docs: publish WI-11 resolution and verified release operations
- update architecture and preserve the historical investigation
- add release evidence, proof images, and an operations runbook
- distinguish verified outcomes from remaining readiness limits
🛠️ - Generated by Copilot
docs(wiki): add ready-to-send draft reply for second support response
docs(wiki): deepen Q3 answer with Azure Policy verification for public network access
docs(wiki): answer support's 4 outstanding questions for WI-11 escalation
docs(wiki): document first (templated) MS support response and draft reply
docs(wiki): record WI-11 Azure support ticket 2609040400007027
docs: record live CI validation of WI-11 retry-logic fix
Run 33899929713 (commit 4e20ca9) reached the smoke-test step for the
first time since the retry-logic correction, after fixing an unrelated
deploy-blocking azure.yaml bug (WI-19). Result: 3/3 attempts failed
identically with 401 PermissionDenied in ~46s (down from ~4 min),
confirming both the fix's timing improvement and that WI-11 remains an
unresolved persistent platform bug, not a transient RBAC delay.
📝 - Generated by Copilot
Add CI-confirmed evidence that the 401 retry is not RBAC propagation delay
CI run 33830260451 (commit cb8ff04) exhausted all 8 retry attempts over
~4 minutes with identical 401 PermissionDenied errors, corroborating the
broadened-RBAC test's conclusion that this is a persistent hosted-agent
platform bug, not a transient propagation delay. The deploy-and-evaluate.yml
workflow's retry budget and messaging were corrected in the main repo
accordingly.
Add manual-agent workaround proof and expand RBAC 401 evidence
- Document a portal-native agent (threat-assessment-manual-poc) created
manually in the same Foundry project, proving chat and MCP tool-calling
both work with zero 401 errors, isolating the hosted-agent bug to the
LangGraph/Blueprint-identity runtime path.
- New Manual-Agent-Workaround page: step-by-step reproduction, findings,
and screenshots of a full get_device_risk + list_vulnerabilities MCP
tool-call round trip returning correct mock data.
- RBAC-401-Investigation: add broadened-RBAC test-and-rollback results
(Cognitive Services Contributor / OpenAI Contributor / Azure AI
Administrator, all failed, all rolled back), MCP-server-independently-
verified-healthy note, and screenshot evidence of the raw
openai.AuthenticationError 401 across three agent versions (17, 19, 31).
- Architecture: add environment screenshot gallery (resource group,
Foundry project, Agents list, agent detail, Traces tab requiring App
Insights).
- Home: link the new Manual Agent Workaround page.
docs: add architecture and RBAC 401 investigation wiki pages