Skip to content

feat(chat-with-factory): add resilient voice and session continuity - #748

Merged
Ben Brooks (benljbrooks) merged 12 commits into
mainfrom
feature/chat-factory-voice-enhancements
Aug 7, 2026
Merged

feat(chat-with-factory): add resilient voice and session continuity #748
Ben Brooks (benljbrooks) merged 12 commits into
mainfrom
feature/chat-factory-voice-enhancements

Conversation

@benljbrooks

@benljbrooks Ben Brooks (benljbrooks) commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pull Request

Description

This PR adds resilient voice interaction and device-local session continuity to Chat With Your Factory while preserving the existing Foundry function-tool loop and Fabric ontology grounding.

Closes #749
Related to #750

Voice interaction

  • Added Voice Live text-to-speech from the authoritative completed assistant response.
  • Added speech-safe Markdown conversion and 24 kHz PCM16 browser playback.
  • Stopped queued playback when user speech begins without claiming backend cancellation.
  • Serialized Voice Live dispatches per session while preserving concurrency across sessions.
  • Restricted publication to completed assistant messages correlated to the active Foundry run.

Session continuity and authentication

  • Added identity-scoped IndexedDB persistence with local-first transcript reconciliation, account-change clearing, deletion, and fail-closed 30-day retention.
  • Added bounded HMAC resume tokens and authenticated Foundry-only process-restart adoption.
  • Preserved stable client message IDs across optimistic and server transcripts.
  • Added expiry-aware Teams SSO refresh with concurrent request coalescing.

Deployment and operations

  • Added neutral Voice Live, external resume-secret, and opt-in workload-identity settings to the Helm chart.
  • Defaulted container dependency restoration to Central Feed Services through a builder-only override.
  • Added bounded structured logging on the touched client and server paths.
  • Documented East US 2 GPT Realtime requirements and the PCM16 speech-output path.

Related Issue

None.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Blueprint modification or addition
  • Component modification or addition
  • Documentation update
  • CI/CD pipeline change
  • Other (please describe):

Implementation Details

The server keeps persisted Markdown and SSE publication authoritative. After a Foundry run reaches completed, the current run's completed assistant message is persisted and broadcast once, then converted to a citation- and URL-free derivative for Voice Live synthesis. Timer and disconnect dispatches share a process-local FIFO queue keyed by session ID.

The client schedules streamed PCM16 deltas through Web Audio and clears active sources when speech starts or the connection stops. Session and transcript data are cached in identity-scoped IndexedDB, hydrated before server reconciliation, and removed when ownership changes or retention cannot be proven.

Restart recovery uses signed, expiring tokens bound to the authenticated user and session. Only Foundry sessions with verified thread IDs can be adopted after process restart. Cached identity, participants, backend pointers, and arbitrary metadata are not trusted during adoption.

Helm consumes an externally managed Kubernetes ServiceAccount and resume secret. The component does not create federated credentials or Azure role assignments. The Docker builder uses Central Feed Services by default, and the registry setting is not retained in the runtime image.

Testing Performed

  • Terraform plan/apply
  • Blueprint deployment test
  • Unit tests
  • Integration tests
  • Bug fix includes regression test (see Test Policy)
  • Manual validation
  • Other: server/client builds, lint, Helm lint/render, container build, diagnostics, secret scan, and diff checks

Automated validation passed before the latest main dependency merge: clean install, server build, Voice Live client build, lint, all six existing tests, Helm lint/render, the 21-stage container build, diagnostics, and diff checks.

Local acceptance covered retention boundaries, Foundry-only restart recovery, same-session FIFO ordering, cross-session concurrency, Foundry terminal states, cancellation cleanup, current-run publication, and speech payload conversion.

Live acceptance covered Foundry requires_action, Fabric ontology results, authoritative response publication, browser reload, signed restart recovery and rejection cases, East US 2 GPT Realtime playback, and audible interruption.

Validation Steps

  1. From src/500-application/516-chat-with-your-factory/services/chat-with-your-factory, run npm ci.
  2. Run npm run build:server, npm run build:client:voicelive, npm run lint, and npm test.
  3. Run helm lint charts/chat-with-your-factory from the component directory.
  4. Render the chart with Voice Live, an external resume-secret placeholder, and serviceAccount.name; verify the Secret contains the resume value and the pod receives the workload-identity label and ServiceAccount binding.
  5. Build the container with docker build --build-arg SPEECH_PROVIDER=voicelive -t chat-with-your-factory:voice-validation services/chat-with-your-factory.
  6. Verify a Foundry ontology turn persists and broadcasts one authoritative Markdown response and produces one spoken rendition.
  7. Verify reload recovery, signed process-restart recovery, rejection of tampered or cross-user tokens, same-session voice ordering, cross-session concurrency, and playback interruption when speech begins.

Checklist

  • I have updated the documentation accordingly
  • I have added tests to cover my changes
  • All new and existing tests passed
  • I have run terraform fmt on all Terraform code
  • I have run terraform validate on all Terraform code
  • I have run az bicep format on all Bicep code
  • I have run az bicep build to validate all Bicep code
  • I have checked for any sensitive data/tokens that should not be committed
  • Lint checks pass (run applicable linters for changed file types)

Security Review

  • No credentials, secrets, or tokens are hardcoded or logged
  • RBAC and identity changes follow least-privilege principles
  • No new network exposure or public endpoints introduced without justification
  • Dependency additions or updates have been reviewed for known vulnerabilities
  • Container image changes use pinned digests or SHA references

Additional Notes

  • No focused test files were added because repository policy requires explicit authorization. Existing tests and behavior-specific local harnesses were used instead.
  • The authenticated session-resume route is the only new API surface. It verifies the route/session match, authenticated user binding, token signature and expiry, Foundry backend, and thread pointer before adopting state.
  • Production acceptance still requires a platform-managed ServiceAccount, federated credential, dedicated resume secret, and least-privilege Azure RBAC validated from the deployed pod.
  • Product and privacy owners still need to approve or replace the 30-day identity-scoped browser retention policy for shared-device scenarios.
  • The pinned Node base image has known vulnerability findings and an outdated digest. Remediation remains separate from this feature.

Ben Brooks and others added 7 commits August 5, 2026 10:34
Ben Brooks
feat(application): add resilient voice and session continuity
7924c01 
- add Voice Live TTS, PCM playback, and speech interruption
- persist sessions with fail-closed retention and signed Foundry resume
- serialize voice turns and publish only current completed runs
- refresh Teams auth and bound logs
- configure Helm identity and CFS builds
@nguyena2 Ben Brooks
Configure devcontainer Dockerfile with proxy/package index build args (…
d9c7d9e 
…#737)

## Summary

Switches the dev container from a plain `image` reference to a `build`
configuration backed by a new `.devcontainer/Dockerfile`. This lets the
base image and package index/registry URLs be overridden via local
environment variables, which is needed for environments behind a proxy
or using internal package mirrors.

## Changes

- **`.devcontainer/Dockerfile`** (new): Defines build args with sensible
public defaults:
- `BASE_IMAGE` → defaults to
`mcr.microsoft.com/devcontainers/python:3.12-bookworm`
  - `NPM_CONFIG_REGISTRY` → defaults to `https://registry.npmjs.org/`
  - `PIP_INDEX_URL` → defaults to `https://pypi.org/simple/`
  - `UV_DEFAULT_INDEX` → defaults to `https://pypi.org/simple/`
- **`.devcontainer/devcontainer.json`**: Replaces the static `image`
with a `build` block that passes these args from `localEnv` overrides.

## Why

Contributors on proxied networks or internal mirrors can point the dev
container at the correct base image and package indexes without editing
tracked files. When the environment variables are unset, the defaults
preserve the previous public behavior.
@dependabot Ben Brooks
chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#739)
60cbda5 
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from
10.2.0 to 10.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/beaugunderson/ip-address/releases">ip-address's
releases</a>.</em></p>
<blockquote>
<h2>v10.4.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add GitHub Actions CI by <a
href="https://github.com/beaugunderson"><code>@​beaugunderson</code></a>
in <a
href="https://redirect.github.com/beaugunderson/ip-address/pull/213">beaugunderson/ip-address#213</a></li>
<li>Keep the package loadable on node 12, and enforce it by <a
href="https://github.com/beaugunderson"><code>@​beaugunderson</code></a>
in <a
href="https://redirect.github.com/beaugunderson/ip-address/pull/216">beaugunderson/ip-address#216</a></li>
<li>Validate the byte arrays Address6 is given by <a
href="https://github.com/beaugunderson"><code>@​beaugunderson</code></a>
in <a
href="https://redirect.github.com/beaugunderson/ip-address/pull/217">beaugunderson/ip-address#217</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/beaugunderson/ip-address/compare/v10.3.1...v10.4.0">https://github.com/beaugunderson/ip-address/compare/v10.3.1...v10.4.0</a></p>
<h2>v10.3.1</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/beaugunderson/ip-address/compare/v10.3.0...v10.3.1">https://github.com/beaugunderson/ip-address/compare/v10.3.0...v10.3.1</a></p>
<h2>v10.3.0</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/beaugunderson/ip-address/compare/v10.2.2...v10.3.0">https://github.com/beaugunderson/ip-address/compare/v10.2.2...v10.3.0</a></p>
<h2>v10.2.2</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/beaugunderson/ip-address/compare/v10.2.1...v10.2.2">https://github.com/beaugunderson/ip-address/compare/v10.2.1...v10.2.2</a></p>
<h2>v10.2.1</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.2.1">https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.2.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/fbb8db28f1559842b7191cab7d8ea6408ed82f7b"><code>fbb8db2</code></a>
10.4.0</li>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/45a2b11ec254a2e5620de66e248adcb33d16e669"><code>45a2b11</code></a>
Validate the byte arrays Address6 is given (<a
href="https://redirect.github.com/beaugunderson/ip-address/issues/217">#217</a>)</li>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/bac8810b3935cab123316a4bc5ebaa22db140299"><code>bac8810</code></a>
Keep the package loadable on node 12, and enforce it (<a
href="https://redirect.github.com/beaugunderson/ip-address/issues/216">#216</a>)</li>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/9b3d8488d15e6bfe5f5503867b088ce056723e08"><code>9b3d848</code></a>
Add a security policy and a README section on security posture</li>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/e84a7b381d02cb97ed114023e44133efae151254"><code>e84a7b3</code></a>
Order the README API reference Address4, Address6, AddressError</li>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/015160b85ee60b39548219817a5de3c4e828a6d6"><code>015160b</code></a>
Collapse each class in the README API reference</li>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/34061a897d526b7a063c3605402cd30a8363a035"><code>34061a8</code></a>
Pin checkout and setup-node to commits in the release job</li>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/c5fae5d9bdfe8ded7f4ca01a3d3ea8d97f8f1277"><code>c5fae5d</code></a>
Pin action-gh-release to a commit and move it to 3.0.2</li>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/e0ef0484193218b0d28cfbb53795bc44ddb3cc21"><code>e0ef048</code></a>
Replace CircleCI with GitHub Actions</li>
<li><a
href="https://github.com/beaugunderson/ip-address/commit/5e3ceb779aee6ad3f33264e66225e8e7584ab612"><code>5e3ceb7</code></a>
Add GitHub Actions CI across Node 20, 22, 24 and 25 (<a
href="https://redirect.github.com/beaugunderson/ip-address/issues/213">#213</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for ip-address since your current version.</p>
</details>
<details>
<summary>Install script changes</summary>
<p>This version adds <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ip-address&package-manager=npm_and_yarn&previous-version=10.2.0&new-version=10.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/edge-ai/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@katriendg Ben Brooks
chore(deps): consolidate cross-ecosystem dependency security bumps (#745
d76d67d 
)

## Description

Consolidated dependency security updates across npm, Python, and Go. The
changes refreshed manifests, locks, hashes, and checksums; removed
obsolete vulnerability suppressions; added commit-specific identity to
Grype scans; and updated the external Terraform module source example to
use the public GitHub repository.

### npm dependencies

* Refreshed the root, Docusaurus, markdown link-check, and chat service
dependency graphs, including safe resolutions for `brace-expansion`,
`fast-uri`, `undici`, `ip-address`, and `postcss`.
* Raised the Docusaurus `fast-uri` override to 3.1.5.
* Updated the chat service to Azure Identity 4.13.1, MSAL Node 5.5.0,
and Microsoft Cognitive Services Speech SDK 1.51.0.
* Introduced Node.js 20 minimum engine requirements in affected markdown
link-check and chat dependency paths.

### Python dependencies

* Constrained Checkov to the compatible 3.2.x line and regenerated the
lock at 3.2.531.
* Raised `aiohttp` to a 3.14.3 minimum in the root, Checkov, SSE
connector, and ONVIF connector requirements.
* Removed `ecdsa` from the root resolved dependency graph.

### Go dependencies

* Updated `github.com/klauspost/compress` from 1.16.5 to 1.18.7 in
shared test utilities and three blueprint test modules.
* Regenerated the corresponding Go checksums.

### Security and tooling

* Removed obsolete `ecdsa`, `fast-uri`, and `brace-expansion` advisory
suppressions from dependency review, Grype, and OSV Scanner
configuration.
* Added `edge-ai@${GITHUB_SHA}` as the Grype source identity.
* Changed the Terraform-from-blueprint external module source example
from Azure DevOps to the public GitHub repository while retaining SHA
pinning.

## Related Issue

Fixes #744

## Type of Change

* [ ] Bug fix (non-breaking change which fixes an issue)
* [ ] New feature (non-breaking change which adds functionality)
* [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
* [x] Blueprint modification or addition
* [x] Component modification or addition
* [ ] Documentation update
* [x] CI/CD pipeline change
* [x] Other (please describe): Dependency security remediation and
prompt configuration update

## Implementation Details

Updated direct constraints where vulnerable transitive versions could
not be replaced by lock refreshes alone, then regenerated each
ecosystem's resolution artifacts. The Checkov graph was constrained to
3.2.x so it could resolve `aiohttp` 3.14.3 without retaining `ecdsa`.
npm parent upgrades aligned the chat service on current MSAL and Speech
SDK dependency paths, while Go modules moved the shared compression
dependency to 1.18.7. Vulnerability exceptions were removed after the
affected packages were upgraded or removed.

## Testing Performed

* [ ] Terraform plan/apply
* [ ] Blueprint deployment test
* [ ] Unit tests
* [ ] Integration tests
* [ ] Bug fix includes regression test (see [Test
Policy](docs/contributing/testing-validation.md))
* [ ] Manual validation
* [ ] Other: Dependency installation, audit, build, scanner, and Go
module checks listed below

## Validation Steps

1. Run `npm ci` and `npm audit --package-lock-only` in the repository
root, Docusaurus site, markdown link-check tool, and chat service.
2. Run the applicable lint, test, and build commands for the Docusaurus
site and chat service.
3. Install each changed Python lock with `pip install --require-hashes`
and run a focused Checkov regression scan.
4. Run `go test ./...` and `govulncheck ./...` in each changed Go
module.
5. Run `grype dir:. --config .grype.yaml` and confirm that removed
suppressions do not reappear as unresolved findings.

## Checklist

* [ ] I have updated the documentation accordingly
* [ ] I have added tests to cover my changes
* [ ] All new and existing tests passed
* [ ] I have run `terraform fmt` on all Terraform code
* [ ] I have run `terraform validate` on all Terraform code
* [ ] I have run `az bicep format` on all Bicep code
* [ ] I have run `az bicep build` to validate all Bicep code
* [x] I have checked for any sensitive data/tokens that should not be
committed
* [ ] Lint checks pass (run applicable linters for changed file types)

## Security Review

* [x] No credentials, secrets, or tokens are hardcoded or logged
* [x] RBAC and identity changes follow least-privilege principles
* [x] No new network exposure or public endpoints introduced without
justification
* [x] Dependency additions or updates have been reviewed for known
vulnerabilities
* [x] Container image changes use pinned digests or SHA references

## Additional Notes

The refreshed dependency paths introduced Node.js 20 minimum engine
requirements for the markdown link checker and chat service. Checkov
resolved to 3.2.531 under the new 3.2.x constraint because the 3.3.x
dependency graph could not resolve the required `aiohttp` floor without
retaining the vulnerable `ecdsa` package.

## Screenshots (if applicable)

Not applicable.
@katriendg Ben Brooks
fix(513-tiered-notification-service): use hostname-based validation f…
e8881e8 
…or webhook URL provider detection (#733)

## Description

This PR updates the webhook provider detection logic in the tiered
notification service so it evaluates the parsed hostname rather than
matching substrings against the full webhook URL. The change makes Teams
and Slack routing more reliable for URLs that include additional path or
query components while preserving the existing HTTPS and private-network
validation safeguards.

The implementation adds hostname parsing helpers and uses them in both
the direct webhook payload path and the digest payload path in
[src/500-application/513-tiered-notification-service/src/functions/processAlerts.js](src/500-application/513-tiered-notification-service/src/functions/processAlerts.js).

## Related Issue

- Related to #732

## Type of Change

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] Blueprint modification or addition
- [ ] Component modification or addition
- [ ] Documentation update
- [ ] CI/CD pipeline change
- [ ] Other (please describe):

## Implementation Details

- Extracted webhook hostname parsing into dedicated helpers for reuse in
the alert processing flow.
- Switched Teams and Slack provider detection to use the parsed hostname
for both single-alert and digest payload generation.
- Left the existing webhook URL validation logic intact so HTTPS-only
and private-address restrictions remain unchanged.

## Testing Performed

- [x] Unit tests
- [ ] Terraform plan/apply
- [ ] Blueprint deployment test
- [ ] Integration tests
- [ ] Bug fix includes regression test (see [Test
Policy](docs/contributing/testing-validation.md))
- [x] Manual validation
- [ ] Other:

## Validation Steps

1. Review the updated hostname-based provider detection in
[src/500-application/513-tiered-notification-service/src/functions/processAlerts.js](src/500-application/513-tiered-notification-service/src/functions/processAlerts.js).
2. Confirm that Teams and Slack payload routing still behaves correctly
for the supported webhook hostnames.
3. Run the JavaScript syntax check for the modified function file.

## Checklist

- [ ] I have updated the documentation accordingly
- [ ] I have added tests to cover my changes
- [ ] All new and existing tests passed
- [ ] I have run `terraform fmt` on all Terraform code
- [ ] I have run `terraform validate` on all Terraform code
- [ ] I have run `az bicep format` on all Bicep code
- [ ] I have run `az bicep build` to validate all Bicep code
- [ ] I have checked for any sensitive data/tokens that should not be
committed
- [x] Lint checks pass (run applicable linters for changed file types)

## Security Review

- [x] No credentials, secrets, or tokens are hardcoded or logged
- [x] RBAC and identity changes follow least-privilege principles
- [x] No new network exposure or public endpoints introduced without
justification
- [x] Dependency additions or updates have been reviewed for known
vulnerabilities
- [x] Container image changes use pinned digests or SHA references

## Additional Notes

- This is a focused change to the webhook routing logic for the tiered
notification service.
- Validation was limited to the syntax check for the modified JavaScript
file in this environment.

## Screenshots (if applicable)
@OssSecurityBot @rezatnoMsirhC
@katriendg Ben Brooks
Pin GitHub Actions to full-length commit SHAs (#738)
a5dcbb2 
This PR adds a 7 day cooldown to Dependabot configuration for GitHub Actions.

## Why?

Pinning actions to commit SHAs prevents supply-chain attacks where a tag
could be moved to point to malicious code. This is a recommended
security best practice per the [GitHub Actions security hardening
guide](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).

This change mitigates the risk of tag retargeting to malicious code as
seen in incidents like the [tj-actions/changed-files action
compromise](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised)
or [codfish/semantic-release-action
compromise](https://www.stepsecurity.io/blog/supply-chain-compromise-codfish-semantic-release-action)
and improves the integrity and reproducibility of the CI/CD pipeline.

## What changed?

**Action pinning:** Third-party action references in
`.github/workflows/` that used mutable tag-based references (e.g.,
`actions/checkout@v4`) have been updated to full-length commit SHAs with
a version comment (e.g., `actions/checkout@<sha> # v4`) using the
[pinact](https://github.com/suzuki-shunsuke/pinact) tool. References
that were already pinned to a SHA, or that used immutable release tags,
were left unchanged.

**Dependabot configuration:** `.github/dependabot.yml` has been updated
to ensure a `github-actions` package-ecosystem section is present with a
`cooldown` configuration (`default-days: 7`). This groups Dependabot PRs
for GitHub Actions and enforces a minimum 7-day cooldown between
updates. If the file did not exist, it was created. If a
`github-actions` section already existed, only the `cooldown` block was
added or its `default-days` value was increased to 7 if it was lower.
The 7-day cooldown provides a window for the community to detect and
report compromised releases before they are automatically proposed as
updates, reducing exposure to supply-chain attacks via newly published
malicious versions.

## Is this safe to merge?

Yes. The pinned SHAs correspond to the same commits that the existing
tags pointed to. No behavioral changes are introduced. You can verify
the pinned SHA value using the GitHub REST API (e.g., the commit hash
for `actions/checkout@v7` can be found in the `sha` property in the JSON
response for `GET
https://api.github.com/repos/actions/checkout/commits/v7`).

---

<sub>For more information, visit https://aka.ms/action-pinning</sub>

Co-authored-by: Chris Montazer <17170709+rezatnoMsirhC@users.noreply.github.com>
Co-authored-by: Katrien De Graeve <katriendg@users.noreply.github.com>
@dependabot Ben Brooks
chore(deps): bump the github-actions group across 1 directory with 2 …
163dfe1 
…updates (#747)

Bumps the github-actions group with 2 updates in the / directory:
[docker/login-action](https://github.com/docker/login-action) and
[actions/attest](https://github.com/actions/attest).

Updates `docker/login-action` from 4.5.2 to 4.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.0</h2>
<ul>
<li>Harden buildx scoped config path handling by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1059">docker/login-action#1059</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1095.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1051">docker/login-action#1051</a></li>
<li>Bump js-yaml from 5.2.1 to 5.2.2 in <a
href="https://redirect.github.com/docker/login-action/pull/1057">docker/login-action#1057</a></li>
<li>Bump postcss from 8.5.10 to 8.5.22 in <a
href="https://redirect.github.com/docker/login-action/pull/1056">docker/login-action#1056</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.5.2...v4.6.0">https://github.com/docker/login-action/compare/v4.5.2...v4.6.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/dbcb813823bdd20940b903addbd779551569679f"><code>dbcb813</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1051">#1051</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li><a
href="https://github.com/docker/login-action/commit/5bcb015ee6ec720ecdeaef2dc1164122e9b209fc"><code>5bcb015</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/b30b2f2d3196c1714318ba0c3c3bec211d949752"><code>b30b2f2</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/9087f1e6d666fe0292409e3c819680c18526e108"><code>9087f1e</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1057">#1057</a>
from docker/dependabot/npm_and_yarn/js-yaml-5.2.2</li>
<li><a
href="https://github.com/docker/login-action/commit/0009830ea169ca16c24c0ea4cac1c325bfa3aee4"><code>0009830</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/23255232d3e43c8f0052d9a0dba82a515a88ce92"><code>2325523</code></a>
build(deps): bump js-yaml from 5.2.1 to 5.2.2</li>
<li><a
href="https://github.com/docker/login-action/commit/4ec1d4a769e8b05a89a7396551dc38b329211688"><code>4ec1d4a</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1056">#1056</a>
from docker/dependabot/npm_and_yarn/postcss-8.5.22</li>
<li><a
href="https://github.com/docker/login-action/commit/5fc99ba47bca274c5a499688f71c7ea79c0ea1b3"><code>5fc99ba</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1053">#1053</a>
from docker/dependabot/github_actions/aws-actions/co...</li>
<li><a
href="https://github.com/docker/login-action/commit/e512bd59d16c53d79ea5c0f0e345fe554453c4bb"><code>e512bd5</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1052">#1052</a>
from docker/dependabot/github_actions/codeql-actions...</li>
<li><a
href="https://github.com/docker/login-action/commit/a146c91b8f371700d323bae808af7cbdc2766ed5"><code>a146c91</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1059">#1059</a>
from crazy-max/harden-buildx-scope-paths</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c...dbcb813823bdd20940b903addbd779551569679f">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/attest` from 4.2.0 to 4.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/attest/releases">actions/attest's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump tar from 7.5.17 to 7.5.21 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/attest/pull/459">actions/attest#459</a></li>
<li>fix: strip OCI image tag when pushing attestation to registry by <a
href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a
href="https://redirect.github.com/actions/attest/pull/464">actions/attest#464</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/attest/compare/v4.2.0...v4.2.1">https://github.com/actions/attest/compare/v4.2.0...v4.2.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/attest/commit/508db95dd578ae2727ebd6217d5ba78e4fbda05d"><code>508db95</code></a>
fix: strip OCI image tag when pushing attestation to registry (<a
href="https://redirect.github.com/actions/attest/issues/464">#464</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/dda48f2935afea63fd4651871c16233251f9d06c"><code>dda48f2</code></a>
Bump the npm-development group across 1 directory with 6 updates (<a
href="https://redirect.github.com/actions/attest/issues/461">#461</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/7d789a33ada19b33b74fbcdeb7f8e6cbb509a577"><code>7d789a3</code></a>
Bump the actions-minor group with 3 updates (<a
href="https://redirect.github.com/actions/attest/issues/463">#463</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/1f3ca2fbe3d1c724d701286b30c7d90309029739"><code>1f3ca2f</code></a>
Add release-cutter canvas extension (<a
href="https://redirect.github.com/actions/attest/issues/454">#454</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/d215549ae8a52064102300d4b4698f3fc1babad8"><code>d215549</code></a>
Bump tar from 7.5.17 to 7.5.21 (<a
href="https://redirect.github.com/actions/attest/issues/459">#459</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/20c90ed94816337d30d322057e464c15e29f9890"><code>20c90ed</code></a>
Bump the npm-development group with 2 updates (<a
href="https://redirect.github.com/actions/attest/issues/455">#455</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/43c2c81fd275fe2d0ac9a887891189fc000588f1"><code>43c2c81</code></a>
Bump the actions-minor group with 4 updates (<a
href="https://redirect.github.com/actions/attest/issues/456">#456</a>)</li>
<li><a
href="https://github.com/actions/attest/commit/f1d64fbfc1f8a8116057701aa4e9bd8ad650283d"><code>f1d64fb</code></a>
Bump actions/setup-node from 6.4.0 to 7.0.0 (<a
href="https://redirect.github.com/actions/attest/issues/457">#457</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/attest/compare/f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6...508db95dd578ae2727ebd6217d5ba78e4fbda05d">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@github-actions

This comment was marked as duplicate.

Sign in to view
@github-actions

This comment was marked as duplicate.

Sign in to view
@github-actions

This comment was marked as duplicate.

Sign in to view
Copilot AI reviewed Aug 5, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds Voice Live-driven resilient voice interaction (including PCM16 playback from completed assistant responses) and device-local session continuity with authenticated restart-resume for the “Chat With Your Factory” application.

Changes:

  • Add Voice Live protocol/bridge updates plus speech-safe markdown-to-text conversion and browser PCM16 playback.
  • Add identity-scoped IndexedDB caching with local-first transcript/session reconciliation and server-side session adoption via signed resume tokens.
  • Add bounded structured logging and deployment knobs (Helm values + workload identity ServiceAccount binding).

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/shared/types.ts Adds resumeToken on sessions and introduces device continuity state type.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/shared/logging.ts Introduces bounded/sanitized logging utility shared by client/server.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/server/voiceLiveProtocol.ts Adds helpers to build Voice Live session/update and response.create messages.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/server/voiceLiveBridge.ts Adds serialized per-session dispatch + completed-response TTS dispatching and cleaner logging.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/server/speechText.ts Converts markdown to speech-safe text (removes citations/URLs/empty artifacts).
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/server/sessionStore.ts Adds session adoption path with sanitization and continuity window constraints.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/server/sessionsHandler.ts Adds resume endpoint and issues per-session resume tokens for Foundry threads.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/server/resumeToken.ts Adds HMAC-signed, bounded, expiring resume token issuance/verification.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/server/index.ts Registers /api/sessions/:id/resume route.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/server/chatHandler.ts Adds stable client message IDs, assistant-completed callback for Voice Live, improved run polling/cancel handling.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/client/utils/apiFetch.ts Adds expiry-aware Teams SSO refresh with in-flight request coalescing.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/client/storage/indexedDbSessionStore.ts Implements identity-scoped IndexedDB session/transcript persistence and retention purging.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/client/hooks/useVoiceLive.ts Adds PCM16 playback scheduling, interruption handling, and cleaner logging.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/client/hooks/useTeamsUser.ts Updates local fallback identity values.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/client/hooks/useSessions.ts Implements local-first hydration, server reconciliation, and restart resume attempts.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/client/audio/pcmPlayback.ts Adds PCM16 decoding + playback scheduling helpers.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/src/client/App.tsx Integrates continuity hook, persists transcript locally, and adds “Clear device data” UI.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/package-lock.json Updates lockfile to match dependency graph changes.
src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/Dockerfile Adds build arg for npm registry and wires it into npm ci.
src/500-application/516-chat-with-your-factory/README.md Updates documentation for Voice Live requirements/region + TTS behavior.
src/500-application/516-chat-with-your-factory/charts/chat-with-your-factory/values.yaml Adds Voice Live env knobs, workload identity ServiceAccount name, and resume secret guidance.
src/500-application/516-chat-with-your-factory/charts/chat-with-your-factory/templates/deployment.yaml Conditionally binds ServiceAccount and workload identity pod label.
src/500-application/516-chat-with-your-factory/.env.template Updates Voice Live docs/settings (region + API version).
Files not reviewed (1)
  • src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/package-lock.json: Generated file

Comment thread ...ication/516-chat-with-your-factory/services/chat-with-your-factory/src/server/resumeToken.ts
Comment thread src/500-application/516-chat-with-your-factory/services/chat-with-your-factory/Dockerfile
@github-actions

This comment was marked as duplicate.

Sign in to view
@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

📚 Documentation Health Report

Generated on: 2026-08-05 16:45:52 UTC

📈 Documentation Statistics

Category File Count
Main Documentation 222
Infrastructure Components 230
Blueprints 40
GitHub Resources 26
AI Assistant Guides (Copilot) 17
Total 535

🏗️ Three-Tree Architecture Status

  • ✅ Bicep Documentation Tree: Auto-generated navigation
  • ✅ Terraform Documentation Tree: Auto-generated navigation
  • ✅ README Documentation Tree: Manual README organization

🔍 Quality Metrics

  • Frontmatter Validation:
    success
  • Link Validation: success

This report is automatically generated by the Documentation Automation workflow.

@benljbrooks
Ben Brooks (benljbrooks) marked this pull request as ready for review August 5, 2026 17:07
@benljbrooks
Ben Brooks (benljbrooks) requested a review from a team August 5, 2026 17:07
katriendg
Katrien De Graeve (katriendg) approved these changes Aug 6, 2026
View reviewed changes

@katriendg Katrien De Graeve (katriendg) left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work on this — the resilient voice interaction and session continuity design is solid, and the auth-sensitive pieces (resume tokens, Voice Live ticket auth, session adoption) are well thought through. Approving. Left two non-blocking suggestions inline that you may want to tackle in this PR or as a follow-up.

Comment thread ...ication/516-chat-with-your-factory/services/chat-with-your-factory/src/server/resumeToken.ts
Comment thread src/500-application/516-chat-with-your-factory/README.md
@katriendg

Katrien De Graeve (katriendg) commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Also forgot to validate, Ben Brooks (@benljbrooks) please create a backlog issue and attach it to the PR before you merge? I don't see one in the PR description. Thanks.

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown

📚 Documentation Health Report

Generated on: 2026-08-07 14:35:47 UTC

📈 Documentation Statistics

Category File Count
Main Documentation 222
Infrastructure Components 230
Blueprints 40
GitHub Resources 26
AI Assistant Guides (Copilot) 17
Total 535

🏗️ Three-Tree Architecture Status

  • ✅ Bicep Documentation Tree: Auto-generated navigation
  • ✅ Terraform Documentation Tree: Auto-generated navigation
  • ✅ README Documentation Tree: Manual README organization

🔍 Quality Metrics

  • Frontmatter Validation:
    success
  • Link Validation: success

This report is automatically generated by the Documentation Automation workflow.

@benljbrooks
Ben Brooks (benljbrooks) merged commit 4ba27f0 into main Aug 7, 2026
47 checks passed
@benljbrooks
Ben Brooks (benljbrooks) deleted the feature/chat-factory-voice-enhancements branch August 7, 2026 16:15
@edge-ai-release-please edge-ai-release-please Bot mentioned this pull request Aug 7, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@katriendg Katrien De Graeve (katriendg) katriendg approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat(chat-with-factory): add resilient voice and session continuity

5 participants

@benljbrooks @katriendg @nguyena2 @OssSecurityBot