[thebobhuff]

What changed

Adds Azure Foundry as a first-class model provider for enterprise Azure deployments. Choose Azure Foundry directly in Connect a brain when creating or reconnecting an Overseer, or configure a resource endpoint, deployment name, and API key later under Settings → AI & Models; CHECK & USE verifies one small response and saves the connection before selecting it. Reuses the existing streaming/tool-call adapter and native credential storage.

This initial connector supports OpenAI v1 Chat Completions with API-key authentication. Entra ID/managed identity, Anthropic-native deployments, and Responses API support are outside this PR.

Verification

• npm run test:fast — blocked on macOS by the existing plugin-runtime.test.js /var versus /private/var path comparison; reproduced on unmodified upstream d540d503.
• Relevant HTTP/E2E or live-app verification completed: 15 focused fast tests and 3 focused HTTP tests pass, including Azure wire authentication, streaming/tool calls, rejected deployments, failed-save preservation, native keychain handoff, reload persistence, and no-generation background probes. Both the Settings form and the initial Connect a brain provider selection/required-field failure were checked in isolated local stations.
• No credentials, local workspaces, QA captures, or generated release artifacts committed.

npm run test:http stops at the existing output-recovery.e2e.test.js Windows type command on macOS; reproduced on unmodified upstream. cargo check --offline cannot resolve uncached locked tauri-plugin-updater 2.10.1. No live Azure tenant or packaged native build is claimed as verified.

Safety and truthfulness

No migrations or permission changes. Keys use the configured Azure endpoint with api-key authentication; HTTPS is required outside loopback tests, URL credentials/query parameters are rejected, and redirects are refused. Key and endpoint save together through the existing store. Re-entering a key is required; spare keys cannot follow a change of resource. Native keys remain in the OS keychain.

The setup check explicitly discloses Azure quota usage. Background probes do not generate responses or treat catalogs as proof of deployment access. User-defined deployment names remain selected. Unknown Azure contract/region prices remain unpriced and retain existing token-budget limits.

User-reported regression coverage

Feature acceptance correction: Azure originally appeared in Settings but was missing from Overseer creation. The new genesis-azure test covers required endpoint/deployment fields, using the deployment instead of a foreign model ID, rejected validation, and avoiding fabricated catalog defaults. Existing OAuth, managed-credit, credential-selection, and accessibility genesis tests also pass.

Understanding the interface

Uses the existing Connect a brain provider picker and AI & Models settings category; the card names its purpose as “Azure deployment + API key.” CONFIGURE exposes endpoint, deployment, and key requirements. CHECK & USE reports validation/storage failures while retaining the current selection. The card can be reopened to change the deployment; existing spare-key controls remain available for the same resource. No new settings destination is introduced.