v3.8.2

What this version delivers

The v3.8.x cycle makes the hosted agent on Microsoft Foundry the default for
fresh deployments (ADR-0001), with classic, hosted/no-panel, and hosted/panel
as explicit topologies resolved by a single shared resolver. It also adds opt-in
GenAI message-content capture in Application Insights, the hosted administrative
panel platform contract (ADR-0004), delegated hosted-continuity ownership that
fails closed, an isolated azd project for the hosted agent, Windows
provisioning fixes, and an AI Landing Zone pinned to a released tag. See
v3.8.0 for the full
feature notes.

v3.8.0 and v3.8.1 do not deploy. This is the first release of the cycle
that does. The changes below are what it fixes on top of them.

Changed

• Repinned gpt-rag-ingestion to
  v2.7.2,
  which restores the ingestion container's ability to start. The version
  pinned by v3.8.1 builds its image successfully and then crashes on boot
  with ImportError: cannot import name 'LogData'. An
  opentelemetry-instrumentation-httpx==0.65b0 pin fell outside the range
  required by azure-monitor-opentelemetry; pip resolved that conflict by
  silently backtracking to an eleven-versions-older exporter that imports a
  symbol removed in opentelemetry-sdk 1.44. Because the failure happens at
  import time rather than at build time, an image build would not have caught
  it. Anyone on v3.8.1 should move to this release.

• Repinned gpt-rag-ui to
  v2.6.2, which
  fixes citations the orchestrator returns as absolute URLs for the solution's
  own storage account. The legacy path returned them unsigned and the secured
  path discarded them entirely; both paths now normalize the URL to a
  container-relative path first, so the existing per-document authorization
  check still applies before any download grant is issued.

• Added a release/* exception to the pull-request guard, which
  previously blocked every pull request to main unconditionally, including
  release branches.

• Added continuous integration for gpt-rag-ingestion and for the
  gpt-rag-orchestrator frontend. Neither had a workflow exercising the
  code that broke — the ingestion repository already contained 12 test files
  that no workflow ran, and the orchestrator SPA was built only inside the
  Dockerfile. That gap is the direct cause of the defects fixed here and in
  v3.8.1.

Component versions

Component	Version
gpt-rag-ui	v2.6.2
gpt-rag-orchestrator	v4.1.1
gpt-rag-ingestion	v2.7.2
infra / AI Landing Zone	v2.5.1

Validation

• unit-tests green on each pinned component commit: ingestion 168 passed,
  UI 410 tests, orchestrator frontend build exit 0 on a Linux runner.
• Resolved ingestion dependency set verified coherent against the Azure Monitor
  distro requirements, with no backtracking.
• AI Landing Zone pins verified to agree across manifest.json ailz_tag,
  .gitmodules infra.branch, and the recorded infra/ submodule
  gitlink.