Update 04 Agentic CLM MicroHack model fleet: drop Claude (→ gpt-5.4), switch renewal to gpt-5.4-nano - #412
Open
glejdisshkembi (glejdis) wants to merge 92 commits into
Open
Conversation
Intake & Drafting now runs on gpt-5.4 (shared with the orchestrator) instead of Anthropic Claude Opus 4.8, and the Obligation & Renewal agent runs on gpt-4.1-mini (2025-04-14, GlobalStandard) instead of gpt-5-mini. Updates config, requirements, infra (bicep + regenerated ARM), deploy scripts, CI, and all docs under 04_Agentic_Contract_Lifecycle_Management. Diagrams (SVG/.mmd) left unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2ceb92-7f36-4509-828e-6425aa8e6adc
Replace the Obligation & Renewal agent's lightweight model (gpt-4.1-mini) with gpt-5.4-nano across code, infra, and docs in the 04 Agentic CLM MicroHack: MODEL_RENEWAL default, Bicep/ARM deployment names, deploy scripts, CI eval workflow, challenge and walkthrough guides, and the Ch3 bake-off. Pinned model version and historical gpt-4o-mini deprecation notes are unchanged; image assets (.png/.svg) are not touched. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8fce816f-a3e7-4004-aee5-159b20e67f1e
glejdisshkembi (glejdis)
changed the title
Mirror remaining delta from glejdis/microhack-aiagents@main on top of the gpt-5.4-nano model switch: - Add 9 Challenge 1 step screenshots wired into challenge-01.md slots (fork, Codespace, az login, azd up, portal RG, Foundry deployments, smoke). - Refresh challenge-01.md, README, and marketing deck. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 56e340cf-1118-41ad-b0d0-8812f357f5f4
…n-admin tenants Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
…n-admin tenants Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Replace the architecture.png diagram (images/ and images/diagrams/) in the 04 Agentic CLM MicroHack with the refreshed diagram showing the Obligation & Renewal agent on GPT 5.4 nano. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8fce816f-a3e7-4004-aee5-159b20e67f1e
…ck docs) My previous commit was based on a pre-sync copy and reverted the .png screenshot refs added by the content sync; this restores them while keeping the Task 6 Path B changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Replace images/diagrams/user-journey.png in the 04 Agentic CLM MicroHack with the refreshed Contract Manager journey diagram showing the Obligation & Renewal and Proactive Alert agents on GPT 5.4 nano. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8fce816f-a3e7-4004-aee5-159b20e67f1e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
…in README Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
…media-compressed) 489 MB source deck compressed to 64 MB (re-encoded embedded videos to H.264/AAC capped at 1280w; downscaled/quantized images and GIFs) so it fits GitHub's 100 MB per-file limit. Structure verified intact (1547/1547 entries, 117 slides load). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Remove the 9 step SVGs in images/challenge-01/steps that have a real PNG twin (01-08, 10) and repoint solution-01.md's references to the PNGs. The 5 svg-only steps (09, 11-14) are kept until real screenshots exist. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Follow-up to 788bde9, which deleted the placeholder SVGs but missed the solution-01.md repoint, leaving broken image links. Point 01,04,05,06,07,08,10 at their PNG twins; 09 stays SVG. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
…dry Playground intake_drafting_agent.py uses FoundryChatClient, which runs the tool-calling loop in-process, so the agent never registers server-side and does not appear in the Foundry portal Agents list or Playground. publish_agent.py publishes the same agent (name, persona, gpt-5.4, Foundry IQ grounding) as a persistent Foundry agent version via AIProjectClient.agents.create_version, so it shows in the Playground for the Task 4 sample prompts/screenshots. Docs updated in challenge-02.md and solution-02.md to explain the in-process vs. portal paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
…optional Two fixes for this nested copy: - The Foundry publish/Playground note landed under Task 1 (before the kb_setup screenshot) instead of Task 4 (before the Playground screenshot), because this file has extra earlier screenshot slots than the standalone repo. Moved the note in challenge-02.md and solution-02.md to Task 4 where it belongs. - Clarify that publishing the agent (publish_agent.py) is an OPTIONAL Playground convenience, not required; --delete is optional, not cleanup you must run. Add a Challenge 3 note that Tracing / Agent Monitoring are populated by OpenTelemetry telemetry from running the in-process demos, not by a registered agent, so an empty Assets -> Agents list is expected and deleting a published agent does not affect monitoring. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Mirror the three real Challenge 02 screenshots (kb-setup, agent demo, Foundry Playground) from microhack-aiagents main (PR microsoft#21) into the hack and repoint challenge-02.md and solution-02.md image slots from placeholder .svg to the real .png, matching the standalone repo. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The three Challenge 02 screenshot slots now use the real PNGs, so the placeholder .svg files are unreferenced. Delete them, matching the standalone repo. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Re-encode the marketing deck's media to keep the committed .pptx well under GitHub's 100MB limit, matching the standalone repo: - MP4 videos re-encoded to H.264 720p (CRF 30): ~303MB -> ~45MB - Large opaque PNGs converted to JPEG; alpha PNGs quantized/downscaled (cap 1280px): ~151MB -> ~9MB - Animated GIFs re-encoded to 480px/96-color palette: ~46MB -> ~4MB All 128 slides, 2364 shapes and 573 media parts preserved and verified loadable; no broken relationships. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Mirror of microhack-aiagents main a8a550c. The Challenge 3 quality gate averaged groundedness over all 16 rows, including 3 refusal + 2 tool_call rows whose correct answer is deliberately not grounded in the row's context snippet — they score low and drag the mean below --gate 4.0 even for a well-built agent. Compute the gate over the groundable categories only (grounded_qa + clause_risk), show both numbers in the scorecard, and add a hint + docs pointing a genuinely low score at an empty/unconnected clm-corpus AI Search index. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Mirror of microhack-aiagents main c3040c0. The renewal model was renamed to gpt-5.4-nano but the version was left at 2025-04-14 (the gpt-4.1 family version), which Azure rejects during azd up template validation because no 'gpt-5.4-nano @ 2025-04-14' exists in the swedencentral catalog. The catalog offers gpt-5.4-nano at 2026-03-17 (GlobalStandard), so pin that across resources.bicep, azuredeploy.json, deploy.sh, deploy.ps1, and the challenge-01 docs; keep 2025-04-14 only in the stale-fork detection lists. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
azure-ai-evaluation pulls in NLTK, whose import-time security finder blocks import regex unless Python runs with -P / PYTHONSAFEPATH, crashing python src/evaluators.py before any row is scored. Pre-import regex so it's cached in sys.modules before nltk loads; add a troubleshooting row. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The earlier regex pre-import was whack-a-mole: NLTK (pulled in by azure-ai-evaluation) blocks *several* helper libs (regex, defusedxml, ...) via its import-time security finder unless Python runs in safe-path mode. Getting past regex just surfaced the same block on defusedxml. Fix at the root: evaluators.py, safety_eval.py and red_team.py now re-run themselves once under PYTHONSAFEPATH (via subprocess) when not already in safe-path mode, so the guard stands down for every such module. Each script re-adds its own dirs to sys.path explicitly, so safe-path mode doesn't break sibling imports. Verified end-to-end against a simulated NLTK guard. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
azure-ai-evaluation pulls in NLTK, whose inisec.py import guard blocks regex/defusedxml/wordnet when they resolve to a path inside the current working directory. Because the hack venv lives inside the repo (./.venv), every site-package counts as "inside cwd" and imports are blocked. -P / PYTHONSAFEPATH do not help -- the guard checks Path.cwd(), not sys.path. Replace the ineffective PYTHONSAFEPATH self-relaunch in evaluators.py, safety_eval.py and red_team.py with a _preload_eval_sdk() shim that imports the azure-ai-evaluation -> NLTK chain once from a throwaway temp directory, so the guard sees those modules as outside cwd and caches them. Update the challenge-03 troubleshooting row with the real root cause + cd-outside-repo workaround. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The Challenge 3 quality gate grounds on the clm-corpus Azure AI Search index, which is seeded in Challenge 1. If a participant runs the evaluation before seeding (or built the index schema via the SharePoint path without crawling any documents), every groundable row scores low and the gate fails with a confusing "groundedness below threshold" instead of the real cause. - evaluators.py: add a best-effort _corpus_document_count() preflight that runs before the (slow, LLM-judged) eval. A definitive 0 stops early with the exact seed_corpus.py / kb_setup.py fix (exit 4); an unknown count never blocks. - challenge-03.md: list "Challenge 1 corpus seeded (non-zero doc count)" as an explicit prerequisite. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The New Foundry portal has no project-level Tracing menu item; tracing and monitoring moved under Build -> agent/model -> Monitor (or the search bar). Update Task 1/Task 2 + the 'No spans' troubleshooting row to cover both the New Foundry and classic click-paths, and make tracing_setup.py's console hint UI-neutral to match. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The quality gate only prints an aggregate groundedness number, so a low score (e.g. 2.8) gives no signal about WHY. --explain prints each row's category, query, response, groundedness score AND the LLM judge's own groundedness_reason, so participants can see which groundable rows lose points and why. Update the 'gate fails low' troubleshooting row to diagnose (check doc count, then --explain) instead of assuming an empty index. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
The GroundednessEvaluator scores each agent response against the row's context field. The 11 gated rows (grounded_qa + clause_risk) used terse one-line context snippets, so the drafting agent's thorough, corpus-grounded answers were penalized for adding true detail not present in the snippet (fallback ranges, DoA signature bands, carve-out lists). --explain confirmed every gated row scored 2.0 with the judge noting correct-but-adds-details-not-in-context, while rows whose context was already complete scored 4.0-5.0. Enrich each gated row's context with the fuller authoritative passages that already exist in the corpus (MSA/NDA template clauses, Standard Clause Library CL-01..CL-12 positions, Contracting Policy P-2, Delegation of Authority DOA-1, Negotiation Playbook fallbacks). Queries, ground truths, and categories are unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
… directly Candidates read instructions in microsoft/MicroHack and never push code, so a fork adds no value and is the top source of stale-checkout DeploymentModelNotSupported failures. Task 1 now opens the repo in a Codespace directly (no fork); Task 2 keeps only build-and-verify. All 'sync your fork' recovery text is replaced with a plain git pull.
…cript fallback Removed the confusing Option A/B/C framing and the Deploy-to-Azure/ARM option; azd up is the single documented path with a one-line deploy.sh fallback.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Rewrite Task 4 to connect to platform-provisioned resources (paste lab-dashboard values into .env) and demote azd up to a self-hosting fallback. Surface APPLICATIONINSIGHTS_CONNECTION_STRING as a HackboxCredential for Challenge 3. Add a lab-dashboard screenshot slot and fix the Task 4 troubleshooting anchor. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 03271468-6418-4ab5-822b-2890df1a432e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0fac447f-3cf0-4144-a2ed-d08060ed7dbc
Docs (challenge-05.md, solution-05.md): rewrite Tasks 2-3 to the current Foundry portal flow (Publish -> Publish to Teams and M365 Copilot -> Prepare Agent -> Individual scope -> Submit -> Apps > Your agents); add the 400 -> Download & customize fallback and a stale-bot/App-ID-collision warning; add a Troubleshooting Teams deployment section (adapted from MS Learn 05a; generic-responses reframed for the MCP-backed agent). Code: proactive_alerts.py builds a tenant-aware BotFrameworkAdapter (channel_auth_tenant=MICROSOFT_APP_TENANT_ID) so continue_conversation stops 401/403-ing on single-tenant Foundry bots; add src/capture_reference_bot.py (aiohttp helper) to capture TEAMS_SERVICE_URL + TEAMS_CONVERSATION_ID from a real Teams chat into .env. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
…repo Port the recent challenge-01 updates from glejdis/microhack-aiagents: - Merge Codespace open+build into one compact Task 1; renumber tasks and align sub-step labels (Step 3a/3b, 4a/4b/4c). - Remove the hard-coded repo URL from step 1. - Anonymize the Create-Codespace screenshot. - Remove the fabricated lab-dashboard screenshot slot and its placeholder image (the Step 3b table already lists every dashboard credential). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e9d165a1-0761-495a-8e5d-8ee61c75a0c4
…gh screenshots Mirror of glejdis/microhack-aiagents. challenge-04.md: correct Part B to match the current portal (Build an agent -> Create an agent, Connect a tool -> Custom -> MCP -> Create, Name/Remote MCP Server endpoint/Unauthenticated, Approve-once dropdown). solution-04.md: expand Part B with five real portal screenshots (endpoint subdomain whitened). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e9d165a1-0761-495a-8e5d-8ee61c75a0c4
…etails screenshot Mirror of glejdis/microhack-aiagents. solution-05.md Part A step 3: clarify that the Publish to Teams and Microsoft 365 app details are pre-filled from the agent, and Developer is the one required field the user must type. Add the real publish dialog screenshot inline. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e9d165a1-0761-495a-8e5d-8ee61c75a0c4
The scan target was an async single-arg callback (def callback(query)). The AI Red Teaming Agent treats a single-parameter callback as a synchronous simple callback whose return value must be a str, so it never awaited our coroutine -> 'Invalid data type <coroutine>, expected str', 0/0 attacks, empty 0.0%% scorecard.
Switch to the OpenAI Chat-Protocol callback shape (messages, stream, session_state, context) returning {'messages': [...]}, which the SDK awaits on the scan's own event loop. Add defensive latest-message extraction and troubleshooting rows in challenge-06 + solution-06.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
Mirror of glejdis/microhack-aiagents. solution-05.md Part A step 3: replace 'Individual scope -> Submit' with the actual Publish options dialog (Direct publish -> Just you vs People in your organization -> Publish) and embed the screenshot. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e9d165a1-0761-495a-8e5d-8ee61c75a0c4
…bject dump) Stop passing our .json name to scan(output_path=...), which this experimental azure-ai-evaluation version turned into a directory named 'redteam_scorecard.json/'. Instead export a clean single redteam_scorecard.json by copying the SDK's own ./.scan_<timestamp>/final_results.json after the run. Also drop the print(result) that dumped an unreadable <RedTeamResult object at 0x...> (the SDK already prints its scorecard table). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
…uccess) Replace the Task 2 placeholder with the actual Publish -> Teams & Microsoft 365 Copilot dropdown, and add screenshots of the publish-details metadata form and the 'Publish successful' confirmation to Task 3. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
…tions, auto icons) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
…s test step) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43d3974f-5d29-4ae8-a120-77f4ca35428c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #404 (merged) updating the model fleet for the 04_Agentic_Contract_Lifecycle_Management MicroHack.
What changed
gpt-5.4(shared with the orchestrator) instead of Anthropic Claude Opus 4.8. All Claude/Anthropic deploy machinery is removed (marketplace attestation params, quota preflight,deployClaudeModelbicep param, Anthropic SDK fallback,anthropicdependency).gpt-5-minitogpt-5.4-nano(version2025-04-14,GlobalStandard) — the lightweight, high-frequency mini tier available in swedencentral.gpt-5.4(orchestrator + drafting),gpt-5.6-sol(clause & risk),gpt-5.4-nano(renewal).az login,azd up, portal resource group, Foundry deployments, smoke test) wired into their slots inchallenges/challenge-01.md.Scope
Updates config,
requirements.txt, infra (resources.bicep/main.bicep+ regeneratedazuredeploy.json), deploy scripts (deploy-lab.ps1/deploy.ps1/deploy.sh), CI, and all challenge/walkthrough/README docs. Diagrams (SVG /.mmd) are intentionally left unchanged.Verified:
az bicep buildcompiles,py_compilepasses, and no residualclaude/gpt-5-mini/gpt-4.1-minireferences remain in code or docs.Recent fixes (MCP / Challenge 4)
421 Invalid Host header: the Container Apps-hostedclm-mcpserver rejected Foundry/orchestrator tool calls because FastMCP's DNS-rebinding protection defaults to a localhost-only Host allowlist, which the public ACA FQDN fails.src/mcp_server/server.pynow disables that protection on the public HTTPS transport (opt-in lockdown viaMCP_ALLOWED_HOSTS). Existing labs must redeploy the server to pick up the new image.src/orchestrator_mcp.pynow probes a failedCLM_MCP_URLand, on421, tells the candidate the server is running an old image and to redeploy (bash deploy/mcp-server/deploy.sh) — instead of the opaqueMCP server failed to initialize: Cancelled via cancel scope. A matching troubleshooting TIP was added to Challenge 4 Part C.