[JiahuiGu (Jiahui-Gu)]

Summary

Follow up on #1107 to use Microsoft Entra ID for both report uploads and downloads, and make telemetry logging enabled by default without enabling sensitive-content recording.

• Replace signed report download URLs with immutable unsigned Blob URLs, Blob names, SHA256 digests, and explicit Entra authentication metadata.
• Add download_report.py, which uses the caller's DefaultAzureCredential and verifies the report digest before writing the output. Reject SAS/query strings and non-Azure Blob endpoints; require a private report container for publication.
• Enable default INFO logging in Deep Agents while retaining the stock host as the sole telemetry owner and leaving sensitive-content capture off.
• Review the other samples and add default OpenTelemetry/INFO-log setup to the three custom WebSocket runtimes that lacked it: LiveKit, Pipecat WebRTC, and Pipecat WebSocket. Initialize each LiveKit worker process and avoid logging full event payloads or model-supplied handoff reasons.
• Update sample/shared documentation and the existing Deep Agents CI fixture to reflect the Entra download contract and safe logging expectations. Preserve the existing research, revision, and read-both workflow and fixture owner.

User-visible changes

Reports no longer use one-hour SAS bearer links. Downloaders must sign in with their own Entra identity and have Blob read access; opening the URL directly in a browser does not automatically authenticate. The README includes Azure CLI and Python download instructions.

The publishing identity needs container-scoped Storage Blob Data Contributor. Download-only users need Storage Blob Data Reader. The revised sample does not require Storage Blob Delegator, account keys, or SAS signing. Container-level Reader access is not per-user report isolation; existing shared CI grants are not revoked by this change.

INFO logs and telemetry instrumentation are enabled by default. Export to Application Insights still requires APPLICATIONINSIGHTS_CONNECTION_STRING (or configure an OTLP destination); sensitive model/tool content remains opt-in. Standard hosted samples already using the host telemetry setup do not receive a second tracer/provider.

Dependency scope

Deep Agents dependencies are unchanged. The three custom runtimes add microsoft-opentelemetry==1.3.8 and compatible frozen locks. This requires OpenTelemetry 1.43 and FastAPI 0.141.1; unchanged package artifact metadata is preserved. Frozen installation and dependency compatibility checks pass for all three runtimes.

Validation

Check	Result
Deep Agents focused tests, local and clean frozen Linux container	20 passed in each environment
Custom WebSocket telemetry regression tests	5 passed
All three custom runtimes: clean frozen Linux installs, dependency compatibility, real distro/Loguru probes	Passed
CI fixture schema/plan tests	4 passed
Existing assertion framework tests	45 passed
Dependency policy including resolution; scoped Ruff lint/format; whitespace	Passed
Existing modified Python files compared with main	No additional Ruff diagnostics

Container validation uses the real SDK/host and telemetry distribution, with external model/project/Blob boundaries simulated where needed. Test-owned ACR images have been cleaned up; shared CI resources and IAM are unchanged.

Remaining acceptance

• A live upload to the existing CI Storage container returns HTTP 403 AuthorizationPermissionMismatch for the current testing identity. Container properties are readable and the container is private; successful live Entra upload/download has not been verified with this identity.
• Full deployed-agent cloud E2E, voice/media session E2E, and actual Application Insights ingestion are not yet verified. The updated CI fixture checks the output/log contract but does not itself execute an authenticated download.
• The broad shared script suite is not reported as passed: it timed out and two Windows shell-related failures were reproduced on unchanged main; unrelated tests were left untouched.

Kept as draft pending cloud acceptance and CI review.