pelikhan · Nov 13, 2026 · Nov 13, 2026 · Nov 13, 2026 · Nov 13, 2026
@@ -4,7 +4,7 @@
     "web": {
       "host": {
         "target": {
-          "module": "azure-functions"
+          "module": "container"
         },
         "operational-store": {
           "backend": "postgres"

@@ -57,9 +57,6 @@ jobs:
   actions-runtime:
     needs: revision
     uses: ./.github/workflows/actions-runtime.yml # zizmor: ignore[self-repository] - Local reusable workflows use syntax supported by Actions and actionlint.
-  azure:
-    needs: revision
-    uses: ./.github/workflows/azure-local-integration.yml # zizmor: ignore[self-repository] - Local reusable workflows use syntax supported by Actions and actionlint.
   mobile:
     needs: revision
     uses: ./.github/workflows/actions.yml # zizmor: ignore[self-repository] - Local reusable workflows use syntax supported by Actions and actionlint.
@@ -149,7 +146,6 @@ jobs:
       - extension
       - bootstrap
       - actions-runtime
-      - azure
       - mobile
       - views
       - deployed

@@ -152,23 +152,11 @@ jobs:
           ./gh-cao pages --json > /dev/null
 
   extension-setup-simulator:
-    name: Setup against local GitHub and Azure simulators
+    name: Setup against local GitHub simulators
     # Keep the full external-tool topology matrix off the PR critical path.
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    services:
-      postgres:
-        image: postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
-        env:
-          POSTGRES_DB: cao
-          POSTGRES_HOST_AUTH_METHOD: trust
-        ports: ["5432:5432"]
-        options: >-
-          --health-cmd "pg_isready -U postgres -d cao"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 12
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -191,21 +179,6 @@ jobs:
           GH_ENTERPRISE_TOKEN: ""
           GITHUB_ENTERPRISE_TOKEN: ""
         run: npm run test:integration:setup
-      - name: Prepare offline Azure simulation prerequisites
-        run: |
-          go mod download
-          go -C server mod download
-          docker pull mcr.microsoft.com/azure-storage/azurite:3.37.0@sha256:830430c1da1a2d537e08f3e6764dd1f5ae00cf0346bcaf625b968ec3f0971fd5
-      - name: Run Azure setup with official Azurite and local control-plane simulation
-        env:
-          POSTGRES_URL: postgres://postgres@127.0.0.1:5432/cao?sslmode=disable
-          GH_TOKEN: ""
-          GITHUB_TOKEN: ""
-          GH_ENTERPRISE_TOKEN: ""
-          GITHUB_ENTERPRISE_TOKEN: ""
-        run: |
-          npm run test:integration:setup-azure
-          npm run test:integration:azure-install-journey
 
   extension-authtests:
     name: Doctor authenticated integration tests

@@ -5,16 +5,10 @@ on:
     paths:
       - .github/workflows/podman.yml
       - scripts/container-*.sh
-      - scripts/azure-local/**
       - internal/**
       - server/**
       - tests/unit/container-engine.test.mjs
       - tests/unit/podman-ci.test.mjs
-      - tests/unit/azure-local-*.test.mjs
-      - tests/integration/azure-local-*.test.mjs
-      - tests/helpers/azure-local-go.mjs
-      - tests/integration/azure-local-*.test.mjs
-      - tests/helpers/azure-local-go.mjs
       - go.mod
       - go.sum
       - package.json
@@ -25,14 +19,10 @@ on:
     paths:
       - .github/workflows/podman.yml
       - scripts/container-*.sh
-      - scripts/azure-local/**
       - internal/**
       - server/**
       - tests/unit/container-engine.test.mjs
       - tests/unit/podman-ci.test.mjs
-      - tests/unit/azure-local-*.test.mjs
-      - tests/integration/azure-local-*.test.mjs
-      - tests/integration/azure-local-*.test.mjs
       - go.mod
       - go.sum
       - package.json
@@ -50,39 +40,34 @@ concurrency:
 
 jobs:
   podman:
-    name: Rootless Podman lifecycle and local Azure services
+    name: Rootless Podman lifecycle
     runs-on: ubuntu-24.04
     timeout-minutes: 25
     env:
       CAO_CONTAINER_ENGINE: podman
       CAO_TEST_PODMAN: "1"
     steps:
-      - &checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - &node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-      - &binaries
-        name: Restore exact-source race-instrumented executables
+      - name: Restore exact-source race-instrumented executable
         id: binaries
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .tmp/podman-bin
-          key: podman-bin-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.github/workflows/podman.yml', 'scripts/azure-local/prepare-test-binaries.sh', 'server/**', 'internal/**', 'go.mod', 'go.sum') }}
-      - &go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+          key: podman-bin-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.github/workflows/podman.yml', 'server/**', 'internal/**', 'go.mod', 'go.sum') }}
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         if: steps.binaries.outputs.cache-hit != 'true'
         with:
           go-version: 1.27.3
           cache: true
           cache-dependency-path: |
             go.sum
             server/go.sum
-      - &podman-host
-        name: Prepare rootless Podman with a delegated user session
+      - name: Prepare rootless Podman with a delegated user session
         run: |
           missing=()
           for tool in podman newuidmap slirp4netns fuse-overlayfs crun; do
@@ -97,11 +82,12 @@ jobs:
           sudo systemctl start "user@$(id -u).service"
           echo "XDG_RUNTIME_DIR=/run/user/$(id -u)" >> "$GITHUB_ENV"
           echo "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u)/bus" >> "$GITHUB_ENV"
-      - &build
-        name: Build current-source executables on cache miss
+      - name: Build current-source executable on cache miss
         if: steps.binaries.outputs.cache-hit != 'true'
-        run: bash scripts/azure-local/prepare-test-binaries.sh
-      - name: Run independent rootless and harness checks concurrently
+        run: |
+          mkdir -p .tmp/podman-bin/server
+          go -C server test -race -c -o "$GITHUB_WORKSPACE/.tmp/podman-bin/server/hostedcli.test" ./internal/hostedcli
+      - name: Run independent rootless and container checks concurrently
         run: |
           boundary() {
             image="$(sed -n 's/^const DefaultContainerImage = "\(.*\)"$/\1/p' server/internal/hostedcli/container_runner.go)"
@@ -114,45 +100,9 @@ jobs:
           }
           boundary &
           boundary_pid=$!
-          node --test tests/unit/container-engine.test.mjs tests/unit/azure-local-*.test.mjs &
+          node --test tests/unit/container-engine.test.mjs &
           contracts_pid=$!
           status=0
           wait "$boundary_pid" || status=$?
           wait "$contracts_pid" || status=$?
           exit "$status"
-  azure-protocols:
-    name: Azure deployment protocol contracts
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - *checkout
-      - *node
-      - *binaries
-      - *go
-      - *build
-      - name: Verify deployment protocols without waiting for service startup
-        env:
-          AZURE_LOCAL_TEST_BINARIES: ${{ github.workspace }}/.tmp/podman-bin
-        run: node tests/integration/azure-local-protocols.test.mjs
-  azure-services:
-    name: Real Azure services with rootless Podman
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    env:
-      CAO_CONTAINER_ENGINE: podman
-    steps:
-      - *checkout
-      - *node
-      - *binaries
-      - *go
-      - name: Restore checksum-verified Azure Functions Core Tools
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: .tmp/azure-local/tools
-          key: podman-core-tools-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/azure-local/azure-local.sh') }}
-      - *podman-host
-      - *build
-      - name: Verify real Functions, Storage and PostgreSQL independently
-        env:
-          AZURE_LOCAL_TEST_BINARIES: ${{ github.workspace }}/.tmp/podman-bin
-        run: bash scripts/azure-local/azure-local.sh run-services
@@ -165,7 +165,7 @@ prompts, tool payloads or sensitive data. Do not spawn agents or sessions.
    provisioned resources or illustrative examples into implemented guarantees.
 3. Inspect at most 30 relevant implementation/test files under
    `dashboard/site/src/data/`, `server/internal/`, `server/spec/`,
-   `server/azure/` and `activity/`
+   `internal/topology/assets/container-apps/`, `server/azure/` and `activity/`
    to verify material changed claims. Trace consumer, owned contract, adapter
    and regression tests before describing a boundary. Normative conflicts
    remain explicit qualifications; do not silently reconcile contradictory
@@ -215,19 +215,19 @@ does not complete the proposed ADR or activate native collection.
 Maintain **Azure service mapping as the final section** of the guide, after
 document ownership. Map domain responsibilities and owned interfaces to concrete
 Azure services with a concise table, a bounded accessible topology diagram and
-nearby source citations. Verify `server/azure/main.bicep` and relevant modules,
+nearby source citations. Verify `internal/topology/assets/container-apps/main.bicep` and relevant modules,
 operational contracts, archive `BlobStore`/`QueryService` adapters and regression
 tests rather than deriving deployment from service names. Cover the complete Go
 handler, canonical and operational PostgreSQL, owner/runtime jobs, optional
-collection/backfill, ACR, Key Vault/managed identity, Functions runtime storage,
+collection/backfill, ACR, Key Vault/managed identity,
 private lake Blob, ADX, observability and network boundaries.
 
 Label each mapping as baseline-provisioned, conditionally provisioned,
-operator-managed or unsupported for the selected host. Functions runtime storage
+operator-managed or unsupported for the selected host; ephemeral container storage
 is not the session lake; `adxEnabled` provisions a destination, not exporter or
 archive activation, external tables or runtime data roles. Preserve the persistent
-single-owner archive/exporter restriction and rejection of Functions platform
-listeners, ephemeral/per-request hosts and standalone collection jobs as archive
+single-owner archive/exporter restriction and rejection of
+ephemeral/per-request hosts and standalone collection jobs as archive
 hosts. Do not invent Redis/Service Bus substitutions, Entra dashboard sign-in,
 managed-identity archive authentication, automatic Go telemetry export or
 production assurance. Changes to mappings must update affected diagrams and

@@ -341,7 +341,7 @@
       "properties": {
         "module": {
           "type": "string",
-          "enum": ["generic", "container", "azure-functions"]
+          "enum": ["generic", "container"]
         },
         "name": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
         "authentication": { "type": "string", "enum": ["github-oauth"] },

@@ -24,7 +24,7 @@ const TARGET_KEYS = [
   "module", "name", "authentication", "listener", "require-https",
   "trust-platform-proxy", "supports-single-replica", "replicas",
 ];
-const TARGET_MODULES = ["generic", "container", "azure-functions"];
+const TARGET_MODULES = ["generic", "container"];
 const REDIS_KEYS = [
   "module", "url-env", "host-env", "port-env", "username-env", "password-env",
   "namespace-env", "session", "isolate-process-namespace",
@@ -677,7 +677,6 @@ function validateHost(host, path) {
         throw new PolicyError(`${operationalPath} memory requires single-process and allow-volatile acknowledgements`);
       }
       if (!targetSupportsSingleReplica || host.target.replicas !== 1 ||
-          host.target.module === "azure-functions" ||
           (host.target.module === "generic" && host.target.listener !== "process")) {
         throw new PolicyError(`${operationalPath} memory requires a single-process, single-replica process-listener target`);
       }