IanMatthewHuff · IanMatthewHuff · Apr 16, 2026 · Apr 17, 2026 · Apr 17, 2026 · Apr 17, 2026
diff --git a/.vscode/cspell.global.yaml b/.vscode/cspell.global.yaml
@@ -15,6 +15,14 @@ words:
     - azdo
     - choco
     - winget
+    - bicepparam
+    - cmdhook
+    - containerapp
+    - containerapps
+    - Exegraph
+    - exegraph
+    - GOMAXPROCS
+    - unrecovered
 ignoreWords:
     - AADSTS
     - afwp

diff --git a/.vscode/cspell.misc.yaml b/.vscode/cspell.misc.yaml
@@ -59,6 +59,11 @@ overrides:
           - singleflight
           - stdlib
           - whatif
+    - filename: ./docs/specs/exegraph/**
+      words:
+          - stdlib
+          - dependson
+          - appsettings
     - filename: schemas/**/azure.yaml.json
       words:
           - prodapi

diff --git a/cli/azd/.vscode/cspell-azd-dictionary.txt b/cli/azd/.vscode/cspell-azd-dictionary.txt
@@ -1,39 +1,12 @@
 AADSTS
 ABRT
 ACCESSTOKEN
-ALLUSERS
-AZCLI
-AZURECLI
-AZURESUBSCRIPTION
 Agentic
-BOOLSLICE
-BUILDID
-BUILDNUMBER
-Backticks
-Cobo
-Errorf
-Frontends
-GOARCH
-GOCOVERDIR
-GOTOOLCHAIN
-GOWORK
-Ghostty
-LASTEXITCODE
-MCPJSON
-PSHOME
-PYTHONDONTWRITEBYTECODE
-PYTHONUNBUFFERED
-RPCJSONRPC
-STRINGSLICE
-SliceOfPtrs
-Syncer
-TOCTOU
-Truef
-Veyor
 agentmanifests
 aiomysql
 aiopg
 akvs
+ALLUSERS
 alphafeatures
 apimanagement
 apims
@@ -68,6 +41,7 @@ asyncpg
 avmres
 azapi
 azblob
+AZCLI
 azcorelog
 azdcli
 azdcontext
@@ -83,17 +57,22 @@ azsdk
 azureai
 azureaiagent
 azureappservice
+AZURECLI
 azurecodingagent
 azureedge
 azureml
 azurestaticapps
+AZURESUBSCRIPTION
 azuretools
 azureutil
 azureyaml
-bicepparam
+Backticks
 bicept
 blockblob
+BOOLSLICE
 buildargs
+BUILDID
+BUILDNUMBER
 buildpacks
 byoi
 callstack
@@ -104,6 +83,7 @@ chelupati
 circleci
 cmdrecord
 cmdsubst
+Cobo
 cognitiveservices
 concurx
 conditionalize
@@ -120,6 +100,7 @@ csharpapp
 csharpapptest
 cupaloy
 custommaps
+dependson
 deletedservices
 devcenter
 devcenters
@@ -142,51 +123,62 @@ envlist
 envname
 envsubst
 errcheck
+Errorf
 errorinfo
 errorlint
 evals
 eventhub
 eventhubs
 executil
 flexconsumption
+Frontends
 fsnotify
 funcapp
 funcignore
 functionapp
+Ghostty
 gjson
 go-imath
+GOARCH
+GOCOVERDIR
 godotenv
 gofmt
 golangci
 googleapis
+goroutines
 gosec
 goterm
 gotest
 gotestsum
+GOTOOLCHAIN
 govet
+GOWORK
 grpcserver
 hotspot
+Idxs
 ignorefile
 iidfile
 ineffassign
+INSTALLDIR
 jaegertracing
 javac
 jmes
 jmespath
 jongio
 jquery
-keychain
 keepalives
+keychain
 kubelogin
 langchain
 langchaingo
+LASTEXITCODE
 ldflags
 lechnerc77
 libc
 llms
-INSTALLDIR
 localtools
 maml
+MCPJSON
 mcptools
 memfs
 mergo
@@ -235,18 +227,25 @@ patternmatcher
 pflag
 pgadmin
 posix
+postdeploy
+postprovision
+predeploy
 preinit
+preprovision
 protogen
 proxying
 psanford
 pseudonymized
+PSHOME
 psycopg
 psycopgbinary
 pulumi
 pyapp
 pycache
 pyproject
 pytest
+PYTHONDONTWRITEBYTECODE
+PYTHONUNBUFFERED
 pyvenv
 rabbitmq
 reauthentication
@@ -259,6 +258,7 @@ resourcegraph
 resourcegroup
 restoreapp
 retriable
+RPCJSONRPC
 runtimes
 rzip
 secureobject
@@ -268,6 +268,7 @@ serverfarms
 servicebus
 setenvs
 skus
+SliceOfPtrs
 snapshotter
 springapp
 sqlserver
@@ -277,20 +278,27 @@ staticwebapp
 stdbool
 stdlib
 stdouttrace
+STRINGSLICE
 struct
 structs
 subst
 substr
+succ
 swacli
+syncatomic
+Syncer
 teamcity
 testdata
+threadsafe
 tmpl
+TOCTOU
 toplevel
 traceparent
 tracesdk
 tracestate
 tracetest
 trafficmanager
+Truef
 typeflag
 unhide
 unmanage
@@ -303,6 +311,7 @@ unsets
 upgrader
 utsname
 uxlib
+Veyor
 vite
 vsrpc
 vuejs

diff --git a/cli/azd/AGENTS.md b/cli/azd/AGENTS.md
@@ -208,6 +208,14 @@ This file is the authoritative reference for core azd terminal UX patterns inclu
 - **Extension-specific documentation**: Keep extension-specific environment variables and configuration documented in the extension's own docs, not in core azd reference docs, unless they are consumed by the core CLI itself
 - **Verify env vars against source**: When documenting environment variables, verify the actual parsing method in code — `os.LookupEnv` (presence-only) vs `strconv.ParseBool` (true/false) vs `time.ParseDuration` vs integer seconds. Document the expected format and default value accurately
 
+### Concurrency
+
+The graph-driven `up`/`provision`/`deploy` engine runs multiple service steps and (when `infra.layers[]` is configured) multiple layer provision steps in parallel. Several long-lived types now have explicit locking contracts that you MUST honor when adding new methods or write paths.
+
+See [docs/concurrency-model.md](./docs/concurrency-model.md) for the full list — `environment.Environment`, `environment.Manager`, `kubectl.Cli`, `containerAppTarget`/`aksTarget`, and `serviceManager` — and the rules for adding new concurrent state.
+
+When adding a method that mutates one of these types: take the documented lock, hold it across the full read-modify-write, and run `go test -race` to catch missed locks (single-goroutine tests will not).
+
 ### Path Safety
 
 - **Validate derived paths**: When deriving directory names from user input or template paths, always validate the result is not `.`, `..`, empty, or contains path separators. These can cause path traversal outside the working directory

diff --git a/cli/azd/CHANGELOG.md b/cli/azd/CHANGELOG.md
@@ -4,12 +4,26 @@
 
 ### Features Added
 
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) Layer dependency analysis for `infra.layers` is now safe-by-default: when the static analyzer encounters a syntax pattern it cannot resolve to a literal env-var name (non-literal `readEnvironmentVariable(varName)` in `.bicepparam`, ARM template expressions like `[parameters('foo')]` in `.parameters.json`, or `param x = readEnvironmentVariable('Y')` defaults inside `.bicep`), the consuming layer is forced to depend on all earlier layers. This trades parallelism for correctness on under-analyzed inputs.
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) New `infra.layers[].dependsOn` field in `azure.yaml` lets authors declare hook-mediated edges (for example, when a postprovision hook in another layer writes an env var that this layer's bicepparam reads at provision time) that no static analyzer can infer from `.bicep` / `.bicepparam` / `.parameters.json` contents alone. Explicit edges union with detected edges and are validated for unknown layer names, self-references, and cycles.
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) Add `provision.layer.*` telemetry attributes (`count`, `max_parallel`, `safe_fallback_count`, `explicit_dependson_count`) on the ambient command span for multi-layer `azd provision` / `azd up` runs so the team can measure adoption and detect when the safe-by-default detector fallback engages on real templates.
+
 ### Breaking Changes
 
 ### Bugs Fixed
 
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) Fix `concurrent map writes` panics when running `azd up` or `azd deploy` against multi-service projects: `*environment.Environment` now serializes all `dotenv` map access with an internal `sync.RWMutex`, the environment manager serializes `Save`/`Reload` calls, the singleton `kubectl.Cli` and `kustomize.Cli` are concurrency-safe, and AKS service publish/deploy updates to `SERVICE_<name>_IMAGE_NAME`/`ENDPOINT_URL` are wrapped in a package-level mutex (mirroring the Container Apps pattern).
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) Restore intra-phase progress detail (e.g. `"Pushing image"`, `"Updating container app"`) in the per-service progress tracker during `azd deploy` and `azd up`. The graph-driven engine previously dropped sub-phase `ServiceProgress.Message` updates, leaving the tracker's "Detail" column blank between phase transitions.
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) Make `x-ms-client-request-id` unique per HTTP request (previously derived from the shared OpenTelemetry trace id, which duplicated the header across every call in a single `azd` invocation). The Azure ARM common-types spec requires this header to be unique per request so Azure services can use it as a deduplication / idempotency / log-correlation key for individual calls — a shared value broke that contract and could cause collisions in parallel deploy / provision scheduling. Microsoft Graph's `client-request-id` header now uses the same per-request UUID for the same reason.
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) Fix cross-service image contamination when publishing multiple Container Apps in parallel via ACR remote build (`docker.remoteBuild: true`). ACR's `GetBuildSourceUploadURL` derives the relative blob path it hands back (`tasks-source/<yyyymmdd>/<correlationId>.tar.gz`) from the caller's `x-ms-correlation-request-id` header, and azd was sending the same correlation id — the root OpenTelemetry trace id shared across every request in a command — on every parallel upload. Each upload overwrote the previous service's source tarball before either build consumed it, so every Container App ended up running the last-uploaded service's image content under its own repository name. ACR source uploads now override `x-ms-correlation-request-id` with a freshly generated UUID per HTTP request so each parallel upload lands in a distinct blob.
+
 ### Other Changes
 
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) **Security:** environment `.env` files are now persisted with mode `0600` (owner read/write only) on Unix-like systems. Previously they inherited the process umask (typically `0644`). The change tightens default permissions for files that may contain subscription IDs and values written via `azd env set`.
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) `azd up` now emits a single `"Provisioning and deploying (azd up)"` title and consolidated final message instead of the legacy `"Packaging services (azd package)"` / `"Provisioning Azure resources (azd provision)"` / `"Deploying services (azd deploy)"` banners and the `"Your up workflow to provision and deploy to Azure completed in …"` footer. CI/automation that grep-matches the legacy strings on stdout will need to update its expected output.
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) `azd up` honors `AZD_DEPLOY_CONCURRENCY` as a fallback when `AZD_UP_CONCURRENCY` is unset, so existing deploy-tuning configurations carry over to the unified up workflow.
+- [[#7776]](https://github.com/Azure/azure-dev/pull/7776) `FailFast` semantics in the parallel scheduler: when a step fails, the scheduler cancels the run context to interrupt in-flight work, but steps that don't honor context cancellation (e.g., long-running ARM operations) will run to completion before the run returns. This is a behavior change versus the previous strictly-sequential `azd up`, which never started a later step after a prior failure.
+
 ## 1.24.3 (2026-05-01)
 
 ### Features Added

diff --git a/cli/azd/cmd/actions_coverage3_test.go b/cli/azd/cmd/actions_coverage3_test.go
@@ -74,7 +74,7 @@ func Test_NewUpAction_Constructor(t *testing.T) {
 	t.Parallel()
 	flags := &upFlags{}
 	console := mockinput.NewMockConsole()
-	a := newUpAction(flags, console, nil, nil, nil, nil, nil, nil, nil)
+	a := newUpAction(flags, console, nil, nil, nil, nil, nil, nil, nil, nil)
 	ua := a.(*upAction)
 	require.Same(t, flags, ua.flags)
 }

diff --git a/cli/azd/cmd/container.go b/cli/azd/cmd/container.go
@@ -578,6 +578,11 @@ func registerCommonDependencies(container *ioc.NestedContainer) {
 	container.MustRegisterScoped(project.NewImportManager)
 	container.MustRegisterScoped(project.NewServiceManager)
 
+	// Unified up action: the exegraph-backed `azd up` entry point that
+	// collapses provision + package + publish + deploy (and project command
+	// hooks) into a single DAG.
+	container.MustRegisterScoped(cmd.NewUpGraphAction)
+
 	// Even though the service manager is scoped based on its use of environment we can still
 	// register its internal cache as a singleton to ensure operation caching is consistent across all instances
 	container.MustRegisterSingleton(func() project.ServiceOperationCache {