apex-localops

Deploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffold, agent.yaml, dataset curation from traces, model fine-tuning (SFT/DPO/RFT). USE FOR: azd ai agent, azd provision/deploy, deploy agent, hosted agent, create agent, add tool to agent, invoke agent, evaluate agent, continuous eval, continuous monitoring, optimize prompt, improve prompt, optimize agent instructions, agent optimizer, deploy model, Foundry project, RBAC, role assignment, permissions, quota, capacity, region, troubleshoot agent, deployment failure, AI Services, create Foundry resource, provision, knowledge index, customize deployment, onboard, availability, fine-tune, SFT, DPO, RFT, training-data, grader, distillation, fine-tuned model, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure-prepare).

**WORKFLOW SKILL** — Plan, create, and operate AKS (Arc) clusters on Azure Local: requirements, create via portal/CLI/API, node pools & autoscaling, upgrades, networking, storage, security/identity, and monitoring. WHEN: "AKS on Azure Local", "AKS Arc", "create AKS cluster Azure Local", "Kubernetes on Azure Local", "AKS hybrid", "node pool Azure Local", "autoscale AKS Arc", "upgrade AKS Arc cluster". USE FOR: AKS cluster lifecycle on Azure Local. DO NOT USE FOR: AKS in Azure cloud (use azure-kubernetes), model serving on AKS (use airunway-aks-setup).

**WORKFLOW SKILL** — Deploy an Azure Local instance via Azure portal or ARM template: prerequisites, software download, OS install, Arc registration, and cloud deployment. WHEN: "deploy Azure Local", "install Azure Local", "Azure Local deployment", "deploy via portal", "Azure Local ARM template", "register Azure Local with Arc", "download Azure Local software". USE FOR: running a fresh Azure Local 23H2+ deployment end to end. DO NOT USE FOR: planning/sizing (use azlocal-plan-size), SFF edge devices (use azlocal-sff), AKS clusters (use aksarc-on-azure-local).

**WORKFLOW SKILL** — Deploy and operate Azure Local Small Form Factor (SFF) for ruggedized/edge single-host scenarios: subscription setup, install (incl. in a VM), connect via portal, run containerized/GPU workloads, and troubleshoot. WHEN: "Azure Local small form factor", "SFF Azure Local", "ruggedized Azure Local", "edge single host Azure Local", "SFF install", "SFF in a VM", "SFF configurator app", "SFF containerized workloads". USE FOR: SFF edge/single-host evaluation and operation. DO NOT USE FOR: multi-node cluster deployment (use azlocal-deploy).

**ANALYSIS SKILL** — Troubleshoot Azure Local deployment, registration, and update failures: collect logs, use the diagnostic support tools, and open support. WHEN: "troubleshoot Azure Local", "Azure Local deployment failed", "collect logs Azure Local", "Azure Local registration issue", "deployment validation failed", "diagnostic support tool", "update failed Azure Local", "Configurator app issue". USE FOR: diagnosing Azure Local infrastructure failures. DO NOT USE FOR: tenant app/Kubernetes debugging (use azure-diagnostics).

**WORKFLOW SKILL** — Create and manage Arc VMs on Azure Local (single or at scale via Bicep): VM images, logical networks, NICs, GPU (DDA/partitioning), and Trusted Launch. WHEN: "create Azure Local VM", "create Azure Local VMs at scale", "Azure Local VM Bicep", "deploy multiple Azure Local VMs", "Arc VM Azure Local", "manage Azure Local VMs", "Azure Local VM image", "attach GPU Azure Local", "GPU partitioning Azure Local", "Trusted Launch Azure Local", "VM extensions Azure Local". USE FOR: Arc VM lifecycle and at-scale Bicep VM deployment on an Azure Local instance. DO NOT USE FOR: cluster networking design (use azlocal-networking), choosing a workload type (use azlocal-workloads).

**WORKFLOW SKILL** — Run workloads on Azure Local: Arc VMs, AKS clusters, SQL Server, and Azure Virtual Desktop (AVD). Routes to the right workload path. WHEN: "run workloads on Azure Local", "AVD on Azure Local", "Azure Virtual Desktop Azure Local", "SQL Server on Azure Local", "run AKS on Azure Local", "deploy app to Azure Local", "workloads Azure Local". USE FOR: choosing and starting a workload type on an existing instance. DO NOT USE FOR: deep AKS cluster lifecycle (use aksarc-on-azure-local), VM image/NIC lifecycle (use azlocal-vm-management).

**WORKFLOW SKILL** — Configure Azure Local host and tenant networking: Network ATC intents, software-defined networking (SDN), Network Controller, datacenter firewall, and network security groups (NSGs). WHEN: "Azure Local networking", "Network ATC", "configure SDN Azure Local", "Network Controller", "datacenter firewall", "network security groups Azure Local", "NSG Azure Local", "logical networks Azure Local". USE FOR: host networking intents and tenant SDN/firewall/NSG configuration. DO NOT USE FOR: VM lifecycle (use azlocal-vm-management), cloud Azure networking (use azure-enterprise-infra-planner).

**ANALYSIS SKILL** — Manage Azure Local security: security baseline/defaults, BitLocker encryption, Secure Boot, Microsoft Defender for Cloud, and compliance assurance (ISO 27001, PCI DSS, HIPAA, FedRAMP). WHEN: "Azure Local security", "security baseline Azure Local", "BitLocker Azure Local", "Secure Boot Azure Local", "Defender for Cloud Azure Local", "Azure Local compliance", "application control WDAC". USE FOR: hardening an Azure Local instance and mapping to compliance standards. DO NOT USE FOR: cloud subscription compliance scans (use azure-compliance).

**WORKFLOW SKILL** — Keep Azure Local current: apply solution updates (PowerShell, Azure Update Manager, offline) and perform OS/solution upgrades with readiness validation. WHEN: "update Azure Local", "Azure Local solution update", "Azure Update Manager Azure Local", "upgrade Azure Local", "22H2 to 23H2", "update via PowerShell Azure Local", "offline update Azure Local", "validate upgrade readiness". USE FOR: applying updates and OS/solution upgrades. DO NOT USE FOR: troubleshooting failed updates beyond the update flow (use azlocal-troubleshoot).

**WORKFLOW SKILL** — Plan, deploy, and operate Azure Local disconnected operations (air-gapped / no continuous Azure connectivity): network, identity, security, PKI, control-plane appliance, and local management via CLI/PowerShell. WHEN: "Azure Local disconnected operations", "air-gapped Azure Local", "Azure Local without internet", "disconnected operations deploy", "local control plane appliance", "disconnected identity", "disconnected PKI", "sovereign air gap Azure Local". USE FOR: air-gapped Azure Local deployments and local operations. DO NOT USE FOR: connected-instance deployment (use azlocal-deploy).

**WORKFLOW SKILL** — Migrate VMs to Azure Local using Azure Migrate (Hyper-V and VMware) or PowerShell: requirements, replication, migration, and IP preservation. WHEN: "migrate to Azure Local", "Azure Migrate Azure Local", "migrate Hyper-V to Azure Local", "migrate VMware to Azure Local", "VM migration Azure Local", "replicate VMs Azure Local", "maintain static IP migration". USE FOR: moving existing Hyper-V/VMware VMs onto Azure Local. DO NOT USE FOR: cross-cloud app migration (use azure-cloud-migrate), creating net-new VMs (use azlocal-vm-management).

**ANALYSIS SKILL** — Monitor Azure Local with Insights, metrics, and alerts (single and at-scale), plus observability concepts. WHEN: "monitor Azure Local", "Azure Local Insights", "Azure Local metrics", "Azure Local alerts", "health alerts Azure Local", "monitor multiple Azure Local systems", "observability Azure Local", "monitor at scale". USE FOR: Azure Local instance health monitoring. DO NOT USE FOR: app/Kubernetes runtime debugging on Azure (use azure-diagnostics / azure-kusto).

**ANALYSIS SKILL** — Plan and size an Azure Local instance: node count, network reference pattern, system/physical-network/firewall requirements, and Active Directory prep. WHEN: "plan Azure Local", "size Azure Local cluster", "Azure Local requirements", "how many nodes Azure Local", "network reference pattern", "Azure Local system requirements", "physical network requirements", "firewall requirements Azure Local". USE FOR: pre-deployment planning and requirement validation. DO NOT USE FOR: running the deployment (use azlocal-deploy), SFF edge sizing (use azlocal-sff).

**ANALYSIS SKILL** — Explain Microsoft Sovereign Cloud foundations: digital sovereignty, European digital commitments, and the data / operational / technological-independence / key-management controls. WHEN: "what is Microsoft Sovereign Cloud", "digital sovereignty", "sovereignty controls", "data controls sovereign", "operational controls sovereign", "technological independence", "key management controls", "European digital commitments". USE FOR: explaining sovereignty concepts and the control taxonomy. DO NOT USE FOR: implementing public-cloud (use sov-public-cloud) or private-cloud (use sov-private-cloud) solutions.

**ANALYSIS SKILL** — Design with Microsoft Sovereign Private Cloud on Azure Local: connected vs disconnected operations, use cases, and Foundry Local AI (deploy/run models, BYOM, inference) for on-premises sovereign AI. WHEN: "Sovereign Private Cloud", "sovereign Azure Local", "connected operations", "disconnected operations sovereign", "Foundry Local", "on-premises AI sovereign", "run models on Azure Local", "sovereign AI workloads". USE FOR: designing on-premises sovereign solutions on Azure Local. DO NOT USE FOR: public-cloud sovereignty (use sov-public-cloud), air-gapped operational runbooks (use azlocal-disconnected).

**ANALYSIS SKILL** — Design with Microsoft Sovereign Public Cloud: capabilities, Data Guardian, external/confidential key management, confidential computing, Sovereign Landing Zone, sovereign policies, and AI workload sovereignty. WHEN: "Sovereign Public Cloud", "Sovereign Landing Zone", "Data Guardian", "external key management sovereign", "confidential computing sovereign", "sovereign policy initiatives", "AI workloads sovereignty". USE FOR: designing sovereign solutions in Azure public regions. DO NOT USE FOR: on-premises sovereign (use sov-private-cloud), foundational concepts (use sov-cloud-foundations).