Align Adaptive Apps Console with platform-engineer scenario

03-Azure/01-01-App Innovation/04-adaptive-apps/Readme.md

@@ -100,19 +100,17 @@ challenges. Both start at Challenge 01.
 | Audience | Path | What you do |
 | --- | --- | --- |
 | **Platform engineer** | Challenges **02 - 06** | Prepare the Kubernetes platforms, install and operate Radius, author the resource-type contracts and the recipes behind them, then verify that an application deploys unchanged to every environment. |
-| **Application developer** | Challenge **06**, then optional **07, 09, 10** | Connect to a developer-ready hosted lab, deploy and port the application, then explore identity, AI, and Radius Canvas with their separate prerequisites. |
+| **Application developer** | Challenge **06**, then optional **07, 09, 10** | Start after your team completes Challenges 03-05, deploy and port the application, then explore identity, AI, and Radius Canvas with their separate prerequisites. |
 
 Challenges 05 and 06 are the deliberate handover point: the platform engineer
 finishes by proving the contracts work, and the application developer starts
 from the same place.
 
 > [!TIP]
-> **A ready hosted Console lab covers Challenges 02-05**, including recipe
-> publication and registration. Complete the hosted section of Challenge 01 and
-> [connect your workstation](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/docs/console-setup.md)
-> before starting Challenge 06. Provisioned infrastructure does not supply your
-> local Kubernetes/Radius state. Platform engineers retain the manual 01-06 path.
-> The hosted connection flow still needs live workshop validation.
+> **Using a hosted Console lab?** Complete the workstation setup in Challenge 01
+> and follow [Console setup](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/docs/console-setup.md).
+> Your infrastructure is supplied: explore it in Challenge 02, then install Radius,
+> define resource types, and publish recipes in **03-05** before deploying the app in **06**.
 
 ```mermaid
 flowchart LR
@@ -123,7 +121,7 @@ flowchart LR
     C711["<b>Optional 07, 09, 10</b><br/>Identity, AI, Radius Canvas"]
 
     C1 --> C24 --> C5 --> C6 --> C711
-    C1 -. "Ready Console lab: 02 - 05 + local connection" .-> C6
+    C1 -. "Console: connect, validate 02, then install in 03 - 05" .-> C24
 
     classDef platform fill:#dbeafe,stroke:#1d4ed8,color:#0f172a
     classDef developer fill:#dcfce7,stroke:#15803d,color:#0f172a
@@ -161,7 +159,8 @@ published and are excluded from the current participant path.
 > The challenge sequence is completed incrementally. Follow the links below for
 > the currently published student and coach material. Each bucket is labelled
 > with its primary audience, so you can follow either the platform engineer path
-> (Challenges 02 - 06) or the hosted developer path (06, then optional 07, 09, 10).
+> (Challenges 02 - 06) or the hosted path (validate 02, complete 03-06, then
+> optional 07, 09, 10).
 
 ### General prerequisites
 
@@ -188,8 +187,9 @@ provisioning. For the manual bring-your-own-subscription path, have:
 - [Visual Studio Code](https://code.visualstudio.com/)
 - Bash or PowerShell 7; Windows users can also use WSL 2
 
-For a ready hosted lab, cluster capacity, the registry, and recipes are supplied.
-You still need the tools above and the non-provisioning connection helper.
+For an infrastructure-ready hosted lab, cluster capacity and the registry are supplied;
+Radius, abstractions, and recipes are not. You still need the tools above, a full
+repository checkout, and the non-provisioning connection helper.
 Use Bash for hosted instructions, including in containers with PowerShell.
 
 The recommended option is the repository
@@ -229,8 +229,9 @@ which audience path you follow.
 Radius control plane.
 
 > [!NOTE]
-> Ready Console labs include Challenges 02-05. Hosted developers connect after
-> Challenge 01 and start 06; do not rerun the provisioning/install steps below.
+> Console labs supply infrastructure only. Connect after Challenge 01, validate
+> and explore 02 without reprovisioning, then install Radius, abstractions, and
+> recipes in 03-05 before starting 06.
 > Platform engineers work through these steps manually on their own lab.
 
 - [Challenge 02 - Prepare the platforms](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/challenges/challenge-02.md)
@@ -244,8 +245,8 @@ implement them with recipes.
 
 - [Challenge 04 - Build the platform abstractions](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/challenges/challenge-04.md)
 - [Challenge 05 - Build the platform abstractions with recipes](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/challenges/challenge-05.md)
-  - *Required on the manual setup path; supplied by the ready hosted baseline.
-    Hosted developers may read it without republishing or reinstalling recipes.*
+  - *Required for both BYOS and hosted teams. Console supplies ACR only;
+    participants publish and register recipes in this challenge.*
 
 ### Bucket 3: Portable apps across platforms
 

03-Azure/01-01-App Innovation/04-adaptive-apps/challenges/challenge-01.md

@@ -16,12 +16,9 @@ any bucket.
 
 Complete Tasks **2-4** for workstation setup and tools, then follow
 [Console setup](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/docs/console-setup.md)
-to sign in and connect from a **Bash terminal**. Skip the manual access/capacity,
-provider-registration, extra-resource-group preflight, and platform setup below.
-The helper reconstructs your local kubeconfig, Radius workspaces, and Bicep
-extension using your own credentials. Source `artifacts/console-env.sh` in every
-new Bash terminal and start **Challenge 06**, not provisioning Challenges 02-05.
-The manual bring-your-own-subscription path below is unchanged.
+to sign in and connect from a **Bash terminal**. Skip the remaining setup tasks;
+your infrastructure is already supplied. Explore and validate it in **Challenge 02**,
+then continue to **Challenge 03** to install Radius.
 
 ## Learning goals
 
@@ -53,7 +50,9 @@ Confirm that your workshop team has:
 - Permission to create a resource group, AKS cluster, Linux VM, networking resources,
   Azure Bastion Standard, its managed public IP, a NAT gateway and its public IP, VM Run
   Command, and role assignments
-- Permission to create a Microsoft Entra application and service principal
+- Permission to create a user-assigned managed identity and role assignments in the
+  lab resource group, or tenant permission to create a Microsoft Entra application
+  and service principal for the optional application identity path
 - Regional quota for the AKS nodes, K3s VM, Azure Bastion, and two Standard public IP
   addresses
 - Contributor or equivalent resource permissions, Network Contributor where networking
@@ -71,7 +70,7 @@ deployed these services silently fails later with provider or feature errors:
 az account set --subscription "<subscription-id>"
 
 for provider in Microsoft.Network Microsoft.Compute Microsoft.ContainerService \
-  Microsoft.ContainerRegistry Microsoft.KeyVault Microsoft.Storage; do
+  Microsoft.ContainerRegistry Microsoft.ManagedIdentity Microsoft.KeyVault Microsoft.Storage; do
   az provider register --namespace "$provider" --wait
 done
 
@@ -235,7 +234,8 @@ Radius CLI, PowerShell 7, Git, `jq`, `yq`, `curl`, SSH, and `tar`. These tools c
 every command in Challenges 01-06.
 The container is only a workstation: AKS, the Linux VM, K3s, Radius control planes,
 portfolio workloads, and recipes are still created on the remote Azure and Kubernetes
-targets by the manual commands or the organizer's hosted setup.
+targets. Hosted setup supplies only AKS, the private VM with K3s, networking/NAT/Bastion,
+and ACR; participants install Radius, portfolio workloads, and recipes in 03-05.
 
 Sign in to Azure from inside the container. If the container cannot open a browser, use
 the device-code flow:
@@ -380,7 +380,9 @@ kubeconfig or SSH private key into the Git workspace.
 ## Success criteria
 
 For hosted labs, the success criteria are working local tools and a successful
-Console connection with both contexts/workspaces and `artifacts/types.tgz`.
+Console connection with both Kubernetes contexts, Ready nodes, a working private
+API tunnel, and `artifacts/console-env.sh`. Workspaces and `artifacts/types.tgz`
+are created by participants in Challenges 03 and 04, not by the connection helper.
 The capacity and subscription-wide checks below apply to manual setup only.
 
 You are ready to continue when:

03-Azure/01-01-App Innovation/04-adaptive-apps/challenges/challenge-02.md

@@ -8,7 +8,9 @@ Estimated time: 30-60 minutes | Difficulty: intermediate
 
 **Hosted Console:** this platform setup is already supplied in a ready lab.
 Follow [Console setup](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/docs/console-setup.md)
-and start 06; read this manual path for context without rerunning provisioning.
+after Challenge 01. Skip provisioning, but complete the read-only validation and
+context-switching exercises below. Then start **Challenge 03** to install Radius.
+Keep the supplied resource group, region, and names from `artifacts/console-env.sh`.
 
 Prepare and validate the two Kubernetes platforms used throughout the MicroHack:
 
@@ -37,6 +39,8 @@ portability boundary explored in later challenges.
 
 ### Task 1: Plan the environment
 
+Hosted teams inspect and record the supplied values instead of choosing replacements.
+
 Agree on names and values for:
 
 - Azure subscription and location
@@ -60,6 +64,8 @@ Azure Bastion: bas-adaptive-apps
 
 ### Task 2: Provision AKS
 
+**Hosted:** skip creation and proceed to Task 4 for validation.
+
 Create a two-node AKS cluster with:
 
 - OIDC issuer enabled
@@ -73,6 +79,9 @@ and cluster values explicitly, then validate the result independently.
 
 ### Task 3: Provision K3s on an Azure VM
 
+**Hosted:** skip VM/network creation and K3s installation. The connection helper
+supplies the kubeconfig/tunnel; proceed to Tasks 4-5 for validation and exploration.
+
 Create an Ubuntu VM with:
 
 - A private NIC and no VM public IP
@@ -124,7 +133,7 @@ Record the active kubeconfig and context whenever you switch platforms.
 - Every node reports `Ready`.
 - The team can identify and switch between the AKS and K3s kubeconfig/context pairs.
 - K3s management access is restricted to `AzureBastionSubnet`.
-- No Radius control plane, portfolio, recipe, or application workload is installed.
+- The platforms are ready for Radius installation in Challenge 03.
 
 ## Hints
 

03-Azure/01-01-App Innovation/04-adaptive-apps/challenges/challenge-03.md

@@ -6,9 +6,9 @@ Estimated time: 30-45 minutes per environment | Difficulty: intermediate
 
 ## Challenge objective
 
-**Hosted Console:** Radius is already installed in a ready lab. Use
-[Console setup](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/docs/console-setup.md)
-to create your local workspaces and start 06; do not repeat this manual installation.
+**Hosted Console:** source `artifacts/console-env.sh` from your lab directory
+and use the supplied resource names. Complete the installation below using the
+**managed identity** option.
 
 Install and explore independent Radius control planes on both default platforms.
 Configure the matching local CLI workspaces, Radius environments, and groups:
@@ -30,11 +30,13 @@ control plane and can operate independently.
 - Configure Azure workload identity for the AKS Radius control plane.
 - Validate Radius through Kubernetes, the CLI, and the dashboard.
 
-Before the first K3s command in this challenge, re-establish the private API tunnel if
-the devcontainer was reopened or rebuilt:
+Before the first K3s command, re-establish the private API tunnel if the devcontainer
+was reopened or rebuilt. Hosted participants rerun `bash resources/connect-console.sh`
+and source `artifacts/console-env.sh`, then select the dedicated K3s kubeconfig.
+The following subscription placeholder is for the bring-your-own-subscription path:
 
 ```bash
-export AZURE_SUBSCRIPTION="<subscription-id>"
+export AZURE_SUBSCRIPTION="${AZURE_SUBSCRIPTION:-<subscription-id>}"
 bash resources/prepare-k3s-azure-vm.sh connect
 export KUBECONFIG="$HOME/.kube/adaptive-apps-k3s.yaml"
 ```
@@ -59,9 +61,12 @@ governance trade-offs.
 Before installation:
 
 1. Select kube context `aks-adaptive-apps`.
-2. Create a Microsoft Entra application and service principal for Radius.
+2. **Hosted:** create a user-assigned managed identity in the supplied lab resource
+   group. **Bring your own subscription:** use that same path, or create a Microsoft
+   Entra application and service principal if you have tenant permissions.
 3. Use the AKS OIDC issuer to create federated credentials for the Radius service
-   accounts in namespace `radius-system`.
+   accounts in namespace `radius-system`: `applications-rp`, `bicep-de`, `ucp`,
+   and `dynamic-rp`. Do not configure only the first service account.
 4. Grant the Radius identity the required role on the isolated lab resource group.
 
 Install Radius with Azure workload identity enabled. Only one team member should run
@@ -76,6 +81,11 @@ Create and select:
 Configure the environment's Azure subscription and resource group, then register the
 Azure workload-identity credential.
 
+The [manual walkthrough](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/walkthrough/challenge-03/solution-03.md#2-prepare-azure-workload-identity)
+contains both identity options and the common installation steps. The managed
+identity and its role assignment stay within the lab resource group; no tenant
+app registration or service-principal creation command is required.
+
 ### Task 3: Install Radius manually on K3s
 
 Select the dedicated K3s kubeconfig and context `k3s-azure-vm`, then install a second,
@@ -150,6 +160,15 @@ recover the exercise, these scripts perform the same setup:
 - `resources/deploy-radius-aks.sh`
 - `resources/deploy-radius-k3s.sh`
 
+For hosted AKS recovery, first source `artifacts/console-env.sh`, unset `KUBECONFIG`,
+and select `aks-adaptive-apps`, then explicitly run
+`RADIUS_IDENTITY_MODE=managedidentity RADIUS_REINSTALL=false bash resources/deploy-radius-aks.sh`.
+The sourced Console configuration also exports these values. Keep
+`RADIUS_REINSTALL=false` to preserve an existing installation and coordinate
+recovery with the team. Without these overrides the script defaults to the
+application identity path and reinstall behavior for BYOS; do not use those defaults
+with hosted RG-only permissions.
+
 If Azure Local or an existing Arc-enabled cluster replaces K3s, use its active context,
 create a distinct Radius workspace and environment, and decide explicitly whether it
 needs an Azure provider.

03-Azure/01-01-App Innovation/04-adaptive-apps/challenges/challenge-04.md

@@ -6,9 +6,10 @@ Estimated time: 45-75 minutes | Difficulty: intermediate
 
 ## Challenge objective
 
-**Hosted Console:** the portfolio and types are already installed in a ready lab.
+**Hosted Console:** complete Challenge 03 first, then perform this exercise.
 [Console setup](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/docs/console-setup.md)
-regenerates your local `artifacts/types.tgz`; start 06 without reinstalling this baseline.
+only connects the supplied platforms; it does not install the portfolio/types or
+generate `artifacts/types.tgz`. You create those here, then continue at Challenge 05.
 
 Install the Adaptive Apps capability portfolio, then define the portable contracts that
 application developers use in later challenges. Create one resource type manually
@@ -33,7 +34,7 @@ Before the first K3s command, restore the localhost API tunnel after any contain
 restart:
 
 ```bash
-export AZURE_SUBSCRIPTION="<subscription-id>"
+export AZURE_SUBSCRIPTION="${AZURE_SUBSCRIPTION:-<subscription-id>}"
 bash resources/prepare-k3s-azure-vm.sh connect
 export KUBECONFIG="$HOME/.kube/adaptive-apps-k3s.yaml"
 ```

03-Azure/01-01-App Innovation/04-adaptive-apps/challenges/challenge-05.md

@@ -6,9 +6,9 @@ Estimated time: 60-90 minutes | Difficulty: advanced
 
 ## Challenge objective
 
-**Hosted Console:** a ready lab includes published and registered recipes.
-Follow [Console setup](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/docs/console-setup.md)
-and start 06. Read this manual exercise without recreating the registry or recipes.
+**Hosted Console:** complete Challenges 03-04 first. Source
+`artifacts/console-env.sh` and use the supplied `ACR_NAME`, resource group, and
+region. Skip registry creation; complete the recipe exercises below.
 
 Implement the portable resource-type contracts from Challenge 04. Manually author,
 publish, and register an Azure SQL recipe before registering the complete
@@ -29,7 +29,7 @@ Before the first K3s command, restore the localhost API tunnel after any contain
 restart:
 
 ```bash
-export AZURE_SUBSCRIPTION="<subscription-id>"
+export AZURE_SUBSCRIPTION="${AZURE_SUBSCRIPTION:-<subscription-id>}"
 bash resources/prepare-k3s-azure-vm.sh connect
 export KUBECONFIG="$HOME/.kube/adaptive-apps-k3s.yaml"
 ```
@@ -60,7 +60,8 @@ administrator password.
 
 While targeting AKS and workspace `ws-azure-prod`:
 
-1. Create or select a globally unique, lowercase Azure Container Registry.
+1. Hosted: use the supplied `ACR_NAME` from `artifacts/console-env.sh` without
+   recreating it. BYOS: create or select a globally unique, lowercase registry.
 2. Authenticate to the registry.
 3. Publish `iac/recipes/sql-server.bicep` and the workshop-owned Azure and Kubernetes
    PostgreSQL recipes as version `1.0.0`.

03-Azure/01-01-App Innovation/04-adaptive-apps/challenges/challenge-06.md

@@ -6,10 +6,12 @@ Estimated time: 45-75 minutes | Difficulty: intermediate to advanced
 
 ## Challenge objective
 
-**Hosted entry point:** after the workstation portion of Challenge 01, complete
+**Hosted prerequisites:** after the workstation portion of Challenge 01, complete
 [Console setup](https://github.com/microsoft/MicroHack/blob/main/03-Azure/01-01-App%20Innovation/04-adaptive-apps/docs/console-setup.md).
-It supplies local contexts, workspaces, and `artifacts/types.tgz`; the ready lab
-already includes Challenges 02-05. Use Bash and source `artifacts/console-env.sh`
+Validate/explore the supplied platforms in 02, then complete **Challenges 03-05**:
+install Radius, create workspaces and abstractions (including `artifacts/types.tgz`),
+and publish/register recipes. Console supplies infrastructure only.
+Use Bash and source `artifacts/console-env.sh`
 in each new terminal. Do not rerun platform provisioning to obtain local state.
 
 Prove that the same application model can be deployed to the private K3s platform and