Release v3.7.0 · Azure/GPT-RAG

Changed

Operator impact. Issue #571 is delivered through implementation PR #573 and documentation PR #574, with orchestrator v3.8.0 and ingestion v2.5.0 pinned as one umbrella combination.
Safe defaults. Metadata audit events and ingestion provenance remain disabled by default, and sensitive-content capture remains independently disabled. Existing deployments do not change behavior until an operator explicitly opts in.
Key Vault-backed HMAC integration. Post-provisioning creates or reuses a 256-bit audit pseudonymization key and stores only its Key Vault reference in App Configuration. Existing operator-managed references are preserved, valid legacy plaintext keys are migrated without changing their value, and rotation remains explicit.
Additive Search migration. Provenance and governance fields are merged into the existing RAG Search index in place. Existing documents and operator-owned fields are preserved; incompatible same-name fields fail before update, with no delete/recreate fallback.
Governance boundary. The shared audit contract provides technical evidence for adopter governance and incident response. It does not establish legal or regulatory compliance. Operators remain responsible for retention enforcement, confirmed deletion, telemetry access, export controls, and reviewed enablement policy.

GPT-RAG governance and Search suites: 131 tests passed.
Bicep compilation, template rendering, static RBAC checks, manifest and component-release checks, and create-only Azure previews passed.
Runtime provisioning could not complete. Azure platform capacity blocked Azure AI Search in eastus2 and the Container Apps managed environment in swedencentral; the Sweden Central attempt also exposed an ARM nested deployment name over the 64-character limit.
No runtime endpoints, application health checks, live governance defaults, Search migration result, or Application Insights/KQL evidence were obtained.