diff --git a/.github/workflows/terraform-translator.yml b/.github/workflows/terraform-translator.yml
new file mode 100644
index 0000000..17dc747
--- /dev/null
+++ b/.github/workflows/terraform-translator.yml
@@ -0,0 +1,78 @@
+name: terraform-translator
+
+on:
+  push:
+    paths:
+      - "terraform-translator/**"
+      - ".github/workflows/terraform-translator.yml"
+  pull_request:
+    paths:
+      - "terraform-translator/**"
+      - ".github/workflows/terraform-translator.yml"
+
+defaults:
+  run:
+    working-directory: terraform-translator
+
+jobs:
+  # Always runs — needs no secrets. The translator lazily imports the Anthropic
+  # SDK, so the offline suite runs without dependencies or an API key.
+  offline-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Run offline unit tests
+        run: python -m unittest discover -s tests -v
+
+  # Runs only when an ANTHROPIC_API_KEY repository secret is configured.
+  # Generates real Terraform via the CLI and validates it with the Terraform CLI.
+  live-check:
+    runs-on: ubuntu-latest
+    needs: offline-tests
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Detect API key
+        id: detect
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: |
+          if [ -n "$ANTHROPIC_API_KEY" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::No ANTHROPIC_API_KEY secret set — skipping live check."
+          fi
+
+      - uses: actions/setup-python@v5
+        if: steps.detect.outputs.present == 'true'
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        if: steps.detect.outputs.present == 'true'
+        run: pip install -r requirements.txt
+
+      - name: Generate Terraform from a prompt
+        if: steps.detect.outputs.present == 'true'
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: |
+          mkdir -p tf-check
+          python cli.py "a resource group named demo-rg in West Europe with a storage account" > tf-check/main.tf
+          echo "----- generated main.tf -----"
+          cat tf-check/main.tf
+
+      - uses: hashicorp/setup-terraform@v3
+        if: steps.detect.outputs.present == 'true'
+
+      - name: Validate generated HCL
+        if: steps.detect.outputs.present == 'true'
+        working-directory: terraform-translator/tf-check
+        run: |
+          terraform fmt -check
+          terraform init -backend=false
+          terraform validate
diff --git a/iac-aistudio-update/.gitlab-ci.yml b/iac-aistudio-update/.gitlab-ci.yml
new file mode 100644
index 0000000..dba12d3
--- /dev/null
+++ b/iac-aistudio-update/.gitlab-ci.yml
@@ -0,0 +1,19 @@
+# GitLab CI — runs the security regression tests on every push/MR.
+# No secrets required: the suite runs in LOCAL_DEV mode (SQLite, dummy secret).
+stages:
+  - test
+
+security-tests:
+  stage: test
+  image: python:3.12-slim
+  variables:
+    LOCAL_DEV: "1"
+    FLASK_SECRET_KEY: "ci-test-secret"
+  before_script:
+    - pip install --no-cache-dir -r requirements-dev.txt
+  script:
+    # Run from the bundle root so `import app` and templates/ resolve.
+    - pytest -v
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH
diff --git a/iac-aistudio-update/IMPLEMENTATION_GUIDE.md b/iac-aistudio-update/IMPLEMENTATION_GUIDE.md
new file mode 100644
index 0000000..37b876a
--- /dev/null
+++ b/iac-aistudio-update/IMPLEMENTATION_GUIDE.md
@@ -0,0 +1,133 @@
+# IaC Build — security hardening update (deploy guide)
+
+This bundle contains a hardened `app.py` plus tests. It is a **drop-in replacement
+for `app.py`** in your existing deploy bundle — nothing else in your bundle
+(Dockerfile, templates, `landing.html`, `app.html`, `requirements.txt`) needs to
+change, and **no new environment variables or Azure resources are required** (all
+new settings have safe built-in defaults).
+
+> Scope note: this pass covers the changes that are pure code and low-risk to a
+> live deploy. It deliberately does **not** change the model/cost profile, touch
+> your SSE streaming, or add infrastructure. See "Still open" at the bottom.
+
+---
+
+## 1. What changed (and why)
+
+All changes are in `app.py`. Diff it against your current file before deploying
+(`diff -u old/app.py app.py`).
+
+| Area | Change | Security-plan item |
+|------|--------|--------------------|
+| **LLM model pin** | `/api/generate` now uses a **server-pinned** model (`LLM_MODEL`, default `claude-sonnet-4-6`). The client-supplied `model` field is ignored. | P1-5 |
+| **OTP strength** | Codes are now **6-digit, cryptographically random** (`secrets`), stored as an **HMAC** (never plaintext), with **server-side expiry** (10 min) and **lockout** after 5 wrong attempts. Single-use. | P0-1 |
+| **Password-reset authorization** | `/recover_reset` now **requires a verified OTP in the session**. Previously the reset step did not check that the code had been entered, so anyone who set `recover_email` (a plain POST to `/recover_lookup`) could POST `/recover_reset` and change another account's password. This is the most important fix here. | (gap found during review) |
+| **Registration authorization** | `/profile` (account creation) likewise requires a verified OTP, so accounts can't be created for an unverified email by skipping the code step. | P0-1 related |
+| **Session fixation** | `login()` and the OAuth callback now rotate the session (`session.clear()` then re-issue) via a shared `_login_user()` helper. | P1-3 |
+| **Email enumeration** | `/recover_lookup` returns a **uniform** "if that account exists, a code has been sent" response whether or not the email exists. | P2 (upgrades) |
+| **Session version** | `SESSION_VERSION` bumped `3 → 4`, so all pre-deploy sessions are invalidated once (everyone is logged out a single time after deploy). | — |
+
+New env vars (all **optional**, defaults shown):
+
+| Env var | Default | Purpose |
+|---------|---------|---------|
+| `LLM_MODEL` | `claude-sonnet-4-6` | The pinned generation model. |
+| `LLM_MAX_TOKENS` | `8000` | Hard clamp on output tokens (unchanged value). |
+| `LLM_DEFAULT_TOKENS` | `4000` | Default when the client omits `max_tokens` (unchanged value). |
+| `OTP_TTL_SECONDS` | `600` | OTP validity window. |
+| `OTP_MAX_ATTEMPTS` | `5` | Wrong attempts before lockout. |
+
+---
+
+## 2. Test before you ship (optional but recommended)
+
+From the bundle root (where `app.py` and `templates/` are):
+
+```bash
+pip install -r requirements-dev.txt
+LOCAL_DEV=1 FLASK_SECRET_KEY=test-secret pytest -v
+```
+
+This exercises the OTP logic, the reset-authorization fix, and the model pin
+with no Azure dependencies and no network calls.
+
+---
+
+## 3. Deploy (Azure Cloud Shell)
+
+This follows your existing build/deploy pattern. Replace only `app.py` in the
+bundle, then rebuild and roll the revision.
+
+```bash
+# 0) Note the current image so you can roll back instantly if needed.
+PREV=$(az containerapp show -n ca-iacb-web -g rg-iacb-lean \
+  --query "properties.template.containers[0].image" -o tsv)
+echo "rollback image: $PREV"
+
+# 1) Unzip your current deploy bundle (adjust the zip name/path to yours).
+rm -rf ~/iacb && mkdir -p ~/iacb && unzip -o ~/your-deploy-bundle.zip -d ~/iacb
+
+# 2) Drop in the updated app.py (from this update bundle).
+cp /path/to/iac-aistudio-update/app.py ~/iacb/app.py
+cd ~/iacb
+
+# 3) Build the image in ACR (Dockerfile base must already exist in ACR:
+#    FROM acriacblean.azurecr.io/python:3.12-slim-bookworm).
+TAG=$(date +%Y%m%d-%H%M)
+az acr build --registry acriacblean --image iacb-web:$TAG .
+
+# 4) Roll the Container App to the new image.
+az containerapp update -n ca-iacb-web -g rg-iacb-lean \
+  --image "acriacblean.azurecr.io/iacb-web:$TAG"
+```
+
+Optional — override any of the new settings (not required; defaults are baked in):
+
+```bash
+az containerapp update -n ca-iacb-web -g rg-iacb-lean \
+  --set-env-vars LLM_MODEL=claude-sonnet-4-6 OTP_TTL_SECONDS=600 OTP_MAX_ATTEMPTS=5
+```
+
+---
+
+## 4. Post-deploy verification
+
+```bash
+# Health (also proves DB connectivity)
+curl -fsS https://iac-aistudio.com/healthz && echo
+```
+
+Then click through once:
+
+1. **Register** a throwaway account → confirm the email code is now **6 digits**,
+   that a **wrong** code is rejected, and that completing the flow logs you in.
+2. **Forgot password** for that account → confirm reset works **only after**
+   entering the code, and that entering an **unknown** email gives the same
+   "if that account exists…" message (no "no account found").
+3. **Reset bypass is closed**: a direct POST to `/recover_reset` without first
+   verifying a code must NOT change any password (the test asserts this too).
+4. **Model pin**: in App Insights / container logs, confirm generations run on
+   `LLM_MODEL` regardless of what the client sends.
+5. Everyone is logged out once (expected — `SESSION_VERSION` bump).
+
+---
+
+## 5. Rollback (instant)
+
+```bash
+az containerapp update -n ca-iacb-web -g rg-iacb-lean --image "$PREV"
+```
+
+---
+
+## 6. Still open (not in this code drop)
+
+- **P0-2 — shared rate-limit store.** The limiter is still in-memory (per
+  replica). This needs an **Azure Cache for Redis** resource provisioned first,
+  then `storage_uri="redis://…"` on the `Limiter(...)`. Infrastructure, not a
+  pure code change — do it as a follow-up.
+- **CSP `'unsafe-inline'`** on `script-src` (P1-4) — requires externalizing
+  inline JS to `/static/js/*.js` and moving to nonces. Large, deferred.
+- **Central input-validation layer** (P1-5 cont.) — Pydantic/marshmallow on POST
+  bodies. Deferred.
+- **Monthly LLM spend cap / WAF / image scanning** — roadmap items.
diff --git a/iac-aistudio-update/README.md b/iac-aistudio-update/README.md
new file mode 100644
index 0000000..aa454dc
--- /dev/null
+++ b/iac-aistudio-update/README.md
@@ -0,0 +1,37 @@
+# IaC Build — security hardening update
+
+Drop-in replacement for `app.py` in the IaC-AIStudio deploy bundle, plus tests
+and CI. Hardens authentication and pins the LLM model server-side, with no new
+Azure resources and no required config changes.
+
+**Start here:** [`IMPLEMENTATION_GUIDE.md`](./IMPLEMENTATION_GUIDE.md) — what
+changed, how to test, and the exact Cloud Shell deploy + rollback steps.
+
+## Contents
+
+| File | What it is |
+|------|------------|
+| `app.py` | Hardened application (replaces your current `app.py`) |
+| `IMPLEMENTATION_GUIDE.md` | Deploy guide + change log + verification checklist |
+| `tests/test_security.py` | Security regression tests (OTP, reset auth, model pin) |
+| `requirements-dev.txt` | Minimal deps to run the tests in `LOCAL_DEV` mode |
+| `.gitlab-ci.yml` | Runs the tests on every push/MR (no secrets) |
+| `requirements.txt` | Your runtime deps (unchanged copy, for reference) |
+
+## Quick test
+
+```bash
+pip install -r requirements-dev.txt
+LOCAL_DEV=1 FLASK_SECRET_KEY=test-secret pytest -v
+```
+
+## Summary of changes
+
+- **Model pin (P1-5):** `/api/generate` ignores the client `model`; pinned via `LLM_MODEL`.
+- **OTP (P0-1):** 6-digit crypto codes, HMAC-stored, 10-min expiry, 5-attempt lockout, single-use.
+- **Reset/registration authorization:** both now require a verified OTP (closes a password-reset bypass).
+- **Session fixation (P1-3):** session rotates on login and OAuth callback.
+- **Email enumeration:** uniform recovery response.
+
+See the guide for the full table and the items still left open (Redis limiter,
+CSP nonces, validation layer).
diff --git a/iac-aistudio-update/SETUP-VSCODE.md b/iac-aistudio-update/SETUP-VSCODE.md
new file mode 100644
index 0000000..ab40e23
--- /dev/null
+++ b/iac-aistudio-update/SETUP-VSCODE.md
@@ -0,0 +1,84 @@
+# Move the IaC Build app to a git repo + VS Code (deploy without Cloud Shell)
+
+Today the app is deployed from a **zip bundle**. This sets it up as a proper git
+repo you edit in VS Code and deploy from the VS Code integrated terminal.
+
+## Prerequisites (install once on your workstation)
+
+- **Azure CLI** (`az`) — https://learn.microsoft.com/cli/azure/install-azure-cli
+- **Git**
+- **VS Code** + extensions: Claude Code (you have it), and optionally
+  *Azure Container Apps*, *Docker*, and *Python*.
+- You do **not** need Docker Desktop — `az acr build` builds in Azure.
+
+## 1. Make the app a git repo
+
+Use the bundle you already unzipped (it has the hardened `app.py`):
+
+```bash
+cd ~/iacb/code                      # the folder with Dockerfile, app.py, app.html, templates/
+
+cp /path/to/iac-aistudio-update/deploy.sh ./deploy.sh && chmod +x deploy.sh
+cp /path/to/iac-aistudio-update/app.gitignore ./.gitignore
+
+git init -b main
+git add .
+git commit -m "IaC Build app (hardened) — initial repo"
+```
+
+> Keep the repo **private** — it contains your application logic (no secrets:
+> those stay in Key Vault). Do not commit `.env` files or local databases
+> (the `.gitignore` handles this).
+
+## 2. Push to your git host (pick one)
+
+**GitLab** (you mentioned this):
+```bash
+git remote add origin https://gitlab.com/<you>/iac-build.git
+git push -u origin main
+```
+
+**GitHub:**
+```bash
+git remote add origin https://github.com/<you>/iac-build.git
+git push -u origin main
+```
+
+## 3. Open in VS Code
+
+```bash
+code ~/iacb/code
+```
+Or in VS Code: **File ▸ Open Folder…** → select the repo. Use the Claude Code
+extension in that window to make changes.
+
+## 4. Deploy from VS Code (replaces Cloud Shell)
+
+In the VS Code integrated terminal (**Ctrl+`**):
+
+```bash
+az login            # once per session/workstation
+az account set --subscription 35b00a54-aaaf-46cb-9ec3-783ab739b084
+./deploy.sh
+```
+
+`deploy.sh` builds in ACR, rolls the Container App, prints revision health, and
+shows the exact rollback command. That's your whole deploy now — edit in VS
+Code, commit, run `./deploy.sh`.
+
+## 5. Day-to-day loop
+
+1. Edit code in VS Code (Claude Code can make the changes).
+2. `git commit` (and `git push` to back it up).
+3. `./deploy.sh` in the terminal.
+4. Verify: the script's health line, plus a click-through on https://iac-aistudio.com.
+
+Rollback any time: `az containerapp update -n ca-iacb-web -g rg-iacb-lean --image "<previous-tag>"`.
+
+## Notes
+
+- The base image `python:3.12-slim-bookworm` now lives in your ACR. If a build
+  ever fails with `manifest unknown`, uncomment the `az acr import` line in
+  `deploy.sh` and run it once.
+- For automated checks on every push, wire up the security tests
+  (`tests/test_security.py` + `.gitlab-ci.yml`) from this update bundle.
diff --git a/iac-aistudio-update/app.gitattributes b/iac-aistudio-update/app.gitattributes
new file mode 100644
index 0000000..cbcd7dd
--- /dev/null
+++ b/iac-aistudio-update/app.gitattributes
@@ -0,0 +1,8 @@
+# Rename to ".gitattributes" in your app repo root.
+# Forces LF line endings so files built into the Linux container image stay
+# correct even when edited on Windows.
+* text=auto
+*.py text eol=lf
+*.sh text eol=lf
+*.html text eol=lf
+Dockerfile text eol=lf
diff --git a/iac-aistudio-update/app.gitignore b/iac-aistudio-update/app.gitignore
new file mode 100644
index 0000000..4471f9d
--- /dev/null
+++ b/iac-aistudio-update/app.gitignore
@@ -0,0 +1,15 @@
+# Rename this to ".gitignore" in your app repo root.
+# Keeps secrets, local venvs, and build cruft out of git.
+__pycache__/
+*.pyc
+.venv/
+venv/
+env/
+.env
+.env.*
+*.local
+.DS_Store
+.pytest_cache/
+# Don't commit local SQLite dev databases
+users.db
+instance/
diff --git a/iac-aistudio-update/app.py b/iac-aistudio-update/app.py
new file mode 100644
index 0000000..b1be92b
--- /dev/null
+++ b/iac-aistudio-update/app.py
@@ -0,0 +1,974 @@
+"""
+IaC Build — Flask app for Azure Container Apps deployment.
+
+Entra-only PostgreSQL authentication via the Container App's system-assigned
+managed identity. Flask secret key is pulled from Azure Key Vault at startup.
+PG-backed sessions, in-app rate limiting, security headers.
+
+Environment variables (all required in cloud mode):
+  KEY_VAULT_URI                       https://kv-iacb-lean.vault.azure.net/
+  PG_HOST                             pg-iacb-lean.postgres.database.azure.com
+  PG_DB                               appdb
+  PG_USER                             ca-iacb-web    (the MI's name, case-sensitive)
+  APPLICATIONINSIGHTS_CONNECTION_STRING  (optional, enables AI export)
+
+Local-dev mode:
+  Set LOCAL_DEV=1 to use SQLite + an env-var-based secret key. Useful
+  for running on your laptop without Azure dependencies.
+"""
+import os
+import requests
+import json
+import tempfile
+import subprocess
+import re
+import html
+import random
+import string
+import time
+import hmac
+import hashlib
+import logging
+from datetime import datetime, timedelta
+from urllib.parse import quote_plus
+
+from flask import (Flask, render_template, request, session, redirect,
+                   url_for, Response, make_response)
+from flask_sqlalchemy import SQLAlchemy
+from flask_session import Session
+from flask_compress import Compress
+from flask_wtf import CSRFProtect
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
+from werkzeug.security import generate_password_hash, check_password_hash
+import secrets
+from authlib.integrations.flask_client import OAuth
+from werkzeug.middleware.proxy_fix import ProxyFix
+from sqlalchemy import event
+from sqlalchemy.engine import Engine
+
+# ----- Environment ----------------------------------------------------------
+
+LOCAL_DEV = os.environ.get("LOCAL_DEV", "").lower() in ("1", "true", "yes")
+KV_URI    = os.environ.get("KEY_VAULT_URI")
+PG_HOST   = os.environ.get("PG_HOST")
+PG_DB     = os.environ.get("PG_DB", "appdb")
+PG_USER   = os.environ.get("PG_USER")
+
+OSSRDBMS_SCOPE = "https://ossrdbms-aad.database.windows.net/.default"
+
+logging.basicConfig(level=logging.INFO,
+                    format="%(asctime)s %(levelname)s %(name)s %(message)s")
+log = logging.getLogger("iacb")
+
+# ----- Azure Identity -------------------------------------------------------
+
+_cred = None
+if not LOCAL_DEV:
+    from azure.identity import DefaultAzureCredential
+    from azure.keyvault.secrets import SecretClient
+    _cred = DefaultAzureCredential(exclude_interactive_browser_credential=True)
+
+# ----- Application Insights (auto-instrumentation) -------------------------
+# Configures the OTLP exporter to Azure Monitor and auto-instruments Flask,
+# requests, urllib, logging, and SQLAlchemy. No code changes elsewhere needed.
+# Must run BEFORE Flask app is created so Flask routes get instrumented.
+if not LOCAL_DEV and os.environ.get("APPLICATIONINSIGHTS_CONNECTION_STRING"):
+    try:
+        from azure.monitor.opentelemetry import configure_azure_monitor
+        configure_azure_monitor(
+            logger_name="iacb",
+            disable_offline_storage=True,   # ACA filesystem is ephemeral
+        )
+        log.info("Application Insights instrumentation configured")
+    except Exception as e:
+        # Never let telemetry init crash the app on cold-start.
+        log.warning("App Insights setup failed (continuing without): %s", e)
+
+# Quiet Azure SDK HTTP logging: at root INFO it dumps every telemetry POST
+# (URL, headers, status) to stdout, which then floods ContainerAppConsoleLogs_CL
+# and App Insights traces. App's own "iacb" logger stays at INFO.
+for _n in ("azure", "azure.core.pipeline.policies.http_logging_policy",
+           "azure.monitor.opentelemetry.exporter", "azure.identity"):
+    logging.getLogger(_n).setLevel(logging.WARNING)
+
+# ----- Flask app ------------------------------------------------------------
+
+app = Flask(__name__)
+Compress(app)   # gzip/br responses (HTML/CSS/JS/JSON) to cut transfer size
+csrf = CSRFProtect(app)   # protects all HTML form POSTs; JSON proxy + logout exempted below
+
+# Trust ACA's TLS termination — sets request.is_secure correctly behind the
+# Container Apps edge load balancer so secure cookies and url_for(_scheme)
+# work as expected.
+app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)
+
+# ----- Secret key: Key Vault in cloud, env var local -----------------------
+
+if LOCAL_DEV:
+    app.secret_key = os.environ.get("FLASK_SECRET_KEY", "dev-only-do-not-ship")
+    log.warning("LOCAL_DEV=1 — using insecure dev secret key")
+else:
+    if not KV_URI:
+        raise RuntimeError("KEY_VAULT_URI must be set in cloud mode")
+    _sc = SecretClient(vault_url=KV_URI, credential=_cred)
+    # Stable signing key from Key Vault. Keeps sessions and CSRF tokens valid
+    # across redeploys/restarts instead of logging every user out on each deploy.
+    app.secret_key = _sc.get_secret("flask-secret-key").value
+    log.info("Loaded stable session secret from Key Vault")
+
+# ----- LLM API key for the server-side /api/generate proxy ------------------
+# Fetched once at startup (KV in cloud, env var locally). The route returns 503
+# if the key is absent, so the app still boots before the secret is created.
+_LLM_KEY = os.environ.get("LLM_API_KEY")
+if not LOCAL_DEV:
+    try:
+        _LLM_KEY = _sc.get_secret("llm-api-key").value
+    except Exception as _e:
+        log.warning("LLM key not in Key Vault yet: %s", _e)
+
+# SECURITY (P1-5): pin the generation model and output cap server-side.
+# Previously /api/generate took "model" straight from the client payload
+# (only max_tokens was clamped), so a caller could request an arbitrary, more
+# expensive model. These are now fixed here and overridable ONLY via env vars
+# on the Container App — never by the request body.
+LLM_MODEL          = os.environ.get("LLM_MODEL", "claude-sonnet-4-6")
+LLM_MAX_TOKENS     = int(os.environ.get("LLM_MAX_TOKENS", "8000"))
+LLM_DEFAULT_TOKENS = int(os.environ.get("LLM_DEFAULT_TOKENS", "4000"))
+
+# ----- OAuth social login (Google + GitHub) --------------------------------
+# Client IDs are public; secrets come from Key Vault (same vault as llm-api-key).
+# TWO GitHub apps (one per domain) since a classic OAuth App locks to one host.
+GOOGLE_CLIENT_ID        = os.environ.get("GOOGLE_CLIENT_ID",        "810180534624-mm6n7c8a50k2r98pmgrnksn983gcp05m.apps.googleusercontent.com")
+GITHUB_CLIENT_ID_IAC    = os.environ.get("GITHUB_CLIENT_ID_IAC",    "Ov23litRKnOeOcC5YIBS")
+GITHUB_CLIENT_ID_ONLINE = os.environ.get("GITHUB_CLIENT_ID_ONLINE", "Ov23ctEWg1GUBxzQtpdU")
+
+_OAUTH_SECRETS = {}
+if not LOCAL_DEV:
+    for _sn in ("google-oauth-secret", "github-oauth-secret-iac", "github-oauth-secret-online"):
+        try:
+            _OAUTH_SECRETS[_sn] = _sc.get_secret(_sn).value
+        except Exception as _e:
+            log.warning("OAuth secret %s not loaded: %s", _sn, _e)
+
+oauth = OAuth(app)
+if _OAUTH_SECRETS.get("google-oauth-secret"):
+    oauth.register(
+        name="google",
+        client_id=GOOGLE_CLIENT_ID,
+        client_secret=_OAUTH_SECRETS["google-oauth-secret"],
+        server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
+        client_kwargs={"scope": "openid email profile"},
+    )
+for _gk, _gid, _gname in (("github-oauth-secret-iac",    GITHUB_CLIENT_ID_IAC,    "github_iac"),
+                          ("github-oauth-secret-online", GITHUB_CLIENT_ID_ONLINE, "github_online")):
+    if _OAUTH_SECRETS.get(_gk):
+        oauth.register(
+            name=_gname,
+            client_id=_gid,
+            client_secret=_OAUTH_SECRETS[_gk],
+            access_token_url="https://github.com/login/oauth/access_token",
+            authorize_url="https://github.com/login/oauth/authorize",
+            api_base_url="https://api.github.com/",
+            client_kwargs={"scope": "read:user user:email"},
+        )
+
+OAUTH_ENABLED = bool(_OAUTH_SECRETS)
+
+def _github_client_name():
+    host = (request.host or "").lower().split(":")[0]
+    if host.startswith("www."):
+        host = host[4:]
+    return "github_online" if "online-shield.com" in host else "github_iac"
+
+# ----- Session policy -------------------------------------------------------
+
+app.config["PERMANENT_SESSION_LIFETIME"] = timedelta(minutes=30)
+app.config["IDLE_SECONDS"]               = 1800
+app.config["SESSION_COOKIE_HTTPONLY"]    = True
+app.config["SESSION_COOKIE_SAMESITE"]    = "Lax"
+# Secure cookies only in cloud (HTTPS); LOCAL_DEV runs HTTP.
+app.config["SESSION_COOKIE_SECURE"]      = not LOCAL_DEV
+
+# Bump SESSION_VERSION to invalidate ALL existing sessions on next deploy.
+# Bumped 3 -> 4 with the auth hardening (OTP/session-rotation) so no pre-deploy
+# session lingers in a half-migrated state. Users are logged out once.
+SESSION_VERSION = 4
+
+# ----- Database -------------------------------------------------------------
+
+if LOCAL_DEV:
+    app.config["SQLALCHEMY_DATABASE_URI"] = "sqlite:///users.db"
+else:
+    # Password placeholder in URL is overwritten per-connection by the
+    # do_connect event listener below.
+    app.config["SQLALCHEMY_DATABASE_URI"] = (
+        f"postgresql+psycopg://{quote_plus(PG_USER)}@{PG_HOST}/{PG_DB}?sslmode=require"
+    )
+    app.config["SQLALCHEMY_ENGINE_OPTIONS"] = {
+        "pool_pre_ping": True,
+        "pool_recycle":  1800,   # < ~1h token TTL
+    }
+app.config["SQLALCHEMY_TRACK_MODIFICATIONS"] = False
+
+db = SQLAlchemy(app)
+
+# Per-connection Entra token injection. Fires when SQLAlchemy opens a new
+# physical connection (not per-query). Only affects PostgreSQL dialect, so
+# local SQLite dev mode is unaffected.
+@event.listens_for(Engine, "do_connect")
+def _provide_token(dialect, conn_rec, cargs, cparams):
+    if not LOCAL_DEV and dialect.name == "postgresql":
+        cparams["password"] = _cred.get_token(OSSRDBMS_SCOPE).token
+
+# ----- PG-backed sessions (cloud only) -------------------------------------
+
+if not LOCAL_DEV:
+    app.config["SESSION_TYPE"]       = "sqlalchemy"
+    app.config["SESSION_SQLALCHEMY"] = db
+    Session(app)   # auto-creates a 'sessions' table on first request
+
+# ----- User model -----------------------------------------------------------
+
+class User(db.Model):
+    id            = db.Column(db.Integer,     primary_key=True)
+    email         = db.Column(db.String(120), unique=True, nullable=False)
+    password_hash = db.Column(db.String(256), nullable=False)
+    first_name    = db.Column(db.String(50),  nullable=False)
+    last_name     = db.Column(db.String(50),  nullable=False)
+    phone         = db.Column(db.String(20),  nullable=False)
+
+
+class GenLog(db.Model):
+    __tablename__ = "gen_log"
+    id      = db.Column(db.Integer, primary_key=True)
+    user_id = db.Column(db.Integer, index=True, nullable=False)
+    ts      = db.Column(db.DateTime, default=datetime.utcnow, index=True, nullable=False)
+
+
+# ----- Access control -------------------------------------------------------
+# Admins (comma-separated emails in ADMIN_EMAILS) may run real AI generation.
+# Everyone else is locked to DEMO mode so test users cannot spend API credits.
+# Fail-closed: if ADMIN_EMAILS is unset, NO account can run live generation.
+ADMIN_EMAILS = {e.strip().lower() for e in os.environ.get("ADMIN_EMAILS", "").split(",") if e.strip()}
+
+def _is_admin(user):
+    return bool(user) and bool(user.email) and user.email.lower() in ADMIN_EMAILS
+
+
+with app.app_context():
+    # No-op if tables already exist. Creates User table + (in cloud) sessions
+    # table on first run after deploy.
+    db.create_all()
+
+# ----- Rate limiter ---------------------------------------------------------
+
+limiter = Limiter(
+    app=app,
+    key_func=get_remote_address,
+    default_limits=[],
+    storage_uri="memory://",   # single-replica prototype; OK per docx
+)
+
+# ----- Security & cache headers --------------------------------------------
+
+# Content-Security-Policy.
+# HONEST CAVEAT: this is a PERMISSIVE CSP, not a strict one. The existing
+# HTML has 110+ inline event handlers (onclick=..., onload=..., etc.) and 11
+# inline <script> blocks, which require 'unsafe-inline' on script-src. This
+# CSP therefore does NOT prevent inline-script XSS. What it DOES do:
+#   - Restricts external script/style/font/img sources to a known allow-list
+#   - Blocks <object>/<embed> (object-src 'none')
+#   - Blocks framing of this site (frame-ancestors 'none' — clickjacking)
+#   - Locks <base> and <form action> to same-origin
+# Phase 2 fix: extract inline JS to /static/js/*.js, use script-src nonces.
+_CSP = (
+    "default-src 'self'; "
+    "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; "
+    "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+    "style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+    "font-src 'self' https://fonts.gstatic.com data:; "
+    "img-src 'self' data: https:; "
+    "connect-src 'self'; "
+    "frame-ancestors 'none'; "
+    "base-uri 'self'; "
+    "form-action 'self'; "
+    "object-src 'none'"
+)
+
+
+@app.after_request
+def _security_headers(resp):
+    if resp.mimetype == "text/html":
+        resp.headers["Cache-Control"] = "no-store"
+        resp.headers["Content-Security-Policy"] = _CSP
+    resp.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+    resp.headers["X-Content-Type-Options"]    = "nosniff"
+    resp.headers["X-Frame-Options"]           = "DENY"
+    resp.headers["Referrer-Policy"]           = "strict-origin-when-cross-origin"
+    resp.headers["Permissions-Policy"]        = "camera=(), microphone=(), geolocation=()"
+    return resp
+
+# ----- Session guard --------------------------------------------------------
+
+@app.before_request
+def _session_guard():
+    if "user_id" in session:
+        now = time.time()
+        if session.get("sv") != SESSION_VERSION:
+            session.clear()
+            return
+        if now - session.get("la", 0) > app.config["IDLE_SECONDS"]:
+            session.clear()
+            return
+        session["la"] = now
+
+# ----- Login helper (session rotation to prevent fixation) ------------------
+
+def _login_user(user):
+    """Start an authenticated session. Clears any pre-auth session first so a
+    fixated/anonymous session id cannot be reused after login (P1-3)."""
+    session.clear()
+    session["user_id"] = user.id
+    session.permanent  = True
+    session["sv"]      = SESSION_VERSION
+    session["la"]      = time.time()
+
+# ----- Domain layer ---------------------------------------------------------
+
+def generate_svg_captcha(text):
+    width, height = 250, 60
+    svg = f'<svg width="{width}" height="{height}" xmlns="http://www.w3.org/2000/svg">'
+    svg += '<rect width="100%" height="100%" fill="#0D1017"/>'
+    x_position = 25
+    for char in text:
+        y_position = random.randint(35, 45)
+        angle = random.randint(-15, 15)
+        font_size = random.randint(32, 40)
+        svg += (f'<text x="{x_position}" y="{y_position}" '
+                f'transform="rotate({angle} {x_position} {y_position})" '
+                f'font-family="Georgia, serif" font-size="{font_size}" fill="#3B82F6">{char}</text>')
+        x_position += 35
+    svg += "</svg>"
+    return svg
+
+
+def check_password_strength(password):
+    if not password or len(password) < 8:
+        return False, "Password must be at least 8 characters."
+    if not any(c.isupper() for c in password):
+        return False, "Password needs a capital letter."
+    if not any(c.isdigit() for c in password):
+        return False, "Password needs a number."
+    return True, "Password is secure."
+
+# ----- OTP (one-time codes) -------------------------------------------------
+# Hardened per security review (P0-1): 6-digit cryptographically-random codes,
+# stored in the session as an HMAC (never plaintext) with an issue timestamp
+# and an attempt counter. Enforces server-side expiry and lockout after too
+# many wrong tries, and consumes the code on success (single-use).
+OTP_TTL_SECONDS  = int(os.environ.get("OTP_TTL_SECONDS", "600"))   # 10 minutes
+OTP_MAX_ATTEMPTS = int(os.environ.get("OTP_MAX_ATTEMPTS", "5"))
+
+
+def _hash_otp(code):
+    key = app.secret_key
+    if isinstance(key, str):
+        key = key.encode()
+    return hmac.new(key, (code or "").encode(), hashlib.sha256).hexdigest()
+
+
+def _clear_otp():
+    for _k in ("otp_hash", "otp_ts", "otp_attempts"):
+        session.pop(_k, None)
+
+
+def issue_otp():
+    """Generate a 6-digit code, store its HMAC + metadata in the session, and
+    return the plaintext code (to be emailed)."""
+    code = f"{secrets.randbelow(10**6):06d}"
+    session["otp_hash"]     = _hash_otp(code)
+    session["otp_ts"]       = time.time()
+    session["otp_attempts"] = 0
+    return code
+
+
+def verify_otp(submitted):
+    """Validate a submitted code against the session. Returns (ok, message).
+    Enforces expiry and attempt lockout; consumes the code on success."""
+    submitted = (submitted or "").strip()
+    stored = session.get("otp_hash")
+    if not stored:
+        return False, "No code outstanding — request a new one."
+    if time.time() - session.get("otp_ts", 0) > OTP_TTL_SECONDS:
+        _clear_otp()
+        return False, "Code expired — request a new one."
+    session["otp_attempts"] = session.get("otp_attempts", 0) + 1
+    if session["otp_attempts"] > OTP_MAX_ATTEMPTS:
+        _clear_otp()
+        return False, "Too many attempts — request a new code."
+    if hmac.compare_digest(stored, _hash_otp(submitted)):
+        _clear_otp()
+        return True, ""
+    return False, "Incorrect verification code."
+
+# ----- Email OTP sender (Resend with log fallback) -------------------------
+
+RESEND_FROM = os.environ.get("RESEND_FROM", "noreply@iac-aistudio.com").strip()
+RESEND_FROM_NAME = os.environ.get("RESEND_FROM_NAME", "IaC-AIStudio IaC Build").strip()
+RESEND_API_KEY_KV_SECRET = os.environ.get("RESEND_API_KEY_KV_SECRET", "resend-api-key")
+
+
+def _resend_from():
+    """Pick the email sender by the domain the request is on, so each domain
+    sends from itself (online-shield.com -> its address, everything else -> the
+    RESEND_FROM default = iac-aistudio.com). Mirrors the per-host OAuth routing."""
+    host = ""
+    try:
+        host = (request.host or "").lower().split(":")[0]
+    except Exception:
+        host = ""
+    if host.startswith("www."):
+        host = host[4:]
+    if "online-shield.com" in host:
+        return ("Online-Shield IaC Build", "noreply@online-shield.com")
+    return (RESEND_FROM_NAME, RESEND_FROM)
+
+
+def send_otp_email(email, code, subject="Your verification code"):
+    """Send OTP via Resend. Falls back to log if Resend not configured."""
+    if not email or LOCAL_DEV or _sc is None:
+        log.info("[MOCK-EMAIL] to=%s subject=%s code=%s", email, subject, code)
+        return
+    try:
+        api_key = _sc.get_secret(RESEND_API_KEY_KV_SECRET).value
+        import resend
+        resend.api_key = api_key
+        html = (
+            '<div style="font-family:ui-sans-serif,system-ui,-apple-system,Segoe UI,sans-serif;'
+            'max-width:480px;margin:auto;padding:32px;background:#0D1017;color:#F2F4F6;border-radius:14px">'
+            f'<h2 style="color:#3B82F6;margin:0 0 16px;font-size:20px">{subject}</h2>'
+            '<p style="margin:0 0 20px;color:#C3CCD7">Your verification code is:</p>'
+            f'<div style="font-size:34px;letter-spacing:10px;font-weight:700;color:#3B82F6;'
+            'text-align:center;background:#080A0F;padding:24px;border-radius:10px;margin:20px 0;'
+            f'border:1px solid #1F2735">{code}</div>'
+            '<p style="color:#A7AEB8;font-size:13px;margin:24px 0 8px">'
+            "This code expires in 10 minutes. If you didn't request this, ignore this email.</p>"
+            '<p style="color:#6E757F;font-size:12px;margin:24px 0 0;border-top:1px solid #1F2735;padding-top:16px">'
+            "— IaC-AIStudio.com IaC Build</p></div>"
+        )
+        _fn, _fa = _resend_from()
+        resend.Emails.send({
+            "from": f"{_fn} <{_fa}>",
+            "to": [email],
+            "subject": subject,
+            "html": html,
+        })
+        log.info("[EMAIL-SENT] to=%s subject=%s", email, subject)
+    except Exception as exc:
+        log.error("[EMAIL-FAIL] to=%s err=%s", email, exc)
+        log.info("[MOCK-EMAIL] to=%s subject=%s code=%s", email, subject, code)
+
+
+# Backwards-compat alias
+def send_mock_email(email, code, subject="Your verification code"):
+    send_otp_email(email, code, subject)
+
+
+def log_audit_trail(email, action):
+    log.info("[AUDIT] %s: %s", action, email)
+
+# ----- App HTML serving (single dark-blue variant) -------------------------
+
+APP_DIR      = os.path.dirname(os.path.abspath(__file__))
+LANDING_FILE = os.path.join(APP_DIR, "landing.html")
+APP_FILE     = os.path.join(APP_DIR, "app.html")
+
+
+def serve_iac_app(user):
+    with open(APP_FILE, encoding="utf-8") as f:
+        page = f.read()
+    name = html.escape(f"{user.first_name} {user.last_name}")
+    page = page.replace('class="nav-item user-menu hidden"',
+                        'class="nav-item user-menu"')
+    page = page.replace("__USER_NAME__", name)
+    page = page.replace("/*__IS_ADMIN__*/false/*__/IS_ADMIN__*/",
+                        "true" if _is_admin(user) else "false")
+    page = page.replace('id="authBtns"', 'id="authBtns" style="display:none"')
+
+    _form = ('<form method="post" action="/logout" style="display:inline;margin:0">'
+             '<button type="submit" style="all:unset;cursor:pointer;color:#F06A5C;'
+             'display:block;padding:9px 14px;border-radius:8px;font-size:12.5px;'
+             'width:100%;box-sizing:border-box;text-align:left">Logout</button></form>')
+    page = re.sub(r'<a href="(?:/logout|#)"[^>]*>Logout</a>', _form, page)
+    return Response(page, mimetype="text/html")
+
+# ----- Routes ---------------------------------------------------------------
+
+@app.route("/")
+def home():
+    with open(LANDING_FILE, encoding="utf-8") as f:
+        page = f.read()
+    if "user_id" in session:
+        user = db.session.get(User, session["user_id"])
+        if user is not None:
+            start = page.find("<!--AUTH-->")
+            end = page.find("<!--/AUTH-->") + len("<!--/AUTH-->")
+            if start != -1 and end > start:
+                name = (user.first_name or user.email.split("@")[0])
+                replacement = (
+                    f'<span style="font-size:12px;color:var(--text2);'
+                    f'white-space:nowrap;align-self:center">Signed in as '
+                    f'<b style="color:var(--text)">{html.escape(name)}</b></span>\n'
+                    f'      <a class="btn primary" href="/app">⌂ Open Workspace</a>\n'
+                    f'      <form method="post" action="/logout" '
+                    f'style="display:inline;margin:0">'
+                    f'<button type="submit" class="btn" style="cursor:pointer">'
+                    f'Logout</button></form>'
+                )
+                page = page[:start] + replacement + page[end:]
+    resp = Response(page, mimetype="text/html")
+    resp.headers["Cache-Control"] = "no-store"
+    return resp
+
+
+@app.route("/login", methods=["GET", "POST"])
+@limiter.limit("10/minute", methods=["POST"])
+def login():
+    if request.method == "GET":
+        if "user_id" in session:
+            return redirect(url_for("iac_app"))
+        return render_template("auth.html", view="login", oauth_enabled=OAUTH_ENABLED)
+
+    email = request.form.get("email")
+    password = request.form.get("password")
+    user = User.query.filter_by(email=email).first()
+    if user and check_password_hash(user.password_hash, password):
+        _login_user(user)
+        log_audit_trail(user.email, "LOGGED IN")
+        return redirect(url_for("iac_app"))
+    return render_template("auth.html", view="login",
+                           error_message="Invalid email or password.")
+
+
+@app.route("/upgrade")
+def upgrade():
+    return render_template("auth.html", view="upgrade")
+
+
+@app.route("/auth/<provider>/login")
+def oauth_login(provider):
+    if provider == "google":
+        client = oauth.create_client("google")
+    elif provider == "github":
+        client = oauth.create_client(_github_client_name())
+    else:
+        client = None
+    if client is None:
+        return redirect(url_for("login"))
+    redirect_uri = url_for("oauth_callback", provider=provider, _external=True,
+                           _scheme=("http" if LOCAL_DEV else "https"))
+    return client.authorize_redirect(redirect_uri)
+
+
+@app.route("/auth/<provider>/callback")
+def oauth_callback(provider):
+    try:
+        if provider == "google":
+            client = oauth.create_client("google")
+            if client is None:
+                return redirect(url_for("login"))
+            token = client.authorize_access_token()
+            info  = token.get("userinfo") or {}
+            email    = (info.get("email") or "").strip().lower()
+            verified = bool(info.get("email_verified"))
+            fn = info.get("given_name") or ""
+            ln = info.get("family_name") or ""
+        elif provider == "github":
+            client = oauth.create_client(_github_client_name())
+            if client is None:
+                return redirect(url_for("login"))
+            client.authorize_access_token()
+            emails  = client.get("user/emails").json()
+            primary = next((e for e in emails
+                            if e.get("primary") and e.get("verified")), None)
+            email    = ((primary or {}).get("email") or "").strip().lower()
+            verified = primary is not None
+            prof = client.get("user").json()
+            full = (prof.get("name") or prof.get("login") or "").strip()
+            bits = full.split(" ", 1)
+            fn = bits[0] if bits else ""
+            ln = bits[1] if len(bits) > 1 else ""
+        else:
+            return redirect(url_for("login"))
+    except Exception as _e:
+        log.warning("OAuth callback failed (%s): %s", provider, _e)
+        return redirect(url_for("login"))
+
+    if not email or not verified:
+        log.warning("OAuth: no verified email from %s", provider)
+        return redirect(url_for("login"))
+
+    user = User.query.filter_by(email=email).first()
+    if user is None:
+        user = User(
+            email=email,
+            password_hash=generate_password_hash(secrets.token_urlsafe(32)),
+            first_name=(fn or email.split("@")[0])[:50],
+            last_name=(ln or "")[:50],
+            phone="",
+        )
+        db.session.add(user)
+        db.session.commit()
+        log_audit_trail(email, f"REGISTERED via {provider}")
+
+    _login_user(user)
+    log_audit_trail(email, f"LOGGED IN via {provider}")
+    return redirect(url_for("iac_app"))
+
+
+@app.route("/captcha_image")
+def captcha_image():
+    text = "".join(random.choices(string.ascii_letters + string.digits, k=6))
+    session["captcha_answer"] = text.lower()
+    return Response(generate_svg_captcha(text), mimetype="image/svg+xml")
+
+
+@app.route("/start_register")
+def start_register():
+    return render_template("auth.html", view="register", step=1)
+
+
+@app.route("/register", methods=["POST"])
+@limiter.limit("5/minute")
+def register():
+    user_captcha = request.form.get("captcha", "").lower().strip()
+    email = request.form.get("email", "").strip()
+    password = request.form.get("password")
+
+    if user_captcha != session.get("captcha_answer"):
+        return render_template("auth.html", view="register", step=1,
+                               error_message="CAPTCHA Failed.")
+    if User.query.filter_by(email=email).first():
+        return render_template("auth.html", view="register", step=1,
+                               error_message="Email already registered.")
+    ok, msg = check_password_strength(password)
+    if not ok:
+        return render_template("auth.html", view="register", step=1,
+                               error_message=msg)
+
+    session["reg_email"]    = email
+    session["reg_hash"]     = generate_password_hash(password)
+    session["reg_verified"] = False
+    send_otp_email(email, issue_otp())
+    return render_template("auth.html", view="register", step=2,
+                           success_message="Code sent — check your email inbox.")
+
+
+@app.route("/verify", methods=["POST"])
+@limiter.limit("10/minute")
+def verify():
+    ok, msg = verify_otp(request.form.get("otp"))
+    if ok:
+        session["reg_verified"] = True
+        return render_template("auth.html", view="register", step=3,
+                               success_message="Code confirmed! Complete profile.")
+    return render_template("auth.html", view="register", step=2,
+                           error_message=msg)
+
+
+@app.route("/profile", methods=["POST"])
+def profile():
+    first = request.form.get("first_name")
+    last  = request.form.get("last_name")
+    phone = request.form.get("phone", "").strip()  # optional now
+    if not all([first, last]):
+        return render_template("auth.html", view="register", step=3,
+                               error_message="First and last name are required.")
+    if not session.get("reg_email") or not session.get("reg_hash"):
+        return render_template("auth.html", view="register", step=1,
+                               error_message="Session expired — restart registration.")
+    # Require that the emailed OTP was actually verified in this session, so the
+    # account-creation step can't be reached by skipping verification.
+    if not session.get("reg_verified"):
+        return render_template("auth.html", view="register", step=1,
+                               error_message="Please verify your email code first.")
+    new_user = User(
+        email=session.get("reg_email"),
+        password_hash=session.get("reg_hash"),
+        first_name=first, last_name=last, phone=phone,
+    )
+    db.session.add(new_user)
+    db.session.commit()
+    log_audit_trail(new_user.email, "ACCOUNT CREATED")
+    session.clear()
+    return render_template("auth.html", view="register", step=4)
+
+
+def _gen_day_window():
+    """Calendar-day cap window (UTC): returns (midnight_today, resets_in_seconds)."""
+    now = datetime.utcnow()
+    since = datetime(now.year, now.month, now.day)
+    secs = int((since + timedelta(days=1) - now).total_seconds())
+    return since, max(0, secs)
+
+
+@app.post("/api/generate")
+@limiter.limit("30/minute")
+def api_generate():
+    # Server-side proxy to the model API. The builder (/app) is auth-gated, so
+    # this endpoint requires a session too: it keeps the API key server-side and
+    # blocks anonymous use of a paid endpoint. Streams (SSE) when the client sets
+    # {"stream": true}; otherwise returns the full JSON response.
+    if "user_id" not in session:
+        return {"error": "authentication required"}, 401
+    if not _is_admin(db.session.get(User, session["user_id"])):
+        return {"error": "demo_only",
+                "message": "This account is limited to Demo mode; live AI generation is disabled."}, 403
+    if not _LLM_KEY:
+        return {"error": "LLM key not configured on the server"}, 503
+    payload = request.get_json(force=True, silent=True) or {}
+    messages = payload.get("messages")
+    if not isinstance(messages, list) or not messages:
+        return {"error": "messages array is required"}, 400
+    # Per-user daily generation cap (cost guardrail). Counts accepted requests
+    # since 00:00 UTC today; configurable via DAILY_GEN_CAP (default 100).
+    _cap = int(os.environ.get("DAILY_GEN_CAP", "100"))
+    _since, _ = _gen_day_window()
+    _used = db.session.query(GenLog).filter(
+        GenLog.user_id == session["user_id"], GenLog.ts >= _since).count()
+    if _used >= _cap:
+        return {"error": "daily generation limit reached", "limit": _cap, "used": _used}, 429
+    db.session.add(GenLog(user_id=session["user_id"]))
+    db.session.commit()
+    log.info("generation user=%s used=%s/%s", session["user_id"], _used + 1, _cap)
+    want_stream = bool(payload.get("stream"))
+    body = {
+        # Model is PINNED server-side (P1-5) — the client "model" field is
+        # intentionally ignored. Change it via the LLM_MODEL env var only.
+        "model": LLM_MODEL,
+        "max_tokens": min(int(payload.get("max_tokens", LLM_DEFAULT_TOKENS)), LLM_MAX_TOKENS),
+        "messages": messages,
+        "stream": want_stream,
+    }
+    headers = {
+        "x-api-key": _LLM_KEY,
+        "anthropic-version": "2023-06-01",
+        "content-type": "application/json",
+    }
+    if not want_stream:
+        try:
+            r = requests.post("https://api.anthropic.com/v1/messages",
+                              headers=headers, json=body, timeout=120)
+            return Response(r.text, status=r.status_code, mimetype="application/json")
+        except requests.RequestException as e:
+            log.warning("LLM upstream error: %s", e)
+            return {"error": "upstream request failed"}, 502
+
+    def relay():
+        try:
+            with requests.post("https://api.anthropic.com/v1/messages",
+                               headers=headers, json=body, stream=True, timeout=300) as up:
+                for chunk in up.iter_content(chunk_size=None):
+                    if chunk:
+                        yield chunk
+        except requests.RequestException as e:
+            log.warning("LLM stream error: %s", e)
+            yield b'event: error\ndata: {"error":"upstream"}\n\n'
+
+    return Response(relay(), mimetype="text/event-stream",
+                    headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"})
+
+
+@app.get("/api/usage")
+def api_usage():
+    if "user_id" not in session:
+        return {"error": "authentication required"}, 401
+    cap = int(os.environ.get("DAILY_GEN_CAP", "100"))
+    since, resets_in = _gen_day_window()
+    used = db.session.query(GenLog).filter(
+        GenLog.user_id == session["user_id"], GenLog.ts >= since).count()
+    return {"used": used, "limit": cap, "remaining": max(0, cap - used),
+            "resets_in_seconds": resets_in}
+
+
+@app.post("/api/validate")
+@limiter.limit("20/minute")
+def api_validate():
+    # Real static IaC scan (checkov) on generated HCL. checkov parses the HCL
+    # only: no terraform init, no provider download, no code execution.
+    if "user_id" not in session:
+        return {"error": "authentication required"}, 401
+    payload = request.get_json(force=True, silent=True) or {}
+    hcl = payload.get("hcl", "")
+    if not isinstance(hcl, str) or not hcl.strip():
+        return {"error": "hcl required"}, 400
+    if len(hcl) > 200000:
+        return {"error": "hcl too large"}, 413
+    with tempfile.TemporaryDirectory() as d:
+        fp = os.path.join(d, "main.tf")
+        with open(fp, "w", encoding="utf-8") as f:
+            f.write(hcl)
+        try:
+            r = subprocess.run(
+                ["checkov", "-f", fp, "-o", "json", "--compact", "--quiet"],
+                capture_output=True, text=True, timeout=120, cwd=d)
+        except subprocess.TimeoutExpired:
+            return {"error": "validation timed out"}, 504
+        except FileNotFoundError:
+            return {"error": "validator not installed"}, 500
+        out = (r.stdout or "").strip()
+    try:
+        data = json.loads(out) if out else {}
+    except ValueError:
+        return {"error": "validator output unparseable"}, 500
+    if isinstance(data, list):
+        data = data[0] if data else {}
+    results = data.get("results") or {}
+    failed = results.get("failed_checks") or []
+    passed = results.get("passed_checks") or []
+    return {
+        "passed": len(passed),
+        "failed": len(failed),
+        "failures": [
+            {"id": c.get("check_id"), "name": c.get("check_name"),
+             "resource": c.get("resource")} for c in failed[:60]
+        ],
+    }
+
+
+@app.route("/app")
+def iac_app():
+    if "user_id" not in session:
+        return redirect(url_for("login"))
+    user = db.session.get(User, session["user_id"])
+    if user is None:
+        session.clear()
+        return redirect(url_for("login"))
+    return serve_iac_app(user)
+
+
+@app.route("/dashboard")
+def dashboard():
+    return redirect(url_for("iac_app"))
+
+
+@app.route("/settings", methods=["GET", "POST"])
+def settings():
+    if "user_id" not in session:
+        return redirect(url_for("home"))
+    user = db.session.get(User, session["user_id"])
+    if user is None:
+        session.clear()
+        return redirect(url_for("home"))
+    if request.method == "POST":
+        first = request.form.get("first_name", "").strip()
+        last  = request.form.get("last_name", "").strip()
+        phone = request.form.get("phone", "").strip()
+        if not all([first, last, phone]):
+            return render_template("auth.html", view="settings", user=user,
+                                   error_message="All fields are required.")
+        user.first_name, user.last_name, user.phone = first, last, phone
+        db.session.commit()
+        log_audit_trail(user.email, "PROFILE UPDATED")
+        return render_template("auth.html", view="settings", user=user,
+                               success_message="Profile saved.")
+    return render_template("auth.html", view="settings", user=user)
+
+
+@app.route("/logout", methods=["GET", "POST"])
+def logout():
+    # POST logs out; GET is harmless (browser back replay won't kill sessions).
+    if request.method == "POST":
+        session.clear()
+    return redirect(url_for("home"))
+
+
+@app.route("/start_recover")
+def start_recover():
+    return render_template("auth.html", view="recover", step=1)
+
+
+@app.route("/recover_lookup", methods=["POST"])
+@limiter.limit("5/minute")
+def recover_lookup():
+    email = request.form.get("email", "").strip()
+    user = User.query.filter_by(email=email).first()
+    # Uniform response whether or not the account exists, to avoid email
+    # enumeration. A real code is only issued + sent when the user exists.
+    if user:
+        session["recover_email"]    = email
+        session["recover_verified"] = False
+        send_otp_email(email, issue_otp(), subject="Password Reset Code")
+    else:
+        _clear_otp()
+        session.pop("recover_email", None)
+        session.pop("recover_verified", None)
+    return render_template("auth.html", view="recover", step=2,
+                           success_message="If that account exists, a reset code has been sent.")
+
+
+@app.route("/recover_verify", methods=["POST"])
+@limiter.limit("10/minute")
+def recover_verify():
+    ok, msg = verify_otp(request.form.get("otp"))
+    if ok:
+        session["recover_verified"] = True
+        return render_template("auth.html", view="recover", step=3,
+                               success_message="Identity verified. Set new password.")
+    return render_template("auth.html", view="recover", step=2,
+                           error_message=msg)
+
+
+@app.route("/recover_reset", methods=["POST"])
+def recover_reset():
+    # Require a verified OTP in THIS session before allowing a reset, so the
+    # reset step cannot be reached by skipping verification. Without this guard,
+    # anyone who can set recover_email (a plain POST to /recover_lookup) could
+    # POST here directly and change another account's password.
+    if not session.get("recover_verified"):
+        return render_template("auth.html", view="recover", step=1,
+                               error_message="Session expired — restart recovery.")
+    new_password = request.form.get("new_password")
+    ok, msg = check_password_strength(new_password)
+    if not ok:
+        return render_template("auth.html", view="recover", step=3,
+                               error_message=msg)
+    user = User.query.filter_by(email=session.get("recover_email")).first()
+    if user is None:
+        return render_template("auth.html", view="recover", step=1,
+                               error_message="Session expired — restart recovery.")
+    user.password_hash = generate_password_hash(new_password)
+    db.session.commit()
+    log_audit_trail(user.email, "PASSWORD RESET")
+    session.clear()
+    return render_template("auth.html", view="login",
+                           success_message="Password reset. Please log in.")
+
+
+# ----- Health check (for Container Apps probes / external monitors) --------
+
+@app.route("/healthz")
+@limiter.exempt
+def healthz():
+    # Note: this hits the DB by design — a healthy app must be able to query PG.
+    try:
+        db.session.execute(db.text("SELECT 1"))
+        return {"status": "ok"}, 200
+    except Exception as e:
+        log.error("Healthcheck failed: %s", e)
+        return {"status": "degraded", "detail": str(e)}, 503
+
+
+if __name__ == "__main__":
+    # Local dev only — production runs via Gunicorn (see Dockerfile).
+    app.run(host="0.0.0.0", port=8000, debug=False)
+
+
+# --- CSRF exemptions: the session-gated JSON proxy (the SameSite=Lax session
+# cookie already blocks cross-site POST) and logout (served from raw HTML that
+# carries no token). All HTML <form> POSTs remain CSRF-protected. ---
+for _ep in ("api_generate", "api_validate", "logout"):
+    _vf = app.view_functions.get(_ep)
+    if _vf is not None:
+        csrf.exempt(_vf)
diff --git a/iac-aistudio-update/conftest.py b/iac-aistudio-update/conftest.py
new file mode 100644
index 0000000..4c660a1
--- /dev/null
+++ b/iac-aistudio-update/conftest.py
@@ -0,0 +1,2 @@
+# Placed at the repo root so pytest prepends this directory to sys.path,
+# letting the tests under tests/ do `import app`.
diff --git a/iac-aistudio-update/deploy.ps1 b/iac-aistudio-update/deploy.ps1
new file mode 100644
index 0000000..e82a7e5
--- /dev/null
+++ b/iac-aistudio-update/deploy.ps1
@@ -0,0 +1,49 @@
+# deploy.ps1 — deploy IaC Build to Azure Container Apps from Windows / VS Code.
+# Builds the image in ACR (server-side — no local Docker needed) and rolls the
+# Container App, then prints revision health. Run from the repo root (the folder
+# with the Dockerfile):   .\deploy.ps1
+$ErrorActionPreference = "Stop"
+
+$RG     = "rg-iacb-lean"
+$APP    = "ca-iacb-web"
+$ACR    = "acriacblean"
+$IMAGE  = "iacb-web"
+$HEALTH = "https://iac-aistudio.com/healthz"
+
+Set-Location -Path $PSScriptRoot
+if (-not (Test-Path ".\Dockerfile")) { throw "No Dockerfile in $PWD - run this from the repo root." }
+
+# Make sure you're logged in.
+az account show -o table 2>$null | Out-Null
+if ($LASTEXITCODE -ne 0) { throw "Not logged in. Run 'az login' first." }
+
+# Capture current image for one-command rollback.
+$prev = az containerapp show -n $APP -g $RG --query "properties.template.containers[0].image" -o tsv
+Write-Host "Current image (rollback target): $prev" -ForegroundColor Cyan
+
+# Optional: if a build ever fails with 'manifest unknown' for the base image,
+# uncomment and run once to re-import it into ACR:
+# az acr import -n $ACR --source mirror.gcr.io/library/python:3.12-slim-bookworm --image python:3.12-slim-bookworm --force
+
+$tag  = Get-Date -Format "yyyyMMdd-HHmm"
+$full = "$ACR.azurecr.io/${IMAGE}:$tag"
+
+Write-Host "Building $full ..." -ForegroundColor Cyan
+az acr build --registry $ACR --image "${IMAGE}:$tag" .
+if ($LASTEXITCODE -ne 0) { throw "ACR build failed." }
+
+Write-Host "Rolling Container App to the new image ..." -ForegroundColor Cyan
+az containerapp update -n $APP -g $RG --image $full -o none
+if ($LASTEXITCODE -ne 0) { throw "Container App update failed." }
+
+Write-Host "Active revisions:" -ForegroundColor Cyan
+az containerapp revision list -n $APP -g $RG `
+  --query "[?properties.active].{rev:name,running:properties.runningState,health:properties.healthState,traffic:properties.trafficWeight}" -o table
+
+Write-Host "Health check:" -ForegroundColor Cyan
+try { (Invoke-WebRequest -UseBasicParsing $HEALTH).Content }
+catch { Write-Host "  (not ready yet - re-check revision health in a moment)" -ForegroundColor Yellow }
+
+Write-Host ""
+Write-Host "Deployed tag: $tag" -ForegroundColor Green
+Write-Host "Rollback:  az containerapp update -n $APP -g $RG --image `"$prev`""
diff --git a/iac-aistudio-update/deploy.sh b/iac-aistudio-update/deploy.sh
new file mode 100644
index 0000000..7bf3a54
--- /dev/null
+++ b/iac-aistudio-update/deploy.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Deploy the IaC Build app to Azure Container Apps from your workstation.
+# Builds the image in ACR (server-side — no local Docker needed) and rolls the
+# Container App to it, then prints revision health. Run from the repo root
+# (the folder containing the Dockerfile):  ./deploy.sh
+set -euo pipefail
+
+RG=rg-iacb-lean
+APP=ca-iacb-web
+ACR=acriacblean
+IMAGE=iacb-web
+HEALTH_URL=https://iac-aistudio.com/healthz
+
+cd "$(dirname "$0")"
+
+# Sanity: must be run where the Dockerfile lives.
+[ -f Dockerfile ] || { echo "ERROR: no Dockerfile here ($(pwd))."; exit 1; }
+
+# Make sure you're logged in / on the right subscription.
+az account show -o table >/dev/null 2>&1 || { echo "Run 'az login' first."; exit 1; }
+
+# Capture the current image so rollback is one command.
+PREV=$(az containerapp show -n "$APP" -g "$RG" \
+  --query "properties.template.containers[0].image" -o tsv)
+echo "Current image (rollback target): $PREV"
+
+# Optional: ensure the base image exists in ACR (uncomment if a build ever
+# fails with 'manifest unknown' for python:3.12-slim-bookworm):
+# az acr import -n "$ACR" --source mirror.gcr.io/library/python:3.12-slim-bookworm \
+#   --image python:3.12-slim-bookworm --force
+
+TAG=$(date +%Y%m%d-%H%M)
+echo "Building $ACR.azurecr.io/$IMAGE:$TAG ..."
+az acr build --registry "$ACR" --image "$IMAGE:$TAG" .
+
+echo "Rolling Container App to the new image ..."
+az containerapp update -n "$APP" -g "$RG" \
+  --image "$ACR.azurecr.io/$IMAGE:$TAG" -o none
+
+echo "Active revisions:"
+az containerapp revision list -n "$APP" -g "$RG" \
+  --query "[?properties.active].{rev:name,running:properties.runningState,health:properties.healthState,traffic:properties.trafficWeight}" \
+  -o table
+
+echo "Health check:"
+curl -fsS "$HEALTH_URL" && echo || echo "  (not ready yet — re-check revision health in a moment)"
+
+echo
+echo "Deployed tag: $TAG"
+echo "Rollback if needed:  az containerapp update -n $APP -g $RG --image \"$PREV\""
diff --git a/iac-aistudio-update/github-actions-security-tests.yml b/iac-aistudio-update/github-actions-security-tests.yml
new file mode 100644
index 0000000..131af2c
--- /dev/null
+++ b/iac-aistudio-update/github-actions-security-tests.yml
@@ -0,0 +1,25 @@
+# GitHub Actions — runs the security regression tests on every push / PR.
+# Place this at .github/workflows/security-tests.yml in the iac-build repo.
+# No secrets needed: tests run in LOCAL_DEV mode (SQLite, dummy secret) in a
+# clean cloud Python, so your broken local Python is irrelevant.
+name: security-tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      LOCAL_DEV: "1"
+      FLASK_SECRET_KEY: ci-test-secret
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install test dependencies
+        run: pip install --no-cache-dir -r requirements-dev.txt
+      - name: Run security tests
+        run: pytest -v
diff --git a/iac-aistudio-update/requirements-dev.txt b/iac-aistudio-update/requirements-dev.txt
new file mode 100644
index 0000000..a58cc8a
--- /dev/null
+++ b/iac-aistudio-update/requirements-dev.txt
@@ -0,0 +1,15 @@
+# Minimal deps to import app.py in LOCAL_DEV mode and run the security tests.
+# (The Azure/checkov/resend/OpenTelemetry packages in requirements.txt are not
+# imported in LOCAL_DEV, so the test job stays fast.) Versions match
+# requirements.txt where they overlap.
+Flask==3.0.3
+Werkzeug==3.0.4
+Flask-WTF==1.3.0
+Flask-Compress==1.24
+Flask-SQLAlchemy==3.1.1
+SQLAlchemy==2.0.36
+Flask-Session==0.8.0
+Flask-Limiter==3.8.0
+Authlib==1.3.2
+requests==2.32.3
+pytest==8.3.2
diff --git a/iac-aistudio-update/requirements.txt b/iac-aistudio-update/requirements.txt
new file mode 100644
index 0000000..d9d118c
--- /dev/null
+++ b/iac-aistudio-update/requirements.txt
@@ -0,0 +1,30 @@
+# --- Web framework ---
+Flask==3.0.3
+gunicorn==23.0.0
+Werkzeug==3.0.4
+requests==2.32.3
+Flask-WTF==1.3.0
+checkov==3.3.1
+Flask-Compress==1.24
+
+# --- DB & sessions ---
+Flask-SQLAlchemy==3.1.1
+SQLAlchemy==2.0.36
+Flask-Session==0.8.0
+# psycopg v3 (NOT psycopg2). Binary build for portability inside slim images.
+psycopg[binary]==3.2.3
+
+# --- Rate limiting ---
+Flask-Limiter==3.8.0
+
+# --- OAuth social login (Google + GitHub) ---
+Authlib==1.3.2
+
+# --- Azure SDKs (managed identity, Key Vault) ---
+azure-identity==1.19.0
+azure-keyvault-secrets==4.9.0
+
+# --- Application Insights (auto-instruments Flask, requests, logging, SQLAlchemy) ---
+# Pulls in opentelemetry-* and OTLP exporter for Azure Monitor. Pure Python deps.
+azure-monitor-opentelemetry==1.6.4
+resend==2.6.0
diff --git a/iac-aistudio-update/tests/test_security.py b/iac-aistudio-update/tests/test_security.py
new file mode 100644
index 0000000..fe26ff5
--- /dev/null
+++ b/iac-aistudio-update/tests/test_security.py
@@ -0,0 +1,119 @@
+"""
+Security regression tests for the IaC Build app (the 2026-06 hardening pass).
+
+Run from the app bundle root (where app.py and templates/ live), with the
+runtime deps installed and LOCAL_DEV on:
+
+    pip install -r requirements-dev.txt
+    LOCAL_DEV=1 FLASK_SECRET_KEY=test-secret pytest -v
+
+These cover the changes made in this update:
+  - OTP: 6-digit, single-use, expiry, lockout            (P0-1)
+  - Password reset cannot proceed without a verified OTP (takeover fix)
+  - /api/generate ignores the client-supplied "model"    (P1-5 pin)
+"""
+import os
+
+os.environ["LOCAL_DEV"] = "1"
+os.environ.setdefault("FLASK_SECRET_KEY", "test-secret-key-for-ci")
+
+import time  # noqa: E402
+import app as appmod  # noqa: E402
+
+app = appmod.app
+app.config.update(TESTING=True, WTF_CSRF_ENABLED=False)
+
+
+# ----- OTP ------------------------------------------------------------------
+
+def test_otp_is_six_digits_and_single_use():
+    with app.test_request_context():
+        code = appmod.issue_otp()
+        assert len(code) == 6 and code.isdigit()
+        ok, _ = appmod.verify_otp(code)
+        assert ok is True
+        # Code is consumed on success — a replay must fail.
+        ok2, _ = appmod.verify_otp(code)
+        assert ok2 is False
+
+
+def test_otp_wrong_code_rejected():
+    with app.test_request_context():
+        code = appmod.issue_otp()
+        wrong = "000000" if code != "000000" else "111111"
+        ok, _ = appmod.verify_otp(wrong)
+        assert ok is False
+
+
+def test_otp_expires():
+    with app.test_request_context() as ctx:
+        code = appmod.issue_otp()
+        ctx.session["otp_ts"] = 0  # issued at the epoch -> long expired
+        ok, msg = appmod.verify_otp(code)
+        assert ok is False and "expired" in msg.lower()
+
+
+def test_otp_locks_out_after_max_attempts():
+    with app.test_request_context():
+        code = appmod.issue_otp()
+        wrong = "000000" if code != "000000" else "111111"
+        for _ in range(appmod.OTP_MAX_ATTEMPTS):
+            appmod.verify_otp(wrong)
+        # Next attempt — even with the RIGHT code — is locked out.
+        ok, msg = appmod.verify_otp(code)
+        assert ok is False and "request a new" in msg.lower()
+
+
+# ----- Password-reset authorization ----------------------------------------
+
+def test_recover_reset_blocked_without_verified_otp():
+    client = app.test_client()
+    # Simulate an attacker who set recover_email (a plain POST to
+    # /recover_lookup) but never verified an OTP.
+    with client.session_transaction() as s:
+        s["recover_email"] = "victim@example.com"
+        # deliberately NO recover_verified
+    resp = client.post("/recover_reset", data={"new_password": "NewPassw0rd1"})
+    body = resp.get_data(as_text=True).lower()
+    # The reset must NOT have happened.
+    assert "password reset. please log in" not in body
+
+
+# ----- /api/generate model pin (P1-5) ---------------------------------------
+
+def test_api_generate_pins_model(monkeypatch):
+    client = app.test_client()
+    appmod._LLM_KEY = "test-key"
+    appmod.ADMIN_EMAILS = {"admin@example.com"}
+
+    with app.app_context():
+        u = appmod.User(email="admin@example.com", password_hash="x",
+                        first_name="A", last_name="B", phone="")
+        appmod.db.session.add(u)
+        appmod.db.session.commit()
+        uid = u.id
+
+    captured = {}
+
+    class _Resp:
+        text = '{"ok": true}'
+        status_code = 200
+
+    def fake_post(*args, **kwargs):
+        captured["body"] = kwargs.get("json")
+        return _Resp()
+
+    monkeypatch.setattr(appmod.requests, "post", fake_post)
+
+    with client.session_transaction() as s:
+        s["user_id"] = uid
+        s["sv"] = appmod.SESSION_VERSION
+        s["la"] = time.time()
+
+    client.post("/api/generate", json={
+        "model": "claude-please-bill-me-more",   # should be ignored
+        "messages": [{"role": "user", "content": "hi"}],
+    })
+
+    assert captured["body"]["model"] == appmod.LLM_MODEL
+    assert captured["body"]["model"] != "claude-please-bill-me-more"
diff --git a/terraform-translator/.gitignore b/terraform-translator/.gitignore
new file mode 100644
index 0000000..b26f40d
--- /dev/null
+++ b/terraform-translator/.gitignore
@@ -0,0 +1,10 @@
+__pycache__/
+*.pyc
+.venv/
+.env
+
+# Terraform / CI artifacts
+tf-check/
+.terraform/
+*.tfstate
+*.tfstate.*
diff --git a/terraform-translator/README.md b/terraform-translator/README.md
new file mode 100644
index 0000000..d2f23c1
--- /dev/null
+++ b/terraform-translator/README.md
@@ -0,0 +1,108 @@
+# Plain Language → Azure Terraform
+
+A small AI-powered app that turns a plain-English description of Azure
+infrastructure into [Terraform](https://www.terraform.io/) (HCL) using the
+official `azurerm` provider. It is powered by Anthropic's Claude (Opus 4.8).
+
+You can use it two ways:
+
+- **Web app** — a single-page UI (Flask)
+- **CLI** — pipe a description in and get `main.tf` on stdout
+
+> ⚠️ The generated Terraform is a starting point. Always review it (and run
+> `terraform validate` / `terraform plan`) before applying to a real subscription.
+
+## Setup
+
+```bash
+cd terraform-translator
+python -m venv .venv && source .venv/bin/activate
+pip install -r requirements.txt
+export ANTHROPIC_API_KEY=sk-ant-...   # your Anthropic API key
+```
+
+## Web app
+
+```bash
+python app.py
+# open http://127.0.0.1:5000
+```
+
+Type something like:
+
+> A Linux web app on a B1 plan with a PostgreSQL flexible server, both in West Europe
+
+…and click **Generate Terraform**. Use the **Copy** button to grab the HCL.
+
+## CLI
+
+```bash
+python cli.py "a storage account with a private blob container"
+
+# or read the description from stdin
+echo "an AKS cluster with 3 nodes and a container registry" | python cli.py
+```
+
+## Testing
+
+There are two levels.
+
+**Offline tests (no API key, no network).** These inject a fake client that
+mimics the SDK, so they verify the parsing/error logic anywhere:
+
+```bash
+python -m unittest discover -s tests -v   # or: pytest
+```
+
+**Real end-to-end check (needs `ANTHROPIC_API_KEY`).** After `pip install -r
+requirements.txt` and setting the key:
+
+```bash
+# CLI
+python cli.py "a resource group named demo-rg in West Europe"
+
+# Web app — start it, then send a request
+python app.py &
+curl -s localhost:5000/api/translate \
+  -H 'Content-Type: application/json' \
+  -d '{"prompt":"a storage account with a private blob container"}'
+```
+
+Then run `terraform fmt -check` / `terraform validate` on the output to confirm
+it's syntactically valid HCL.
+
+### Continuous integration
+
+`.github/workflows/terraform-translator.yml` runs on every push/PR that touches
+this directory:
+
+- **`offline-tests`** — always runs, no secrets required.
+- **`live-check`** — runs only if an `ANTHROPIC_API_KEY` repository secret is
+  set (Settings → Secrets and variables → Actions). It generates Terraform via
+  the CLI and validates it with `terraform fmt`/`init`/`validate`. Without the
+  secret it is skipped, not failed.
+
+## How it works
+
+`translator.py` sends your description to Claude with a system prompt that makes
+it act as an Azure + Terraform expert. It uses:
+
+- **Model:** `claude-opus-4-8`
+- **Streaming** via `client.messages.stream(...)` so long outputs don't hit the
+  SDK's HTTP timeout (the final message is read with `get_final_message()`).
+- **Adaptive thinking** (`thinking={"type": "adaptive"}`) so the model can reason
+  about which Azure resources to use before emitting code.
+- **`effort: "high"`** for better code quality.
+
+The model is instructed to return only HCL; any surrounding Markdown code fence
+is stripped before display.
+
+## Files
+
+| File                   | Purpose                                          |
+| ---------------------- | ------------------------------------------------ |
+| `translator.py`        | Core logic — calls the Anthropic API             |
+| `app.py`               | Flask web server (`/` and `/api/translate`)      |
+| `cli.py`               | Command-line entry point                         |
+| `templates/index.html` | Web UI                                            |
+| `requirements.txt`     | Python dependencies                              |
diff --git a/terraform-translator/app.py b/terraform-translator/app.py
new file mode 100644
index 0000000..8d5ad7c
--- /dev/null
+++ b/terraform-translator/app.py
@@ -0,0 +1,38 @@
+"""Minimal Flask web app for translating plain language into Azure Terraform.
+
+Run locally:
+    export ANTHROPIC_API_KEY=sk-ant-...
+    pip install -r requirements.txt
+    python app.py
+    # open http://127.0.0.1:5000
+"""
+
+from __future__ import annotations
+
+from flask import Flask, jsonify, render_template, request
+
+from translator import TranslationError, translate
+
+app = Flask(__name__)
+
+
+@app.get("/")
+def index():
+    return render_template("index.html")
+
+
+@app.post("/api/translate")
+def api_translate():
+    data = request.get_json(silent=True) or {}
+    prompt = data.get("prompt", "")
+    try:
+        terraform = translate(prompt)
+    except TranslationError as exc:
+        return jsonify(error=str(exc)), 400
+    except Exception as exc:  # surface unexpected SDK/network errors to the UI
+        return jsonify(error=f"Unexpected error: {exc}"), 500
+    return jsonify(terraform=terraform)
+
+
+if __name__ == "__main__":
+    app.run(debug=True)
diff --git a/terraform-translator/cli.py b/terraform-translator/cli.py
new file mode 100644
index 0000000..8e4afb9
--- /dev/null
+++ b/terraform-translator/cli.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+"""Command-line interface for the plain-language -> Azure Terraform translator.
+
+Usage:
+    python cli.py "a linux web app with a postgres flexible server database"
+    echo "a storage account with a private blob container" | python cli.py
+
+Requires the ANTHROPIC_API_KEY environment variable to be set.
+"""
+
+from __future__ import annotations
+
+import sys
+
+from translator import TranslationError, translate
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) > 1:
+        prompt = " ".join(argv[1:])
+    elif not sys.stdin.isatty():
+        prompt = sys.stdin.read()
+    else:
+        print(__doc__.strip(), file=sys.stderr)
+        return 2
+
+    try:
+        print(translate(prompt))
+    except TranslationError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))
diff --git a/terraform-translator/requirements.txt b/terraform-translator/requirements.txt
new file mode 100644
index 0000000..83e656f
--- /dev/null
+++ b/terraform-translator/requirements.txt
@@ -0,0 +1,2 @@
+anthropic>=0.69.0
+flask>=3.0.0
diff --git a/terraform-translator/templates/index.html b/terraform-translator/templates/index.html
new file mode 100644
index 0000000..bdec33b
--- /dev/null
+++ b/terraform-translator/templates/index.html
@@ -0,0 +1,114 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Plain Language → Azure Terraform</title>
+  <style>
+    :root { color-scheme: light dark; }
+    * { box-sizing: border-box; }
+    body {
+      font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+      max-width: 880px; margin: 0 auto; padding: 2rem 1.25rem; line-height: 1.5;
+    }
+    h1 { font-size: 1.6rem; margin-bottom: 0.25rem; }
+    p.sub { margin-top: 0; color: #6b7280; }
+    textarea {
+      width: 100%; min-height: 120px; padding: 0.75rem; font-size: 1rem;
+      border: 1px solid #cbd5e1; border-radius: 8px; resize: vertical;
+      font-family: inherit;
+    }
+    .row { display: flex; gap: 0.75rem; align-items: center; margin: 0.75rem 0; }
+    button {
+      background: #2563eb; color: #fff; border: 0; border-radius: 8px;
+      padding: 0.6rem 1.1rem; font-size: 1rem; cursor: pointer;
+    }
+    button:disabled { opacity: 0.6; cursor: progress; }
+    .examples { font-size: 0.85rem; color: #6b7280; }
+    .examples button {
+      background: transparent; color: #2563eb; border: 1px solid #cbd5e1;
+      padding: 0.25rem 0.6rem; font-size: 0.8rem; border-radius: 999px; margin: 0.15rem;
+    }
+    pre {
+      background: #0f172a; color: #e2e8f0; padding: 1rem; border-radius: 8px;
+      overflow-x: auto; font-size: 0.85rem; line-height: 1.45;
+    }
+    .error { color: #b91c1c; font-weight: 600; }
+    .toolbar { display: flex; justify-content: space-between; align-items: center; }
+    .copy { background: #334155; }
+  </style>
+</head>
+<body>
+  <h1>Plain Language → Azure Terraform</h1>
+  <p class="sub">Describe the Azure infrastructure you want and get Terraform (HCL) using the <code>azurerm</code> provider.</p>
+
+  <textarea id="prompt" placeholder="e.g. A Linux web app on a B1 plan with a PostgreSQL flexible server, both in West Europe"></textarea>
+
+  <div class="examples">
+    Try:
+    <button class="ex">A storage account with a private blob container</button>
+    <button class="ex">An AKS cluster with 3 nodes and a container registry</button>
+    <button class="ex">A virtual network with two subnets and a network security group</button>
+  </div>
+
+  <div class="row">
+    <button id="go">Generate Terraform</button>
+    <span id="status"></span>
+  </div>
+
+  <div id="result" hidden>
+    <div class="toolbar">
+      <strong>Generated <code>main.tf</code></strong>
+      <button class="copy" id="copy">Copy</button>
+    </div>
+    <pre><code id="code"></code></pre>
+  </div>
+
+  <script>
+    const $ = (id) => document.getElementById(id);
+    const promptEl = $("prompt"), goEl = $("go"), statusEl = $("status");
+    const resultEl = $("result"), codeEl = $("code");
+
+    document.querySelectorAll(".ex").forEach((b) =>
+      b.addEventListener("click", () => { promptEl.value = b.textContent; promptEl.focus(); })
+    );
+
+    $("copy").addEventListener("click", async () => {
+      await navigator.clipboard.writeText(codeEl.textContent);
+      $("copy").textContent = "Copied!";
+      setTimeout(() => ($("copy").textContent = "Copy"), 1500);
+    });
+
+    async function generate() {
+      const prompt = promptEl.value.trim();
+      if (!prompt) { promptEl.focus(); return; }
+      goEl.disabled = true;
+      statusEl.textContent = "Generating… (this can take a moment)";
+      resultEl.hidden = true;
+      statusEl.classList.remove("error");
+      try {
+        const res = await fetch("/api/translate", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ prompt }),
+        });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || "Request failed");
+        codeEl.textContent = data.terraform;
+        resultEl.hidden = false;
+        statusEl.textContent = "";
+      } catch (err) {
+        statusEl.textContent = err.message;
+        statusEl.classList.add("error");
+      } finally {
+        goEl.disabled = false;
+      }
+    }
+
+    goEl.addEventListener("click", generate);
+    promptEl.addEventListener("keydown", (e) => {
+      if ((e.metaKey || e.ctrlKey) && e.key === "Enter") generate();
+    });
+  </script>
+</body>
+</html>
diff --git a/terraform-translator/tests/test_translator.py b/terraform-translator/tests/test_translator.py
new file mode 100644
index 0000000..795fb30
--- /dev/null
+++ b/terraform-translator/tests/test_translator.py
@@ -0,0 +1,75 @@
+"""Offline tests for translator.py.
+
+These run without an ANTHROPIC_API_KEY and without the `anthropic` package,
+by injecting a fake client that mimics the SDK's streaming surface.
+
+    python -m unittest discover -s tests        # or: pytest
+"""
+
+import os
+import sys
+import unittest
+from types import SimpleNamespace
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from translator import TranslationError, _strip_code_fences, translate
+
+
+class _FakeStream:
+    """Stands in for the context manager returned by client.messages.stream(...)."""
+
+    def __init__(self, message):
+        self._message = message
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+    def get_final_message(self):
+        return self._message
+
+
+class _FakeClient:
+    """Minimal fake exposing client.messages.stream(...)."""
+
+    def __init__(self, text, stop_reason="end_turn"):
+        message = SimpleNamespace(
+            stop_reason=stop_reason,
+            content=[SimpleNamespace(type="text", text=text)],
+        )
+        self.messages = SimpleNamespace(stream=lambda **kwargs: _FakeStream(message))
+
+
+class StripFenceTests(unittest.TestCase):
+    def test_hcl_fence(self):
+        self.assertEqual(_strip_code_fences('```hcl\nresource "x" "y" {}\n```'),
+                         'resource "x" "y" {}')
+
+    def test_bare_fence(self):
+        self.assertEqual(_strip_code_fences("```\nfoo\n```"), "foo")
+
+    def test_no_fence(self):
+        self.assertEqual(_strip_code_fences("  plain  "), "plain")
+
+
+class TranslateTests(unittest.TestCase):
+    def test_returns_code_and_strips_fence(self):
+        client = _FakeClient('```hcl\nprovider "azurerm" {\n  features {}\n}\n```')
+        out = translate("a resource group", client=client)
+        self.assertEqual(out, 'provider "azurerm" {\n  features {}\n}')
+
+    def test_empty_prompt_raises(self):
+        with self.assertRaises(TranslationError):
+            translate("   ", client=_FakeClient("ignored"))
+
+    def test_refusal_raises(self):
+        client = _FakeClient("", stop_reason="refusal")
+        with self.assertRaises(TranslationError):
+            translate("something", client=client)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/terraform-translator/translator.py b/terraform-translator/translator.py
new file mode 100644
index 0000000..783fd11
--- /dev/null
+++ b/terraform-translator/translator.py
@@ -0,0 +1,92 @@
+"""Core translation logic: plain language -> Azure Terraform (HCL).
+
+Uses the Anthropic Python SDK with Claude Opus 4.8. Streaming is used so that
+long generations don't hit the SDK's HTTP timeout, and adaptive thinking lets
+the model reason about the right Azure resources before emitting code.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:  # only needed for type checkers, not at runtime
+    from anthropic import Anthropic
+
+MODEL = "claude-opus-4-8"
+
+SYSTEM_PROMPT = """\
+You are an expert cloud infrastructure engineer specializing in Microsoft Azure \
+and Terraform (HCL). Convert the user's plain-language infrastructure \
+description into production-quality Terraform configuration using the official \
+`azurerm` provider.
+
+Guidelines:
+- Output valid, well-formatted HCL.
+- Include a `terraform` block that pins a recent `azurerm` provider version, and \
+a `provider "azurerm"` block with `features {}`.
+- Create a resource group unless the user explicitly says to use an existing one.
+- Use descriptive, Azure-valid resource names and locations.
+- Parameterize key values with `variable` blocks (with sensible defaults) and \
+expose useful values (IDs, endpoints, connection info) via `output` blocks.
+- Apply Azure + Terraform best practices: tags, secure defaults, least-privilege.
+- Add concise `#` comments explaining non-obvious choices.
+- If the request is ambiguous, pick reasonable defaults and note them in comments.
+
+Return ONLY the Terraform code. Do not add any explanation before or after it."""
+
+
+class TranslationError(RuntimeError):
+    """Raised when the model cannot produce Terraform for the request."""
+
+
+def _strip_code_fences(text: str) -> str:
+    """Remove a surrounding ```hcl ... ``` (or ```) fence if the model added one."""
+    fenced = re.match(r"^\s*```[a-zA-Z]*\n(.*?)\n```\s*$", text, re.DOTALL)
+    if fenced:
+        return fenced.group(1).strip()
+    return text.strip()
+
+
+def translate(prompt: str, *, client: Anthropic | None = None) -> str:
+    """Translate a plain-language description into Azure Terraform HCL.
+
+    Args:
+        prompt: Natural-language description of the desired Azure infrastructure.
+        client: Optional pre-configured Anthropic client. If omitted, a default
+            client is created (reads ANTHROPIC_API_KEY from the environment).
+
+    Returns:
+        The generated Terraform configuration as a string.
+    """
+    prompt = (prompt or "").strip()
+    if not prompt:
+        raise TranslationError("Please describe the infrastructure you want.")
+
+    if client is None:
+        from anthropic import Anthropic  # imported lazily so tests can inject a fake
+
+        client = Anthropic()
+
+    with client.messages.stream(
+        model=MODEL,
+        max_tokens=64000,
+        thinking={"type": "adaptive"},
+        output_config={"effort": "high"},
+        system=SYSTEM_PROMPT,
+        messages=[{"role": "user", "content": prompt}],
+    ) as stream:
+        message = stream.get_final_message()
+
+    if message.stop_reason == "refusal":
+        raise TranslationError(
+            "The request was declined by the model's safety system."
+        )
+
+    text = "".join(
+        block.text for block in message.content if block.type == "text"
+    )
+    code = _strip_code_fences(text)
+    if not code:
+        raise TranslationError("The model did not return any Terraform code.")
+    return code