Run Keynote Demo 1

Guide the user through the existing Caldova Regional Care demo. Treat the package README and demo runbook as the sources of truth. Use repository scripts as written; do not recreate their logic with ad hoc commands.

Safety Rules

• Never display or read into chat the kubeconfig, Kubernetes API key, database scoped credential secret, database master-key password, or a literal key from chatLanguageModels.json.
• Never retrieve a Kubernetes Secret directly for inspection. Only the existing setup and database wrappers may consume it.
• Do not provision, restart, scale, or modify Azure Local, AKS Arc, Foundry Local, the model deployment, or portal resources.
• Do not bypass TLS validation or add --insecure.
• Ask for explicit confirmation before running an elevated setup, restarting SQL Server, initializing the database, invoking the live model, or generating a live receiving briefing.
• Never request a secret through chat. If a terminal prompts for one, tell the user to enter it directly in the terminal.

Select a Mode

Infer the mode from the request. If it is unclear, ask the user to choose:

• prepare: configure a demo VM and database using existing infrastructure.
• preflight: perform non-destructive readiness checks before presenting.
• rehearse: guide the locked presentation sequence one beat at a time.
• troubleshoot: diagnose one failed gate without broad environment changes.

Prepare

1. Confirm the user is on the intended Windows demo VM and read setup guidance.
2. Check, without printing sensitive contents:
   • PowerShell is elevated before setup.
   • C:\setup\SJ-SQLAI-admin.kubeconfig exists, or record the alternate path.
   • SQL Server 2025 is running.
   • az, kubectl, kubelogin, curl.exe, sqlcmd, and the .NET 10 SDK are available.

3. Explain that setup imports a root certificate and restarts SQL Server. After explicit confirmation, run from an elevated PowerShell terminal:

   Set-Location C:\setup
   Set-ExecutionPolicy -Scope Process RemoteSigned
   .\Setup.ps1

   Pass documented overrides only when the user supplied them.

4. Require exit code 0 and Setup completed successfully.
5. Ask before invoking the live model. If approved, run C:\setup\test.ps1 and require trusted HTTPS plus HTTP 200 through SQL Server. A successful direct curl call is not sufficient.

6. From demo1-azure-local, determine whether CaldovaRegionalCare already exists. Use -InitializeDatabase only for an absent database and only after explicit confirmation:

   .\database\Setup-CaldovaDatabase.ps1 -InitializeDatabase

   For an existing database, run the repeat-safe update without that switch.

7. Run the live AI validation only after separate confirmation:

   .\database\Setup-CaldovaDatabase.ps1 -TestFoundryAi

8. Build the application. Start app\run.ps1 as a long-running process only when the user asks to launch it.

Preflight

Perform checks without repairing or provisioning:

1. Confirm the application responds at http://localhost:5099.
2. Confirm /api/health reports Healthy for CaldovaRegionalCare.
3. Confirm the MSSQL extension can connect to localhost and database CaldovaRegionalCare.
4. Confirm the Azure portal is already signed in and the Azure Local VM, AKS cluster, and Azure Virtual Desktop resources are ready to show.
5. Confirm Phi-3.5 Mini appears in the VS Code model picker. Do not send a clinical prompt.
6. Report each gate as PASS, FAIL, or NOT CHECKED. Stop on a failed gate and offer the smallest relevant repair from the documented scripts.

Rehearse

Follow the runbook's locked order exactly:

1. Transfer Center application.
2. Azure portal: Azure Local VM, AKS, and Azure Virtual Desktop.
3. VS Code MSSQL connection and ordered database scripts.
4. Native RegEx extraction.
5. Approved ai.Skill row.
6. Transfer-skill procedure, JSON payload, and sys.sp_invoke_external_rest_endpoint.
7. Phi-3.5 Mini in VS Code Chat.

For each beat, present only its Say, Show, and Land guidance, then wait for the user to continue. Do not execute setup or repair commands during a rehearsal. Do not expose credential rows when showing endpoint metadata.

Troubleshoot

• Start from the failed gate and its exact error.
• Read the owning script before proposing a change.
• Prefer rerunning a documented validation over changing infrastructure.
• Do not use Connect-AksArc.ps1 unless direct kubeconfig access failed and the user explicitly asks to troubleshoot Arc Cluster Connect.
• End with the failed command, the evidence found, and the next documented action.

Completion Report

Report the selected mode, checks performed, commands run, gates passed, and any remaining manual step. Never include secret values in the report.