Update 04 Agentic CLM MicroHack model fleet: drop Claude (→ gpt-5.4), switch renewal to gpt-5.4-nano - #412
Merged
Marco Weber (qxsch) merged 154 commits intoAug 12, 2026
Conversation
Intake & Drafting now runs on gpt-5.4 (shared with the orchestrator) instead of Anthropic Claude Opus 4.8, and the Obligation & Renewal agent runs on gpt-4.1-mini (2025-04-14, GlobalStandard) instead of gpt-5-mini. Updates config, requirements, infra (bicep + regenerated ARM), deploy scripts, CI, and all docs under 04_Agentic_Contract_Lifecycle_Management. Diagrams (SVG/.mmd) left unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2ceb92-7f36-4509-828e-6425aa8e6adc
Replace the Obligation & Renewal agent's lightweight model (gpt-4.1-mini) with gpt-5.4-nano across code, infra, and docs in the 04 Agentic CLM MicroHack: MODEL_RENEWAL default, Bicep/ARM deployment names, deploy scripts, CI eval workflow, challenge and walkthrough guides, and the Ch3 bake-off. Pinned model version and historical gpt-4o-mini deprecation notes are unchanged; image assets (.png/.svg) are not touched. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8fce816f-a3e7-4004-aee5-159b20e67f1e
glejdisshkembi (glejdis)
changed the title
Mirror remaining delta from glejdis/microhack-aiagents@main on top of the gpt-5.4-nano model switch: - Add 9 Challenge 1 step screenshots wired into challenge-01.md slots (fork, Codespace, az login, azd up, portal RG, Foundry deployments, smoke). - Refresh challenge-01.md, README, and marketing deck. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 56e340cf-1118-41ad-b0d0-8812f357f5f4
…n-admin tenants Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
…n-admin tenants Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Replace the architecture.png diagram (images/ and images/diagrams/) in the 04 Agentic CLM MicroHack with the refreshed diagram showing the Obligation & Renewal agent on GPT 5.4 nano. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8fce816f-a3e7-4004-aee5-159b20e67f1e
…ck docs) My previous commit was based on a pre-sync copy and reverted the .png screenshot refs added by the content sync; this restores them while keeping the Task 6 Path B changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Replace images/diagrams/user-journey.png in the 04 Agentic CLM MicroHack with the refreshed Contract Manager journey diagram showing the Obligation & Renewal and Proactive Alert agents on GPT 5.4 nano. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8fce816f-a3e7-4004-aee5-159b20e67f1e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
…in README Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
…media-compressed) 489 MB source deck compressed to 64 MB (re-encoded embedded videos to H.264/AAC capped at 1280w; downscaled/quantized images and GIFs) so it fits GitHub's 100 MB per-file limit. Structure verified intact (1547/1547 entries, 117 slides load). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Remove the 9 step SVGs in images/challenge-01/steps that have a real PNG twin (01-08, 10) and repoint solution-01.md's references to the PNGs. The 5 svg-only steps (09, 11-14) are kept until real screenshots exist. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Follow-up to 788bde9, which deleted the placeholder SVGs but missed the solution-01.md repoint, leaving broken image links. Point 01,04,05,06,07,08,10 at their PNG twins; 09 stays SVG. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
…dry Playground intake_drafting_agent.py uses FoundryChatClient, which runs the tool-calling loop in-process, so the agent never registers server-side and does not appear in the Foundry portal Agents list or Playground. publish_agent.py publishes the same agent (name, persona, gpt-5.4, Foundry IQ grounding) as a persistent Foundry agent version via AIProjectClient.agents.create_version, so it shows in the Playground for the Task 4 sample prompts/screenshots. Docs updated in challenge-02.md and solution-02.md to explain the in-process vs. portal paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
…optional Two fixes for this nested copy: - The Foundry publish/Playground note landed under Task 1 (before the kb_setup screenshot) instead of Task 4 (before the Playground screenshot), because this file has extra earlier screenshot slots than the standalone repo. Moved the note in challenge-02.md and solution-02.md to Task 4 where it belongs. - Clarify that publishing the agent (publish_agent.py) is an OPTIONAL Playground convenience, not required; --delete is optional, not cleanup you must run. Add a Challenge 3 note that Tracing / Agent Monitoring are populated by OpenTelemetry telemetry from running the in-process demos, not by a registered agent, so an empty Assets -> Agents list is expected and deleting a published agent does not affect monitoring. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Mirror the three real Challenge 02 screenshots (kb-setup, agent demo, Foundry Playground) from microhack-aiagents main (PR microsoft#21) into the hack and repoint challenge-02.md and solution-02.md image slots from placeholder .svg to the real .png, matching the standalone repo. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The three Challenge 02 screenshot slots now use the real PNGs, so the placeholder .svg files are unreferenced. Delete them, matching the standalone repo. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Re-encode the marketing deck's media to keep the committed .pptx well under GitHub's 100MB limit, matching the standalone repo: - MP4 videos re-encoded to H.264 720p (CRF 30): ~303MB -> ~45MB - Large opaque PNGs converted to JPEG; alpha PNGs quantized/downscaled (cap 1280px): ~151MB -> ~9MB - Animated GIFs re-encoded to 480px/96-color palette: ~46MB -> ~4MB All 128 slides, 2364 shapes and 573 media parts preserved and verified loadable; no broken relationships. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Mirror of microhack-aiagents main a8a550c. The Challenge 3 quality gate averaged groundedness over all 16 rows, including 3 refusal + 2 tool_call rows whose correct answer is deliberately not grounded in the row's context snippet — they score low and drag the mean below --gate 4.0 even for a well-built agent. Compute the gate over the groundable categories only (grounded_qa + clause_risk), show both numbers in the scorecard, and add a hint + docs pointing a genuinely low score at an empty/unconnected clm-corpus AI Search index. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Mirror of microhack-aiagents main c3040c0. The renewal model was renamed to gpt-5.4-nano but the version was left at 2025-04-14 (the gpt-4.1 family version), which Azure rejects during azd up template validation because no 'gpt-5.4-nano @ 2025-04-14' exists in the swedencentral catalog. The catalog offers gpt-5.4-nano at 2026-03-17 (GlobalStandard), so pin that across resources.bicep, azuredeploy.json, deploy.sh, deploy.ps1, and the challenge-01 docs; keep 2025-04-14 only in the stale-fork detection lists. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
azure-ai-evaluation pulls in NLTK, whose import-time security finder blocks import regex unless Python runs with -P / PYTHONSAFEPATH, crashing python src/evaluators.py before any row is scored. Pre-import regex so it's cached in sys.modules before nltk loads; add a troubleshooting row. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The earlier regex pre-import was whack-a-mole: NLTK (pulled in by azure-ai-evaluation) blocks *several* helper libs (regex, defusedxml, ...) via its import-time security finder unless Python runs in safe-path mode. Getting past regex just surfaced the same block on defusedxml. Fix at the root: evaluators.py, safety_eval.py and red_team.py now re-run themselves once under PYTHONSAFEPATH (via subprocess) when not already in safe-path mode, so the guard stands down for every such module. Each script re-adds its own dirs to sys.path explicitly, so safe-path mode doesn't break sibling imports. Verified end-to-end against a simulated NLTK guard. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
azure-ai-evaluation pulls in NLTK, whose inisec.py import guard blocks regex/defusedxml/wordnet when they resolve to a path inside the current working directory. Because the hack venv lives inside the repo (./.venv), every site-package counts as "inside cwd" and imports are blocked. -P / PYTHONSAFEPATH do not help -- the guard checks Path.cwd(), not sys.path. Replace the ineffective PYTHONSAFEPATH self-relaunch in evaluators.py, safety_eval.py and red_team.py with a _preload_eval_sdk() shim that imports the azure-ai-evaluation -> NLTK chain once from a throwaway temp directory, so the guard sees those modules as outside cwd and caches them. Update the challenge-03 troubleshooting row with the real root cause + cd-outside-repo workaround. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The Challenge 3 quality gate grounds on the clm-corpus Azure AI Search index, which is seeded in Challenge 1. If a participant runs the evaluation before seeding (or built the index schema via the SharePoint path without crawling any documents), every groundable row scores low and the gate fails with a confusing "groundedness below threshold" instead of the real cause. - evaluators.py: add a best-effort _corpus_document_count() preflight that runs before the (slow, LLM-judged) eval. A definitive 0 stops early with the exact seed_corpus.py / kb_setup.py fix (exit 4); an unknown count never blocks. - challenge-03.md: list "Challenge 1 corpus seeded (non-zero doc count)" as an explicit prerequisite. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The New Foundry portal has no project-level Tracing menu item; tracing and monitoring moved under Build -> agent/model -> Monitor (or the search bar). Update Task 1/Task 2 + the 'No spans' troubleshooting row to cover both the New Foundry and classic click-paths, and make tracing_setup.py's console hint UI-neutral to match. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The quality gate only prints an aggregate groundedness number, so a low score (e.g. 2.8) gives no signal about WHY. --explain prints each row's category, query, response, groundedness score AND the LLM judge's own groundedness_reason, so participants can see which groundable rows lose points and why. Update the 'gate fails low' troubleshooting row to diagnose (check doc count, then --explain) instead of assuming an empty index. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The GroundednessEvaluator scores each agent response against the row's context field. The 11 gated rows (grounded_qa + clause_risk) used terse one-line context snippets, so the drafting agent's thorough, corpus-grounded answers were penalized for adding true detail not present in the snippet (fallback ranges, DoA signature bands, carve-out lists). --explain confirmed every gated row scored 2.0 with the judge noting correct-but-adds-details-not-in-context, while rows whose context was already complete scored 4.0-5.0. Enrich each gated row's context with the fuller authoritative passages that already exist in the corpus (MSA/NDA template clauses, Standard Clause Library CL-01..CL-12 positions, Contracting Policy P-2, Delegation of Authority DOA-1, Negotiation Playbook fallbacks). Queries, ground truths, and categories are unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Challenge-01: remove confusing Path C (shared-tenant corpus variant) from Task 5. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
Challenge-02: add 'what this agent is' orientation at top of Task 2. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
Challenge-02: drop duplicated 'What good looks like' table + CT-4821 JSON from Task 4. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
… Challenge 6 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
Challenge-02 solution: enrich into a real answer key (full INSTRUCTIONS, 'what correct looks like' per capability, acceptance-checks table). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
…il steps Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
…ublishing - intake_drafting_agent persona: always retrieve the approved template from the knowledge base before drafting; never ask the user to supply one; mark any missing details as [PLACEHOLDERS] - Challenge 2 Task 3: refresh the demo to the real six prompts (draft, 3x cited Q&A, CT-4821 tool call, refusal); fix the "four-prompt" wording - Progressive publishing: each challenge publishes only its own agent via --agent (Ch2 intake-drafting, Ch4 clause-risk, Ch5 obligation-renewal) - Add "Publish to Foundry & test in the Playground" as a named step and renumber optional content safety accordingly Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
… screenshots Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
Challenge-03: clean up Task 2 (Generate traffic) into clear connect/run/open steps. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
Challenge-03: simplify Task 2 (Generate traffic) to the New Foundry path only; drop the New/Classic portal table. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
…check The Foundry portal Monitor tab showed a permanent 'Setup incomplete: Verifying access' banner because the lab granted participants only AI/Search roles - never a monitoring read role on the connected App Insights / Log Analytics, so the data-plane access check never passed (and never self-healed). Grant Monitoring Reader (App Insights) + Log Analytics Reader (Log Analytics workspace) to the lab user in infra/resources.bicep + azuredeploy.json user-role block, in the deploy-lab.ps1 multi-user loop (idempotent, remediates existing labs), and to the signed-in user in deploy.ps1/deploy.sh. Add a Challenge 3 troubleshooting row (challenge + solution) with the immediate portal fix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
…+ solution Task 4's intro jumped straight to 'gpt-5.4 vs gpt-5.4-nano on the same scorecard' with no context. Add a plain-language explainer (A/B test, same eval/only the model changes, quality vs latency/cost trade-off) to challenge-03.md, and a fuller walkthrough with a worked reading of the side-by-side table + the model-choice trade-off to solution-03.md. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
Challenge-03 solution: explain the clm_rubric evaluator in one section before Task 3 (concept + code + Foundry-portal build), align the scorecard/bake-off/quality gate with src/evaluators.py, and add the Task 2 run + trace-trajectory screenshots. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
Challenge-03: promote the clm_rubric evaluator to Task 3 in both the challenge and solution (renumber the following tasks), expand the quality-gate explanation, and add the bake-off screenshot. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
Challenge-03: add the rubric evaluator screenshot to Task 3 (the Create-evaluator dialog showing the auto-generated clm_rubric dimensions and weights). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
Mirror of glejdis/microhack-aiagents main. solution-03 gains the 5-step New Foundry Create-evaluation run flow (create -> target agent -> existing traces -> add ClmRubricEvaluator -> review/submit) and challenge-03 gets the matching text-only steps. Also syncs the upstream rubric-creation screenshots (03-rubric-*) referenced by solution-03. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
…urn detail) Mirror of glejdis/microhack-aiagents main. Extends the Task 3 portal run flow with the Completed run scoring 100% overall and the run detail view (overall metric strip + per-turn Detailed metrics table with View JSON). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
Mirror of glejdis/microhack-aiagents main. Task 4 Part A shows deploy.sh output (build/push, Container App created, managed identity, live /mcp endpoint) and how to copy CLM_MCP_URL for Parts B/C. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
Mirror of glejdis/microhack-aiagents main. Task 1 states the baseline scan provides the before-number for the Task 4 hardening comparison; Task 2 explains --strategies tests obfuscated/encoded attacks native safety misses. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
Challenge-06: replace the Task 1 red-team scorecard screenshot with a clean baseline scan (Overall ASR 0.0%, 0/8 attacks) and update the alt text to match; the solution shares the same image. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ceb0541-1624-4040-bd74-c20395e5ed63
…ound
Mirror of glejdis/microhack-aiagents main. Brings the restructured Task 6
setup ("Register your own app" single-tenant flow) and adds the Dev Tunnels
CLI install + devtunnel user login before hosting (step 4), plus a
troubleshooting row — Codespaces don't ship the devtunnel CLI.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
…ev tunnel + Open in Teams) Bring microsoft#412's solution-05.md in line with main: adds the detailed single-tenant app + Azure Bot registration steps (task6-app-*, task6-create-azure-bot, task6-enable-teams-channel) plus new steps 7-8 for the Dev Tunnels CLI install/host (task6-devtunnel-install) and the Open-in-Teams channel action (task6-open-in-teams), each with an explanation. Ships all 8 referenced task6 images so no links break. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
Adds deploy/capture-bot (deploy.sh, deploy.ps1, README) so the throwaway capture bot can run on Azure Container Apps instead of local + dev tunnel. Dockerfile CMD dispatches on APP_ROLE; capture bot binds CAPTURE_BOT_HOST and now echoes TEAMS_SERVICE_URL + TEAMS_CONVERSATION_ID in its Teams reply so the deployed (container) case can copy them into a local .env. Challenge + solution Task 6 restructured into Option A (local+tunnel) / Option B (deploy), plus a troubleshooting row for the Teams permission gate. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
…olution step 7 Rewrites solution-05.md step 7 to match challenges/challenge-05.md Task 6: present the public-endpoint choice as Option A (local + dev tunnel) vs Option B (deploy to Azure) instead of dev-tunnel-primary with deploy as an afterthought. Keeps the devtunnel screenshot under Option A. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
…7 Option B Adds task6-deploy-capture-bot.png (a successful deploy/capture-bot/deploy.sh run showing the printed Messaging endpoint + follow-up log/delete commands) under Option B, keeping the dev-tunnel screenshot under Option A. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
The Teams install/sideload gate blocks the capture-bot step for many tenants, making Tasks 5-7 (proactive alerts) unrunnable. Remove the whole optional extension and its delivery code/images; keep the Obligation & Renewal agent (used by the C1 smoke test, C3 tracing demo, and publish). - Docs: challenge-05.md + solution-05.md trimmed to publish-only (Tasks 1-4); README, coach-guide, src/README, images READMEs, copilot-instructions updated - Code: delete proactive_alerts.py, capture_reference_bot.py, deploy/capture-bot/; revert Dockerfile to MCP-only; drop botbuilder/aiohttp deps; drop the MICROSOFT_APP_*/TEAMS_* env scaffolding (.env.example, write_env, deploy.sh/ps1) - Diagrams: remove the proactive-alert edge from architecture.mmd and the README mermaid; regenerate the C1 azure-resources diagram label Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
Mirror latest Challenge 6 state from glejdis/microhack-aiagents@main: - Update challenge-06.md and solution-06.md (guardrail/safety walkthrough) - Refresh 02-redteam-scorecard.png - Add guardrail step images (create-menu, pii-datatypes, controls, review, blocked) and safety-eval images (prompts, summary, safety-gate-dryrun) - Remove superseded images (02-safety-gate.png/.svg, 05-guardrails-protected-materials.png, 06-guardrails-select-agents.png) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2131e192-9edc-47a7-92a2-14c05655a4b1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #404 (merged) updating the model fleet for the 04_Agentic_Contract_Lifecycle_Management MicroHack.
What changed
gpt-5.4(shared with the orchestrator) instead of Anthropic Claude Opus 4.8. All Claude/Anthropic deploy machinery is removed (marketplace attestation params, quota preflight,deployClaudeModelbicep param, Anthropic SDK fallback,anthropicdependency).gpt-5-minitogpt-5.4-nano(version2025-04-14,GlobalStandard) — the lightweight, high-frequency mini tier available in swedencentral.gpt-5.4(orchestrator + drafting),gpt-5.6-sol(clause & risk),gpt-5.4-nano(renewal).az login,azd up, portal resource group, Foundry deployments, smoke test) wired into their slots inchallenges/challenge-01.md.Scope
Updates config,
requirements.txt, infra (resources.bicep/main.bicep+ regeneratedazuredeploy.json), deploy scripts (deploy-lab.ps1/deploy.ps1/deploy.sh), CI, and all challenge/walkthrough/README docs. Diagrams (SVG /.mmd) are intentionally left unchanged.Verified:
az bicep buildcompiles,py_compilepasses, and no residualclaude/gpt-5-mini/gpt-4.1-minireferences remain in code or docs.Recent fixes (MCP / Challenge 4)
421 Invalid Host header: the Container Apps-hostedclm-mcpserver rejected Foundry/orchestrator tool calls because FastMCP's DNS-rebinding protection defaults to a localhost-only Host allowlist, which the public ACA FQDN fails.src/mcp_server/server.pynow disables that protection on the public HTTPS transport (opt-in lockdown viaMCP_ALLOWED_HOSTS). Existing labs must redeploy the server to pick up the new image.src/orchestrator_mcp.pynow probes a failedCLM_MCP_URLand, on421, tells the candidate the server is running an old image and to redeploy (bash deploy/mcp-server/deploy.sh) — instead of the opaqueMCP server failed to initialize: Cancelled via cancel scope. A matching troubleshooting TIP was added to Challenge 4 Part C.