feat: an Azure infrastructure consultant

[craigthackerx]

Copilot already knows Azure. What it does not know is your position, so that is what this agent carries.

The house position it enforces

• Check for a published house module before proposing raw resources. You publish over a hundred Terraform modules. The agent names one when it exists, and says so plainly when it cannot confirm one does, rather than inventing an address that will not resolve.
• Managed identity, then OIDC, then nothing. A stored client secret is a finding, not a design.
• Private by default, and honest about what that breaks. A deployment-package storage account still has to be writable by whatever runs the deployment, and a trusted-services bypass does not cover a build agent. Learned the hard way in this repo's sibling earlier today.
• Names built inside the module from structured inputs so a caller cannot drift them; tags constructed once and merged, never per resource.

The two rules doing the heavy lifting

Name the trade. Every design is assessed against the five Well-Architected pillars and the agent must say which it traded away. A recommendation claiming all five are satisfied is usually one that has not been thought about.

Never quote a price. Pricing is regional, changes without notice, and depends on commitments the agent cannot see. It states the cost model (the meter, what drives it, which choice moves it) then points at the calculator. A confident wrong number is worse than no number, because someone will budget against it.

It also separates three failures people collapse into one word: zone redundancy, region pairing and backup answer an instance dying, a region failing, and someone deleting the data.

A sourcing decision worth flagging

The Well-Architected Framework is deliberately not a knowledge pack. There is no reliable public markdown mirror of it. The one that turns up (MicrosoftDocs/architecture-sandbox) is dated 20 November 2019.

So the five pillars live in the instructions as a review lens, and the detail comes from scoped web search against the live pages. Shipping a six-year-old archive as authoritative knowledge would have been worse than not shipping it, and the reasoning is recorded in sources.yaml so nobody adds it later without knowing.

CAF is public and current, so the landing zone design areas, resource naming and abbreviations are packs.

Gates

Budget 7513/8000, under the warning line. just validate clean: 8 agents, 0 warnings.