Update 04 Agentic CLM MicroHack model fleet: drop Claude (→ gpt-5.4), switch renewal to gpt-5.4-nano

03-Azure/01-04-AI/04_Agentic_Contract_Lifecycle_Management/.dockerignore

@@ -0,0 +1,12 @@
+# Keep the MCP server image build context minimal — only requirements.txt and
+# src/ are needed to run the server. Everything else (docs, images, walkthrough,
+# lab automation, screenshots) is excluded.
+*
+!requirements.txt
+!src
+
+# Prune noise re-included with src/
+**/__pycache__
+**/*.pyc
+**/*.pyo
+**/.pytest_cache

03-Azure/01-04-AI/04_Agentic_Contract_Lifecycle_Management/.env.example

@@ -1,6 +1,7 @@
 # ==========================================================================
 # Foundry CLM Microhack — environment template
-# Copy to `.env` (never commit `.env`). Challenge 1's deploy script autofills
+# Copy to `.env` (never commit `.env`). For a MicroHack event, paste the values
+# from your lab dashboard (Challenge 1, Task 4); self-hosting `azd up` autofills
 # most of these for you. Fill the Bot values in Challenge 5.
 # ==========================================================================
 
@@ -9,15 +10,14 @@
 # Example: https://<account>.services.ai.azure.com/api/projects/<project>
 AZURE_AI_PROJECT_ENDPOINT=
 
-# --- Model deployments (multi-model fleet) --------------------------------
-# Deployment names you created in Challenge 1. Intake & Drafting runs on Claude
-# (GA in Microsoft Foundry); Clause & Risk runs on GPT-5.6 Sol; the orchestrator
-# + lightweight agent run on GPT. If you skipped Claude (DEPLOY_CLAUDE_MODEL=false
-# — no quota/marketplace offer), set MODEL_DRAFTING to gpt-5.4 instead.
+# --- Model deployments (multi-model GPT fleet) ----------------------------
+# Deployment names you created in Challenge 1. The orchestrator AND the Intake &
+# Drafting agent run on gpt-5.4 (the highest-quota flagship in Foundry); Clause &
+# Risk runs on GPT-5.6 Sol; the lightweight renewal agent runs on gpt-5.4-nano.
 MODEL_ORCHESTRATOR=gpt-5.4
-MODEL_DRAFTING=claude-opus-4-8
+MODEL_DRAFTING=gpt-5.4
 MODEL_CLAUSE_RISK=gpt-5.6-sol
-MODEL_RENEWAL=gpt-5-mini
+MODEL_RENEWAL=gpt-5.4-nano
 
 # --- Azure AI Search (Foundry IQ knowledge base) --------------------------
 AZURE_SEARCH_ENDPOINT=
@@ -66,7 +66,7 @@ AZURE_TRACING_GEN_AI_CONTENT_RECORDING_ENABLED=true
 # with your AAD login (default). Set them to point the judge at a dedicated
 # Azure OpenAI deployment (e.g. a cheaper/faster model) or to use an API key.
 # AZURE_OPENAI_ENDPOINT=https://<your-aoai>.openai.azure.com/
-# AZURE_OPENAI_DEPLOYMENT=gpt-5-mini
+# AZURE_OPENAI_DEPLOYMENT=gpt-5.4-nano
 # AZURE_OPENAI_API_VERSION=2024-10-21
 # AZURE_OPENAI_API_KEY=
 # Evaluator batch concurrency. Lower it (or pass --workers) if a shared judge

03-Azure/01-04-AI/04_Agentic_Contract_Lifecycle_Management/.github/copilot-instructions.md

@@ -63,7 +63,7 @@ param(
 
 - `deploymentType`: `"resourcegroup"` | `"resourcegroup-with-subscriptionowner"` | `"subscription"`
 - `groups`: `["M365-E5-Users"]` for this hack — the CLM scenario needs M365 E5 (Teams publish, SharePoint corpus, proactive alerts). Use `[]` for Azure-only, or `["GHCPUsers"]` for a GitHub Copilot seat.
-- `preferredLocation`: comma-separated regions, priority order — swedencentral first for gpt-5.4 + Claude Opus 4.8 availability
+- `preferredLocation`: comma-separated regions, priority order — swedencentral first for gpt-5.4 availability
 - `estimatedDailyCostsUsd`: per-user per-day cost for the lifecycle wizard (Foundry models + AI Search + App Insights)
 
 ## Returning Credentials to Users

03-Azure/01-04-AI/04_Agentic_Contract_Lifecycle_Management/.github/workflows/ci-eval.yml

@@ -1,62 +1,62 @@
-name: ci-eval
-
-# Continuous evaluation gate (Challenge 3 quality + Challenge 6 safety).
-# Runs on demand and nightly. Requires Azure secrets to be configured, so it is
-# guarded: if AZURE_CLIENT_ID is not set, the job no-ops instead of failing.
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 6 * * 1-5" # weekdays 06:00 UTC
-
-permissions:
-  id-token: write # OIDC federated login to Azure
-  contents: read
-
-jobs:
-  eval-gate:
-    runs-on: ubuntu-latest
-    env:
-      AZURE_AI_PROJECT_ENDPOINT: ${{ secrets.AZURE_AI_PROJECT_ENDPOINT }}
-      MODEL_ORCHESTRATOR: ${{ vars.MODEL_ORCHESTRATOR || 'gpt-5.4' }}
-      MODEL_DRAFTING: ${{ vars.MODEL_DRAFTING || 'claude-opus-4-8' }}
-      MODEL_CLAUSE_RISK: ${{ vars.MODEL_CLAUSE_RISK || 'gpt-5.6-sol' }}
-      MODEL_RENEWAL: ${{ vars.MODEL_RENEWAL || 'gpt-5-mini' }}
-      AZURE_SEARCH_INDEX: ${{ vars.AZURE_SEARCH_INDEX || 'clm-corpus' }}
-      PYTHONPATH: src
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Skip if Azure isn't configured
-        id: guard
-        run: |
-          if [ -z "${{ secrets.AZURE_CLIENT_ID }}" ]; then
-            echo "configured=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::Azure secrets not set — skipping the eval gate. Configure AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_SUBSCRIPTION_ID and AZURE_AI_PROJECT_ENDPOINT to enable."
-          else
-            echo "configured=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - uses: actions/setup-python@v5
-        if: steps.guard.outputs.configured == 'true'
-        with:
-          python-version: "3.11"
-
-      - name: Install dependencies
-        if: steps.guard.outputs.configured == 'true'
-        run: pip install -r requirements.txt "azure-ai-evaluation[redteam]"
-
-      - name: Azure login (OIDC)
-        if: steps.guard.outputs.configured == 'true'
-        uses: azure/login@v2
-        with:
-          client-id: ${{ secrets.AZURE_CLIENT_ID }}
-          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
-      - name: Quality gate (Challenge 3)
-        if: steps.guard.outputs.configured == 'true'
-        run: python src/evaluators.py --gate 4.0
-
-      - name: Safety gate (Challenge 6)
-        if: steps.guard.outputs.configured == 'true'
-        run: python src/safety_eval.py --gate 0.1 --safety-evals
+name: ci-eval
+
+# Continuous evaluation gate (Challenge 3 quality + Challenge 6 safety).
+# Runs on demand and nightly. Requires Azure secrets to be configured, so it is
+# guarded: if AZURE_CLIENT_ID is not set, the job no-ops instead of failing.
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 6 * * 1-5" # weekdays 06:00 UTC
+
+permissions:
+  id-token: write # OIDC federated login to Azure
+  contents: read
+
+jobs:
+  eval-gate:
+    runs-on: ubuntu-latest
+    env:
+      AZURE_AI_PROJECT_ENDPOINT: ${{ secrets.AZURE_AI_PROJECT_ENDPOINT }}
+      MODEL_ORCHESTRATOR: ${{ vars.MODEL_ORCHESTRATOR || 'gpt-5.4' }}
+      MODEL_DRAFTING: ${{ vars.MODEL_DRAFTING || 'gpt-5.4' }}
+      MODEL_CLAUSE_RISK: ${{ vars.MODEL_CLAUSE_RISK || 'gpt-5.6-sol' }}
+      MODEL_RENEWAL: ${{ vars.MODEL_RENEWAL || 'gpt-5.4-nano' }}
+      AZURE_SEARCH_INDEX: ${{ vars.AZURE_SEARCH_INDEX || 'clm-corpus' }}
+      PYTHONPATH: src
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Skip if Azure isn't configured
+        id: guard
+        run: |
+          if [ -z "${{ secrets.AZURE_CLIENT_ID }}" ]; then
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Azure secrets not set — skipping the eval gate. Configure AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_SUBSCRIPTION_ID and AZURE_AI_PROJECT_ENDPOINT to enable."
+          else
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-python@v5
+        if: steps.guard.outputs.configured == 'true'
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        if: steps.guard.outputs.configured == 'true'
+        run: pip install -r requirements.txt "azure-ai-evaluation[redteam]"
+
+      - name: Azure login (OIDC)
+        if: steps.guard.outputs.configured == 'true'
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Quality gate (Challenge 3)
+        if: steps.guard.outputs.configured == 'true'
+        run: python src/evaluators.py --gate 3.0
+
+      - name: Safety gate (Challenge 6)
+        if: steps.guard.outputs.configured == 'true'
+        run: python src/safety_eval.py --gate 0.1 --safety-evals

03-Azure/01-04-AI/04_Agentic_Contract_Lifecycle_Management/.github/workflows/validate.yml

@@ -1,47 +1,47 @@
-name: validate
-
-on:
-  push:
-    branches: ["**"]
-  pull_request:
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Byte-compile all challenge + shared code
-        run: python -m compileall -q src labautomation
-
-      - name: Validate JSON + evaluation dataset
-        run: |
-          python - <<'PY'
-          import json, pathlib, sys
-          root = pathlib.Path(".")
-          bad = 0
-          for p in root.rglob("*.json"):
-              if "node_modules" in p.parts:
-                  continue
-              try:
-                  json.loads(p.read_text(encoding="utf-8"))
-              except Exception as e:
-                  print(f"BAD JSON {p}: {e}"); bad += 1
-          ds = root / "src" / "data" / "evaluation" / "evaluation_dataset.jsonl"
-          rows = [l for l in ds.read_text(encoding="utf-8").splitlines() if l.strip()]
-          for i, line in enumerate(rows, 1):
-              try:
-                  json.loads(line)
-              except Exception as e:
-                  print(f"BAD JSONL line {i}: {e}"); bad += 1
-          print(f"validated {len(rows)} eval rows")
-          sys.exit(1 if bad else 0)
-          PY
-
-      # Go Further: run the Challenge 3 quality gate on a schedule/PR once Azure
-      # secrets (AZURE_AI_PROJECT_ENDPOINT, etc.) are configured as repo secrets:
-      #   python src/evaluators.py --gate 4.0
+name: validate
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Byte-compile all challenge + shared code
+        run: python -m compileall -q src labautomation
+
+      - name: Validate JSON + evaluation dataset
+        run: |
+          python - <<'PY'
+          import json, pathlib, sys
+          root = pathlib.Path(".")
+          bad = 0
+          for p in root.rglob("*.json"):
+              if "node_modules" in p.parts:
+                  continue
+              try:
+                  json.loads(p.read_text(encoding="utf-8"))
+              except Exception as e:
+                  print(f"BAD JSON {p}: {e}"); bad += 1
+          ds = root / "src" / "data" / "evaluation" / "evaluation_dataset.jsonl"
+          rows = [l for l in ds.read_text(encoding="utf-8").splitlines() if l.strip()]
+          for i, line in enumerate(rows, 1):
+              try:
+                  json.loads(line)
+              except Exception as e:
+                  print(f"BAD JSONL line {i}: {e}"); bad += 1
+          print(f"validated {len(rows)} eval rows")
+          sys.exit(1 if bad else 0)
+          PY
+
+      # Optional: run the Challenge 3 quality gate on a schedule/PR once Azure
+      # secrets (AZURE_AI_PROJECT_ENDPOINT, etc.) are configured as repo secrets:
+      #   python src/evaluators.py --gate 4.0

03-Azure/01-04-AI/04_Agentic_Contract_Lifecycle_Management/Dockerfile

@@ -0,0 +1,47 @@
+# syntax=docker/dockerfile:1
+# =============================================================================
+# Challenge 4 — container image for the CLM MCP server (remote / streamable-HTTP)
+# -----------------------------------------------------------------------------
+# The build CONTEXT must be the REPO ROOT — the image needs requirements.txt and
+# src/. Deploy it with one command (builds in the cloud, no local Docker needed):
+#
+#     az containerapp up -n clm-mcp -g <rg> --source . \
+#         --target-port 8000 --ingress external \
+#         --env-vars AZURE_AI_PROJECT_ENDPOINT=<your-project-endpoint>
+#
+# The server then exposes the MCP tools at:
+#     https://<app-name>.<region>.azurecontainerapps.io/mcp
+# which a Foundry agent (portal Playground or orchestrator_mcp.py with CLM_MCP_URL)
+# connects to as an MCP client. See challenges/challenge-04.md · Task 4.
+# =============================================================================
+FROM python:3.11-slim
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1 \
+    MCP_TRANSPORT=streamable-http \
+    MCP_HOST=0.0.0.0 \
+    MCP_PORT=8000
+
+WORKDIR /app
+
+# unixodbc is only needed if you wire AZURE_SQL_CONNECTION_STRING (pyodbc);
+# harmless otherwise. curl is used by the container HEALTHCHECK below.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends unixodbc curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt ./
+RUN pip install -r requirements.txt
+
+COPY src/ ./src/
+
+EXPOSE 8000
+
+# Liveness: the streamable-HTTP endpoint answers on /mcp once the app is up.
+# (A bare GET returns 4xx without a session — that still proves it's serving, so
+# we don't use `-f`; any HTTP response means the process is alive.)
+HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
+    CMD curl -s -o /dev/null "http://127.0.0.1:${MCP_PORT}/mcp" || exit 1
+
+CMD ["python", "src/mcp_server/server.py", "--http"]