v3.8.0

Caution

Do not deploy this release. A clean deployment fails at the
gpt-rag-orchestrator image build, so azd deploy cannot complete. Use
v3.8.2 instead,
which pins the fixed component versions. The notes below still describe the
features this cycle delivers and are kept for reference.

Changed

• Hosted agent on Microsoft Foundry is the fresh-deployment default. ADR-0001
  makes the hosted/no-panel topology the default for new deployments. Classic,
  hosted/no-panel, and hosted/panel are now explicit, deterministic topologies
  resolved by a single shared resolver (config/deployment/topology.py) rather
  than inferred per script.
• Opt-in GenAI message-content capture for the hosted agent. Chat turns can
  now be inspected in Application Insights. The turns come from the
  agent_framework invoke_agent spans that already existed in the trace; the
  span enricher reads gen_ai.input.messages / gen_ai.output.messages, which
  the SDK only writes when content capture is enabled. Off by default.
• Hosted administrative panel platform contract (issue #611, ADR-0004). New
  operator-surface App Configuration keys and an explicit integration matrix
  covering which capabilities each topology exposes.
• Hosted continuity ownership is delegated and fails closed. The trusted UI
  BFF forwards x-ms-user-identity under Responses protocol 2.0.0. Activation
  stays disabled until the UI identity holds the required roles directly at the
  individual agent scope; the disabled path returns the documented fallback
  instead of degrading silently.
• Hosted-agent azd service isolation. An isolated child azd project deploys
  the hosted agent, so its lifecycle no longer couples to the container-app
  services.
• AI Landing Zone pinned to a released tag. The temporary develop pin is
  replaced by v2.5.1; manifest.json ailz_tag, .gitmodules infra.branch,
  and the recorded infra/ gitlink all resolve to the same commit.
• Component pins refreshed. The orchestrator moves to v4.1.0, which carries
  four fixes found during hosted-agent validation: Foundry Playground HTTP 422
  rejections (the strict request allowlist is inverted to ignore-and-log with a
  minimal deny-list), spurious opentelemetry.context.detach error records from
  third-party GenAI instrumentation, hosted-agent session-readiness HTTP 424, and
  an HTTP 500 on every live request under the hosted runtime.
• Windows provisioning fixes. AI Foundry project endpoint discovery, jumpbox
  package imports, the Azure CLI launcher used by hosted-image builds, and the
  regional prerequisite checks all now resolve correctly on Windows. Foundry IQ
  ingestion honors the Search managed-identity mode.

Component versions

Component	Version
gpt-rag-ui	v2.6.1
gpt-rag-orchestrator	v4.1.0
gpt-rag-ingestion	v2.7.1
infra / AI Landing Zone	v2.5.1

Validation

• Validated as the exact pinned combination above, in a network-isolated
  validation environment in westus3 with NETWORK_ISOLATION=true and
  BUILD_MODE=acr-task, provisioned from a clean azd up.
• Deployment mode: hosted agent on Microsoft Foundry with Foundry IQ retrieval
  (hosted/no-panel topology), reached through the jumpbox.
• Retrieval verified end to end against a Foundry IQ knowledge base backed by
  Blob Storage, confirming both the grounded answer and its citation.
• Foundry Playground turns confirmed to return an answer with its citation after
  the request-validation policy inversion, over a fresh set of serving role
  instances.
• Spurious detach records measured before and after: 15 of 15 serving instances
  emitted them at baseline; four fresh role instances emitted zero afterwards,
  with the answer and citation intact.
• Frontend container app confirmed reachable and returning HTTP 200 after the
  OAuth app registration was wired in.