[Kshitija Murudi (kmurudi)]

please provide the link to the corresponding pull request in Azure/azure-cli or Azure/azure-cli-extensions:

Azure/azure-cli-extensions#10370

Summary

• Add generated agentfabric command models while preserving the merged Agent Mesh removal from [agentmesh] Remove retired Agent Mesh command models #1097.
• Keep [agentfabric] Add Agent Fabric command models #1095 synchronized with [agentfabric] Add Agent Fabric CLI extension azure-cli-extensions#10370:
  • AAZ head: 8e5241a029924fc997767adb3cddf999dcde495f
  • Extension head used for parity: 3b3aa3b6c0bf31ca12a7cbb0adb88092b698a205
  • 19 modeled API commands + four generated waits = 23 public commands
• Public hierarchy:
  • az agentfabric create|show|list|update|delete|wait
  • az agentfabric member show|list|wait
  • az agentfabric policy-group create|show|list|update|delete|wait
  • az agentfabric aks attach|show|list|update|detach|wait
  • az agentfabric egress-trust-bundle show|list
• Members remain Agent Fabric children requiring --fabric-name; Policy Groups remain independent resource-group-scoped Microsoft.NetworkSecurity peers.

Final source provenance

The models use the final RPSaaSMaster Microsoft.NetworkSecurity preview merged by Azure/azure-rest-api-specs-pr#30665 at a52c4fc4ac8cd197d38a1072704853f485cafb6c.

• API version: 2026-10-07-preview
• OpenAPI: specification/networksecurity/resource-manager/Microsoft.NetworkSecurity/agentFabric/preview/2026-10-07-preview/agentFabric.json
• OpenAPI SHA-256: 6de5cd31bbf92e418b5946074bcb3591ca8d30b538521cdf30cd6c24fa35d508
• Provider Operations_List and internal OperationStatus_Get are excluded.

Command-model behavior

Agent Fabric

• PUT create/replace supports system-assigned identity and customer-owned Content Safety input through -p/--inspection-profile/--content-inspection-profile.
• The API key is a prompted write-only secret and is absent from GET/list/wait/LRO outputs.
• PATCH update exposes only tags and system-assigned identity.
• resourceGuid retains UUID metadata and is read-only.

Members

Following the extension reviewer request, Member AAZ models exactly match the extension's generated public surface:

• Member commands are show, list, and generated wait only.
• Member create, update, and delete models are removed from both modeled API versions.
• Show/list response schemas retain only the AgentFabricSandbox discriminator; ACI and AKS Member arguments, examples, and response discriminators are absent.
• Sandbox output retains UUID memberGuid, service/target port mappings, optional Entra agent identity, and optional blueprintId.
• This narrows the atomic CLI surface; it does not change the underlying ARM REST contract.

Cluster Associations / agentfabric aks

• Attach is tracked-resource LRO PUT with required location and target resource ID, optional SKU/tags, and no public If-None-Match.
• Update is location-polled PATCH requiring the matching immutable target ID, with optional SKU/tags/gateway IP through -i/--gateway-ip/--workload-cluster-gateway-ip.
• Gateway IP remains update-only and is absent from attach/show/list outputs.
• Item naming retains --association-name, --name/-n, and compatibility alias --cluster-name.

Egress trust bundles and Policy Groups

• agentfabric egress-trust-bundle show|list is read-only for the service-managed singleton.
• All five Policy Group families remain modeled under independent peer-resource CRUD/wait commands.

Generation and parity

• Generated with aaz-dev 4.7.0 / Python 3.14 from the final Swagger, all 40 examples, and referenced ARM common types.
• Used AAZ workspace/controller APIs to remove Member create/update/delete from both versions and narrow show/list to Agent Fabric Sandbox.
• Regenerated extension head 3b3aa3b6c0bf31ca12a7cbb0adb88092b698a205.
• The complete 33-file generated AAZ Python folder is byte-for-byte identical, including the preserved GET-based Member wait.

Validation

• 19 modeled AAZ API commands and 10 latest resource configurations: passed.
• Canonical targeted agentfabric AAZ metadata/model verification: passed.
• Extension regeneration: 23 registrations across 33 Python files: passed.
• Complete generated-folder parity with the extension head: passed.
• Python compileall and git diff --check: passed.
• Reviewer synchronization commit 8e5241a029924fc997767adb3cddf999dcde495f: 14 Member-owned files, 8 insertions / 1,392 deletions.
• Final PR scope: 63 files, 24 Commands/agentfabric files, 38 Agent Fabric resource artifacts, one root index entry; no specs, Agent Mesh, or unrelated changes.

[Kshitija Murudi (kmurudi)]

Following the same one-module-per-PR split, this PR remains draft and is being rewritten to add only Commands/agentfabric. Removal of Commands/agentmesh is moving to a separate ready PR.