foundry-observability

Foundry Observability

End-to-end telemetry across every component of a Threadlight pilot: Foundry hosted agent, MCP servers on ACA, ACA jobs (cron triggers), bot service, workspace UI. Default discipline, not optional.

Downstream FinOps consumer. foundry-cost-monitoring joins the gen_ai.usage.* spans this skill emits with the Azure Retail Prices API to compute per-agent / per-project / per-tenant cost projection — wire it whenever a FinOps stakeholder needs to answer "what is this agent costing us right now?"

Why this skill exists. Recent pilots deployed cleanly (azd up returned 0, all resources provisioned) but App Insights stayed completely empty — no agent traces, no MCP tool calls, no cron logs. Root cause: no one wired the connection at any layer. The intel for each layer lives scattered across threadlight-deploy, foundry-hosted-agents, foundry-mcp-aca, threadlight-event-triggers — but no single skill walks an operator through the full chain. That's what this skill does. Pair with threadlight-safe-check Step 5.6 (App Insights existence + first-trace probe) to gate it shut.

Mental model — three layers, one signal

┌─────────────────────────────────────────────────────────────────────┐
│ Layer 3: ACA workloads (MCP / bot / workspace / cron jobs)          │
│   • configure_azure_monitor() reads APPLICATIONINSIGHTS_CONNECTION_STRING │
│   • Env var set by Bicep from app-insights.outputs.connectionString  │
│   • OTel exporter ships spans + logs + metrics over HTTPS           │
└─────────────────────────────────────────────────────────────────────┘
                                  ▲
                                  │ direct push from container code
                                  │
┌─────────────────────────────────┼───────────────────────────────────┐
│ Layer 2: Foundry hosted agent (the runtime)                         │
│   • Account-level AppInsights connection (category: AppInsights)    │
│   • Platform AUTO-INJECTS APPLICATIONINSIGHTS_CONNECTION_STRING     │
│   • RBAC: Monitoring Metrics Publisher on agent identities           │
│   • Tracing emitted by the runtime — no app code change             │
└─────────────────────────────────┼───────────────────────────────────┘
                                  │
                                  ▼
┌─────────────────────────────────────────────────────────────────────┐
│ Layer 1: Bicep substrate                                            │
│   • app-insights.bicep — workspace-based (LAW-bound)                │
│   • log-analytics.bicep — single LAW for ALL workloads in the RG    │
│   • ACA env wiring: dapr.appInsightsConnectionString OR direct env  │
│   • Output `connectionString` consumed by every workload            │
└─────────────────────────────────────────────────────────────────────┘