Correct Agent 365 Lifecycle Atlas setup and runtime-integration guidance

[Alejandro Lopez (soyalejolopez)]

Correct Agent 365 Lifecycle Atlas setup and runtime-integration guidance

Summary

Corrects the Agent 365 Lifecycle Atlas coverage of a365 setup all runtime configuration and observability, and adds a runtime-integration architecture diagram. All changes are grounded in public Microsoft Learn documentation and the pinned public microsoft/Agent365-devTools source (commit 08e48a9). Only the setup-all and telemetry sections changed; navigation, attribution, license, sources bibliography, and all other diagrams are preserved.

Corrections

• Runtime-config synchronization is conditional on project detection, not a flag. The pinned ProjectSettingsSyncHelper uses DeploymentProjectPath, falling back to the configuration-file directory when that path is missing or absent, detects .NET/Node.js/Python, and writes appsettings.json/.env; it skips only when no usable directory or supported project is found. The config-free path can therefore still write configuration; the standard-agent orchestrator deliberately skips sync only for --agent-registration-only.
• Setup sequence scoped to the default standard-agent, non-AI-teammate path in the visible heading, the in-SVG label, and the accessible title/desc. Clarifies that --aiteammate provisions only the blueprint and permissions during setup and that --agent-registration-only is a narrow recovery path.
• Language-specific generated defaults. .NET sets TokenValidation.Enabled = false and applies EnableAgent365Exporter ??= false (explicit values preserved); Node.js/Python set ENABLE_A365_OBSERVABILITY_EXPORTER=false. Adds that written configuration does not prove the SDK, token validation, or exporter is installed or active.
• Observability identity binding. gen_ai.agent.id must equal the agent's authenticated appId / OAuth client_id (token appid/azp) and the ingestion-URL agentId, never the Entra object ID or blueprint appId. Adds per-request identity resolution for shared multi-instance hosts.
• New "What changes in my code?" runtime-integration diagram (compact, static, accessible title/desc, existing palette) plus an illustrative code-area table describing customer-hosted integration boundaries. Emphasizes that registration establishes a management record and does not take ownership of the executable or auto-intercept operations.
• Package lifecycle labeled specifically as Microsoft 365 package distribution.

Validation

• Internal anchors all resolve; <section>/<svg> tags balanced.
• Edited SVGs parse as well-formed XML and carry title/desc.
• Inline JavaScript passes node --check; catalog metadata check passes for all resources.
• Rendered in a headless browser (light and dark) with no content-related console errors.
• Bumps version to 1.3.0; updates CHANGELOG.md and review dates.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[github-actions]

🛰️ PR Sweeper report

Risk: 🟢 LOW · Security gate: ✅ passing · Files: 3

🔒 Automated guardrails (authoritative)

No secret, PII, file-policy, or scope issues detected. ✅

🤖 Dual-model AI review (advisory)

AI review unavailable for this run (models not reachable or no diff). Guardrails above are unaffected.

• GPT-class reviewer (openai/gpt-5): skipped — request failed: Unexpected token 'O', "OK
  " is not valid JSON
• Deep-reasoning reviewer (openai/o3): skipped — request failed: Unexpected token 'O', "OK
  " is not valid JSON

---

The automated guardrails are authoritative and gate the security status. The AI review is advisory and never auto-merges. Thanks for contributing to FastTrack! 🛩️