@msn-control/liftoff 0.3.0 → 0.3.2

package/dist/templates.js

@@ -3,6 +3,50 @@ import { addGenAiExtensionArtifacts } from './genai-templates.js';
 import { addStandardStackArtifacts, renderStandardDockerfile, renderStandardEnv } from './standard-templates.js';
 import { liftoffVersion } from './version.js';
 const contentHash = (content) => `sha256:${createHash('sha256').update(content, 'utf8').digest('hex')}`;
+const DEFAULT_FUNCTION_WORKER_QUEUE_NAME = 'events';
+export const AZURE_NAME_LIMITS = {
+    resourceGroup: 90,
+    containerRegistry: 50,
+    identity: 128,
+    containerAppEnvironment: 60,
+    backendContainerApp: 32,
+    frontendContainerApp: 32,
+    functionServicePlan: 40,
+    functionApp: 60,
+    postgres: 63,
+    redis: 63,
+    storage: 24,
+    serviceBus: 50,
+    communication: 63,
+    keyVault: 24
+};
+const boundedToken = (value, length) => value.slice(0, length).replace(/-+$/g, '') || 'app';
+export function buildAzureResourceNames(plan, environment, resourceSuffix) {
+    const workload = boundedToken(plan.safeProjectName, 12);
+    const compactWorkload = boundedToken(plan.safeProjectName.replace(/-/g, ''), 8);
+    return {
+        resourceGroup: `rg-${workload}-${environment}`,
+        containerRegistry: `acr${compactWorkload}${resourceSuffix}`,
+        identity: `id-${workload}-${environment}`,
+        containerAppEnvironment: `cae-${workload}-${environment}`,
+        backendContainerApp: `ca-${workload}-be-${environment}`,
+        frontendContainerApp: `ca-${workload}-fe-${environment}`,
+        functionServicePlan: `asp-${workload}-fn-${environment}`,
+        functionApp: `func-${workload}-${environment}-${resourceSuffix}`,
+        postgres: `psql-${workload}-${environment}-${resourceSuffix}`,
+        redis: `redis-${workload}-${environment}-${resourceSuffix}`,
+        storage: `st${compactWorkload}${resourceSuffix}`,
+        serviceBus: `sb-${workload}-${environment}-${resourceSuffix}`,
+        communication: `acs-${workload}-${environment}-${resourceSuffix}`,
+        keyVault: `kv-${compactWorkload}-${resourceSuffix}`
+    };
+}
+function stableResourceSuffix(plan, environment) {
+    return createHash('sha256')
+        .update(`${plan.safeProjectName}:${environment}`, 'utf8')
+        .digest('hex')
+        .slice(0, 12);
+}
 const pyModule = (value) => value.replace(/-/g, '_');
 const titleCase = (value) => value.replace(/(^|[-_\s])([a-z])/g, (_match, prefix, letter) => `${prefix ? ' ' : ''}${letter.toUpperCase()}`).trim();
 const sourceString = (value) => JSON.stringify(value);
@@ -111,6 +155,8 @@ function addBackendArtifacts(add, plan) {
     add('backend-observability', 'backend', ['backend', 'observability', 'tracing.py'], renderTracing());
     add('backend-observability-package', 'backend', ['backend', 'observability', '__init__.py'], '');
     add('backend-test-health', 'backend-test', ['backend', 'tests', 'test_health.py'], renderBackendHealthTest());
+    add('backend-test-messaging', 'backend-test', ['backend', 'tests', 'test_messaging.py'], renderMessagingTest());
+    add('backend-test-tracing', 'backend-test', ['backend', 'tests', 'test_tracing.py'], renderTracingTest());
 }
 function addDatabaseArtifacts(add, plan) {
     add('database-alembic-ini', 'database', ['database', 'alembic.ini'], renderAlembicIni());
@@ -122,6 +168,7 @@ function addPatternArtifacts(add, plan) {
     const pattern = genAiPattern(plan);
     const routeModule = pyModule(pattern.id);
     add('pattern-agent', 'pattern', ['backend', 'orchestration', 'agents', `${routeModule}_agent.py`], renderPatternAgent(plan));
+    add('pattern-agent-test', 'backend-test', ['backend', 'tests', `test_${routeModule}_orchestration.py`], renderPatternAgentTest(plan));
     add('pattern-prompt', 'pattern', ['backend', 'orchestration', 'prompts', `${pattern.id}.md`], renderPromptTemplate(plan));
     add('pattern-agent-package', 'pattern', ['backend', 'orchestration', 'agents', '__init__.py'], '');
     add('pattern-prompt-readme', 'pattern', ['backend', 'orchestration', 'prompts', 'README.md'], renderPromptReadme());
@@ -200,11 +247,89 @@ function addFrontendArtifacts(add, plan) {
     add('frontend-index', 'frontend', ['frontend', 'index.html'], renderFrontendIndex(plan));
     add('frontend-main', 'frontend', ['frontend', 'src', 'main.ts'], renderFrontendMain());
     add('frontend-app', 'frontend', ['frontend', 'src', 'App.vue'], renderFrontendApp(plan));
+    add('frontend-env-example', 'frontend', ['frontend', '.env.example'], 'VITE_API_BASE_URL=http://localhost:8000');
     add('frontend-styles', 'frontend', ['frontend', 'src', 'styles.css'], renderFrontendStyles());
     add('frontend-vite-config', 'frontend', ['frontend', 'vite.config.ts'], renderFrontendViteConfig());
     add('frontend-tailwind-config', 'frontend', ['frontend', 'tailwind.config.ts'], renderFrontendTailwindConfig());
     add('frontend-dockerfile', 'frontend', ['frontend', 'Dockerfile'], renderFrontendDockerfile());
 }
+function renderDirectBuildAndTestGuide(plan) {
+    let backendCommands;
+    if (plan.projectType.id === 'genai' || plan.apiStack.id === 'python-fastapi') {
+        backendCommands = `python -m venv .venv
+. .venv/bin/activate
+python -m pip install -e "./backend[test]"
+(cd backend && python -m pytest -q)`;
+    }
+    else if (plan.apiStack.id === 'node-fastify') {
+        backendCommands = `cd backend
+npm install
+npm run build
+npm test`;
+    }
+    else {
+        backendCommands = `cd backend
+go test ./...`;
+    }
+    const frontendCommands = plan.includeFrontend ? `
+
+Build the frontend without a running backend:
+
+\`\`\`bash
+cp frontend/.env.example frontend/.env
+cd frontend
+npm install
+npm run build
+\`\`\`
+` : '';
+    const functionCommands = hasFunctionWorker(plan) ? `
+
+Run the Function worker unit tests from the same Python virtual environment:
+
+\`\`\`bash
+cd functions/${functionWorkerName(plan)}
+python -m pip install -r requirements.txt
+python -m pytest -q
+\`\`\`
+` : '';
+    return `## Direct Build And Test
+
+\`\`\`bash
+${backendCommands}
+\`\`\`
+
+On Windows, activate Python virtual environments with \`.venv\\Scripts\\activate\`.
+${frontendCommands}${functionCommands}`;
+}
+function renderGeneratedConfigurationGuide(plan) {
+    const frontendConfiguration = plan.includeFrontend
+        ? '\n- `frontend/.env` configures `VITE_API_BASE_URL`; the production build does not contact the backend.'
+        : '';
+    if (plan.projectType.id === 'standard') {
+        return `## Runtime Configuration
+
+Copy \`.env.example\` to \`.env\` before running outside Docker Compose. The backend requires \`DATABASE_URL\` and \`REDIS_URL\`. \`CORS_ALLOWED_ORIGINS\` is a comma-separated allowlist and defaults to the local frontend at \`http://localhost:5173\`.${frontendConfiguration}
+`;
+    }
+    return `## Starter Integration Configuration
+
+Copy \`.env.example\` to \`.env\`, then configure only the integrations you use:
+
+- \`PYDANTIC_AI_MODEL\` is required when production orchestration is invoked. If it is absent, the agent raises an explicit configuration error rather than returning a placeholder answer.
+- Redis Streams uses \`REDIS_URL\` and \`REDIS_STREAM_NAME\`.
+- Azure Service Bus uses \`SERVICE_BUS_QUEUE_NAME\` plus either \`SERVICE_BUS_CONNECTION_STRING\` or \`SERVICE_BUS_FULLY_QUALIFIED_NAMESPACE\`; set \`AZURE_CLIENT_ID\` when selecting a user-assigned managed identity.
+- Langfuse requires both \`LANGFUSE_PUBLIC_KEY\` and \`LANGFUSE_SECRET_KEY\`, with optional \`LANGFUSE_HOST\`. Without both keys, tracing is explicitly disabled and no remote trace ID is reported.${frontendConfiguration}
+- \`CORS_ALLOWED_ORIGINS\` is a comma-separated frontend-origin allowlist and defaults to \`http://localhost:5173\`.
+`;
+}
+function renderGeneratedUpdateGuide() {
+    return `## Safe Liftoff Updates
+
+\`liftoff update\` is a read-only drift check; \`liftoff update --apply\` writes only preflighted changes. An occupied destination with different user bytes is reported and skipped, while an identical destination is adopted without rewriting it. Use \`--force\` only after reviewing each conflict.
+
+Liftoff rejects malformed, traversal, absolute, drive-qualified, UNC, separator-containing, or symlink-escaping manifest paths before artifact access. If the manifest is unsafe or malformed, restore \`liftoff.manifest.json\` from version control or regenerate the project with a matching Liftoff version; do not hand-edit unsafe paths. Run \`liftoff <command> --help\` for command-specific syntax because unknown flags, subcommands, values, and extra arguments fail before any write.
+`;
+}
 function renderRootReadme(plan) {
     if (plan.projectType.id === 'standard') {
         return `# ${plan.projectName}
@@ -231,6 +356,9 @@ docker compose up --build
 
 The backend API is available on port 8000. Health and readiness endpoints are available at \`/health\` and \`/ready\`; Scalar is exposed at \`/scalar\`.
 
+${renderGeneratedConfigurationGuide(plan)}
+${renderDirectBuildAndTestGuide(plan)}
+${renderGeneratedUpdateGuide()}
 ## Infrastructure
 
 \`\`\`bash
@@ -280,6 +408,9 @@ docker compose --profile observability up --build
 
 The backend API is available on port 8000. Scalar is exposed at \`/scalar\`.
 
+${renderGeneratedConfigurationGuide(plan)}
+${renderDirectBuildAndTestGuide(plan)}
+${renderGeneratedUpdateGuide()}
 ## Infrastructure
 
 \`\`\`bash
@@ -322,9 +453,18 @@ CLOUD_PROVIDER=${plan.provider.id}
 AZURE_REGION=${plan.region.slug}
 DATABASE_URL=postgresql+asyncpg://postgres:postgres@postgres:5432/${plan.safeProjectName.replace(/-/g, '_')}
 REDIS_URL=redis://redis:6379/0
+REDIS_STREAM_NAME=liftoff-events
 MESSAGING_TRANSPORT=redis-streams
+SERVICE_BUS_QUEUE_NAME=${DEFAULT_FUNCTION_WORKER_QUEUE_NAME}
+SERVICE_BUS_CONNECTION_STRING=
+SERVICE_BUS_FULLY_QUALIFIED_NAMESPACE=
+AZURE_CLIENT_ID=
 BLOB_ENDPOINT=http://azurite:10000/devstoreaccount1
+CORS_ALLOWED_ORIGINS=http://localhost:5173
+PYDANTIC_AI_MODEL=
 LANGFUSE_HOST=http://langfuse:3000
+LANGFUSE_PUBLIC_KEY=
+LANGFUSE_SECRET_KEY=
 `;
 }
 function renderBackendDockerfile() {
@@ -356,15 +496,16 @@ dependencies = [
   "uvicorn[standard]>=0.30",
   "pydantic>=2.7",
   "pydantic-settings>=2.3",
-  "pydantic-ai>=0.0.13",
+  "pydantic-ai-slim[openai]==1.107.1",
   "scalar-fastapi>=1.0",
   "sqlalchemy[asyncio]>=2.0",
   "asyncpg>=0.29",
   "psycopg[binary]>=3.2",
   "alembic>=1.13",
   "redis>=5.0",
-  "langfuse>=2.39",
+  "langfuse==2.60.10",
   "azure-servicebus>=7.12",
+  "azure-identity>=1.17",
   "azure-storage-blob>=12.20",
   "azure-communication-email>=1.0"
 ]
@@ -386,6 +527,7 @@ testpaths = ["tests"]
 }
 function renderFastApiMain(plan, routeModule) {
     return `from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
 
 try:
     from scalar_fastapi import get_scalar_api_reference
@@ -398,6 +540,16 @@ from backend.config.settings import get_settings
 
 settings = get_settings()
 app = FastAPI(title=settings.app_name, version="0.1.0")
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=[
+        origin.strip()
+        for origin in settings.cors_allowed_origins.split(",")
+        if origin.strip()
+    ],
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
 
 app.include_router(health.router)
 app.include_router(${routeModule}.router)
@@ -519,9 +671,18 @@ class Settings(BaseSettings):
     azure_region: str = "${plan.region.slug}"
     database_url: str
     redis_url: str
+    redis_stream_name: str = "liftoff-events"
     messaging_transport: str = "redis-streams"
+    service_bus_queue_name: str = "${DEFAULT_FUNCTION_WORKER_QUEUE_NAME}"
+    service_bus_connection_string: str | None = None
+    service_bus_fully_qualified_namespace: str | None = None
+    azure_client_id: str | None = None
     blob_endpoint: str | None = None
+    cors_allowed_origins: str = "http://localhost:5173"
+    pydantic_ai_model: str | None = None
     langfuse_host: str | None = None
+    langfuse_public_key: str | None = None
+    langfuse_secret_key: str | None = None
 
 
 @lru_cache
@@ -531,18 +692,65 @@ def get_settings() -> Settings:
 }
 function renderModelConfig(plan) {
     const pattern = genAiPattern(plan);
-    return `from pydantic import BaseModel, Field
+    return `import os
+from dataclasses import dataclass
+from typing import Protocol
+
 
+class ModelConfigurationError(RuntimeError):
+    pass
 
-class ModelConfig(BaseModel):
-    provider: str = Field(default="azure-openai")
-    deployment_name: str = Field(default="gpt-4.1")
-    embedding_deployment_name: str = Field(default="text-embedding-3-large")
-    pattern: str = Field(default="${pattern.id}")
+
+class AgentRunner(Protocol):
+    async def run(self, prompt: str) -> str:
+        ...
+
+
+@dataclass(frozen=True)
+class ModelConfig:
+    model_name: str
+    pattern: str = "${pattern.id}"
+
+    @classmethod
+    def from_environment(cls) -> "ModelConfig":
+        model_name = os.getenv("PYDANTIC_AI_MODEL", "").strip()
+        if not model_name:
+            raise ModelConfigurationError(
+                "PYDANTIC_AI_MODEL is required before invoking production GenAI orchestration. "
+                "Use a PydanticAI model name such as 'openai:gpt-4.1-mini'."
+            )
+        return cls(model_name=model_name)
+
+
+class PydanticAgentRunner:
+    def __init__(self, config: ModelConfig):
+        from pydantic_ai import Agent
+
+        self._agent = Agent(config.model_name)
+
+    async def run(self, prompt: str) -> str:
+        result = await self._agent.run(prompt)
+        output = getattr(result, "output", None)
+        if output is None:
+            output = getattr(result, "data", None)
+        if output is None:
+            raise RuntimeError("PydanticAI returned a result without output data.")
+        return str(output)
+
+
+def build_agent_runner(config: ModelConfig | None = None) -> AgentRunner:
+    return PydanticAgentRunner(config or ModelConfig.from_environment())
 `;
 }
 function renderMessagingBoundary() {
-    return `from typing import Protocol
+    return `import json
+import os
+from collections.abc import Callable
+from typing import Any, Protocol
+
+
+class MessagingConfigurationError(RuntimeError):
+    pass
 
 
 class MessagePublisher(Protocol):
@@ -550,32 +758,202 @@ class MessagePublisher(Protocol):
         ...
 
 
+class RedisStreamClient(Protocol):
+    async def xadd(self, name: str, fields: dict[str, str]) -> Any:
+        ...
+
+
+class ServiceBusSender(Protocol):
+    async def __aenter__(self) -> "ServiceBusSender":
+        ...
+
+    async def __aexit__(self, exc_type, exc, traceback) -> None:
+        ...
+
+    async def send_messages(self, message: Any) -> None:
+        ...
+
+
+class ServiceBusClient(Protocol):
+    def get_queue_sender(self, *, queue_name: str) -> ServiceBusSender:
+        ...
+
+
+def _serialize(topic: str, payload: dict) -> str:
+    return json.dumps({"topic": topic, "payload": payload}, separators=(",", ":"), sort_keys=True)
+
+
 class RedisStreamPublisher:
+    def __init__(self, client: RedisStreamClient, stream_name: str):
+        self._client = client
+        self._stream_name = stream_name
+
     async def publish(self, topic: str, payload: dict) -> None:
-        # Implement with redis.asyncio in application code.
-        return None
+        await self._client.xadd(
+            self._stream_name,
+            {"topic": topic, "payload": _serialize(topic, payload)},
+        )
 
 
 class AzureServiceBusPublisher:
-    async def publish(self, topic: str, payload: dict) -> None:
-        # Implement with azure-servicebus in cloud configuration.
-        return None
+    def __init__(
+        self,
+        client: ServiceBusClient,
+        queue_name: str,
+        message_factory: Callable[[str], Any] | None = None,
+    ):
+        self._client = client
+        self._queue_name = queue_name
+        self._message_factory = message_factory or self._default_message_factory
+
+    @staticmethod
+    def _default_message_factory(body: str) -> Any:
+        from azure.servicebus import ServiceBusMessage
+
+        return ServiceBusMessage(body)
 
+    async def publish(self, topic: str, payload: dict) -> None:
+        message = self._message_factory(_serialize(topic, payload))
+        async with self._client.get_queue_sender(queue_name=self._queue_name) as sender:
+            await sender.send_messages(message)
+
+
+def build_message_publisher(
+    transport: str,
+    *,
+    redis_client: RedisStreamClient | None = None,
+    service_bus_client: ServiceBusClient | None = None,
+    message_factory: Callable[[str], Any] | None = None,
+) -> MessagePublisher:
+    if transport == "redis-streams":
+        stream_name = os.getenv("REDIS_STREAM_NAME", "liftoff-events").strip()
+        if not stream_name:
+            raise MessagingConfigurationError("REDIS_STREAM_NAME must not be empty.")
+        if redis_client is None:
+            redis_url = os.getenv("REDIS_URL", "").strip()
+            if not redis_url:
+                raise MessagingConfigurationError("REDIS_URL is required for redis-streams messaging.")
+            from redis.asyncio import Redis
+
+            redis_client = Redis.from_url(redis_url, decode_responses=True)
+        return RedisStreamPublisher(redis_client, stream_name)
 
-def build_message_publisher(transport: str) -> MessagePublisher:
     if transport == "azure-service-bus":
-        return AzureServiceBusPublisher()
-    return RedisStreamPublisher()
+        queue_name = os.getenv("SERVICE_BUS_QUEUE_NAME", "").strip()
+        if not queue_name:
+            raise MessagingConfigurationError(
+                "SERVICE_BUS_QUEUE_NAME is required for azure-service-bus messaging."
+            )
+        if service_bus_client is None:
+            connection_string = os.getenv("SERVICE_BUS_CONNECTION_STRING", "").strip()
+            namespace = os.getenv("SERVICE_BUS_FULLY_QUALIFIED_NAMESPACE", "").strip()
+            from azure.servicebus.aio import ServiceBusClient as AzureServiceBusClient
+
+            if connection_string:
+                service_bus_client = AzureServiceBusClient.from_connection_string(connection_string)
+            elif namespace:
+                from azure.identity.aio import DefaultAzureCredential
+
+                client_id = os.getenv("AZURE_CLIENT_ID", "").strip() or None
+                credential = DefaultAzureCredential(managed_identity_client_id=client_id)
+                service_bus_client = AzureServiceBusClient(namespace, credential)
+            else:
+                raise MessagingConfigurationError(
+                    "Set SERVICE_BUS_CONNECTION_STRING or SERVICE_BUS_FULLY_QUALIFIED_NAMESPACE "
+                    "for azure-service-bus messaging."
+                )
+        return AzureServiceBusPublisher(service_bus_client, queue_name, message_factory)
+
+    raise MessagingConfigurationError(
+        f"Unsupported MESSAGING_TRANSPORT '{transport}'. "
+        "Expected 'redis-streams' or 'azure-service-bus'."
+    )
 `;
 }
 function renderTracing() {
-    return `from contextlib import asynccontextmanager
+    return `import os
+from contextlib import asynccontextmanager
+from dataclasses import dataclass
+from typing import Any, AsyncContextManager, Protocol
+
 
+class TracingConfigurationError(RuntimeError):
+    pass
+
+
+@dataclass
+class TraceHandle:
+    enabled: bool
+    trace_id: str | None
+    output: Any = None
+
+    def set_output(self, output: Any) -> None:
+        self.output = output
+
+
+class Tracer(Protocol):
+    def trace(self, name: str, input_data: Any = None) -> AsyncContextManager[TraceHandle]:
+        ...
 
-@asynccontextmanager
-async def trace_llm_operation(name: str):
-    # Wire Langfuse callbacks here when model credentials are configured.
-    yield {"trace": name}
+
+class DisabledTracer:
+    @asynccontextmanager
+    async def trace(self, name: str, input_data: Any = None):
+        del name, input_data
+        yield TraceHandle(enabled=False, trace_id=None)
+
+
+class LangfuseTracer:
+    def __init__(self, client: Any):
+        self._client = client
+
+
+    @asynccontextmanager
+    async def trace(self, name: str, input_data: Any = None):
+        remote_trace = self._client.trace(name=name, input=input_data)
+        remote_id = getattr(remote_trace, "id", None)
+        handle = TraceHandle(
+            enabled=True,
+            trace_id=str(remote_id) if remote_id is not None else None,
+        )
+        try:
+            yield handle
+        except Exception as error:
+            remote_trace.update(level="ERROR", status_message=str(error))
+            raise
+        else:
+            remote_trace.update(output=handle.output)
+
+
+def build_tracer(
+    *,
+    client: Any = None,
+    public_key: str | None = None,
+    secret_key: str | None = None,
+    host: str | None = None,
+) -> Tracer:
+    if client is not None:
+        return LangfuseTracer(client)
+
+    resolved_public_key = public_key or os.getenv("LANGFUSE_PUBLIC_KEY", "").strip()
+    resolved_secret_key = secret_key or os.getenv("LANGFUSE_SECRET_KEY", "").strip()
+    if not resolved_public_key and not resolved_secret_key:
+        return DisabledTracer()
+    if not resolved_public_key or not resolved_secret_key:
+        raise TracingConfigurationError(
+            "LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY must be configured together."
+        )
+
+    from langfuse import Langfuse
+
+    resolved_host = host or os.getenv("LANGFUSE_HOST", "").strip() or None
+    kwargs = {
+        "public_key": resolved_public_key,
+        "secret_key": resolved_secret_key,
+    }
+    if resolved_host:
+        kwargs["host"] = resolved_host
+    return LangfuseTracer(Langfuse(**kwargs))
 `;
 }
 function renderBackendHealthTest() {
@@ -589,6 +967,159 @@ def test_health():
     response = client.get("/health")
     assert response.status_code == 200
     assert response.json()["status"] == "ok"
+
+
+def test_cors_preflight_for_local_frontend():
+    response = TestClient(app).options(
+        "/health",
+        headers={
+            "Origin": "http://localhost:5173",
+            "Access-Control-Request-Method": "GET",
+        },
+    )
+    assert response.status_code == 200
+    assert response.headers["access-control-allow-origin"] == "http://localhost:5173"
+`;
+}
+function renderMessagingTest() {
+    return `import asyncio
+import json
+
+from backend.orchestration.tools.messaging import build_message_publisher
+
+
+class FakeRedisClient:
+    def __init__(self):
+        self.calls = []
+
+    async def xadd(self, name, fields):
+        self.calls.append((name, fields))
+
+
+class FakeSender:
+    def __init__(self):
+        self.messages = []
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, exc_type, exc, traceback):
+        return None
+
+    async def send_messages(self, message):
+        self.messages.append(message)
+
+
+class FakeServiceBusClient:
+    def __init__(self, sender):
+        self.sender = sender
+        self.queue_names = []
+
+    def get_queue_sender(self, *, queue_name):
+        self.queue_names.append(queue_name)
+        return self.sender
+
+
+def test_redis_stream_publisher_uses_xadd(monkeypatch):
+    monkeypatch.setenv("REDIS_STREAM_NAME", "orchestration-events")
+    client = FakeRedisClient()
+    publisher = build_message_publisher("redis-streams", redis_client=client)
+
+    asyncio.run(publisher.publish("rag.ingest", {"source_uri": "az://document"}))
+
+    stream_name, fields = client.calls[0]
+    assert stream_name == "orchestration-events"
+    assert fields["topic"] == "rag.ingest"
+    assert json.loads(fields["payload"]) == {
+        "payload": {"source_uri": "az://document"},
+        "topic": "rag.ingest",
+    }
+
+
+def test_service_bus_publisher_uses_async_sender(monkeypatch):
+    monkeypatch.setenv("SERVICE_BUS_QUEUE_NAME", "orchestration-jobs")
+    sender = FakeSender()
+    client = FakeServiceBusClient(sender)
+    publisher = build_message_publisher(
+        "azure-service-bus",
+        service_bus_client=client,
+        message_factory=lambda body: body,
+    )
+
+    asyncio.run(publisher.publish("workflow.run", {"job_id": "job-1"}))
+
+    assert client.queue_names == ["orchestration-jobs"]
+    assert json.loads(sender.messages[0]) == {
+        "payload": {"job_id": "job-1"},
+        "topic": "workflow.run",
+    }
+`;
+}
+function renderTracingTest() {
+    return `import asyncio
+
+import pytest
+
+from backend.observability.tracing import (
+    TracingConfigurationError,
+    build_tracer,
+)
+
+
+class FakeRemoteTrace:
+    id = "trace-123"
+
+    def __init__(self):
+        self.updates = []
+
+    def update(self, **values):
+        self.updates.append(values)
+
+
+class FakeLangfuse:
+    def __init__(self):
+        self.calls = []
+        self.remote_trace = FakeRemoteTrace()
+
+    def trace(self, **values):
+        self.calls.append(values)
+        return self.remote_trace
+
+
+def test_unconfigured_tracing_is_explicitly_disabled(monkeypatch):
+    monkeypatch.delenv("LANGFUSE_PUBLIC_KEY", raising=False)
+    monkeypatch.delenv("LANGFUSE_SECRET_KEY", raising=False)
+
+    async def scenario():
+        async with build_tracer().trace("offline") as trace:
+            assert trace.enabled is False
+            assert trace.trace_id is None
+
+    asyncio.run(scenario())
+
+
+def test_configured_tracing_updates_langfuse_operation():
+    client = FakeLangfuse()
+
+    async def scenario():
+        async with build_tracer(client=client).trace(
+            "agent.run",
+            {"prompt": "hello"},
+        ) as trace:
+            assert trace.enabled is True
+            assert trace.trace_id == "trace-123"
+            trace.set_output({"answer": "world"})
+
+    asyncio.run(scenario())
+    assert client.calls == [{"name": "agent.run", "input": {"prompt": "hello"}}]
+    assert client.remote_trace.updates == [{"output": {"answer": "world"}}]
+
+
+def test_partial_langfuse_configuration_fails(monkeypatch):
+    monkeypatch.setenv("LANGFUSE_PUBLIC_KEY", "public")
+    monkeypatch.delenv("LANGFUSE_SECRET_KEY", raising=False)
+    with pytest.raises(TracingConfigurationError, match="configured together"):
+        build_tracer()
 `;
 }
 function renderAlembicIni() {
@@ -658,36 +1189,245 @@ function renderPatternAgent(plan) {
     const pattern = genAiPattern(plan);
     const moduleName = pyModule(pattern.id);
     if (pattern.id === 'rag') {
-        return `from backend.orchestration.tools.messaging import build_message_publisher
-
-
-async def answer_question(question: str) -> dict:
+        return `import os
+
+from backend.observability.tracing import Tracer, build_tracer
+from backend.orchestration.model_config import AgentRunner, build_agent_runner
+from backend.orchestration.tools.messaging import MessagePublisher, build_message_publisher
+
+
+async def _run_agent(
+    operation: str,
+    prompt: str,
+    runner: AgentRunner | None,
+    tracer: Tracer | None,
+) -> str:
+    selected_runner = runner or build_agent_runner()
+    selected_tracer = tracer or build_tracer()
+    async with selected_tracer.trace(operation, {"prompt": prompt}) as trace:
+        output = await selected_runner.run(prompt)
+        trace.set_output({"text": output})
+        return output
+
+
+async def answer_question(
+    question: str,
+    *,
+    runner: AgentRunner | None = None,
+    tracer: Tracer | None = None,
+) -> dict:
+    answer = await _run_agent(
+        "rag.query",
+        f"Answer the question using retrieved evidence when available.\\nQuestion: {question}",
+        runner,
+        tracer,
+    )
     return {
-        "answer": "Replace this placeholder with PydanticAI retrieval orchestration.",
+        "answer": answer,
         "question": question,
         "citations": [],
     }
 
 
-async def enqueue_ingestion(source_uri: str) -> dict:
-    publisher = build_message_publisher("redis-streams")
-    await publisher.publish("rag.ingest", {"source_uri": source_uri})
+async def enqueue_ingestion(
+    source_uri: str,
+    *,
+    publisher: MessagePublisher | None = None,
+) -> dict:
+    selected_publisher = publisher or build_message_publisher(
+        os.getenv("MESSAGING_TRANSPORT", "redis-streams")
+    )
+    await selected_publisher.publish("rag.ingest", {"source_uri": source_uri})
     return {"status": "queued", "source_uri": source_uri}
 `;
     }
     if (pattern.id === 'streaming') {
-        return `async def stream_response(prompt: str):
-    yield f"data: Starting response for {prompt}\\n\\n"
-    yield "data: Replace this placeholder with PydanticAI streaming orchestration.\\n\\n"
+        return `import json
+
+from backend.observability.tracing import Tracer, build_tracer
+from backend.orchestration.model_config import AgentRunner, build_agent_runner
+
+
+async def stream_response(
+    prompt: str,
+    *,
+    runner: AgentRunner | None = None,
+    tracer: Tracer | None = None,
+):
+    selected_runner = runner or build_agent_runner()
+    selected_tracer = tracer or build_tracer()
+    async with selected_tracer.trace("streaming.run", {"prompt": prompt}) as trace:
+        output = await selected_runner.run(
+            f"Respond concisely and safely to this streaming request:\\n{prompt}"
+        )
+        trace.set_output({"text": output})
+    yield f"data: {json.dumps({'text': output})}\\n\\n"
 `;
     }
-    return `async def run_${moduleName}(input_text: str) -> dict:
+    return `from backend.observability.tracing import Tracer, build_tracer
+from backend.orchestration.model_config import AgentRunner, build_agent_runner
+
+
+async def run_${moduleName}(
+    input_text: str,
+    *,
+    runner: AgentRunner | None = None,
+    tracer: Tracer | None = None,
+) -> dict:
+    selected_runner = runner or build_agent_runner()
+    selected_tracer = tracer or build_tracer()
+    prompt = (
+        "Run the ${pattern.label} orchestration contract for this input:\\n"
+        f"{input_text}"
+    )
+    async with selected_tracer.trace("${pattern.id}.run", {"input": input_text}) as trace:
+        output = await selected_runner.run(prompt)
+        trace.set_output({"result": output})
     return {
-        "result": "Replace this placeholder with ${pattern.label} PydanticAI orchestration.",
+        "result": output,
         "input": input_text,
     }
 `;
 }
+function renderPatternAgentTest(plan) {
+    const pattern = genAiPattern(plan);
+    const moduleName = pyModule(pattern.id);
+    const agentModule = `backend.orchestration.agents.${moduleName}_agent`;
+    if (pattern.id === 'rag') {
+        return `import asyncio
+
+import pytest
+
+from ${agentModule} import answer_question, enqueue_ingestion
+from backend.observability.tracing import DisabledTracer
+from backend.orchestration.model_config import ModelConfigurationError
+
+
+class FakeRunner:
+    async def run(self, prompt):
+        assert "Question: What is Liftoff?" in prompt
+        return "Liftoff is the generated orchestration starter."
+
+
+class FakePublisher:
+    def __init__(self):
+        self.messages = []
+
+    async def publish(self, topic, payload):
+        self.messages.append((topic, payload))
+
+
+def test_rag_query_uses_injected_runner_without_network():
+    result = asyncio.run(
+        answer_question(
+            "What is Liftoff?",
+            runner=FakeRunner(),
+            tracer=DisabledTracer(),
+        )
+    )
+    assert result == {
+        "answer": "Liftoff is the generated orchestration starter.",
+        "question": "What is Liftoff?",
+        "citations": [],
+    }
+
+
+def test_rag_ingestion_uses_injected_publisher():
+    publisher = FakePublisher()
+    result = asyncio.run(
+        enqueue_ingestion("az://documents/one.pdf", publisher=publisher)
+    )
+    assert result == {
+        "status": "queued",
+        "source_uri": "az://documents/one.pdf",
+    }
+    assert publisher.messages == [
+        ("rag.ingest", {"source_uri": "az://documents/one.pdf"})
+    ]
+
+
+def test_missing_model_configuration_is_explicit(monkeypatch):
+    monkeypatch.delenv("PYDANTIC_AI_MODEL", raising=False)
+    with pytest.raises(ModelConfigurationError, match="PYDANTIC_AI_MODEL is required"):
+        asyncio.run(answer_question("unconfigured"))
+`;
+    }
+    if (pattern.id === 'streaming') {
+        return `import asyncio
+
+import pytest
+
+from ${agentModule} import stream_response
+from backend.observability.tracing import DisabledTracer
+from backend.orchestration.model_config import ModelConfigurationError
+
+
+class FakeRunner:
+    async def run(self, prompt):
+        assert "stream this" in prompt
+        return "offline streamed answer"
+
+
+def test_streaming_uses_injected_runner_without_network():
+    async def collect():
+        return [
+            chunk
+            async for chunk in stream_response(
+                "stream this",
+                runner=FakeRunner(),
+                tracer=DisabledTracer(),
+            )
+        ]
+
+    chunks = asyncio.run(collect())
+    assert chunks == ['data: {"text": "offline streamed answer"}\\n\\n']
+
+
+def test_missing_model_configuration_is_explicit(monkeypatch):
+    monkeypatch.delenv("PYDANTIC_AI_MODEL", raising=False)
+
+    async def collect():
+        return [chunk async for chunk in stream_response("unconfigured")]
+
+    with pytest.raises(ModelConfigurationError, match="PYDANTIC_AI_MODEL is required"):
+        asyncio.run(collect())
+`;
+    }
+    return `import asyncio
+
+import pytest
+
+from ${agentModule} import run_${moduleName}
+from backend.observability.tracing import DisabledTracer
+from backend.orchestration.model_config import ModelConfigurationError
+
+
+class FakeRunner:
+    async def run(self, prompt):
+        assert "offline input" in prompt
+        return "offline ${pattern.id} result"
+
+
+def test_${moduleName}_uses_injected_runner_without_network():
+    result = asyncio.run(
+        run_${moduleName}(
+            "offline input",
+            runner=FakeRunner(),
+            tracer=DisabledTracer(),
+        )
+    )
+    assert result == {
+        "result": "offline ${pattern.id} result",
+        "input": "offline input",
+    }
+
+
+def test_missing_model_configuration_is_explicit(monkeypatch):
+    monkeypatch.delenv("PYDANTIC_AI_MODEL", raising=False)
+    with pytest.raises(ModelConfigurationError, match="PYDANTIC_AI_MODEL is required"):
+        asyncio.run(run_${moduleName}("unconfigured"))
+`;
+}
 function renderPromptTemplate(plan) {
     const pattern = genAiPattern(plan);
     return `# ${pattern.label} Prompt
@@ -741,6 +1481,8 @@ Azure Functions worker scaffold for ${pattern.label}.
 
 This Function app uses the Python v2 decorator programming model and a Service Bus queue trigger. The trigger adapter should stay thin: decode the message, validate the envelope, and call shared code from \`backend/orchestration\` after that shared code is packaged with the Function app.
 
+Deployed triggers use \`ServiceBusConnection__fullyQualifiedNamespace\` and \`ServiceBusConnection__clientId\` to select the same user-assigned identity that OpenTofu grants the Service Bus Data Receiver role. \`SERVICEBUS_QUEUE_NAME\` is populated from \`function_worker_queue_name\`. Function host storage uses the complete \`AzureWebJobsStorage\` connection setting.
+
 ## Local Development
 
 \`\`\`bash
@@ -748,6 +1490,7 @@ python -m venv .venv
 source .venv/bin/activate
 pip install -r requirements.txt
 cp local.settings.example.json local.settings.json
+python -m pytest -q
 func start
 \`\`\`
 
@@ -770,7 +1513,7 @@ function renderFunctionLocalSettings(plan) {
         Values: {
             AzureWebJobsStorage: 'UseDevelopmentStorage=true',
             FUNCTIONS_WORKER_RUNTIME: 'python',
-            SERVICEBUS_QUEUE_NAME: 'events',
+            SERVICEBUS_QUEUE_NAME: DEFAULT_FUNCTION_WORKER_QUEUE_NAME,
             ServiceBusConnection__fullyQualifiedNamespace: '<service-bus-namespace>.servicebus.windows.net',
             GENAI_PATTERN: pattern.id,
             SHARED_ORCHESTRATION_ROOT: '../../backend'
@@ -854,9 +1597,18 @@ CLOUD_PROVIDER=${plan.provider.id}
 AZURE_REGION=${plan.region.slug}
 DATABASE_URL=postgresql+asyncpg://postgres:postgres@postgres:5432/${plan.safeProjectName.replace(/-/g, '_')}
 REDIS_URL=redis://redis:6379/0
+REDIS_STREAM_NAME=liftoff-events
 MESSAGING_TRANSPORT=${transport}
+SERVICE_BUS_QUEUE_NAME=${DEFAULT_FUNCTION_WORKER_QUEUE_NAME}
+SERVICE_BUS_CONNECTION_STRING=
+SERVICE_BUS_FULLY_QUALIFIED_NAMESPACE=${environment === 'dev' ? '' : '<service-bus-namespace>.servicebus.windows.net'}
+AZURE_CLIENT_ID=
 BLOB_ENDPOINT=
-LANGFUSE_HOST=
+CORS_ALLOWED_ORIGINS=http://localhost:5173
+PYDANTIC_AI_MODEL=
+LANGFUSE_HOST=${environment === 'dev' ? 'http://langfuse:3000' : ''}
+LANGFUSE_PUBLIC_KEY=
+LANGFUSE_SECRET_KEY=
 `;
 }
 function renderFunctionsEnv(plan, environment) {
@@ -865,9 +1617,10 @@ function renderFunctionsEnv(plan, environment) {
 APP_NAME=${plan.safeProjectName}
 GENAI_PATTERN=${pattern.id}
 FUNCTIONS_WORKER_RUNTIME=python
-SERVICEBUS_QUEUE_NAME=events
+SERVICEBUS_QUEUE_NAME=${DEFAULT_FUNCTION_WORKER_QUEUE_NAME}
 ServiceBusConnection__fullyQualifiedNamespace=<service-bus-namespace>.servicebus.windows.net
-AzureWebJobsStorage__accountName=<storage-account-name>
+ServiceBusConnection__clientId=<managed-identity-client-id>
+AzureWebJobsStorage=<storage-connection-string>
 SHARED_ORCHESTRATION_ROOT=../../backend
 `;
 }
@@ -991,7 +1744,12 @@ variable "location" {
 
 variable "resource_suffix" {
   type        = string
-  description = "Globally unique suffix for Azure resource names."
+  description = "Twelve-character lowercase alphanumeric suffix for globally scoped Azure resource names."
+
+  validation {
+    condition     = can(regex("^[a-z0-9]{12}$", var.resource_suffix))
+    error_message = "resource_suffix must contain exactly 12 lowercase letters or numbers."
+  }
 }
 
 variable "backend_image" {
@@ -1022,6 +1780,10 @@ ${functionVariables}
 }
 function renderTofuMain(plan) {
     const functionPattern = hasFunctionWorker(plan) ? genAiPattern(plan) : undefined;
+    const names = buildAzureResourceNames(plan, '${var.environment}', '${var.resource_suffix}');
+    const queueName = hasFunctionWorker(plan)
+        ? 'var.function_worker_queue_name'
+        : JSON.stringify(DEFAULT_FUNCTION_WORKER_QUEUE_NAME);
     const projectIdentityEnv = plan.projectType.id === 'genai' ? `
       env {
         name  = "GENAI_PATTERN"
@@ -1033,9 +1795,15 @@ function renderTofuMain(plan) {
         value = "${plan.apiStack.id}"
       }
 `;
+    const frontendCorsEnvironment = plan.includeFrontend ? `
+      env {
+        name  = "CORS_ALLOWED_ORIGINS"
+        value = "https://\${azurerm_container_app.frontend.ingress[0].fqdn}"
+      }
+` : '';
     const frontendContainer = plan.includeFrontend ? `
 resource "azurerm_container_app" "frontend" {
-  name                         = "ca-${plan.safeProjectName}-frontend-\${var.environment}"
+  name                         = "${names.frontendContainerApp}"
   container_app_environment_id = azurerm_container_app_environment.main.id
   resource_group_name          = azurerm_resource_group.main.name
   revision_mode                = "Single"
@@ -1073,7 +1841,7 @@ resource "azurerm_container_app" "frontend" {
 ` : '';
     const functionWorker = hasFunctionWorker(plan) ? `
 resource "azurerm_service_plan" "functions" {
-  name                = "asp-\${local.name_prefix}-functions"
+  name                = "${names.functionServicePlan}"
   resource_group_name = azurerm_resource_group.main.name
   location            = azurerm_resource_group.main.location
   os_type             = "Linux"
@@ -1081,7 +1849,7 @@ resource "azurerm_service_plan" "functions" {
 }
 
 resource "azurerm_linux_function_app" "worker" {
-  name                       = "func-${plan.safeProjectName}-\${var.environment}-\${var.resource_suffix}"
+  name                       = "${names.functionApp}"
   resource_group_name        = azurerm_resource_group.main.name
   location                   = azurerm_resource_group.main.location
   service_plan_id            = azurerm_service_plan.functions.id
@@ -1100,14 +1868,14 @@ resource "azurerm_linux_function_app" "worker" {
   }
 
   app_settings = {
-    APP_ENV                                      = var.environment
-    APP_NAME                                     = "${plan.safeProjectName}"
-    GENAI_PATTERN                                = "${functionPattern?.id}"
-    FUNCTIONS_WORKER_RUNTIME                     = "python"
-    SERVICEBUS_QUEUE_NAME                        = var.function_worker_queue_name
+    APP_ENV                                       = var.environment
+    APP_NAME                                      = "${plan.safeProjectName}"
+    GENAI_PATTERN                                 = "${functionPattern?.id}"
+    FUNCTIONS_WORKER_RUNTIME                      = "python"
+    SERVICEBUS_QUEUE_NAME                         = var.function_worker_queue_name
+    ServiceBusConnection__clientId                = azurerm_user_assigned_identity.app.client_id
     ServiceBusConnection__fullyQualifiedNamespace = "\${azurerm_servicebus_namespace.main.name}.servicebus.windows.net"
-    AzureWebJobsStorage__accountName             = azurerm_storage_account.main.name
-    SHARED_ORCHESTRATION_ROOT                    = "../../backend"
+    SHARED_ORCHESTRATION_ROOT                     = "../../backend"
   }
 }
 
@@ -1123,17 +1891,13 @@ resource "azurerm_role_assignment" "function_storage_blob_contributor" {
   principal_id         = azurerm_user_assigned_identity.app.principal_id
 }
 ` : '';
-    return `locals {
-  name_prefix = "${plan.safeProjectName}-\${var.environment}"
-}
-
-resource "azurerm_resource_group" "main" {
-  name     = "rg-\${local.name_prefix}"
+    return `resource "azurerm_resource_group" "main" {
+  name     = "${names.resourceGroup}"
   location = var.location
 }
 
 resource "azurerm_container_registry" "main" {
-  name                = "acr\${replace(var.resource_suffix, "-", "")}"
+  name                = "${names.containerRegistry}"
   resource_group_name = azurerm_resource_group.main.name
   location            = azurerm_resource_group.main.location
   sku                 = "Basic"
@@ -1141,7 +1905,7 @@ resource "azurerm_container_registry" "main" {
 }
 
 resource "azurerm_user_assigned_identity" "app" {
-  name                = "id-\${local.name_prefix}"
+  name                = "${names.identity}"
   resource_group_name = azurerm_resource_group.main.name
   location            = azurerm_resource_group.main.location
 }
@@ -1153,13 +1917,13 @@ resource "azurerm_role_assignment" "acr_pull" {
 }
 
 resource "azurerm_container_app_environment" "main" {
-  name                = "cae-\${local.name_prefix}"
+  name                = "${names.containerAppEnvironment}"
   resource_group_name = azurerm_resource_group.main.name
   location            = azurerm_resource_group.main.location
 }
 
 resource "azurerm_container_app" "backend" {
-  name                         = "ca-${plan.safeProjectName}-backend-\${var.environment}"
+  name                         = "${names.backendContainerApp}"
   container_app_environment_id = azurerm_container_app_environment.main.id
   resource_group_name          = azurerm_resource_group.main.name
   revision_mode                = "Single"
@@ -1215,6 +1979,7 @@ ${projectIdentityEnv}
         name  = "AZURE_REGION"
         value = var.location
       }
+${frontendCorsEnvironment}
 
       env {
         name        = "DATABASE_URL"
@@ -1251,7 +2016,7 @@ ${projectIdentityEnv}
 }
 ${frontendContainer}
 resource "azurerm_postgresql_flexible_server" "main" {
-  name                   = "psql-\${local.name_prefix}-\${var.resource_suffix}"
+  name                   = "${names.postgres}"
   resource_group_name    = azurerm_resource_group.main.name
   location               = azurerm_resource_group.main.location
   version                = "16"
@@ -1270,7 +2035,7 @@ resource "azurerm_postgresql_flexible_server_firewall_rule" "azure_services" {
 }
 
 resource "azurerm_redis_cache" "main" {
-  name                = "redis-\${local.name_prefix}-\${var.resource_suffix}"
+  name                = "${names.redis}"
   location            = azurerm_resource_group.main.location
   resource_group_name = azurerm_resource_group.main.name
   capacity            = 0
@@ -1279,7 +2044,7 @@ resource "azurerm_redis_cache" "main" {
 }
 
 resource "azurerm_storage_account" "main" {
-  name                     = "st\${replace(var.resource_suffix, "-", "")}"
+  name                     = "${names.storage}"
   resource_group_name      = azurerm_resource_group.main.name
   location                 = azurerm_resource_group.main.location
   account_tier             = "Standard"
@@ -1293,26 +2058,26 @@ resource "azurerm_storage_container" "documents" {
 }
 
 resource "azurerm_servicebus_namespace" "main" {
-  name                = "sb-\${local.name_prefix}-\${var.resource_suffix}"
+  name                = "${names.serviceBus}"
   location            = azurerm_resource_group.main.location
   resource_group_name = azurerm_resource_group.main.name
   sku                 = "Standard"
 }
 
 resource "azurerm_servicebus_queue" "events" {
-  name         = "events"
+  name         = ${queueName}
   namespace_id = azurerm_servicebus_namespace.main.id
 }
 ${functionWorker}
 
 resource "azurerm_communication_service" "main" {
-  name                = "acs-\${local.name_prefix}"
+  name                = "${names.communication}"
   resource_group_name = azurerm_resource_group.main.name
   data_location       = "United States"
 }
 
 resource "azurerm_key_vault" "main" {
-  name                = "kv-\${local.name_prefix}-\${var.resource_suffix}"
+  name                = "${names.keyVault}"
   location            = azurerm_resource_group.main.location
   resource_group_name = azurerm_resource_group.main.name
   tenant_id           = data.azurerm_client_config.current.tenant_id
@@ -1370,7 +2135,7 @@ function renderTofuReadme(plan) {
     const functionSection = hasFunctionWorker(plan) ? `
 ## Azure Functions Worker
 
-This project includes an Azure Functions worker under \`functions/${functionWorkerName(plan)}\`. The OpenTofu configuration provisions Function app hosting, app settings, managed identity access to Service Bus, and worker outputs for the selected environments.
+This project includes an Azure Functions worker under \`functions/${functionWorkerName(plan)}\`. The OpenTofu configuration attaches one user-assigned identity, grants its principal the Service Bus Data Receiver role, and selects it through \`ServiceBusConnection__clientId\` plus \`ServiceBusConnection__fullyQualifiedNamespace\`. \`function_worker_queue_name\` provisions the queue, configures \`SERVICEBUS_QUEUE_NAME\`, and drives the worker queue output. Function host storage uses the complete key-backed \`AzureWebJobsStorage\` connection setting.
 ` : '';
     return `# Azure OpenTofu
 
@@ -1391,7 +2156,8 @@ Build the generated backend in ACR, then replace the bootstrap image:
 \`\`\`bash
 ACR_NAME="$(tofu output -raw container_registry_name)"
 az acr build --registry "$ACR_NAME" --image ${plan.safeProjectName}-backend:latest ../../..
-${plan.includeFrontend ? `az acr build --registry "$ACR_NAME" --image ${plan.safeProjectName}-frontend:latest ../../../frontend
+${plan.includeFrontend ? `BACKEND_URL="https://$(tofu output -raw backend_url)"
+az acr build --registry "$ACR_NAME" --image ${plan.safeProjectName}-frontend:latest --build-arg VITE_API_BASE_URL="$BACKEND_URL" ../../../frontend
 ` : ''}\`\`\`
 
 Persist the deployed images in \`environments/${env}.tfvars\` so future applies do not restore the bootstrap image:
@@ -1408,6 +2174,10 @@ tofu apply -var-file=environments/${env}.tfvars
 
 Local OpenTofu state is generated by default. Use \`backend.remote.example.tf\` as the starting point for team remote state.
 The default PostgreSQL firewall permits Azure-hosted services. Replace it with private networking before production; set \`enable_private_networking=true\` only when the required VNet, delegated subnet, and private DNS resources are added.
+
+## Azure Name Suffixes
+
+Each environment tfvars file contains a deterministic 12-character lowercase alphanumeric \`resource_suffix\` used by globally scoped Azure names. If Azure reports that a name is already taken, replace that environment's suffix with another unique value matching \`^[a-z0-9]{12}$\`; \`tofu validate\` rejects invalid overrides before deployment.
 ${functionSection}
 `;
 }
@@ -1415,7 +2185,7 @@ function renderTofuTfvars(plan, environment) {
     const values = [
         ['environment', JSON.stringify(environment)],
         ['location', JSON.stringify(plan.region.slug)],
-        ['resource_suffix', JSON.stringify(`${plan.safeProjectName.replace(/-/g, '')}${environment}`)],
+        ['resource_suffix', JSON.stringify(stableResourceSuffix(plan, environment))],
         ['backend_image', JSON.stringify('mcr.microsoft.com/azuredocs/containerapps-helloworld:latest')],
         ['backend_target_port', '80'],
         ['enable_private_networking', 'false']
@@ -1424,7 +2194,7 @@ function renderTofuTfvars(plan, environment) {
         values.push(['frontend_image', JSON.stringify('mcr.microsoft.com/azuredocs/containerapps-helloworld:latest')]);
     }
     if (hasFunctionWorker(plan)) {
-        values.push(['function_worker_queue_name', JSON.stringify('events')], ['functions_python_version', JSON.stringify('3.12')]);
+        values.push(['function_worker_queue_name', JSON.stringify(DEFAULT_FUNCTION_WORKER_QUEUE_NAME)], ['functions_python_version', JSON.stringify('3.12')]);
     }
     const width = Math.max(...values.map(([key]) => key.length));
     return values.map(([key, value]) => `${key.padEnd(width)} = ${value}`).join('\n');
@@ -1718,10 +2488,71 @@ createApp(App).mount('#app');
 }
 function renderFrontendApp(plan) {
     const descriptor = plan.projectType.id === 'genai' ? `${genAiPattern(plan).label} starter` : `${plan.apiStack.label} starter`;
+    const apiContract = plan.projectType.id === 'standard'
+        ? { route: '/api', method: 'GET', bodyField: '', queryParameter: '', requiresInput: false }
+        : genAiPattern(plan).id === 'rag'
+            ? { route: `${genAiPattern(plan).routePrefix}/query`, method: 'POST', bodyField: 'question', queryParameter: '', requiresInput: true }
+            : genAiPattern(plan).id === 'streaming'
+                ? { route: genAiPattern(plan).routePrefix, method: 'GET', bodyField: '', queryParameter: 'prompt', requiresInput: true }
+                : { route: `${genAiPattern(plan).routePrefix}/run`, method: 'POST', bodyField: 'input', queryParameter: '', requiresInput: true };
     return `<script setup lang="ts">
+import { ref } from 'vue';
+
 const title = ${scriptSourceString(plan.projectName)};
 const starter = ${scriptSourceString(plan.frontendStarter)};
 const descriptor = ${scriptSourceString(descriptor)};
+const apiBaseUrl = (import.meta.env.VITE_API_BASE_URL || 'http://localhost:8000').replace(/\\/+$/, '');
+const route = ${scriptSourceString(apiContract.route)};
+const method = ${scriptSourceString(apiContract.method)};
+const bodyField = ${scriptSourceString(apiContract.bodyField)};
+const queryParameter = ${scriptSourceString(apiContract.queryParameter)};
+const requiresInput = ${apiContract.requiresInput};
+
+const input = ref('');
+const loading = ref(false);
+const result = ref('');
+const errorMessage = ref('');
+
+async function submit(): Promise<void> {
+  const value = input.value.trim();
+  if (requiresInput && !value) {
+    errorMessage.value = 'Enter a value before running the starter.';
+    return;
+  }
+
+  loading.value = true;
+  result.value = '';
+  errorMessage.value = '';
+  try {
+    const query = queryParameter
+      ? '?' + queryParameter + '=' + encodeURIComponent(value)
+      : '';
+    const request: RequestInit = { method };
+    if (method === 'POST') {
+      request.headers = { 'Content-Type': 'application/json' };
+      request.body = JSON.stringify({ [bodyField]: value });
+    }
+    const response = await fetch(apiBaseUrl + route + query, request);
+    const responseText = await response.text();
+    if (!response.ok) {
+      throw new Error(
+        'Backend request failed (' + response.status + '): ' +
+        (responseText || response.statusText)
+      );
+    }
+    if ((response.headers.get('content-type') || '').includes('application/json')) {
+      result.value = JSON.stringify(JSON.parse(responseText), null, 2);
+    } else {
+      result.value = responseText;
+    }
+  } catch (error) {
+    errorMessage.value = error instanceof Error
+      ? error.message
+      : 'The backend request failed unexpectedly.';
+  } finally {
+    loading.value = false;
+  }
+}
 </script>
 
 <template>
@@ -1734,8 +2565,26 @@ const descriptor = ${scriptSourceString(descriptor)};
       </header>
       <section class="rounded-lg border border-slate-200 bg-white p-6 shadow-sm">
         <h2 class="text-xl font-semibold">{{ starter }}</h2>
-        <textarea class="mt-4 min-h-40 w-full rounded-md border border-slate-300 p-3" placeholder="Start with your application-specific input." />
-        <button class="mt-4 rounded-md bg-emerald-700 px-4 py-2 font-semibold text-white">Run</button>
+        <p class="mt-2 text-sm text-slate-500">API: {{ apiBaseUrl }}{{ route }}</p>
+        <textarea
+          v-if="requiresInput"
+          v-model="input"
+          class="mt-4 min-h-40 w-full rounded-md border border-slate-300 p-3"
+          :disabled="loading"
+          placeholder="Enter input for the generated backend."
+        />
+        <button
+          class="mt-4 rounded-md bg-emerald-700 px-4 py-2 font-semibold text-white disabled:cursor-not-allowed disabled:opacity-60"
+          :disabled="loading"
+          type="button"
+          @click="submit"
+        >
+          {{ loading ? 'Running...' : 'Run' }}
+        </button>
+        <p v-if="errorMessage" class="mt-4 rounded-md bg-red-50 p-3 text-red-800" role="alert">
+          {{ errorMessage }}
+        </p>
+        <pre v-if="result" class="mt-4 overflow-auto rounded-md bg-slate-950 p-4 text-sm text-white" aria-live="polite">{{ result }}</pre>
       </section>
     </section>
   </main>
@@ -1771,6 +2620,8 @@ WORKDIR /app
 COPY package.json package-lock.json* ./
 RUN npm install
 COPY . .
+ARG VITE_API_BASE_URL=http://localhost:8000
+ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
 RUN npm run build
 
 FROM nginx:1.27-alpine