An experimental bring-your-own-container coding agent that runs the OpenAI Agents SDK inside Microsoft Foundry Agent Service. It combines a per-session VM-isolated sandbox, a persistent workspace, a real Linux terminal, browser verification, and keyless Azure access in one end-to-end sample.
Important
This is a community sample, not an official Microsoft product or reference architecture. It has no SLA and is not production-ready. The views in the demo are personal and do not represent Microsoft.
The walkthrough connects Microsoft's broader agentic-platform strategy to the concrete runtime implemented in this repository: moving from prompting to delegating long-running work, then giving an agent the compute, identity, tools, context, and controls needed to finish that work.
agentic-platform-deck.mp4
2.5-minute walkthrough — no audio, subtitled (plays inline above). Also available as a downloadable MP4.
| Path | Use it when you want to... |
|---|---|
| Watch the 2.5-minute walkthrough | Understand the strategy and product story |
| Read the architecture map | Review runtime, identity, trust, and verification flows |
| Explore the interactive guide | Navigate the implementation and controls visually |
| Present the eight-slide deck | Tell the broader agentic-platform story live |
| Bring your agent | Give it a workstation | Operate it responsibly |
|---|---|---|
Package custom OpenAI Agents SDK orchestration behind Foundry's responses:1.0.0 protocol. |
Work across turns with files, patching, Python, a real terminal, and rendered browser checks. | Add scoped identity, optional memory and retrieval, Toolbox skills, Content Safety, telemetry, evaluations, and deterministic acceptance. |
flowchart LR
caller["Caller"] --> endpoint["Foundry hosted-agent endpoint"]
subgraph session["Per-session VM-isolated sandbox"]
host["ResponsesAgentServerHost<br/>:8088 / responses:1.0.0"]
runner["OpenAI Agents SDK Runner"]
local["Files / patch / Python<br/>shell / browser"]
host --> runner
runner --> local
end
endpoint --> host
runner --> model["Azure OpenAI deployment"]
runner -. optional .-> services["Memory / Foundry IQ / web<br/>Toolbox / Content Safety"]
host -. OpenTelemetry .-> monitor["Application Insights"]
Foundry owns the endpoint, session lifecycle, isolation, and state restoration. This repository owns the container, agent loop, local tools, integration policy, and verification harnesses. See the detailed architecture or take the guided visual tour.
flowchart TB
repo["This repository"]
ship["Ships in the image<br/>server_responses.py + src/agent/<br/>agent.yaml + .agent_configs/"]
build["Build contract<br/>Dockerfile + requirements.txt"]
operate["Operate and demonstrate<br/>scripts/"]
prove["Prove behavior<br/>tests/ + datasets/ + evaluators/"]
guide["Explain and govern<br/>docs/ + root Markdown + .github/"]
skills["Guide behavior<br/>skills/"]
repo --> ship
repo --> build
repo --> operate
repo --> prove
repo --> guide
repo --> skills
The deployed image contains 12 Python files: server_responses.py plus the 11
modules under src/. The 20 Python operator scripts stay outside the image. The
script catalog explains which ones deploy, demonstrate, evaluate,
and revalidate the platform.
flowchart TB
build["Build<br/>backend-dev · frontend-dev · frontend-design"]
diagnose["Diagnose and review<br/>systematic-debugging · code-review"]
verify["Verify and research<br/>webapp-testing · web-research-citation"]
operate["Operate safely<br/>cloud-auth"]
validate["Exact names · hashes · 16k context budget"]
toolbox["Immutable Toolbox version"]
agent["All eight or none<br/>in the agent instructions"]
build --> validate
diagnose --> validate
verify --> validate
operate --> validate
validate --> toolbox --> agent
Skills are versioned Foundry resources, not ad hoc prompt fragments. The runtime accepts the complete expected set, sorts it deterministically, and rejects partial, duplicate, stale, or over-budget guidance. See the skill catalog and the supply-chain flow.
- Python 3.12 and Azure CLI;
- an existing Microsoft Foundry account/project and model deployment;
- an existing Azure Container Registry and hosted-agent access;
- a dedicated deployment resource group;
- two distinct existing Azure Static Web Apps for full acceptance;
- optional existing memory, Search, Content Safety, Toolbox/Web IQ, and Application Insights resources.
This repository does not provision Azure resources. azure.yaml is an Agent
Optimizer/deployment-discovery overlay, not infrastructure as code.
python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -r requirements.txt
Copy-Item .env.example .envPopulate .env with your existing-resource values. Never commit it. At minimum,
configure AZURE_OPENAI_ENDPOINT, FOUNDRY_PROJECT_ENDPOINT,
DEPLOY_RESOURCE_GROUP, distinct SWA_NAME and TODO_SWA_NAME, plus the deployment
values documented in docs/deployment.md.
Keep BROWSER_TLS_BYPASS_HOSTS empty unless an exact-host exception is unavoidable.
Acceptance applications must bundle their frontend assets because browser verification
blocks cross-origin redirects, subresources, and service workers.
Validate locally:
python -m pytest -p no:cacheprovider tests -q
python -m compileall -q src scripts server_responses.py
node --check src\agent\browser_probe.js
python scripts\build_space_invaders_demo.py --dry-run
python scripts\build_todo_demo.py --dry-runBuild a linux/amd64 image in your existing registry, then deploy:
python scripts\deploy_foundry.py --tag <image-tag>Detailed setup, RBAC, verification, cleanup, and preview caveats are in docs/deployment.md.
Use synthetic data, a disposable non-production environment, narrowly scoped identities, and explicit retention controls. You pay for the Azure resources you use, and preview pricing or quotas can change.
| Question | Source of truth |
|---|---|
| How does one turn work? | Architecture |
| How do I deploy and verify it? | Deployment and script catalog |
| What are the trust boundaries? | Security and privacy |
| What does the sample not prove? | Limitations |
| How can I contribute or get help? | Contributing and support |
| Which third-party skill sources are retained? | Third-party notices |
Repository code is MIT licensed. Adapted skills retain their upstream notices.