# 3.5.2

**Release Date:** May 8, 2026

---

## 🐛 Bug Fixes

### Terraform: Fix Race Condition in `saif-resources` Identity Module 🔧

**Commit:** [befc4020](https://github.com/saif-corp/forge/commit/befc4020)

The `identity` module in `saif-resources` derived `resource_group_name` from `context.naming` — a string computed at plan time — creating no data-flow dependency on the actual resource group resource. Under Terraform's parallelism, `azurerm_user_assigned_identity` could start before the resource group existed, causing intermittent `ResourceGroupNotFound` (404) errors that required a retry to resolve.

**Root Cause:**

All other modules (`cosmosdb`, `api`, `bot`) accept explicit `resource_group_name` and `resource_group_location` inputs wired from `module.resource_group.*`, giving Terraform a real dependency edge. The `identity` module was the only outlier.

**Fix:**

- Added `resource_group_name` and `resource_group_location` variables to the `identity` module, consistent with the established pattern
- `azurerm_user_assigned_identity` now uses the explicit inputs instead of deriving from `context.naming`
- Smithy consumer updated to pass `module.resource_group.resource_group_name` and `module.resource_group.location` directly
- Terraform now infers the dependency through data flow — no `depends_on` workaround needed

**Impact:** Eliminates intermittent Terraform apply failures in the `bot_infra` deployment that required retries to resolve.

---

### Platform: Fix `AddAzureDefaults` Double-Registration of Feature Management 🔧

**Commit:** [b07be024](https://github.com/saif-corp/forge/commit/b07be024)

`AddAzureDefaults()` registered feature management as a **singleton** via `AddFeatureManagement()`. Applications that also called `AddScopedFeatureManagement()` — required to support scoped feature filters such as auth context — received a `FeatureManagementException: Singleton feature management has been registered` crash at startup.

**Root Cause:**

PR #640 added `AddFeatureManagement()` to `AddAzureDefaults()` as part of label-based feature flag isolation. Smithy's `Program.cs` was already calling `AddScopedFeatureManagement()`. Mixing a singleton and a scoped registration of the same service throws at startup with no fallback.

**Fix:**

- `AddAzureDefaults()` now calls `AddScopedFeatureManagement()` instead of `AddFeatureManagement()` — scoped is strictly more capable and supports feature filters that consume scoped services
- Removed the now-redundant explicit `AddScopedFeatureManagement()` call from `Smithy/Program.cs`

**Impact:** Resolves `smithy-prod` container crash-loop (exit code 139) and the resulting 503 errors returned to all clients including the CLI MCP bridge.

---

### CLI: Fix Resource Identifier for Smithy Server 🔧

**Commit:** [f93f86c0](https://github.com/saif-corp/forge/commit/f93f86c0)

The Smithy MCP server entry in `appsettings.json` used `api://smithy` as the OAuth resource identifier. The correct app registration identifier is `api://smithy-prod`, which is required for the CLI to acquire a valid access token when connecting to the Smithy MCP endpoint.

**Fix:** Updated `Resource` from `api://smithy` to `api://smithy-prod` in the CLI configuration.

**Impact:** Resolves CLI authentication failures when connecting to the Smithy MCP server.

---

## ⚠️ Breaking Changes

None in this release ✅

---

## 📦 Dependencies

No dependency changes in this release.