tomevault-io CAIRA
Use this skill when a user wants to build or extend a generative AI solution. CAIRA is a reference library, not an application generator: inspect the repository, select the smallest relevant reference components, and adapt them into the user's workspace.
Intake before generating changes
Ask only what is needed to choose components:
- What outcome is the user trying to build?
- Do they already have Foundry/OpenAI endpoints, hosting, identity, observability, or frontend/API code?
- What kind of networking isolation or security boundaries are needed?
- Which programming languages or frameworks does the user prefer? If the user prefers something that's not directly in the CAIRA references, try to follow the same architectural patterns and design principles shown in the CAIRA reference components, but adapt them to the user's preferred languages or frameworks.
- Which components are needed now: Foundry, Container Apps, API, frontend, or only app code? If the answer shows the user only needs one component, use only that component.
Core rules
- Use the
reference-architecturesdirectory in thegithub.com/microsoft/caira/repository as the canonical source of truth. Inspect it either with the github mcp server if available, through GitHub raw URLs or clone the repository temporarily to inspectreference-architectures/locally; - Prefer small component references over full-stack copying.
- For scenarios that need OpenAI-compatible endpoints, prefer the Foundry IaC reference unless the user already has endpoints or asks for a different approach.
- Determine what the user already has before proposing new infrastructure.
- When possible, prefer managed identities or other passwordless identity patterns over API keys, static credentials, or secrets, unless the user explicitly asks for an API-key- or secret-based approach.
- Before proposing repository security scans, check whether the target repository already uses or has configured Gitleaks, Trivy, or similar tools for secret, dependency, container, or IaC scanning. If similar scanning is missing, ask whether the user wants to add Gitleaks and/or Trivy scans before implementing them.
- Keep recommendations focused on the current reference components listed below.
- Explain which CAIRA paths influenced the recommendation or generated files.
- Always ask follow-up questions to narrow down the user's needs and avoid unnecessary copying of reference code.
- Before start implementing, confirm the user's scenario, needs, and which CAIRA reference components, configuration, networking, and security boundaries will be used.
Current reference components
| Need | CAIRA reference path |
|---|---|
| Foundry foundation | reference-architectures/iac/foundry/ |
| Container Apps hosting for API + frontend | reference-architectures/iac/container-apps/ |
| TypeScript API using OpenAI Agents SDK | reference-architectures/app/api/typescript/openai-agents-sdk/ |
| TypeScript API using Foundry Agent Service | reference-architectures/app/api/typescript/foundry-agent-service/ |
| C# API using Microsoft Agent Framework | reference-architectures/app/api/csharp/microsoft-agent-framework/ |
| React frontend | reference-architectures/app/frontend/typescript/react/ |
| Frontend/API contract | reference-architectures/app/API_CONTRACT.md |
How to use CAIRA references
- Inspect the relevant component source files.
- Copy or adapt only the files needed for the user's stack.
- Remove sample text, model names, env vars, or Terraform variables that do not apply to the user's scenario.
- Preserve the component's validation style: npm scripts for TypeScript, .NET build for C#, Terraform validation for IaC, Docker builds for containers.
- Mention the exact CAIRA paths used and what was intentionally left out.
Source: microsoft/CAIRA — distributed by TomeVault.