Azure Squad Demo

What you are proving

Each beat maps a capability to the squad role that owns it. This is the narration backbone — the differentiator is that all of it ships as an APM package installed into any repo, MCP-optional with graceful fallbacks, with a human gate on every deploy.

Capability	Squad role	Notes
Cost estimate / pricing	Squad Cost Manager	Pricing MCP when wired, Azure Retail Prices REST fallback otherwise.
Architecture (HLD / LLD)	Squad Azure Architect	AVM modules + landing-zone patterns, Mermaid by default.
IaC codegen (Bicep / Terraform)	Squad IaC Author	Converts the LLD into infra/{track}/{project}; never deploys.
Governance precheck + deploy	Squad Deployer	Read-only Azure Policy precheck before the Impactful-Action Gate.
As-built documentation	Squad As-Built Author	Resource inventory, compliance matrix, runbook, DR plan — read-only.
Diagnose	Squad Azure Diagnose	Ranked hypotheses from Resource Health / Monitor / Resource Graph — read-only.
Research → Plan → Implement → Review	researcher, lead, developer, tester	The methodology spine, seeded into the azure profile alongside the specialists.

Before you start

Point the read-only beats (as-built, diagnose) at an existing resource group you already have. They then produce real output with zero deploy, zero spend, and zero risk.

Prerequisite	Why	Check
hve-squad v0.8.1 installed	The methodology spine and the as-built/diagnose roles require 0.8.1.	apm install "Peter-N91/hve-squad#v0.8.1"
Azure subscription + az login	Real reads for cost / as-built / diagnose; optional deploy.	az account show
Node.js + npx	Runs the optional @azure/mcp server.	node -v
VS Code + Copilot (agent mode)	The squad dispatches subagents.	—
uv (or Python) + Graphviz (optional)	Only for committed Azure-icon architecture diagrams via the python-diagrams skill; the squad falls back to Mermaid without them.	dot -V

Wiring the Azure MCP (optional)

The package never writes your .vscode/mcp.json on install, and a normal squad request will not silently create it either. You get it one of two ways:

1. Ask the coordinator to scaffold it (opt-in merge, shown as a diff before it commits): /squad request="merge the squad MCP template into my workspace".
2. Create it by hand — the minimal runnable version is just the official server:

   {
     "servers": {
       "azure": {
         "type": "stdio",
         "command": "npx",
         "args": ["-y", "@azure/mcp@latest", "server", "start"]
       }
     }
   }

   Reload VS Code, then confirm it is live: ask Copilot to list your resource groups.

The scaffold is a merge, never an overwrite, so any servers you already have are preserved. The pricing block in mcp.template.json is a tracked placeholder, not runnable — only the @azure/mcp server above is demo-ready.

Optional — Azure-icon architecture diagrams

By default the Azure Architect renders the HLD as Mermaid. When you want a committed icon diagram (PNG/SVG with real Azure product icons) instead, the architect uses the python-diagrams skill, which renders with the Python diagrams library on a Graphviz backend. It is opt-in and needs two local tools:

• uv (or Python) — runs the generator: winget install astral-sh.uv.
• Graphviz — the rendering backend, a system binary: winget install Graphviz.Graphviz (run elevated, then reopen the shell so dot is on PATH).

Both are pure pre-deploy tooling — no Azure login, no spend. On a clean machine the implement stage pauses to install Graphviz (it needs elevation), so pre-install it for a smooth run. To trigger it, add one clause to the design request — you name the outcome, not the resources, and the architect derives the diagram from its own design and the Bicep, committing paired PNG + SVG under docs/architecture/:

/squad request="... Also render the architecture you decide on as committed Azure-icon diagram images using the python-diagrams skill."

Without these tools the architect simply falls back to Mermaid; nothing breaks.

Beat 0 — Initialize the squad

/squad profile=azure request="Set up the squad for an Azure infrastructure project."

The coordinator discovers the repo, proposes the azure profile, and on your confirmation seeds the squad. Narrate: "One cast — Cost Manager, Architect, IaC Author, Deployer, As-Built, and Diagnose — and riding along with them the methodology spine: researcher, lead, developer, tester, so research → plan → implement → review is always available."

Beat 1 — Cost analysis

/squad request="Estimate the monthly Azure cost for a small internal web workload in West Europe: a frontend and a backend App Service, an Azure SQL Database, a Key Vault, and a Storage account, reached over private endpoints on a VNet. I need the monthly cost to stay under $60 — give an indicative figure and WAF cost-optimization recommendations to hit that target."

The Cost Manager produces an indicative estimate via the pricing path (MCP if wired, REST fallback otherwise) plus the WAF Cost Optimization checklist.

Beat 2 — Architecture, then IaC

/squad request="Design the HLD and LLD for that workload — frontend and backend web apps, Azure SQL, Key Vault, and Storage in West Europe — using Azure Verified Modules and a landing-zone-aligned layout. Configure the VNet and subnets, add private endpoints and private links where needed, follow security standards, and decide whether containerization is worth it."

/squad request="Author the Bicep for that LLD under infra/bicep/demo using AVM modules. Do not deploy."

The Azure Architect emits the Mermaid HLD and the Bicep-friendly LLD table. This is where the methodology surfaces: "author the Bicep" is an implementation-tier request, so the Implementation Gate runs the researcher role (AVM modules, landing-zone) then the lead role (the IaC plan) before the IaC Author writes a line. It never implements cold.

Want committed Azure-icon diagrams instead of Mermaid? Add "render it as Azure-icon diagram images using the python-diagrams skill" to the design request — see Optional — Azure-icon architecture diagrams above for the one-time uv + Graphviz setup.

Beat 2b — Review the implementation (new in 0.8.1)

After the IaC Author lands the Bicep, Review Follow-Through dispatches tester (Implementation Validator or Code Review Full) to check the IaC against the LLD. Review now closes every implementation, making the gate symmetric — research and plan precede the build, review follows it. You can also request it explicitly:

/squad request="Review the Bicep we just authored against the LLD and flag any drift."

Beat 3 — Governance discovery + gated deploy

/squad request="Deploy infra/bicep/demo to my subscription. Run the policy precheck first and show me what governance constraints apply before the gate."

The Deployer runs a read-only Azure Policy precheck (effective assignments and predicted denials) before the Impactful-Action Gate, then stops for your approval. Narrate: "It discovers real subscription policy before asking to deploy — and never deploys without me." For a safe demo, decline at the gate; the precheck value is already shown.

Beat 4 — As-built documentation

Point at an existing resource group so it works with no deploy:

/squad request="Document the deployed Azure infrastructure in resource group rg-demo as as-built artifacts: a resource inventory, a compliance matrix from Azure Policy, an operations runbook, and a backup/DR plan."

The As-Built Author inventories via Resource Graph (read-only), builds the compliance matrix, and drafts the runbook and DR plan for the technical-writer role — delivered as a markdown package.

Beat 5 — Diagnose

/squad request="Diagnose why the App Service in resource group rg-demo is returning 5xx errors. Query Resource Health and recent logs, rank the likely causes, and recommend fixes — but do not change anything."

The Azure Diagnose role queries Resource Health, Azure Monitor (KQL), and Resource Graph, returns ranked hypotheses with evidence, and hands any fix to the gated Deployer or the IaC Author — strictly read-only.

The autonomous one-request version

The same arc runs from a single autopilot request that expresses the need and names no steps. The squad derives the sequence itself:

/squad mode=autopilot profile=azure request="Stand up a small, production-ready web app on Azure for an internal team — web apps for a frontend and a backend with a SQL database, secrets handling, and file storage in West Europe, I need you to configure vnets and subnets for that and decide on the resources that you prefer. Make sure to follow security standards and create private endpoints and private links when needed. I need monthly cost to stay under $60, the setup to respect our governance, and to be able to operate and troubleshoot it once it's live. So you are free to decide whether it is better to do containerization or not. Keep me in control of anything that spends money or changes my subscription. Also render the architecture you decide on as committed Azure-icon diagram images."

From that one line, autopilot sequences the pipeline and stops only where it must:

• Init — proposes the azure profile and waits for your confirmation.
• Research → Plan — the researcher role, then the lead role.
• Council — architect, security, and cost weigh in before any build.
• Implement — Azure Architect and IaC Author produce the design and the Bicep.
• Review — tester validates the implementation.
• Impactful-Action Gate — stops before the deploy and asks for approval.
• As-built + final-outcome validation — documents the result and waits for your sign-off.

You only touch it at the profile confirm, the deploy gate, and the final sign-off — that is the "tell it once, let it run" mode.

Failure-safe fallbacks

If…	Then…
@azure/mcp will not load	The squad falls back to the az CLI / Retail Prices REST automatically — call it out as MCP-optional design.
No spare subscription to deploy	Stop Beat 3 at the gate; run Beats 4 and 5 against an existing resource group.
A role does not dispatch	Confirm v0.8.1 is installed — the as-built, diagnose, and modernization roles entered the coordinator's dispatch list in 0.8.1.
Deep pricing (RI / spot / PTU) asked	The community pricing MCP is opt-in; the Retail Prices REST fallback covers retail pricing today.

Closing talking points

• No clone. hve-squad is apm install into your repo — the squad rides along.
• MCP-optional. Every Azure capability has a named non-MCP fallback, so a missing server never blocks the squad.
• Safe by construction. Deploys stay behind the Impactful-Action Gate; as-built and diagnose are strictly read-only.
• Full methodology. Research → plan → implement → review runs in every profile, so the Azure work is planned and reviewed, not improvised.