Fix Hosted configuration bootstrap handoff and preserve verified TLS defaults

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [Unreleased]
+
+### Fixed
+- Export the deployed application Key Vault URI from the foundation and pass it
+  to the bundled hosted agent, avoiding environment-specific vault hardcoding
+  during configuration bootstrap.
+
+### Added
+- Pass the opt-in `APP_CONFIG_TLS_COMPATIBILITY` bootstrap control to the hosted
+  agent with a default of `false`; it requires an orchestrator image containing
+  the coordinated verified TLS transport correction.
+
 ## [v4.2.1] - 2026-10-08
 
 ### Changed

hosted-agent/azure.yaml

@@ -51,6 +51,8 @@ services:
         version: "1.0.0"
     env:
       APP_CONFIG_ENDPOINT: ${APP_CONFIG_ENDPOINT}
+      KEY_VAULT_URI: ${KEY_VAULT_URI}
+      APP_CONFIG_TLS_COMPATIBILITY: "${APP_CONFIG_TLS_COMPATIBILITY=false}"
       # APPLICATIONINSIGHTS_CONNECTION_STRING intentionally omitted: it is a reserved env var
       # name for Foundry hosted agents (all FOUNDRY_*/AGENT_* vars, plus this one, are reserved
       # per the container-image-spec) and the Create Agent API rejects it if present. The

infra/main.bicep

@@ -4026,6 +4026,8 @@ output ACR_TASK_AGENT_POOL string = _deployAcrTaskAgentPool ? acrTaskAgentPoolNa
 // ──────────────────────────────────────────────────────────────────────
 #disable-next-line BCP318
 output APP_CONFIG_ENDPOINT string = deployAppConfig ? appConfig.properties.endpoint : ''
+@description('Application Key Vault URI for downstream bootstrap. Empty when Key Vault is not deployed.')
+output KEY_VAULT_URI string = deployKeyVault ? keyVault!.properties.vaultUri : ''
 output RETRIEVAL_BACKEND string = retrievalBackend
 output FOUNDRY_IQ_PATTERN string = foundryIqPattern
 output KNOWLEDGE_BASE_NAME string = retrievalBackend == 'foundry_iq' ? knowledgeBaseName : ''

tests/test_release_contracts.py

@@ -366,6 +366,24 @@ def test_hosted_smoke_uses_json_invocations_contract(self) -> None:
             self.assertIn("--target", content, relative_path)
             self.assertNotIn("-m venv", content, relative_path)
 
+    def test_hosted_configuration_bootstrap_uses_foundation_vault_uri(self) -> None:
+        import yaml
+
+        foundation = (ROOT / "infra" / "main.bicep").read_text(encoding="utf-8")
+        self.assertIn(
+            "output KEY_VAULT_URI string = deployKeyVault ? keyVault!.properties.vaultUri : ''",
+            foundation,
+        )
+        project = yaml.safe_load(
+            (ROOT / "hosted-agent" / "azure.yaml").read_text(encoding="utf-8")
+        )
+        environment = project["services"]["orchestrator-agent"]["env"]
+        self.assertEqual("${KEY_VAULT_URI}", environment["KEY_VAULT_URI"])
+        self.assertEqual(
+            "${APP_CONFIG_TLS_COMPATIBILITY=false}",
+            environment["APP_CONFIG_TLS_COMPATIBILITY"],
+        )
+
     def test_postprovision_preserves_search_user_assigned_identity(self) -> None:
         content = (ROOT / "scripts" / "postProvision.ps1").read_text(
             encoding="utf-8-sig"