feat: Azure-native solution (Functions + HybridAgent + Web.Azure + infra) + CI hygiene - #13

Merged

robgrame merged 31 commits into

masterfrom

feature/azure-native

Jun 9, 2026

Commits on Jun 8, 2026

docs(azure): initial plan.md for Azure-native rewrite (Phase 1 plan-first)

robgrame
and
Copilot
committed
7d521ff
docs(azure): two-solution topology + feature parity strategy

robgrame
and
Copilot
committed
affb7ba
feat(azure): scaffold Azure-native solution + dual-build CI (Batch 1)

robgrame
and
Copilot
committed
dad1420
feat(azure): infra Bicep modules + App Configuration + Key Vault (Batch 2)

robgrame
and
Copilot
committed
4e010fa
docs(azure): add SECURITY-MODEL.md - envelope encryption explained without jargon

robgrame
and
Copilot
committed
c0f1830
feat(azure): add Deploy-Azure.ps1 + AZURE-DEPLOY.md (pure az CLI, no azd)

robgrame
and
Copilot
committed
834b57e
fix(azure): end-to-end deploy verified — KV purge-protection conditional, AppConfig local-auth pragmatic, ARM output-name normalization

robgrame
and
Copilot
committed
366ecf5
docs(plan): add Section 8 Deployment Proof with end-to-end results from dev3

robgrame
and
Copilot
committed
e9ba703
docs: add security-peer encryption briefing

robgrame
and
Copilot
committed
443e467
docs(briefing): clarify implementation status (on-prem done, Azure WIP)

robgrame
and
Copilot
committed
aeac172
feat(security): introduce IKekProvider abstraction (Azure prep, Phase 1)

robgrame
and
Copilot
committed
d1f540f
feat(security): KeyVaultKekProvider for Azure-native operational slot (Phase 2)

robgrame
and
Copilot
committed
1204cee
feat(audit): Log Analytics audit mirror decorator (Phase 4)

robgrame
and
Copilot
committed
a338583
docs(security): flip briefing matrix for Phase 2 (KV KEK) and Phase 4 (LA audit mirror)

robgrame
and
Copilot
committed
d0dfb33
infra(audit): provision DCE + DCR + custom LA table for audit mirror

robgrame
and
Copilot
committed
862b09b
Phase 3: sealed-DEK batch protocol (Functions->HybridAgent)

robgrame
and
Copilot
committed
b73283d
Phase 3 infra: agent-seal KV key + sealed-batches SB queue

robgrame
and
Copilot
committed
6b0b625
fix(azure): wire AppConfiguration in Functions + scope KV crypto

robgrame
and
Copilot
committed
bec65c4
docs: regenerated ENCRYPTION-BRIEFING.pdf and SECURITY-MODEL.pdf

robgrame
and
Copilot
committed
52684fe
docs(web.azure): replace scaffold pages with deployment-status landing

robgrame
and
Copilot
committed
01b7858
feat(web.azure): Phase 0 scaffold for on-prem portal port

robgrame
and
Copilot
committed
6cd011d
feat(web.azure): Phase 1 - Entra ID auth + dashboard port

robgrame
and
Copilot
committed
7c8bd11
fix(web.azure): bypass AppConfig KV ref for SQL conn string

robgrame
and
Copilot
committed
2be4984
feat(web.azure): port read-only pages (DeviceList, DeviceDetail, Audit, Settings) + WorkerStatusBadge

robgrame
and
Copilot
committed
8a8784b
feat(hybridagent): deploy script with .NET 10 prereq + on-prem config sync

robgrame
and
Copilot
committed
66c8d10
feat(hybridagent): pivot to AD scan producer for Azure-native stack

robgrame
and
Copilot
committed
19a6a33
fix(hybridagent): rubber-duck pass on producer pivot

robgrame
and
Copilot
committed
a26439d
feat(hybridagent): add TargetOUs to static config + deploy script

robgrame
and
Copilot
committed
7364bf4

Commits on Jun 9, 2026

fix(infra): align RBAC with producer pivot (HybridAgent -> Functions)

robgrame
and
Copilot
committed
2f5a25c
feat(deploy): add -HybridAgentPrincipalId param to Deploy-Azure.ps1

robgrame
and
Copilot
committed
ada1441
feat(ci): path-aware workflows + CODEOWNERS + auto-labeler + release process

robgrame
and
Copilot
committed
249747a

Navigation Menu

feat: Azure-native solution (Functions + HybridAgent + Web.Azure + infra) + CI hygiene - #13

feat: Azure-native solution (Functions + HybridAgent + Web.Azure + infra) + CI hygiene#13
robgrame merged 31 commits into
masterfrom
feature/azure-native

Commits on Jun 8, 2026

docs(azure): initial plan.md for Azure-native rewrite (Phase 1 plan-first)

docs(azure): two-solution topology + feature parity strategy

feat(azure): scaffold Azure-native solution + dual-build CI (Batch 1)

feat(azure): infra Bicep modules + App Configuration + Key Vault (Batch 2)

docs(azure): add SECURITY-MODEL.md - envelope encryption explained without jargon

feat(azure): add Deploy-Azure.ps1 + AZURE-DEPLOY.md (pure az CLI, no azd)

fix(azure): end-to-end deploy verified — KV purge-protection conditional, AppConfig local-auth pragmatic, ARM output-name normalization

docs(plan): add Section 8 Deployment Proof with end-to-end results from dev3

docs: add security-peer encryption briefing

docs(briefing): clarify implementation status (on-prem done, Azure WIP)

feat(security): introduce IKekProvider abstraction (Azure prep, Phase 1)

feat(security): KeyVaultKekProvider for Azure-native operational slot (Phase 2)

feat(audit): Log Analytics audit mirror decorator (Phase 4)

docs(security): flip briefing matrix for Phase 2 (KV KEK) and Phase 4 (LA audit mirror)

infra(audit): provision DCE + DCR + custom LA table for audit mirror

Phase 3: sealed-DEK batch protocol (Functions->HybridAgent)

Phase 3 infra: agent-seal KV key + sealed-batches SB queue

fix(azure): wire AppConfiguration in Functions + scope KV crypto

docs: regenerated ENCRYPTION-BRIEFING.pdf and SECURITY-MODEL.pdf

docs(web.azure): replace scaffold pages with deployment-status landing

feat(web.azure): Phase 0 scaffold for on-prem portal port

feat(web.azure): Phase 1 - Entra ID auth + dashboard port

fix(web.azure): bypass AppConfig KV ref for SQL conn string

feat(web.azure): port read-only pages (DeviceList, DeviceDetail, Audit, Settings) + WorkerStatusBadge

feat(hybridagent): deploy script with .NET 10 prereq + on-prem config sync

feat(hybridagent): pivot to AD scan producer for Azure-native stack

fix(hybridagent): rubber-duck pass on producer pivot

feat(hybridagent): add TargetOUs to static config + deploy script

Commits on Jun 9, 2026

fix(infra): align RBAC with producer pivot (HybridAgent -> Functions)

feat(deploy): add -HybridAgentPrincipalId param to Deploy-Azure.ps1

feat(ci): path-aware workflows + CODEOWNERS + auto-labeler + release process