Welcome @michaelliav 👋 — start here

[ZaltaClaw]

Welcome aboard as admin on Code Forge!

Start here

1. Accept the repo invite (in your GitHub email or https://github.com/ZaltaClaw/code-forge-workflow/invitations).
2. Read CLAUDE.md at the repo root — full orientation, ~10 min read.
3. Walk through docs/ONBOARDING.md — 30-min ramp from clone to first PR.
4. When you start claude in this repo, the per-directory CLAUDE.md files load context automatically. Try / to see the project slash commands in .claude/commands/.

Quick map

• docs/ARCHITECTURE.md — request lifecycle, capacity model, failure modes
• docs/SECURITY.md — threat model + controls
• docs/OPERATIONS.md — runbooks
• charts/code-forge/CLAUDE.md — Helm chart deep dive
• infra/CLAUDE.md — Bicep IaC

What I'd love your eyes on first

• The threat model in docs/SECURITY.md — does it match how Microsoft thinks about agent isolation?
• The Foundry wiring in containers/model-gateway/ — anything obvious we're missing for a Microsoft-paved-road customer?
• The agent-pod devcontainer setup vs. what you typically see in the field.

Architecture diagram: I'll attach the latest one in a follow-up comment once we lock the v6 layout — if you have a preferred diagramming tool style for Microsoft customers, drop it here.

— Roey

[ZaltaClaw]

@michaelliav — welcome aboard 👋

You now have push access. Quick orientation:

What this repo is:
A working demo of Microsoft Agent Framework Workflows (learn.microsoft.com/agent-framework/workflows/) that strings five coding agents into a graph: spec → impl → fan-out review (Tests + Security + Docs) → fan-in → switch-case routing → conditional revision loop. The SecurityReviewer runs through Claude Sonnet via Azure AI Foundry; everything else is on Azure OpenAI. Topology runs on AKS with workload identity federation, no static secrets.

Where I'd love your eyes — infra/modules/foundry.bicep:

I have the Hub + Project provisioned and a system-assigned MSI on the model-gateway, but three things need a Foundry RBAC expert:

1. Federated identity scope — model-gateway pod uses Azure workload identity. What's the minimum-privilege role for the federated credential against the Foundry project — Cognitive Services User on the project resource, or do we need Azure AI Developer on the parent Hub for inference token issuance?
2. Content filtering policy — which Foundry-side filter level survives the SecurityReviewer's intentionally-spicy code-injection review prompts without false-positive blocking the workflow? I don't want to bypass it; I want a prod-defensible config.
3. Post-deploy bootstrap — the Anthropic terms acceptance gate for Claude on Foundry. Best-practice path to automate via deployment script vs. surface as a manual one-time pre-req?

Proposed split:

• You: infra/modules/foundry.bicep hardening + answers to the three questions above on this issue
• Me: GitHub Actions CI matrix (ruff/black, pytest, bicep build, helm lint, workflow dry-run with CODE_FORGE_PROVIDERS=all-openai) — already on branch roy2392/ci-workflow-matrix, PR up shortly
• Together: v6 architecture diagram once both PRs land

Open michaelliav/foundry-hardening whenever you're ready. Looking forward to it.

[ZaltaClaw]

Status update from Hermes — splitting the work as we said. Two draft PRs up:

#3 — CI test pyramid (my half)
Branch: roy2392/ci-tests-only-no-workflow-file

• 7 graph-build smoke tests, all offline, deterministic
• ruff check/format clean, helm lint+template clean, az bicep build 81 KB clean
• The 5-job CI YAML is drafted but blocked on a one-time workflow OAuth scope refresh on the gh token; will land in a follow-up commit

#4 — Foundry hardening starter (Michael's half, jump-started)
Branch: hermes/foundry-hardening-starter

• Full rewrite of infra/modules/foundry.bicep — Anthropic deployments + federated MI + RBAC + terms-acceptance script
• New gateway MI in identity.bicep (agent MI gets zero Foundry perms — gateway is the only path)
• Three open questions inline as TODO @michaelliav at the exact decision points

@michaelliav — when you're ready, either comment on #4 with answers and I'll iterate, or git checkout -b michaelliav/foundry-hardening hermes/foundry-hardening-starter and take it over yourself. Either works.

— Hermes