Restore post-PR-#463 sample delta (manual cherry-pick from private) (#765)

Cherry-picks the customer-facing changes from private commits 7215e58..0e67b24
that have not yet flowed to public via the normal sync pipeline. The
scheduled sync has been paused while we fix an architectural bug in the
protected-paths guard (PR foundry-samples-pr#463) that surfaced tonight.
See foundry-samples-pr#484 for the full diagnosis.

Without this manual restoration, the following customer-facing changes from
the private repo would not appear on public until the guard is fixed and
sync resumes:

  - PR foundry-samples-pr#470 — Voice Live testing: update to use latest
    SDK (samples/python/hosted-agents/.../voicelive)
  - PR foundry-samples-pr#465 — fix: add outbound PE rule for AI Services
    account (managed VNet) (infrastructure-setup-bicep tf-18)
  - PR foundry-samples-pr#474 — fix(tf-18): add AI Services account
    outbound PE rule for managed VNet (infrastructure-setup-terraform
    tf-18)
  - PR foundry-samples-pr#250 — Hosted Agents validation pipeline
    parts that intersect samples/ (the rest is .azure-pipelines/, which
    is excluded from sync).

This PR is scoped to the SIX files in the private 7215e58..0e67b24
delta that fall in the sync include-set (i.e., outside the sync
exclude_pathspecs in .github/sync-config.json). All other changes in
that range are excluded from sync (.github/, docs/, public-overlay/,
.azure-pipelines/) and are not relevant to public.

Spot-checks against the historical block-list show none of these files
are validation-blocked.

Authorship of the original changes is preserved in the PR body. The
commit author is the operator performing the manual cherry-pick.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: brandom-msft

infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/modules-network-secured/managed-network.bicep

@@ -39,6 +39,22 @@ resource managedNetwork 'Microsoft.CognitiveServices/accounts/managednetworks@20
 
 // Outbound PE rules allow the managed VNet (where hosted agents run) to reach dependent resources
 // Rules must be created sequentially to avoid conflicting state errors on the managed network
+
+// The agent needs a PE back to the Foundry/AI Services endpoint itself (public access is disabled)
+#disable-next-line BCP081
+resource aiServicesOutboundRule 'Microsoft.CognitiveServices/accounts/managedNetworks/outboundRules@2025-10-01-preview' = {
+  parent: managedNetwork
+  name: 'aiservices-account-rule'
+  properties: {
+    type: 'PrivateEndpoint'
+    destination: {
+      serviceResourceId: aiAccount.id
+      subresourceTarget: 'account'
+    }
+    category: 'UserDefined'
+  }
+}
+
 #disable-next-line BCP081
 resource storageOutboundRule 'Microsoft.CognitiveServices/accounts/managedNetworks/outboundRules@2025-10-01-preview' = {
   parent: managedNetwork
@@ -51,6 +67,7 @@ resource storageOutboundRule 'Microsoft.CognitiveServices/accounts/managedNetwor
     }
     category: 'UserDefined'
   }
+  dependsOn: [aiServicesOutboundRule]
 }
 
 #disable-next-line BCP081

infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/ai-foundry.tf

@@ -154,6 +154,39 @@ resource "azapi_resource" "managed_network" {
   }
 }
 
+# Outbound PE rules allow the managed VNet (where hosted agents run) to reach
+# dependent resources. The managed network API does not support concurrent
+# outbound rule creation, so rules are serialized via depends_on to avoid
+# "Resource is in conflicting state" errors. Chain order:
+# aiservices -> storage -> cosmos -> search
+
+# Managed Network Outbound Rule for the AI Services account itself
+# The agent needs a PE back to the Foundry/AI Services endpoint because
+# publicNetworkAccess is disabled on the account.
+resource "azapi_resource" "aiservices_outbound_rule" {
+  type      = "Microsoft.CognitiveServices/accounts/managedNetworks/outboundRules@2025-10-01-preview"
+  name      = "aiservices-account-rule"
+  parent_id = azapi_resource.managed_network.id
+
+  schema_validation_enabled = false
+
+  body = {
+    properties = {
+      type = "PrivateEndpoint"
+      destination = {
+        serviceResourceId = azapi_resource.cognitive_account.id
+        subresourceTarget = "account"
+      }
+      category = "UserDefined"
+    }
+  }
+
+  depends_on = [
+    azapi_resource.managed_network,
+    azurerm_role_assignment.foundry_network_connection_approver
+  ]
+}
+
 # Wait for Storage Account to be fully created before creating outbound rule
 resource "time_sleep" "wait_storage" {
   count           = var.enable_storage ? 1 : 0
@@ -187,6 +220,7 @@ resource "azapi_resource" "storage_outbound_rule" {
 
   depends_on = [
     time_sleep.wait_storage,
+    azapi_resource.aiservices_outbound_rule,
     azurerm_role_assignment.foundry_network_connection_approver,
     azurerm_role_assignment.foundry_storage_blob,
     azurerm_role_assignment.foundry_storage_contributor
@@ -288,6 +322,7 @@ resource "time_sleep" "wait_outbound_rules" {
   create_duration = "600s"
 
   depends_on = [
+    azapi_resource.aiservices_outbound_rule,
     azapi_resource.storage_outbound_rule,
     azapi_resource.cosmos_outbound_rule,
     azapi_resource.aisearch_outbound_rule
@@ -330,6 +365,7 @@ resource "azapi_resource" "project_capability_host" {
     time_sleep.wait_project_rbac,
     # CRITICAL: All outbound rules must be created AND provisioned before capability host
     # The capability host validates that outbound rules exist and are in Succeeded state
+    azapi_resource.aiservices_outbound_rule,
     azapi_resource.storage_outbound_rule,
     azapi_resource.cosmos_outbound_rule,
     azapi_resource.aisearch_outbound_rule,

infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/aisearch.tf

@@ -85,6 +85,7 @@ resource "azapi_resource" "aisearch_outbound_rule" {
 
   depends_on = [
     time_sleep.wait_aisearch,
+    azapi_resource.cosmos_outbound_rule,
     azurerm_role_assignment.foundry_network_connection_approver,
     azurerm_role_assignment.project_search_index,
     azurerm_role_assignment.project_search_contributor

infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/cosmos.tf

@@ -99,6 +99,7 @@ resource "azapi_resource" "cosmos_outbound_rule" {
 
   depends_on = [
     time_sleep.wait_cosmos,
+    azapi_resource.storage_outbound_rule,
     azurerm_role_assignment.foundry_network_connection_approver,
     azurerm_role_assignment.foundry_cosmos_contributor,
     azurerm_role_assignment.project_cosmos_reader,

samples/python/hosted-agents/bring-your-own/voicelive/client/voicelive_client.py

@@ -45,7 +45,7 @@
     sys.exit(1)
 
 # Azure VoiceLive SDK imports
-from azure.ai.voicelive.aio import VoiceLiveConnection, connect, AgentSessionConfig
+from azure.ai.voicelive.aio import VoiceLiveConnection, connect
 from azure.ai.voicelive.models import (
     AudioEchoCancellation,
     AudioNoiseReduction,
@@ -245,7 +245,7 @@ def shutdown(self):
 
 class AgentV2VoiceAssistant:
     """
-    Voice assistant using Azure AI Foundry agent with AgentSessionConfig.
+    Voice assistant using Azure AI Foundry agent.
 
     This demonstrates the new pattern where the agent is configured at
     connection time using AgentSessionConfig, rather than as a tool in the session.
@@ -255,11 +255,13 @@ def __init__(
         self,
         endpoint: str,
         credential: AsyncTokenCredential,
-        agent_config: AgentSessionConfig,
+        agent_name: str,
+        project_name: str,
     ) -> None:
         self.endpoint = endpoint
         self.credential = credential
-        self.agent_config = agent_config
+        self.agent_name = agent_name
+        self.project_name = project_name
         self.connection: Optional[VoiceLiveConnection] = None
         self.audio_processor: Optional[AudioProcessor] = None
         self.session_ready = False
@@ -269,15 +271,16 @@ async def start(self):
         try:
             logger.info(
                 "Connecting to VoiceLive API with agent %s for project %s",
-                self.agent_config.get("agent_name"),
-                self.agent_config.get("project_name"),
+                self.agent_name,
+                self.project_name,
             )
 
             # Connect using AgentSessionConfig
             async with connect(
                 endpoint=self.endpoint,
                 credential=self.credential,
-                agent_config=self.agent_config,  # Agent configured at connection time
+                agent_name=self.agent_name,
+                project_name=self.project_name,
             ) as connection:
                 conn = connection
                 self.connection = conn
@@ -295,8 +298,8 @@ async def start(self):
                 logger.info("Voice assistant ready! Start speaking...")
                 print("\n" + "=" * 60)
                 print("🎤 AGENT V2 VOICE ASSISTANT READY")
-                print(f"Agent: {self.agent_config.get('agent_name')}")
-                print(f"Project: {self.agent_config.get('project_name')}")
+                print(f"Agent: {self.agent_name}")
+                print(f"Project: {self.project_name}")
                 print("Start speaking to begin conversation")
                 print("Press Ctrl+C to exit")
                 print("=" * 60 + "\n")
@@ -424,18 +427,15 @@ async def _handle_event(self, event):
 
 async def run_assistant(endpoint: str, agent_name: str, agent_project_name: str):
     """Run the voice assistant."""
-    agent_config: AgentSessionConfig = {
-        "agent_name": agent_name,
-        "project_name": agent_project_name,
-    }
 
     credential: AsyncTokenCredential = DefaultAzureCredential()
     logger.info("Using DefaultAzureCredential")
 
     assistant = AgentV2VoiceAssistant(
         endpoint=endpoint,
         credential=credential,
-        agent_config=agent_config,
+        agent_name=agent_name,
+        project_name=agent_project_name,
     )
 
     await assistant.start()

samples/python/hosted-agents/bring-your-own/voicelive/hello-world-invocations-voicelive/README.md

@@ -226,7 +226,7 @@ Once the agent is deployed to Microsoft Foundry, you can interact with it using
 - **Python 3.10+** with the following packages:
 
 ```bash
-pip install azure-ai-voicelive[aiohttp]==1.2.0b5 azure-identity pyaudio
+pip install azure-ai-voicelive[aiohttp]==1.3.0b1 azure-identity pyaudio
 ```
 
 > [!NOTE]