Add Foundry Agentic Loop plugin: skill, SDD workflow and canvas 🤖🤖🤖

[vieiraae]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Adds the Foundry Agentic Loop plugin for building agentic solutions on Microsoft Foundry, GitHub and Azure from Copilot. It is aimed at the Microsoft field, customers and partners, and has two build modes:

• Rapid prototyping: works in an existing Foundry project.
• Spec-driven development (SDD): creates the Foundry project and ends in a verified azd deployment.

Type	Path	Purpose
Plugin	plugins/foundry-agentic-loop	Bundles everything below. Installing the plugin is the only onboarding step.
Skill	skills/foundry-agentic-loop	The only skill. It finds and installs the bundled canvas and workflow, and selects the mode: rapid, SDD or improve. references/ holds one guide per SDD phase (Specify, Implement, Verify, Deploy), adapted from the lean spec2cloud skills, with the plan phase folded into Specify. Guides load only when a step needs them.
Extension	extensions/foundry-agentic-loop-workflow	The foundry-agentic-loop-workflow dynamic workflow. It runs Specify → Implement → Verify → Deploy in sequence. Each phase has a lead, an independent fresh-context reviewer and bounded fix rounds, and passes only on evidence. It pauses for spec approval and always before azd up (approval is bound to a fingerprint of the plan, spec, verify report and Azure target), resumes by journaled replay, supports from and to to rerun one phase or a range, and writes a flight record to .agentic-loop/runs/.
Extension	extensions/foundry-agentic-loop-canvas	Rapid prototyping by default; it switches to SDD when the session has workflow runs. Four tabs: Start (mode, readiness, a compact Foundry project picker with a portal link, and a prompt template gallery), Build (live progress, or the SDD phase view with gates and "Fix in Chat"), Explore and Optimize. The gallery opens with Shape it with Copilot, followed by 61 industry templates with search, sort, gallery/list views and filters by industry, capability, building block and pattern, plus an optional Work IQ context toggle. While Copilot works, a dock shows Foundry enablement tips. Includes a five-slide "How it works" deck (public/deck.html).

Use in the GitHub Copilot App

1. Click Customize, then Plugins. Find foundry-agentic-loop and click Install. From the Copilot CLI: copilot plugin install foundry-agentic-loop@awesome-copilot.
2. Ask Copilot to open the agentic loop.
3. On the Start tab, choose Rapid (existing Foundry project) or SDD (subscription), then pick a prompt template or shape your own idea, and click Send to Chat. The canvas switches to Build when the build starts and to Explore when it finishes.
4. The first build writes a marked section to the workspace AGENTS.md. It locks the mode for Chat, the canvas and the workflow, and routes short commands such as deploy. Azure settings live only in .azure/deployment-plan.md.
5. Later, ask Copilot to improve the agentic loop. It mines the lessons in docs/LOOP.md and the flight records, proposes evidence-backed skill and workflow changes, measures them with scripts/evals.mjs against the base commit, and applies only the changes you approve.

Design

The design follows current agentic software factory practice:

• durable artifacts as ground truth;
• fresh-context reviewers;
• computational checks before inferential ones (Foundry evaluations);
• bounded fix rounds, then escalation with evidence; issue waivers only by a human;
• human approval at spec and deploy;
• self-improvement only through reviewed, measured, revertible diffs that never weaken gates.

Maintainability

• One skill with a lean SKILL.md; the phase guides, references and templates load on demand.
• The extensions install separately and cannot share modules, so the contracts shared by the skill, workflow and canvas (the AGENTS.md lock markers, the flight-record path and the shared-files list) are pinned by cross-component tests.
• Both extensions run their tests with npm test. The skill ships 55 behavioral evals with metadata (mode, capabilities, targets, risk), fixtures and a runner.

Credits: builds on aiappsgbb/agentic-loop (MIT) and the lean spec2cloud skills in Azure-Samples/Spec2Cloud (MIT).

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify): dynamic workflow extension (extensions/foundry-agentic-loop-workflow), bundled by the plugin.

---

Additional Notes

Paid services and affiliation: the plugin targets Azure and Microsoft Foundry, which are paid services. It is authored by Microsoft AI Apps GBB (https://github.com/aiappsgbb).

• The plugin README lists the requirements, the billable resources and the teardown steps.
• Copilot confirms billable changes before making them.
• Teardown (azd down --purge, plus the Entra app registrations the build created) runs only with explicit approval.

Validation (on this branch, merged with the current main)

Command	Result
npm run skill:validate	✅ Passed: foundry-agentic-loop is valid
npm run plugin:validate	✅ Passed: foundry-agentic-loop is valid
npm run build	✅ Passed; generated files are up to date
node --test extensions/foundry-agentic-loop-workflow/tests/*.test.mjs extensions/foundry-agentic-loop-canvas/tests/*.test.mjs	✅ 171 of 171 passed
node eng/canvas-smoke-test.mjs --changed-files <changed-files list> --install require	✅ Passed: syntax, imports, file safety, preview images, manifests, materialize and Copilot CLI install. 0 errors, 3 warnings, all in workflow test files not reachable from extension.mjs
Playwright UI checks of the canvas (light and dark, gallery, picker, deck, dock)	✅ 0 failures
CRLF scan of the changed files	✅ LF line endings only

Tested in the GitHub Copilot App

Each test started from open the agentic loop and a canvas industry template, in a new empty repository, with the plugin installed from a local marketplace.

Round	Mode	Scenario	Result
1	Rapid	IT helpdesk agents	A verified local app (hosted Foundry agent, MCP servers, React/FastAPI) in 46 min, including 4 min answering questions; all six seeded tickets passed end to end. Deployed to Azure Container Apps 13 min after approval.
1	SDD	Automated claims processing and fraud detection	Passed all four gates: 474 unit tests, 98/98 E2E checks, Foundry evaluations ≥ 0.9 and live smoke checks on 22 claims. 465 min wall time with 25 subagents, including 28 min of approval waits.
1	Improve	Both runs above	Mined 57 lessons into 8 root-cause clusters with minimal diffs and 9 new evals, reviewed by a fresh-context subagent and applied after approval.
2	Rapid	HR digital assistant	Completed and deployed: about 3 h to a verified local app (7 min of answers), then an 18-min deploy. It skipped the deploy question, so deployment ran after explicit approval.
2	SDD	Customer service always-on agent	Exposed workflow defects (review convergence, provider-error pauses, redundant redeploys) and stopped at Verify because the delegated sign-in needed tenant consent. These drove the hardening in this PR: fail-closed gates, run leases, from/to reruns, deploy fingerprints and unauthenticated access by default only for sample, synthetic or public data.
3	Rapid	Prompt template from the gallery	Manual run by the author; its lessons (docs/LOOP.md) aligned the Build steps with Chat and added automatic tab switching.

Note: round 1 ran claude-opus-5.5 at medium reasoning effort and round 2 ran gpt-5.6-sol at max effort, so round-2 timings are not directly comparable. The skill recommends medium or high effort for subagents.

Known issue: with a local directory marketplace, the app sometimes listed the plugin's extensions as disabled after an older session was resumed. The skill and the canvas readiness check detect this and guide re-enabling; a new session then picks the extensions up.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[Copilot]

🔵 Needs a closer look

Unresolved deployment-safety, workflow-state, access/residency, guidance, and test/evaluation issues block approval.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Preserve target failures until restoration succeeds

extensions/​foundry-agentic-loop-canvas/​public/​target-save.mjs:74

[P2] Keep the target failure until restoration succeeds. If a target save fails and the subsequent /api/state refresh also fails, this clears the failed fields anyway. The next flush() returns {ok: true} without retrying restoration, allowing Send to Chat to use the server's old subscription or region while the controls still show the unsaved choice. Clear the failures only after a successful restore or save.

_{Review effort: Max}

[vieiraae]

Addressed the previously missed P2 "Preserve target failures until restoration succeeds" in 58ac10f: TargetSaver now clears failed fields only after a successful restore or a successful save of that field; a failed restore keeps Send blocked and the next flush retries it. Added a regression test that fails on the old code; all 97 canvas tests pass.

[Copilot]

🔵 Needs a closer look

Deployment re-approval gaps, stale gate inheritance, and other unresolved correctness issues block approval.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Fail closed when flight records are oversized

extensions/​foundry-agentic-loop-workflow/​lib/​rerun.mjs:33

[P2] Fail closed on oversized flight records. With an older verified run and a newer blocked record over 2 MiB, this branch silently selects the older run, and rerunPlan(..., "Deploy") inherits its passed gates despite the newer failure. writeRecord() has no corresponding size cap. Refuse the rerun when a record cannot be inspected safely instead of falling back to stale gate evidence.

_{Review effort: Max}

[vieiraae]

Addressed the previously missed P2 "Fail closed when flight records are oversized" in 259dadb: latestRecord now refuses the rerun when any record in .agentic-loop/runs is a link, larger than 2 MiB or not valid JSON, instead of skipping it and falling back to an older run's gates. Added a regression test (oversized and truncated newer record after a verified run) that fails on the old code; workflow tests 79/79 pass.

[Copilot]

🔵 Needs a closer look

Unresolved approval, workflow-state, ownership, guidance, and fixture defects block approval.

No open issues 🎉

_{Review effort: Max}

[Copilot]

🔵 Needs a closer look

Unresolved approval safeguards, RBAC gates, credential handling, configuration parsing, state races, and guidance inconsistencies block approval.

No open issues 🎉

_{Review effort: Max}