## Description

Add initial module-owned metadata directly to this repository, allow
metadata review by either engineering owners or module owners, and keep
metadata-only changes out of automatic publishing workflows.

- Add **572 `metadata.json` files: 222 roots and 350 children**. All 573
`main.bicep` directories were inventoried; the unpublished internal
`avm/ptn/ai-ml/ai-foundry/modules/project` helper is excluded.
- Root `owners` is a **flat string array**. Preserve all **281 username
entries**, their order/casing, and every MEMBER/MAINTAINER handle
incorporated from the supplied 2026-09-10 snapshot and official indexes.
Thirteen roots have more than two owners; nine genuinely missing owner
lists remain `owners: []`. No deleted legacy team or replacement owner
is invented.
- Authored metadata contains **no `schemaVersion` or `tier`**. The
versioned `$schema` URL remains unchanged. Children do not author
owners. Bicep deprecation is derived from existing `DEPRECATED.md`; no
lifecycle field or deprecation/source edit is introduced here.
- End `.github/CODEOWNERS` with exactly `metadata.json
@Azure/azure-verified-modules-engineering-owners
@Azure/azure-verified-modules-module-owners`, after every module/tooling
rule. **Approval from either team qualifies; approval from both is not
required.** Other ownership remains unchanged.
- Append `!avm/**/metadata.json` to all **217** current per-module
resource, pattern, and utility publishing workflows. Generic
validation/tag-preview remains eligible for metadata changes. Manual
release/approval controls and both existing `main.json`/`version.json`
release selectors remain unchanged.
- Cover root/nested/unindexed ownership, final precedence,
metadata-only/mixed/source/version changes, child release selection, and
explicit manual releases with offline regressions.

### Approved metadata reviewer policy

Commit **2fe528df6fe20f849fb79055589677098357680c** implements the
user-approved two-team OR policy. It changes only `.github/CODEOWNERS`,
the module governance assertion, and the focused ownership tests. The
final basename rule covers root, child, deep, utility, pattern,
resource, and unindexed metadata paths. Tests reject missing approved
teams, an unapproved third team/person, narrowed coverage, and shadowing
rules.

All **572 metadata files**, source/deprecation files, workflow filters,
release selectors, and manual controls are unchanged from the approved
shape below. No GitHub access or review settings are changed.

### Approved authored-shape update

Commit **7f3502d7fb3cb9aa4e6e37911b494205b9619230** changes only the 572
metadata files: remove `schemaVersion`, remove root `tier`, and replace
root owner objects with ordered string arrays. Any nonempty qualified
team would be retained as an array entry; this backfill had none.

Compared with baseline `7fe0438eff8b2b9f4595ec39254c2e2a3213e6e7`,
native JSON checks verify that **every unaffected raw field value is
identical**, including `$schema`, names, descriptions, canonical types,
telemetry, aliases, and comments. All owner strings and their order are
preserved. Nine empty owner arrays and fourteen approved
unpublished-child telemetry omissions are retained. All 572 files pass
the ready shared schema and current source-literal validation.

No source, compiled template, version, workflow, governance,
deprecation, or test file changed in this shape-update commit. Its
actual staged and committed diffs both select **zero module release
templates**.

### Main integration and readiness

Merged `origin/main` **dfa9bab2c46e97b018b0d7b987537f738f6c0ef5** into
this published branch without rebasing or force-pushing, in merge commit
**7fe0438eff8b2b9f4595ec39254c2e2a3213e6e7**.

That merge includes
[#7351](#7351), BAMI
canary validation-variable selection, and
[#7348](#7348), the
PostgreSQL configuration update. BAMI changes validation
tenant/subscription bindings, not workflow inventory or release
selection. Its selected-BAMI checks, legacy behavior for unselected
modules, and credential isolation remain unchanged.

A subsequent read-only compatibility check of main through
**f1f4ba28698437d9a683d68bf181341ad3547e48** found two newer commits
affecting 18 root modules. Their names, descriptions, telemetry
identifiers, canonical types, and all release/governance assumptions
remain compatible with this metadata. Those newer main commits were
**not merged** during the metadata-shape or reviewer-policy updates. Any
required final integration/revalidation remains an explicit rollout
gate; checks on this branch do not claim to cover an unmerged combined
tree.

The review's module changes remain metadata additions only. No extra
`main.bicep`, `main.json`, `version.json`, module README, changelog,
runtime backfill workflow, approval files, reviewed flags, live settings
changes, workflow dispatches, or remote merges are introduced.

### Telemetry and existing data

Fourteen uninstrumented, unpublished resource children intentionally
omit `telemetryIdPrefix`. Each lacks a version file,
publishing-allowlist entry, index entry, and telemetry resource.
[BCPFR4](https://azure.github.io/Azure-Verified-Modules/spec/BCPFR4)
requires top-level telemetry but exempts nested children unless enabled
for direct publishing. Their parents emit telemetry;
[BCPFR7](https://azure.github.io/Azure-Verified-Modules/spec/BCPFR7)
also requires resource parents to disable telemetry on referenced
published modules. Redis child publishing was explicitly rolled back for
upcoming service deprecation in
[#7096](#7096).

The backfill preserves these **pre-existing issues for separate
source/release follow-up**:

- Budget `rg-scope` and `sub-scope` currently emit
`46d3xbcp.res.consumption-budget_mgscope`. Metadata records the actual
source value, not the differing CSV values.
- Resource Graph query currently emits `46d3xbcp.resourcegraph-query`,
without `.res.`. Metadata preserves this exact, narrowly supported
legacy identifier.
- The existing compiled
`avm/ptn/sa/conversation-knowledge-mining/main.json` lacks metadata
name/description fields. Its new metadata matches current Bicep
literals; compiled output is left untouched by this change.

Metadata-only edits, including `telemetryIdPrefix`, do not publish.
Publishing an output-affecting metadata change still requires a normal
source change with generated `main.json`, or a `version.json` release
change.

### Enforcement and coordinated rollout

Active default-branch ruleset **23285568 still has
`require_code_owner_review=true` and one required approving review**,
with no separate required-reviewer list. Both approved teams are visible
and have existing write access. GitHub treats multiple owners on the
same CODEOWNERS line as alternatives, so either team's approval
satisfies this metadata ownership requirement, not both. Existing
authorized AVM App bypass settings are untouched; actor details were not
exposed by the read credential and remain an operator-verification
prerequisite. CODEOWNERS enforcement uses the adopted base-branch rule.
Previously reported unrelated owner-access warnings are not changed by
this policy update.

Follow the [coordinated rollout
plan](https://github.com/Azure/azure-verified-modules-tools/blob/jaredfholgate-module-metadata-implementation/docs/metadata-rollout.md):
operator-approved Bicep Sync pause before the metadata tools merge, and
resume only after repository and generated governance agree on the exact
two-team rule and the operator approves scheduled applies.

- **Sole active tools dependency:**
[Azure/azure-verified-modules-tools#113](Azure/azure-verified-modules-tools#113)
at **db2cf27af7befc4bf1e8dc271f2da084489c62df** consolidates the shared
schema, authoring, catalog, and generated CODEOWNERS policy. Its exact
final two-team rule matches this registry head
`2fe528df6fe20f849fb79055589677098357680c`. The updated v1 schema must
be available before consumers validate the flat authored shape against
its public URL.
- **Final tools CI confirmed on that exact head:** [CI run
35123274927](https://github.com/Azure/azure-verified-modules-tools/actions/runs/35123274927)
passed all **11 jobs**, including three operating-system builds and six
integration legs. [Configuration
validation](https://github.com/Azure/azure-verified-modules-tools/actions/runs/35123274975)
passed both jobs, and
[CodeQL](https://github.com/Azure/azure-verified-modules-tools/actions/runs/35123270783)
passed. All **17 reported current-head checks are successful**. The
tools review remains OPEN/MERGEABLE, but GitHub reports BLOCKED for an
unverified policy reason; successful CI does not establish that every
merge or rollout gate is satisfied.
- Historical policy work
[Azure/azure-verified-modules-tools#120](Azure/azure-verified-modules-tools#120)
is **CLOSED as superseded, not merged**, after its full history was
consolidated into the tools implementation. Its branch is retained and
it is no longer a separate merge dependency. The generator repair
[Azure/azure-verified-modules-tools#119](Azure/azure-verified-modules-tools#119)
is merged.
- Public workflow template/contribution guidance:
[Azure/Azure-Verified-Modules#2929](Azure/Azure-Verified-Modules#2929)
is merged. Public process documentation remains a separate draft in
[Azure/Azure-Verified-Modules#2936](Azure/Azure-Verified-Modules#2936)
at `5ff656df746a0a3e1c213438cc56621959f55cec`.

## Pipeline Reference

<!-- Insert your Pipeline Status Badge below -->

| Validation | Result |
| --- | --- |
| Current reviewer policy: ownership and release regression suites |
**355 passed**, zero failures/skips; covers either approved team,
unindexed/deep metadata and unapproved third owners |
| Current reviewer policy: change boundary | Exactly three governance
files; all 572 metadata files and release controls unchanged |
| Current reviewer policy: committed release diff | **Zero publishable
templates** selected |
| Authored shape: ready schema and source literals | **572 passed**;
schema SHA256
`BE3945F44CABE20C6DD078911D762B18CB684C29E59D8CA830666C06A45AE087` |
| Authored shape: unaffected raw values and owner order | All 572 files
match the original values; all 281 usernames preserved |
| Authored shape: actual staged/committed diff, Prettier and whitespace
| Zero release templates; all 572 formatting checks passed |
| Prior main integration: combined BAMI/CI-parameter and metadata
regressions | 387 passed at `7fe0438` |
| Prior main integration: Actionlint 1.7.12 | 221 publishing
workflows/templates passed; three unsupported `queue` diagnostics in
unchanged `avm.module.yml` reproduce on main |
| Prior upstream PostgreSQL source/test compilation | Both compiled
without rewriting files; two existing API/module-age warnings |

The original three per-module YAML formatting warnings in
api-center.service, azd.apim-api, and sa.content-generation remain
unchanged. No concurrency or release control was weakened to silence an
older linter. Fresh automatic checks are evaluated on exact
reviewer-policy head `2fe528df6fe20f849fb79055589677098357680c`; no
Azure deployment/release workflow was dispatched.

## Type of Change

<!-- Use the checkboxes [x] on the options that are relevant. -->

- Azure Verified Module updates:
- [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT
bumped the MAJOR or MINOR version in `version.json`:
- [ ] Feature update backwards compatible feature updates, and I have
bumped the MINOR version in `version.json`.
- [ ] Breaking changes and I have bumped the MAJOR version in
`version.json`.
  - [ ] Update to documentation
- [x] Update to CI Environment or utilities (Non-module affecting
changes)

## Checklist

- [x] I'm sure there are no other open Pull Requests for the same
update/change
- [ ] I have run `Set-AVMModule` locally to generate the supporting
module files.
- [ ] My corresponding pipelines / checks run clean and green without
any errors or warnings
- [ ] I have updated the module's CHANGELOG.md file with an entry for
the next version

`Set-AVMModule`, module changelogs, and Azure deployment validation are
intentionally not applicable to the metadata-only module diff. Offline
results and pre-existing tool/compiler warnings are recorded above.

<!-- Please keep up to date with the contribution guide at
https://aka.ms/avm/contribute/bicep -->

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>