# Documentation and Evidence Path

## Preferred evidence order

1. Microsoft Learn documentation through the user's configured documentation MCP for documented Azure behavior.
2. Sampled read-only Azure evidence, when safely available, for current configured-environment observations.
3. Sanitized user-provided evidence.
4. Clearly labeled inference.

## What each evidence type can prove

- Microsoft Learn documentation can prove documented service behavior, supported concepts, limitations, and recommended patterns.
- Sampled read-only evidence can prove the sampled configured state at the time observed.
- Sanitized user evidence can prove only what the snippet shows.
- None of these alone prove broad regional availability, future success, full account posture, or production readiness.

## Safe usage pattern

- State whether each claim is documentation-based, sampled-current-state, user-provided, or inference.
- Use read-only queries before recommending changes.
- Do not include sensitive internal identifiers, tenant identifiers, subscription identifiers, or secrets in committed docs or final findings.
- If no sampled evidence is available, say the review is documentation-based and list the exact evidence still needed.

## Live-operation rule

For live operations, documentation is never enough. Require target confirmation, current-state evidence, explicit approval, rollback constraints, and post-action verification.

# Official Sources

Use these sources to ground the skill. Microsoft Learn documentation proves documented Azure behavior; it does not prove the user's tenant, subscription, RBAC, quota, deployed resources, current cost, vault state, app health, or production readiness.

## Primary Microsoft Learn sources

- https://learn.microsoft.com/azure/app-service/deploy-staging-slots
- https://learn.microsoft.com/azure/app-service/reference-app-settings#deployment-slots
- https://learn.microsoft.com/azure/app-service/deploy-best-practices
- https://learn.microsoft.com/azure/app-service/configure-common
- https://learn.microsoft.com/azure/app-service/overview-local-cache

## Grounding notes

- Documentation-based claim: Microsoft Learn evidence says App Service deployment slots are live apps and swaps apply target-slot settings to source instances, restart and warm source instances, then switch routing. Swap with preview pauses after target settings are applied so the operator can validate before completing or resetting. Sticky slot settings and warm-up app settings decide whether secrets, connection strings, networking-sensitive settings, and health paths behave safely during swap.
- Current-state claim: requires sampled read-only Azure evidence or sanitized user-provided evidence.
- Live-operation claim: requires target, principal, approval, preflight evidence, rollback constraints, and post-action verification.
- Inference: allowed only when labeled and tied to observed fields or documented behavior.
- Do not include sensitive internal identifiers or secret material in findings.

## Source use rules

- Prefer Microsoft Learn documentation through the user's configured documentation MCP for current Azure service behavior.
- Use sampled read-only Azure evidence only to validate current configured-environment observations.
- If documentation and sampled evidence appear to conflict, report both and stop short of a production-ready verdict.
- Re-check official sources before changing high-risk guidance, because cloud behavior and feature availability can change.

## Current Microsoft Learn deltas checked on 2026-06-05

- Deployment slots require a supported App Service plan tier; do not promise slot workflows for unsupported plans.
- For staging-to-production swaps, production should be the target slot and preview/reset/swap state must be verified before completion.
- Swap with preview is not universally available; authentication differences between slots can block that path.
- Managed identities, VNet integration, custom domains, TLS settings, and IP restrictions are not ordinary swapped app content; treat them as environment-bound controls.

# Permission Model: Azure Live App Service Slot Swap Guard

## Evidence-variable convention

Shell variables in examples are local operator placeholders from an approved change record or already configured shell context. Do not commit real values, and redact them from shared evidence unless disclosure is explicitly approved.

## Custom role — slot swap only, no config writes

```json
{
  "Name": "App Service Slot Swap Guard",
  "IsCustom": true,
  "Description": "Read App Service slot config and perform staged swap. No write to app settings or deployment config.",
  "Actions": [
    "Microsoft.Web/sites/read",
    "Microsoft.Web/sites/slots/read",
    "Microsoft.Web/sites/slots/config/read",
    "Microsoft.Web/sites/slots/slotsswap/action",
    "Microsoft.Web/sites/slotsswap/action",
    "Microsoft.Web/sites/config/read"
  ],
  "NotActions": [
    "Microsoft.Web/sites/config/write",
    "Microsoft.Web/sites/slots/config/write",
    "Microsoft.Web/sites/delete",
    "Microsoft.Web/sites/slots/delete"
  ],
  "AssignableScopes": [
    "$APPROVED_APP_SERVICE_SCOPE"
  ]
}
```

## Nearest built-in alternative

`Website Contributor` includes swap rights but also allows config writes.
Use only when custom role scope is impractical — and scope it to the single App Service, not the resource group.

## Do not assign

- `Owner` on the App Service — allows deletion
- `Microsoft.Web/sites/config/write` without a change-management gate
- `Microsoft.Web/sites/slots/delete` — slot deletion is irreversible and must not be in the swap role
- Subscription-level `Website Contributor` for routine swap operations

Use exact resource scopes from approved change records; do not paste raw subscription identifiers into chat.

# Preflight Commands: Azure Live App Service Slot Swap Guard

Use shell variables for examples instead of raw identifiers. Populate them from an approved change record or already configured shell context; never paste tenant, subscription, resource, or secret values into chat.

## Evidence-variable convention

Variables such as $AZURE_RESOURCE_GROUP_NAME, $APP_SERVICE_APP_NAME, or $KEY_VAULT_NAME are local operator placeholders. Do not commit real values, and redact them from shared evidence unless the change record explicitly allows disclosure.

Run these before initiating a slot swap. Paste sanitized output as evidence.

## 1. Confirm identity and App Service target

```bash
az account show --query "{subscription:id, name:name, user:user.name}"
az webapp show -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --query "{name:name, state:properties.state, hostNames:properties.hostNames}"
```

## 2. List all slots and their current traffic weights

```bash
az webapp deployment slot list -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --query "[].{name:name, state:properties.state}"
az webapp traffic-routing show -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME
```

## 3. Compare app settings between slots

```bash
az webapp config appsettings list -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --slot staging --query "[].{name:name, slotSetting:slotSetting}"
az webapp config appsettings list -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --query "[].{name:name, slotSetting:slotSetting}"
```

Pay special attention to `slotSetting: false` — those settings WILL swap with the slot.
Settings with `slotSetting: true` are slot-sticky and will NOT be swapped.

## 4. Check slot health before swap

```bash
az webapp show -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME --slot staging \
  --query "{state:properties.state, availabilityState:properties.availabilityState}"
# State must be "Running" and availabilityState must be "Normal" before swap
```

## 5. Review connection strings

```bash
az webapp config connection-string list -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME --slot staging \
  --query "[].{name:name, type:type, slotSetting:slotSetting}"
```


## 6. Start swap with preview, then validate before completion

```bash
az webapp deployment slot swap \
  -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --slot staging --target-slot production --action preview

# Complete only after validation succeeds
az webapp deployment slot swap \
  -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --slot staging --target-slot production --action swap

# Reset if validation fails
az webapp deployment slot swap \
  -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --slot staging --target-slot production --action reset
```

# Rollback Playbook: Azure Live App Service Slot Swap Guard

## Evidence-variable convention

Variables such as $AZURE_RESOURCE_GROUP_NAME, $APP_SERVICE_APP_NAME, $DEPLOYMENT_NAME, or $DEPLOYMENT_STACK_NAME are local operator placeholders. Do not commit real values, and redact them from shared evidence unless the change record explicitly allows disclosure.

## Immediate swap-back (standard rollback path)

The swap operation is symmetric — a second swap returns both slots to their original state.

```bash
# Verify current slot state before swapping back
az webapp show -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --query "{hostNames:properties.hostNames}"
az webapp show -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME --slot staging \
  --query "{hostNames:properties.hostNames}"

# Swap back: production → staging (reverts the original swap)
az webapp deployment slot swap \
  -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --slot staging \
  --target-slot production
```

## Verify after rollback

```bash
az webapp show -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --query "{state:properties.state, defaultHostName:properties.defaultHostName}"
# Check application health endpoint
curl -s https://${APP_SERVICE_APP_NAME}.azurewebsites.net/health
```

## Traffic shifting (partial rollback via A/B routing)

```bash
# Route 10% of traffic to staging while investigating
az webapp traffic-routing set -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME \
  --distribution staging=10

# Return all traffic to production
az webapp traffic-routing clear -g $AZURE_RESOURCE_GROUP_NAME -n $APP_SERVICE_APP_NAME
```

## Rollback limitations

- Slot swap is symmetric and reversible **only if you swap back before a second swap**.
- App settings with `slotSetting: false` were swapped — they will swap back.
- Any data written by the new code version to a shared database or storage is NOT rolled back by swapping.
- Log stream evidence must be captured before initiating a rollback; logs do not travel with slot state.

# Safety Checklist

## Evidence labels

- `documentation-based`: grounded in Microsoft Learn or listed official documentation.
- `sampled-current-state`: grounded in read-only Azure or Kubernetes observations from the user's configured tools.
- `user-provided`: grounded in sanitized snippets supplied by the user.
- `inference`: reasoned from evidence but not directly proven.

## Mutation boundary

- Default to read-only review.
- Do not perform create, update, delete, rotate, purge, recover, apply, swap, reset, complete, deploy, assign, revoke, deallocate, quota, budget, or policy changes unless the user explicitly asks and approval is clear.
- Prefer preview, what-if, dry-run, status, describe, list, show, diff, activity-log, and policy evaluation evidence before any mutation.

## Credential and data boundary

- Never ask users to paste credentials, tokens, tenant IDs, subscription IDs, customer data, private keys, kubeconfig contents, CA requester credentials, secret values, connection strings, or raw environment dumps.
- Summarize sensitive evidence by field presence, control state, and risk; do not reproduce secret material.

## Risk gates

- Stop on ambiguous target, ambiguous principal, missing approval, missing rollback, missing financial owner, or missing asset owner for high-impact assets.
- Treat broad permissions, permanent privileged access, public exposure, purge authority, destructive deployment behavior, quota increases, budget automation, and production slot swaps as high-risk.
- Separate documented product behavior from sampled configured-environment evidence.

## Asset-specific hard line

Never perform a production slot swap without target-slot confirmation, sticky-settings diff, warm-up evidence, authentication limitation check, activity-log monitoring path, and immediate rollback plan.

# Azure App Service Slot Swap Operations

Use this reference for current, source-grounded service behavior and the hard live-operation gates that the lean `SKILL.md` intentionally does not carry.

## What people get wrong

- Treating a slot as a passive artifact rather than a live app with its own hostname.
- Swapping directly to production without proving production is the target slot.
- Ignoring sticky app settings, connection strings, managed identity, VNet integration, and IP restrictions.
- Assuming swap with preview is always available even when site authentication blocks it.
- Calling rollback safe without proving immediate same-slot swap-back and health checks.

## Officially grounded service shape

Microsoft Learn evidence says App Service deployment slots are live apps and swaps apply target-slot settings to source instances, restart and warm source instances, then switch routing. Swap with preview pauses after target settings are applied so the operator can validate before completing or resetting. Sticky slot settings and warm-up app settings decide whether secrets, connection strings, networking-sensitive settings, and health paths behave safely during swap.

- Deployment slots require supported App Service plan tiers and have plan-specific limits.
- During swap, source slot is prepared with target settings before routing changes.
- Swap with preview allows validation after settings apply and before routing cutover.
- Warm-up uses root or configured warm-up paths and statuses; misconfigured rewrites can break warm-up.
- Rollback is normally an immediate swap of the same two slots, but stateful side effects still need separate handling.

## Non-negotiable design rules

- Confirm app, source slot, target slot, production target, plan tier, and active principal before any operation.
- Diff slot-specific settings and connection strings without printing values.
- Require warm-up path, expected status codes, and health criteria before completion.
- Use preview for mission-critical swaps unless a documented limitation prevents it.
- Track pending preview state; complete or reset exactly once.

## Minimal safe implementation flow

- Scope app, resource group, source slot, target slot, hostname, owners, and rollback owner.
- Collect slot config, sticky settings, route percentages, auth, warm-up settings, health endpoint, and recent activity log evidence.
- Run or request preview only after explicit approval and preflight evidence.
- Validate source slot under target settings, then either complete or reset.
- Verify production health and document rollback posture after cutover.

## High-risk assumptions to kill

- A successful slot swap does not prove dependency, identity, or network readiness; it proves only that App Service completed its documented routing/configuration sequence.
- Swap with preview is not universally available; site authentication on either slot blocks that path, so the guard must choose reset/swap controls based on documented constraints.
- Sticky settings are not optional hygiene. Missing slot-specific secrets, connection strings, event bindings, or networking settings can turn a clean platform swap into a production incident.
- Rollback by swapping back does not undo database migrations, queue consumers, external callbacks, or other stateful side effects.
- Warm-up success based on the root path is weak evidence unless the app owner has mapped it to real readiness.

## Safe command/code verification targets

- Check source/target slot names, production target, traffic percentages, and pending swap state before issuing preview, swap, or reset.
- Verify sticky app settings and connection strings by name only; never print values.
- Confirm warm-up path/status settings and recent activity-log entries for slot-swap operations.
- Validate source-slot health after preview and production health after completion with app-owner-approved endpoints.
- Keep reset and same-slot swap-back commands prepared before cutover, with stateful side effects listed separately.

## Safe verification targets

- Production is target slot and source slot is healthy before preview.
- Sticky settings cover secrets, connection strings, event bindings, auth-sensitive and network-sensitive settings.
- Warm-up path and statuses match real readiness, not just HTTP 200 from a shallow page.
- Activity log and app logs can identify swap failures.
- Rollback command and success criteria are available before action.

## When to push back

- The requested operation skips preview and health checks for a critical app.
- Settings diff includes unknown secret or network behavior.
- Authentication, warm-up, or local-cache behavior makes preview unsafe or unsupported.
- No owner accepts stateful side effects outside slot content/config.

# Workflow and Output Contract

## Execution flow

1. Scope the exact target, environment boundary, owner, requested operation, approval state, and rollback owner.
2. Load `official-sources.md`, then the component operations guide for service behavior and risk gates.
3. Gather sampled read-only evidence only when available and safe.
4. Compare observed posture against documented behavior, least-privilege expectations, and live-operation safety rules.
5. Refuse or defer mutation if target, approval, rollback, or evidence is incomplete.
6. Return a verdict with evidence level, blockers, safe next actions, and open questions.

## Required output

- `verdict`: pass, warn, fail, or blocked.
- `evidence_level`: documentation-based, sampled-current-state, user-provided, inference, or mixed.
- `scope`: what was reviewed and what was not reviewed.
- `approval_status`: explicit approval, missing approval, or not applicable for read-only review.
- `blockers`: issues that prevent a safe or production-ready conclusion.
- `findings`: severity-labeled risks with source labels.
- `rollback_posture`: exact rollback path or explicit non-reversibility caveat.
- `safe_next_actions`: reversible actions first; mutation only with explicit approval.
- `open_questions`: missing facts that would change the verdict.

## Stress checks

- What assumption would make this recommendation unsafe?
- Which role, policy, budget, quota, deployment, swap, or purge action has the largest blast radius?
- What evidence would disprove the claimed readiness?
- Is the answer accidentally treating documentation as environment-specific proof?

## Response discipline

Use Microsoft Learn documentation through the user's configured documentation MCP for documented Azure behavior. Use sampled read-only Azure evidence only for current configured-environment observations and label it as sampled evidence.