From 02412b0f128971758ec03b667936f37b6509b952 Mon Sep 17 00:00:00 2001 From: Paul Lizer Date: Wed, 19 Aug 2026 15:14:48 -0400 Subject: [PATCH 1/3] Split Governance into Feature Governance, Policies and MCP Governance First card move of the information architecture rework, and the pattern the remaining groups follow: split the pane markup, update the navigation map, and add a legacy redirect so existing links keep working. Governance held five cards covering three distinct concerns. It is now three tabs: which features are governed, the policies themselves, and MCP-specific governance. The split is done by a tool that works line by line and refuses to write unless every source line is carried into exactly one output. That immediately caught a real problem: governance-status sat after the last card, so copying the pane trailer into each new pane would have produced three elements sharing one id. It is now rendered once outside the panes, which is also better behaviour, since a status message is no longer trapped on whichever governance tab happened to be active when it was raised. Adds LEGACY_TAB_REDIRECTS so #governance still resolves, now to Feature Governance. Later moves extend the same map. Field names and card ids are unchanged at 462 and 110, and the regression set holds at 32 pre-existing failures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- application/single_app/admin_settings_nav.py | 22 +- .../static/js/admin/admin_sidebar_nav.js | 14 +- .../admin/_panes/feature-governance.html | 67 +++++ .../admin/_panes/governance-policies.html | 94 +++++++ .../templates/admin/_panes/governance.html | 250 ------------------ .../admin/_panes/mcp-governance.html | 91 +++++++ .../single_app/templates/admin_settings.html | 7 +- ...st_governance_route_and_wiring_coverage.py | 2 +- 8 files changed, 290 insertions(+), 257 deletions(-) create mode 100644 application/single_app/templates/admin/_panes/feature-governance.html create mode 100644 application/single_app/templates/admin/_panes/governance-policies.html delete mode 100644 application/single_app/templates/admin/_panes/governance.html create mode 100644 application/single_app/templates/admin/_panes/mcp-governance.html diff --git a/application/single_app/admin_settings_nav.py b/application/single_app/admin_settings_nav.py index 75cc98bab..e09f9bfe9 100644 --- a/application/single_app/admin_settings_nav.py +++ b/application/single_app/admin_settings_nav.py @@ -201,17 +201,31 @@ "icon": "bi-clipboard-check", "tabs": [ { - "id": "governance", - "label": "Governance", + "id": "feature-governance", + "label": "Feature Governance", "icon": "bi-braces-asterisk", "sections": [ {"id": "governance-feature-toggles-section", "label": "Governance Feature Toggles", "icon": "bi-braces-asterisk"}, - {"id": "governance-mcp-destination-section", "label": "MCP Action Destination Governance", "icon": "bi-diagram-3"}, - {"id": "governance-inbound-mcp-section", "label": "Inbound MCP Source Governance", "icon": "bi-box-arrow-in-down-right"}, + ], + }, + { + "id": "governance-policies", + "label": "Policies", + "icon": "bi-sliders2", + "sections": [ {"id": "governance-feature-policies-section", "label": "Feature Policies", "icon": "bi-sliders2"}, {"id": "governance-item-policies-section", "label": "Delegated Item Policies", "icon": "bi-list-check"}, ], }, + { + "id": "mcp-governance", + "label": "MCP Governance", + "icon": "bi-diagram-3", + "sections": [ + {"id": "governance-mcp-destination-section", "label": "MCP Action Destination Governance", "icon": "bi-diagram-3"}, + {"id": "governance-inbound-mcp-section", "label": "Inbound MCP Source Governance", "icon": "bi-box-arrow-in-down-right"}, + ], + }, ], }, { diff --git a/application/single_app/static/js/admin/admin_sidebar_nav.js b/application/single_app/static/js/admin/admin_sidebar_nav.js index 0f9b7dcaf..304403f0c 100644 --- a/application/single_app/static/js/admin/admin_sidebar_nav.js +++ b/application/single_app/static/js/admin/admin_sidebar_nav.js @@ -283,7 +283,19 @@ function revealAdminGroupForTab(tabId) { } } -function showAdminTab(tabId) { +// Tabs that existed before the information architecture rework, mapped to +// where their content now lives. Old bookmarks and links keep working. +const LEGACY_TAB_REDIRECTS = { + 'governance': 'feature-governance', +}; + +function resolveAdminTabId(tabId) { + return LEGACY_TAB_REDIRECTS[tabId] || tabId; +} + +function showAdminTab(requestedTabId) { + const tabId = resolveAdminTabId(requestedTabId); + // Open the owning group first, in whichever layout is active, so // activating a tab never leaves it hidden behind a collapsed group header // or filtered out of the top strip. diff --git a/application/single_app/templates/admin/_panes/feature-governance.html b/application/single_app/templates/admin/_panes/feature-governance.html new file mode 100644 index 000000000..d0f153d74 --- /dev/null +++ b/application/single_app/templates/admin/_panes/feature-governance.html @@ -0,0 +1,67 @@ +
+
+

+ Configure governance enforcement for endpoint, agent, and action creation or usage. Governance is disabled by default and only enforced when toggled on. +

+ +
+ +
+
+ Governance Feature Toggles +
+

Turn on governance checks for each feature area. Save with the main Settings button to persist these toggles.

+ +
+
+
Personal Scope
+
+ + +
+
+ + +
+
+ + +
+
+
+
Group Scope
+
+ + +
+
+ + +
+
+ + +
+
+
+
Global Scope
+
+ + + Always On +
+
+ + +
+
+ + +
+
+
+
+ +
diff --git a/application/single_app/templates/admin/_panes/governance-policies.html b/application/single_app/templates/admin/_panes/governance-policies.html new file mode 100644 index 000000000..8b9d2130f --- /dev/null +++ b/application/single_app/templates/admin/_panes/governance-policies.html @@ -0,0 +1,94 @@ +
+
+
+
Feature Policies
+ +
+

Set allow-all, explicit allow lists, and block lists for each governed feature. Block lists override allow settings.

+
+ + + + + + + + + + +
FeatureAllow AllAllow ListBlock List
+
+
+ +
+
+
Delegated Item Policies
+
+ + +
+
+

Manage delegated governance for configured global resources and action type entitlements that admins assign to specific users or groups.

+ + +
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+ +
+ + + + + + + + + + + +
PolicyEntity TypeItemAllow AllActions
+
+ +
+
+
+ + +
+
+
+
diff --git a/application/single_app/templates/admin/_panes/governance.html b/application/single_app/templates/admin/_panes/governance.html deleted file mode 100644 index 450af4b92..000000000 --- a/application/single_app/templates/admin/_panes/governance.html +++ /dev/null @@ -1,250 +0,0 @@ -
-
-

- Configure governance enforcement for endpoint, agent, and action creation or usage. Governance is disabled by default and only enforced when toggled on. -

- -
- -
-
- Governance Feature Toggles -
-

Turn on governance checks for each feature area. Save with the main Settings button to persist these toggles.

- -
-
-
Personal Scope
-
- - -
-
- - -
-
- - -
-
-
-
Group Scope
-
- - -
-
- - -
-
- - -
-
-
-
Global Scope
-
- - - Always On -
-
- - -
-
- - -
-
-
-
- -
-
- MCP Action Destination Governance -
-

- Restrict outbound remote MCP servers by destination pattern and scope. Destination policies reuse delegated item policies, so admins can allow all users, specific users, or workspace groups for each approved destination. -

-
-
-
- - -
-
- - -
-
- Save with the main Settings button. Unsafe literal-IP blocking can be enabled even before the allowlist is enforced. -
-
-
-
Supported destination patterns
-
    -
  • * for any remote MCP destination after identity/auth checks.
    • -
  • preconfiguration:microsoft_learn or preset:generic.
    • -
  • *.contoso.com, https://example.com/mcp*, or transport:streamable-http.
    • -
  • group:<group-id>::preconfiguration:github for one group-specific override.
    • -
-
-
-
-
- - -
-
- - -
-
- - -
-
-
-
-
- -
-
- Inbound MCP Source Governance -
-

- Control which delegated users and groups can use SimpleChat as an inbound MCP server through source-scoped policies. -

- -
-
-
Policy required for inbound MCP
-
    -
  • inbound_mcp_source with delegated item *: allows selected users or groups to use any accepted source ID.
    • -
  • inbound_mcp_source with a configured source ID: allows selected users or groups to use only requests with that source value.
    • -
-
- Client, tenant, delegated scope, and Entra role checks remain in Inbound MCP configuration. The source ID comes from the configured header when present and is advisory unless a trusted gateway sets or validates it. -
-
-
-
-
- - -
-
-
-
-
- -
-
-
Feature Policies
- -
-

Set allow-all, explicit allow lists, and block lists for each governed feature. Block lists override allow settings.

-
- - - - - - - - - - -
FeatureAllow AllAllow ListBlock List
-
-
- -
-
-
Delegated Item Policies
-
- - -
-
-

Manage delegated governance for configured global resources and action type entitlements that admins assign to specific users or groups.

- - -
-
- - -
-
- - -
-
- - -
-
- - -
-
- -
- - - - - - - - - - - -
PolicyEntity TypeItemAllow AllActions
-
- -
-
-
- - -
-
-
- - -
diff --git a/application/single_app/templates/admin/_panes/mcp-governance.html b/application/single_app/templates/admin/_panes/mcp-governance.html new file mode 100644 index 000000000..31080591e --- /dev/null +++ b/application/single_app/templates/admin/_panes/mcp-governance.html @@ -0,0 +1,91 @@ +
+
+
+ MCP Action Destination Governance +
+

+ Restrict outbound remote MCP servers by destination pattern and scope. Destination policies reuse delegated item policies, so admins can allow all users, specific users, or workspace groups for each approved destination. +

+
+
+
+ + +
+
+ + +
+
+ Save with the main Settings button. Unsafe literal-IP blocking can be enabled even before the allowlist is enforced. +
+
+
+
Supported destination patterns
+
    +
  • * for any remote MCP destination after identity/auth checks.
    • +
  • preconfiguration:microsoft_learn or preset:generic.
    • +
  • *.contoso.com, https://example.com/mcp*, or transport:streamable-http.
    • +
  • group:<group-id>::preconfiguration:github for one group-specific override.
    • +
+
+
+
+
+ + +
+
+ + +
+
+ + +
+
+
+
+
+ +
+
+ Inbound MCP Source Governance +
+

+ Control which delegated users and groups can use SimpleChat as an inbound MCP server through source-scoped policies. +

+ +
+
+
Policy required for inbound MCP
+
    +
  • inbound_mcp_source with delegated item *: allows selected users or groups to use any accepted source ID.
    • +
  • inbound_mcp_source with a configured source ID: allows selected users or groups to use only requests with that source value.
    • +
+
+ Client, tenant, delegated scope, and Entra role checks remain in Inbound MCP configuration. The source ID comes from the configured header when present and is advisory unless a trusted gateway sets or validates it. +
+
+
+
+
+ + +
+
+
+
+
+ +
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html index 5c887efee..39ebbc3fe 100644 --- a/application/single_app/templates/admin_settings.html +++ b/application/single_app/templates/admin_settings.html @@ -976,6 +976,9 @@

12. Enhanced Citations and Image Generation

{% endif %} + {# Governance status is rendered outside the panes so a message stays + visible whichever governance tab is active. #} +
{% include "admin/_panes/security.html" %} @@ -984,7 +987,9 @@

12. Enhanced Citations and Image Generation

- {% include "admin/_panes/governance.html" %} + {% include "admin/_panes/feature-governance.html" %} + {% include "admin/_panes/governance-policies.html" %} + {% include "admin/_panes/mcp-governance.html" %} {% include "admin/_panes/logging.html" %} diff --git a/functional_tests/test_governance_route_and_wiring_coverage.py b/functional_tests/test_governance_route_and_wiring_coverage.py index a10b08ac6..73ecb1ffb 100644 --- a/functional_tests/test_governance_route_and_wiring_coverage.py +++ b/functional_tests/test_governance_route_and_wiring_coverage.py @@ -132,7 +132,7 @@ def test_governance_enforcement_hooks_across_changed_routes(): assert key in settings_content, f"Missing governance default setting key: {key}" for marker in [ - "id=\"governance\"", + "id=\"feature-governance\"", "governance-feature-policies-table", "governance-item-policies-table", "governance-item-policy-card-controls", From 98b7cd7cb45da9448683cc3dd6a1b38658d7dda1 Mon Sep 17 00:00:00 2001 From: Paul Lizer Date: Wed, 19 Aug 2026 15:18:14 -0400 Subject: [PATCH 2/3] Split Scale into Redis & Caching, Cosmos, and move Front Door to Security Scale mixed three concerns: cache configuration, Cosmos capacity, and Front Door. It is now Redis & Caching and Cosmos, with Front Door moved out entirely. Front Door configures authentication and redirect flows, not throughput, so it sits under Security as a Network tab. That move needed no markup surgery: panes are independent files and groups are entries in the navigation map, so moving a whole tab between groups is a map change alone. Only moving a card between tabs requires touching markup. This pane exercised the interleaved-modal case. Five modals sit between cards rather than collected at the end, and each has to travel with the tab owning its trigger. The split tool assigns the gap after a card to that card, which placed the Redis explorer with Redis, the three maintenance confirmations with Cosmos Maintenance, and the two throughput dialogs with Cosmos Throughput. Verified by listing the modals in each new pane. Extends the legacy redirect map so #scale still resolves. Field names and card ids are unchanged at 462 and 110, and the regression set holds at 32 pre-existing failures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- application/single_app/admin_settings_nav.py | 24 +- .../static/js/admin/admin_sidebar_nav.js | 1 + .../admin/_panes/{scale.html => cosmos.html} | 487 +----------------- .../templates/admin/_panes/network.html | 41 ++ .../templates/admin/_panes/redis-caching.html | 448 ++++++++++++++++ .../single_app/templates/admin_settings.html | 4 +- 6 files changed, 514 insertions(+), 491 deletions(-) rename application/single_app/templates/admin/_panes/{scale.html => cosmos.html} (70%) create mode 100644 application/single_app/templates/admin/_panes/network.html create mode 100644 application/single_app/templates/admin/_panes/redis-caching.html diff --git a/application/single_app/admin_settings_nav.py b/application/single_app/admin_settings_nav.py index e09f9bfe9..f256b6ebe 100644 --- a/application/single_app/admin_settings_nav.py +++ b/application/single_app/admin_settings_nav.py @@ -193,6 +193,16 @@ {"id": "conversation-archiving-section", "label": "Conversation Archiving", "icon": "bi-archive"}, ], }, + { + # Front Door configures authentication and redirect flows, so it + # belongs with Security rather than with throughput settings. + "id": "network", + "label": "Network", + "icon": "bi-door-open", + "sections": [ + {"id": "front-door-section", "label": "Azure Front Door", "icon": "bi-door-open"}, + ], + }, ], }, { @@ -257,18 +267,24 @@ "icon": "bi-speedometer2", "tabs": [ { - "id": "scale", - "label": "Scale", - "icon": "bi-diagram-3", + "id": "redis-caching", + "label": "Redis & Caching", + "icon": "bi-database", "sections": [ {"id": "redis-cache-section", "label": "Redis Cache", "icon": "bi-database"}, {"id": "redis-monitoring-section", "label": "Redis Metrics", "icon": "bi-activity"}, {"id": "conversation-cache-section", "label": "Conversation Cache", "icon": "bi-chat-square-text"}, + ], + }, + { + "id": "cosmos", + "label": "Cosmos", + "icon": "bi-diagram-3", + "sections": [ {"id": "document-access-index-section", "label": "DAI Metrics", "icon": "bi-diagram-3"}, {"id": "cosmos-maintenance-section", "label": "Cosmos Maintenance", "icon": "bi-tools"}, {"id": "cosmos-throughput-section", "label": "Cosmos DB Throughput", "icon": "bi-speedometer2"}, {"id": "cosmos-throughput-metrics-table-section", "label": "Cosmos Metrics", "icon": "bi-table"}, - {"id": "front-door-section", "label": "Azure Front Door", "icon": "bi-door-open"}, ], }, ], diff --git a/application/single_app/static/js/admin/admin_sidebar_nav.js b/application/single_app/static/js/admin/admin_sidebar_nav.js index 304403f0c..edad020d8 100644 --- a/application/single_app/static/js/admin/admin_sidebar_nav.js +++ b/application/single_app/static/js/admin/admin_sidebar_nav.js @@ -287,6 +287,7 @@ function revealAdminGroupForTab(tabId) { // where their content now lives. Old bookmarks and links keep working. const LEGACY_TAB_REDIRECTS = { 'governance': 'feature-governance', + 'scale': 'redis-caching', }; function resolveAdminTabId(tabId) { diff --git a/application/single_app/templates/admin/_panes/scale.html b/application/single_app/templates/admin/_panes/cosmos.html similarity index 70% rename from application/single_app/templates/admin/_panes/scale.html rename to application/single_app/templates/admin/_panes/cosmos.html index 25e2c5fd7..9d1fa89ca 100644 --- a/application/single_app/templates/admin/_panes/scale.html +++ b/application/single_app/templates/admin/_panes/cosmos.html @@ -1,450 +1,4 @@ -
- {% set enable_dai_debug = settings.enable_dai_debug | default(false) %} -

- Configure Redis cache to improve enterprise scale and performance by caching session data. Enabling Redis allows you to horizontally scale your application across multiple instances without losing session data. -

-
-
- Redis Cache -
-

- Enable Redis Cache to store session data in a distributed cache. This is recommended for production and multi-instance deployments. -

-
- - - -
-
-
- -

(example: simple-chat.redis.cache.windows.net)

- -
-
- - -
-
- -
- - -
-
- Enter the full Key Vault secret name. - Enable Key Vault for Agent and Action Secrets - must be enabled and configured. -
-
- -
-
-
-
-
-
- Redis Monitoring -
-

- Monitor Redis availability, memory pressure, hit rate, evictions, and runtime cache usage before Redis-backed document list caching is enabled. -

-
-
- - -
-
-
-
-
-
-
Configuration
- Not loaded -
-
-
-
-
Health
- Not loaded -
-
-
-
-
App Cache Runtime
- Not loaded -
-
-
-
-
Session Runtime
- Not loaded -
-
-
-
-
-
-
Ping Latency
-
Not loaded
-
-
-
-
-
Memory Usage
-
Not loaded
-
Not loaded
-
-
-
-
-
Connected Clients
-
Not loaded
-
-
-
-
-
Ops/sec
-
Not loaded
-
-
-
-
-
Keyspace Hit Rate
-
Not loaded
-
-
-
-
-
Tracked Keys
-
Not loaded
-
-
-
-
-
DAI Version Markers
-
Not loaded
-
Not loaded
-
-
-
-
-
DAI Cache Payloads
-
Not loaded
-
Not loaded
-
-
-
-
-
Expired / Evicted Keys
-
- Not loaded - / - Not loaded -
-
-
-
-
-
Fragmentation Ratio
-
Not loaded
-
-
-
-
-
Error Replies
-
Not loaded
-
-
-
-
-
Rejected Connections
-
Not loaded
-
-
-
-
-
Redis Version
-
Not loaded
-
-
-
-
-
Monitoring Source
-
Not loaded
-
-
-
-
-
Last Checked
-
Not loaded
-
-
-
-
-
Last Error
-
Not loaded
-
-
-
-
-
- - - -
-
-
-
- Conversation Cache -
-

- Cache conversation list, feed, and advanced-search results per user. Redis is optional; cache misses and disabled cache paths continue using source Cosmos queries. -

-
- -
-
-
-
- - -
-
When enabled, list/feed/search payloads are cached by user and version. Disabling this bypasses cache reads and writes without requiring Redis.
-
-
- - -
Default 120 seconds. User-scoped version invalidation refreshes changed conversations; set to 0 to skip writing new entries.
-
-
-
-
-
-
Runtime Status
- Not loaded -
-
-
-
-
15m Cache Hit Rate
-
Not loaded
-
-
-
-
-
15m Cache Hits / Misses
-
Not loaded
-
-
-
-
-
15m Cache Bypasses / Errors
-
Not loaded
-
-
-
-
-
15m Writes / Invalidations
-
Not loaded
-
-
-
-
-
15m Operation Mix
-
Not loaded
-
-
-
-
-
Last Cache Event
-
Not loaded
-
-
-
-
-
Last Invalidation
-
Not loaded
-
-
-
-
- - Conversation cache metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for cache warnings and fallback behavior. -
-
-
-
- +
@@ -1586,43 +1140,4 @@
-
-
-
- Front Door -
- -
-

Configure Front Door URL for authentication and redirect flows.

- -
- - - -
- -
- - - - The base URL of your Front Door or load balancer. The system will automatically generate: -
    -
  • Home redirect: https://your-frontdoor.azurefd.net
    • -
  • OAuth2 redirect: https://your-frontdoor.azurefd.net/getAToken
    • -
- -
-
diff --git a/application/single_app/templates/admin/_panes/network.html b/application/single_app/templates/admin/_panes/network.html new file mode 100644 index 000000000..83ba4fb03 --- /dev/null +++ b/application/single_app/templates/admin/_panes/network.html @@ -0,0 +1,41 @@ +
+
+
+
+ Front Door +
+ +
+

Configure Front Door URL for authentication and redirect flows.

+ +
+ + + +
+ +
+ + + + The base URL of your Front Door or load balancer. The system will automatically generate: +
    +
  • Home redirect: https://your-frontdoor.azurefd.net
    • +
  • OAuth2 redirect: https://your-frontdoor.azurefd.net/getAToken
    • +
+ +
+
+
diff --git a/application/single_app/templates/admin/_panes/redis-caching.html b/application/single_app/templates/admin/_panes/redis-caching.html new file mode 100644 index 000000000..16d846c71 --- /dev/null +++ b/application/single_app/templates/admin/_panes/redis-caching.html @@ -0,0 +1,448 @@ +
+ {% set enable_dai_debug = settings.enable_dai_debug | default(false) %} +

+ Configure Redis cache to improve enterprise scale and performance by caching session data. Enabling Redis allows you to horizontally scale your application across multiple instances without losing session data. +

+
+
+ Redis Cache +
+

+ Enable Redis Cache to store session data in a distributed cache. This is recommended for production and multi-instance deployments. +

+
+ + + +
+
+
+ +

(example: simple-chat.redis.cache.windows.net)

+ +
+
+ + +
+
+ +
+ + +
+
+ Enter the full Key Vault secret name. + Enable Key Vault for Agent and Action Secrets + must be enabled and configured. +
+
+ +
+
+
+
+
+
+ Redis Monitoring +
+

+ Monitor Redis availability, memory pressure, hit rate, evictions, and runtime cache usage before Redis-backed document list caching is enabled. +

+
+
+ + +
+
+
+
+
+
+
Configuration
+ Not loaded +
+
+
+
+
Health
+ Not loaded +
+
+
+
+
App Cache Runtime
+ Not loaded +
+
+
+
+
Session Runtime
+ Not loaded +
+
+
+
+
+
+
Ping Latency
+
Not loaded
+
+
+
+
+
Memory Usage
+
Not loaded
+
Not loaded
+
+
+
+
+
Connected Clients
+
Not loaded
+
+
+
+
+
Ops/sec
+
Not loaded
+
+
+
+
+
Keyspace Hit Rate
+
Not loaded
+
+
+
+
+
Tracked Keys
+
Not loaded
+
+
+
+
+
DAI Version Markers
+
Not loaded
+
Not loaded
+
+
+
+
+
DAI Cache Payloads
+
Not loaded
+
Not loaded
+
+
+
+
+
Expired / Evicted Keys
+
+ Not loaded + / + Not loaded +
+
+
+
+
+
Fragmentation Ratio
+
Not loaded
+
+
+
+
+
Error Replies
+
Not loaded
+
+
+
+
+
Rejected Connections
+
Not loaded
+
+
+
+
+
Redis Version
+
Not loaded
+
+
+
+
+
Monitoring Source
+
Not loaded
+
+
+
+
+
Last Checked
+
Not loaded
+
+
+
+
+
Last Error
+
Not loaded
+
+
+
+
+
+ + + +
+
+
+
+ Conversation Cache +
+

+ Cache conversation list, feed, and advanced-search results per user. Redis is optional; cache misses and disabled cache paths continue using source Cosmos queries. +

+
+ +
+
+
+
+ + +
+
When enabled, list/feed/search payloads are cached by user and version. Disabling this bypasses cache reads and writes without requiring Redis.
+
+
+ + +
Default 120 seconds. User-scoped version invalidation refreshes changed conversations; set to 0 to skip writing new entries.
+
+
+
+
+
+
Runtime Status
+ Not loaded +
+
+
+
+
15m Cache Hit Rate
+
Not loaded
+
+
+
+
+
15m Cache Hits / Misses
+
Not loaded
+
+
+
+
+
15m Cache Bypasses / Errors
+
Not loaded
+
+
+
+
+
15m Writes / Invalidations
+
Not loaded
+
+
+
+
+
15m Operation Mix
+
Not loaded
+
+
+
+
+
Last Cache Event
+
Not loaded
+
+
+
+
+
Last Invalidation
+
Not loaded
+
+
+
+
+ + Conversation cache metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for cache warnings and fallback behavior. +
+
+
+
+ +
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html index 39ebbc3fe..5e26216b9 100644 --- a/application/single_app/templates/admin_settings.html +++ b/application/single_app/templates/admin_settings.html @@ -1006,7 +1006,9 @@

12. Enhanced Citations and Image Generation

{% include "admin/_panes/data-management.html" %} - {% include "admin/_panes/scale.html" %} + {% include "admin/_panes/redis-caching.html" %} + {% include "admin/_panes/cosmos.html" %} + {% include "admin/_panes/network.html" %} {% include "admin/_panes/workspace-identities.html" %} From 08f5a99caa660d31316872236edf78ffabbc4515 Mon Sep 17 00:00:00 2001 From: Paul Lizer Date: Wed, 19 Aug 2026 15:19:56 -0400 Subject: [PATCH 3/3] Bump version and document the stage D card-move pattern Records the split pattern that Governance and Scale established, the property that moving a whole tab between groups needs only a navigation map change, and the gap that has to close before the remaining groups can move: the split tool handles one source pane at a time, but the rest pull cards from several. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- application/single_app/config.py | 2 +- .../ADMIN_SETTINGS_IA_REWORK_STATUS.md | 42 +++++++++++++++---- docs/explanation/release_notes.md | 19 +++++++++ 3 files changed, 54 insertions(+), 9 deletions(-) diff --git a/application/single_app/config.py b/application/single_app/config.py index 60b856bf6..7dab85ab9 100644 --- a/application/single_app/config.py +++ b/application/single_app/config.py @@ -96,7 +96,7 @@ EXECUTOR_TYPE = 'thread' EXECUTOR_MAX_WORKERS = 30 SESSION_TYPE = 'filesystem' -VERSION = "0.260.010" +VERSION = "0.260.011" IS_DEVELOPMENT = is_development_env_enabled() SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax') diff --git a/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md index 7069ef7d2..985751668 100644 --- a/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md +++ b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md @@ -22,7 +22,7 @@ Development ─── feature/admin-settings-ia ──┬── #1297 stage 1 └──► final PR ──► Development ``` -Current version: **0.260.010**. Fingerprint: **462 field names / 110 card ids**. +Current version: **0.260.011**. Fingerprint: **462 field names / 110 card ids**. ### Shipped @@ -33,6 +33,7 @@ Current version: **0.260.010**. Fingerprint: **462 field names / 110 card ids**. | B | `data-requires` dependency announcements with inline mirror and link; File Sync and Permissions wired | | — | Form field contract enforced in CI | | C | Navigation moved into `admin_settings_nav.py` as groups → tabs → sections; both navigations render from it; group level with persisted collapse state and group pills; three-level search | +| D (part 1) | Governance split into three tabs; Scale split into two; Front Door moved to Security; legacy tab redirects added | --- @@ -79,15 +80,40 @@ template uncomposed while referencing a partial-backed card or field. --- -## Next: Stage D — the risky one +## Next: Stage D — the risky one, in progress -Re-home cards into the 14 target groups, **one group per commit**, running the -field contract test on each. The nav map now makes this a two-part edit: move -the card markup between partials, and move its entry between tabs in -`admin_settings_nav.py`. The parity test fails if the two disagree. +Re-home cards into the target groups, **one group per commit**, running the +field contract test on each. -The interim grouping in the map has 12 groups, because Workflow and Data -Lifecycle have no tabs until their cards move out of Workspaces and Safety. +### Proven pattern + +1. Split the source pane with the split tool. It works line by line and + **refuses to write unless every source line lands in exactly one output**. +2. Update `admin_settings_nav.py`: the tab entries and their sections. +3. Update the `{% include %}` list in `admin_settings.html`. +4. Add the old tab id to `LEGACY_TAB_REDIRECTS` in `admin_sidebar_nav.js`. +5. Verify: field contract, nav map test, parity test, Jinja compile, full + regression set. + +**Moving a whole tab between groups needs no markup change** — panes are +independent files and groups are entries in the map, so it is a one-line map +edit. Only moving a *card* between tabs requires markup surgery. Front Door +moved from Scale to Security that way. + +### Done + +| Group | Result | +|---|---| +| Governance | → Feature Governance, Policies, MCP Governance | +| Scale | → Redis & Caching, Cosmos; Front Door moved to Security as Network | + +### Remaining, and the gap to close first + +The remaining groups pull cards from **several** source panes, for example Data +Lifecycle wants Retention and Classification out of Workspaces and Archiving +out of Safety. The split tool only splits one pane at a time, so a +**move-card-between-panes** operation is needed next, with the same +every-line-accounted-for guarantee. Three complications found while splitting: diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md index 3811e8f15..9da97239a 100644 --- a/docs/explanation/release_notes.md +++ b/docs/explanation/release_notes.md @@ -2,6 +2,25 @@ For feature-focused and fix-focused drill-downs by version, see [Features by Version](/explanation/features/) and [Fixes by Version](/explanation/fixes/). +### **(v0.260.011)** + +#### User Interface Enhancements + +* **Governance And Scale Split Into Focused Tabs** + * Governance held five cards covering three different jobs. It is now **Feature Governance** (which features are governed), **Policies** (the policies themselves), and **MCP Governance**. + * Scale mixed cache configuration with Cosmos capacity, and is now **Redis & Caching** and **Cosmos**. + * **Azure Front Door** moved out of Scale into Security, under a new **Network** tab. It configures authentication and redirect flows rather than throughput, so it never belonged with capacity settings. + * Existing links and bookmarks to `#governance` and `#scale` still work and land on the first tab of each group. + * No settings changed. Every option keeps its name and its saved value. + * (Ref: navigation map, `feature-governance`, `governance-policies`, `mcp-governance`, `redis-caching`, `cosmos`, `network`) + +#### Bug Fixes + +* **Governance Status Messages No Longer Get Stuck On One Tab** + * The inline governance status message lived inside the Governance pane, so a message raised while working in one area could end up rendered on a tab you were not looking at. + * It now sits outside the tabs and is visible wherever you are in Governance. + * (Ref: `governance-status`, `admin_governance.js`) + ### **(v0.260.010)** #### New Features