

Run a threadlight-designed PoC locally without `azd up`. Four patterns: (0) **Quickstart** — `python -m threadlight_quickstart` boots MAF Agent + SkillsProvider + stub tools + Streamlit UI on localhost:8501; one LLM dep (Foundry OR AOAI OR GitHub Models via GITHUB_TOKEN — zero Azure). (1) MCP-direct — local MCP at `~/.copilot/mcp.json`; (2) Smoke-client — `agent.run_async()` bypassing ResponsesHostServer; (3) Local-stack — docker-compose + Cosmos emulator (Linux/Win x86 only). USE FOR: local test, smoke test, run agent locally, dev loop, no azd, copilot cli mcp, faster iteration, prompt tuning, cowork iteration, demo rehearsal, screen-shareable PoC, streamlit demo, GitHub Models, boot Kratos export locally. DO NOT USE FOR: prod deployment (use threadlight-deploy), pre-pilot validation (use threadlight-safe-check), hosted-agent runtime testing in cloud (use foundry-evals).

Validate and deploy Azure Developer CLI (azd) projects with compliance-first patterns. Covers azure.yaml configuration, Bicep parameter sync, Container Apps image preservation (IMAGE_NAME/RESOURCE_EXISTS), service-to-resource binding, azd tags, hook scripts, shared subscription safety, and pre-flight validation. Use when setting up azd projects, writing azure.yaml, validating Bicep infrastructure for Container Apps, troubleshooting azd up failures, running compliance checks, or preparing for deployment. Triggers on azd, azure.yaml, azd compliance, azd deploy, azd provision, azd up, Container Apps deployment, IMAGE_NAME, RESOURCE_EXISTS, remoteBuild, azd tags, parameter mismatch, pre-flight check, deployment validation.

Zero-trust security patterns for Azure applications and infrastructure. Cross-language authentication with ChainedTokenCredential (Python, TypeScript, .NET), managed identity, RBAC least-privilege roles, environment variable policies (allowed/forbidden), Azure Key Vault integration, and pre-deployment security checklists. Use when connecting to any Azure service, configuring authentication, setting up RBAC, reviewing environment variables, or validating security posture. Triggers on Azure security, authentication, managed identity, credential, API key, RBAC, role assignment, Key Vault, AZURE_CLIENT_ID, zero trust, ChainedTokenCredential, AzureDeveloperCliCredential, ManagedIdentityCredential, forbidden, allowed environment variables.

OpenTelemetry and Application Insights observability patterns for Azure Container Apps. Cross-language instrumentation for Python (FastAPI, Gradio, Streamlit), TypeScript (Express, React), and .NET (ASP.NET Core). Covers tracing, structured logging, metrics, Azure Monitor exporter, health check endpoints, and telemetry configuration. Use when setting up monitoring, adding Application Insights, configuring OpenTelemetry, implementing health checks, or setting up structured logging. Triggers on OpenTelemetry, Application Insights, tracing, logging, metrics, health check, Azure Monitor, observability, telemetry, structured logging, log level, Winston, Serilog, Python logging.

Bicep infrastructure templates and patterns for Azure Developer CLI (azd) projects using Azure Verified Modules (AVM). Use when writing main.bicep, calling AVM modules directly, configuring Container Apps in Bicep, managing parameters, outputs, tags, RBAC assignments, or aligning environment variables between Bicep and application code. Triggers on Bicep, main.bicep, parameters.json, azd tags, RBAC, Container Apps Bicep, AVM, module, output.

IP metadata and compliance standards for Azure Developer CLI templates. Defines the ip-metadata.json schema, repository structure requirements, compliance validation checklists, and maturity-level criteria. Use when creating ip-metadata.json, running IP compliance checks, validating repository readiness, checking maturity levels, or preparing templates for publication. Triggers on ip-metadata, IP compliance, maturity level, Gold Silver Bronze, repository structure, ip-metadata.json, compliance check, template validation, publication readiness.

Build container-based Foundry Agents using Azure AI Projects SDK with ImageBasedHostedAgentDefinition. Use when creating hosted agents that run custom code in Azure AI Foundry with your own container images. Triggers on ImageBasedHostedAgentDefinition, hosted agent, container agent, Foundry Agent, create_version, ProtocolVersionRecord, AgentProtocol.RESPONSES, custom agent image.

Azure Identity SDK for Python authentication. Use for DefaultAzureCredential, managed identity, service principals, and token caching. Triggers on azure-identity, DefaultAzureCredential, authentication, managed identity, service principal, credential.

Azure Blob Storage SDK for Python. Use for uploading, downloading, listing blobs, managing containers, and blob lifecycle. Triggers on blob storage, BlobServiceClient, ContainerClient, BlobClient, upload blob, download blob.

Generate a phased migration execution plan for Azure OpenAI model transitions. Covers assessment, testing, pilot, gradual rollout, validation, and cleanup phases with checklists, gate criteria, risk registers, and rollback strategies. USE FOR: migration plan, project plan, rollout plan, migration timeline, migration checklist, phased migration, canary deployment, rollback strategy, migration risk, cutover plan, migration steps, migration template. DO NOT USE FOR: choosing a target model (use aoai-model-lifecycle), code-level API changes (use aoai-model-migration), evaluation setup (use aoai-migration-evaluation).

Evaluate and validate Azure OpenAI model migrations using A/B comparison, LLM-as-Judge, local SDK evaluation, and Azure AI Foundry cloud evaluation. Covers RAG, tool calling, translation, and classification scenarios. USE FOR: evaluate model, compare models, A/B test, LLM judge, migration evaluation, golden dataset, test cases, azure-ai-evaluation, azure-ai-projects, Foundry eval, cloud evaluation, quality metrics, coherence, relevance, groundedness, regression test, before deploying new model, validate migration, eval pipeline, continuous evaluation. DO NOT USE FOR: code-level API migration (use aoai-model-migration), retirement dates or lifecycle planning (use aoai-model-lifecycle).

Plan and manage the Azure OpenAI model upgrade lifecycle. Covers retirement timelines, deployment inventory, update policies, operational checklists, and mid-to-long term migration planning. USE FOR: retirement date, model lifecycle, deprecation, model retirement, when does model retire, deployment inventory, update policy, auto-upgrade, migration planning, model governance, notification setup, Azure Service Health, fine-tuned model retirement, embedding model retirement, model-router. DO NOT USE FOR: code-level API migration (use aoai-model-migration), evaluation or A/B testing (use aoai-migration-evaluation).

Migrate Azure OpenAI applications from GPT-4o/GPT-4o-mini to newer models (GPT-4.1, GPT-5, GPT-5.1 through GPT-5.4, o-series). Covers API changes, client configuration, parameter adaptation, prompt adjustments, and authentication. USE FOR: migrate model, switch model, upgrade model, GPT-4o replacement, AzureOpenAI to OpenAI client, v1 API, max_completion_tokens, reasoning_effort, developer role, system role, parameter adaptation, client factory, model classification. DO NOT USE FOR: retirement dates or lifecycle planning (use aoai-model-lifecycle), evaluation or A/B testing (use aoai-migration-evaluation).

Reply to an email in Outlook Web. Use when the user wants to send an email reply. Navigates to the specific email thread and sends a reply. Requires browser automation via Playwright.

Schedule a meeting with someone using M365 Copilot Chat. Use when the user wants to set up a meeting — Copilot handles name resolution, availability checking, and booking. Requires browser automation via Playwright.

Draft signals for the weekly AI GBB Pulse. Use when asked to write a pulse signal, customer win/loss, escalation, compete signal, product signal, IP initiative, or skills/people signal.

Send a message to someone on Microsoft Teams. Use when the user wants to message a person or channel on Teams. Requires browser automation via Playwright.

Fork an agentic substrate into a customer-flavoured digital clone using an org-brief YAML (from research-company) + the matching industry primer. Clones the substrate to a sibling repo, rebrands literal tokens, repacks the data-fabric generators against the brief's subsidiaries + named ELT, swaps the Kuzu entity-kind tables per the primer, extends the domain registry with the primer's workflow library, generates personae (ELT named from the brief, archetypes from the primer), seeds cadenced rituals + narrative arcs, and scaffolds Node MCP mocks for the brief's stack overrides. Local-only fork by default; no GitHub push. Refuses dirty trees, idempotent re-runnable. USE FOR: fork the substrate for a named customer (Telco, FSI, Airline, Retail, OEM, …), produce a digital-clone-grade demo repo. DO NOT USE FOR: incrementally adding one domain (use compose-domain inside the fork — planned, not yet available), authoring a new substrate from scratch, pitch decks.

Emit a thin org-brief YAML profiling a target organisation — the company-specific overlay that pairs with an industry primer to drive a digital-clone-grade substrate fork. The brief captures only what the vertical can't infer: identity, ownership, size, geography, ~10 subsidiaries, the named ELT, 3–5 strategic themes, and any stack overrides the company publicly disclosed. Function tree, regulator set, entity kinds, proposed-domain library, rituals, KPIs all come from the matching industry primer. Four-phase procedure; claims carry confidence + sources[]; gaps go in uncertainties[], never invented. USE FOR: profile a company before a customer pilot, generate an org-brief, prepare a customer-flavoured demo fork. DO NOT USE FOR: single-process design (use threadlight-design), pitch-deck authoring, code generation, exhaustive personae harvest (compose-org expands archetypes via faker at fork time).

Deploy the Zava agentic-org control plane to Azure Container Apps via azd (Azure Developer CLI). Single uvicorn process: FastAPI backend (462 files, 38 domains, 48 routes, 46 MCP tools, 62 agent graphs, 19 ambient agents, KuzuDB entity graph, working memory, AGT governance) + 3 React/Vite SPAs served via Starlette StaticFiles. Bicep infra plugs into existing shared resources (ACR, App Insights, Citadel APIM). UAMI + RBAC — keyless everywhere. USE FOR: deploy Zava, Zava workspace, Zava control plane, Zava ACA, Zava azd, Zava container, Zava to Azure, Zava Citadel, agentic org deploy, zava-control-plane, deploy control plane, Zava demo deploy, Zava cloud, Zava APIM, azd up zava. DO NOT USE FOR: Threadlight agent deploy (use threadlight-deploy), Threadlight workspace UI (use threadlight-workspace-ui), Citadel hub setup (use citadel-hub-deploy), Foundry agent deploy (use foundry-hosted-agents).

Post-processes the spec produced by specify by applying additional defaults (Foundry hosted agents, Microsoft Agent Framework or the GitHub Copilot SDK as the agent framework - both BYOK against Foundry models, the Copilot SDK for skills and integrated agent loops), selects the right Foundry models / regions / SKUs for the spec, and recommends the companion skills to install.