diff --git a/plugin/skills/azure-prepare/references/analyze.md b/plugin/skills/azure-prepare/references/analyze.md
index aeacc1b85..cdc6d64b6 100644
--- a/plugin/skills/azure-prepare/references/analyze.md
+++ b/plugin/skills/azure-prepare/references/analyze.md
@@ -96,4 +96,10 @@ Converting an existing application to run on Azure.
 
 > ⚠️ **Critical**: The Functions `bicep.md` and `terraform.md` files are **REFERENCE DOCUMENTATION**, not templates to copy. Hand-writing infrastructure from these patterns results in missing RBAC, incorrect managed identity configuration, and security vulnerabilities.
 
-For other compute targets (Container Apps, App Service, Static Web Apps), load their respective README files in `services/` for guidance.
+For **Container Apps**, load the composition rules the same way:
+
+1. Load `services/container-apps/templates/selection.md` — decision tree for base template + recipe
+2. Load `services/container-apps/templates/recipes/composition.md` — the exact algorithm to follow
+3. Use `azd init -t <template>` for **new projects only** to generate proven IaC — **NEVER hand-write Bicep/Terraform**
+
+For other compute targets (App Service, Static Web Apps), load their respective README files in `services/` for guidance.
diff --git a/plugin/skills/azure-prepare/references/research.md b/plugin/skills/azure-prepare/references/research.md
index 9883c10dc..fa417d1dc 100644
--- a/plugin/skills/azure-prepare/references/research.md
+++ b/plugin/skills/azure-prepare/references/research.md
@@ -59,6 +59,8 @@ For each selected service, load the README.md first, then load specific files as
 Selected: Container Apps, Cosmos DB, Key Vault
 
 → Load: services/container-apps/README.md (overview)
+  → If need templates: services/container-apps/templates/selection.md
+  → Follow: services/container-apps/templates/recipes/composition.md
   → If need Bicep: services/container-apps/bicep.md
   → If need Terraform: services/container-apps/terraform.md
   → If need scaling: services/container-apps/scaling.md
@@ -103,7 +105,7 @@ Add research findings to `.azure/deployment-plan.md` under a `## Research Summar
 
 ### Web Application + API + Database (Cosmos DB)
 
-1. Load: [services/container-apps/README.md](services/container-apps/README.md) → [bicep.md](services/container-apps/bicep.md) or [terraform.md](services/container-apps/terraform.md), [scaling.md](services/container-apps/scaling.md)
+1. Load: [services/container-apps/README.md](services/container-apps/README.md) → [templates/selection.md](services/container-apps/templates/selection.md), [bicep.md](services/container-apps/bicep.md) or [terraform.md](services/container-apps/terraform.md), [scaling.md](services/container-apps/scaling.md)
 2. Load: [services/cosmos-db/README.md](services/cosmos-db/README.md) → [partitioning.md](services/cosmos-db/partitioning.md)
 3. Load: [services/key-vault/README.md](services/key-vault/README.md)
 4. Invoke: `azure-observability` (monitoring setup)
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/README.md b/plugin/skills/azure-prepare/references/services/container-apps/README.md
index 69dee56e9..09c2167dd 100644
--- a/plugin/skills/azure-prepare/references/services/container-apps/README.md
+++ b/plugin/skills/azure-prepare/references/services/container-apps/README.md
@@ -38,6 +38,12 @@ services:
 | Background Worker | None | 0 (scale to zero) | Queue-based |
 | Web Application | External | 1 | HTTP-based |
 
+## Templates & Recipes
+
+- **[Selection Guide](templates/selection.md)** — Start here: decision tree for base template + recipe
+- **[Composition Algorithm](templates/recipes/composition.md)** — How to fetch and compose templates
+- [AZD Templates](templates/recipes/README.md) — Recipe overview
+
 ## References
 
 - [Bicep Patterns](bicep.md)
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/api.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/api.md
new file mode 100644
index 000000000..f38d3f202
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/api.md
@@ -0,0 +1,161 @@
+# API Template — REFERENCE ONLY
+
+REST and gRPC API services on Azure Container Apps with ingress configuration.
+
+## When to Use
+
+- REST API with OpenAPI/Swagger
+- gRPC service
+- API gateway backend
+- Backend-for-frontend (BFF) pattern
+
+## Project Structure
+
+```
+project-root/
+├── azure.yaml
+├── Dockerfile
+├── src/
+│   └── (API code)
+└── infra/
+    ├── main.bicep
+    └── app/
+        └── api.bicep
+```
+
+## azure.yaml
+
+```yaml
+name: my-api
+metadata:
+  template: container-apps-api
+services:
+  api:
+    host: containerapp
+    project: .
+    language: <js|ts|python|csharp|java|go>
+```
+
+## Bicep — API Container App
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param envId string
+param containerRegistryName string
+param imageName string
+param userAssignedIdentityId string
+param isGrpc bool = false
+param allowedOrigins array = ['https://example.com']
+
+resource api 'Microsoft.App/containerApps@2024-03-01' = {
+  name: name
+  location: location
+  tags: union(tags, { 'azd-service-name': 'api' })
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: { '${userAssignedIdentityId}': {} }
+  }
+  properties: {
+    managedEnvironmentId: envId
+    configuration: {
+      ingress: {
+        external: true
+        targetPort: 8080
+        transport: isGrpc ? 'http2' : 'auto'
+        corsPolicy: {
+          allowedOrigins: allowedOrigins
+          allowedMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS']
+          allowedHeaders: ['*']
+        }
+        // Use ['*'] only for local/dev smoke tests; set explicit origins for production.
+      }
+      registries: [
+        {
+          server: '${containerRegistryName}.azurecr.io'
+          identity: userAssignedIdentityId
+        }
+      ]
+    }
+    template: {
+      containers: [
+        {
+          name: 'api'
+          image: imageName
+          resources: { cpu: json('0.5'), memory: '1Gi' }
+          env: [
+            { name: 'PORT', value: '8080' }
+          ]
+        }
+      ]
+      scale: {
+        minReplicas: 1
+        maxReplicas: 20
+        rules: [
+          {
+            name: 'http-scale'
+            http: { metadata: { concurrentRequests: '50' } }
+          }
+        ]
+      }
+    }
+  }
+}
+
+output fqdn string = api.properties.configuration.ingress.fqdn
+output name string = api.name
+```
+
+## REST vs gRPC
+
+| Setting | REST | gRPC |
+|---------|------|------|
+| `transport` | `auto` | `http2` |
+| `targetPort` | 8080 | 8080 |
+| Ingress | External or internal | External or internal |
+
+> ⚠️ **gRPC requires `transport: 'http2'`** — without it, gRPC calls fail.
+
+## Internal API (No External Ingress)
+
+For backend APIs only consumed by other Container Apps:
+
+```bicep
+ingress: {
+  external: false        // internal only
+  targetPort: 8080
+  transport: 'auto'
+}
+```
+
+Internal APIs are reachable at `https://<app-name>.internal.<env-domain>`.
+
+## API with Authentication
+
+Use Easy Auth or integrate with Microsoft Entra ID:
+
+```bicep
+configuration: {
+  ingress: {
+    external: true
+    targetPort: 8080
+  }
+}
+```
+
+> 💡 **Tip:** For API authentication, consider using the built-in authentication
+> feature of Container Apps (Easy Auth) or validating JWT tokens in your application code.
+
+## CORS Configuration
+
+Restrict `allowedOrigins` for production:
+
+```bicep
+corsPolicy: {
+  allowedOrigins: ['https://myapp.example.com']
+  allowedMethods: ['GET', 'POST', 'PUT', 'DELETE']
+  allowedHeaders: ['Authorization', 'Content-Type']
+  maxAge: 3600
+}
+```
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/functions-on-aca.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/functions-on-aca.md
new file mode 100644
index 000000000..8b569021e
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/functions-on-aca.md
@@ -0,0 +1,180 @@
+# Functions on Container Apps — REFERENCE ONLY
+
+Azure Functions hosted on Container Apps for event-driven triggers and bindings
+with Container Apps scaling and networking.
+
+## When to Use
+
+- Event-driven processing requiring Functions triggers/bindings
+- Need KEDA-based scaling with Functions programming model
+- Want Container Apps networking (VNet, private endpoints) with Functions
+- Migrating from Functions Consumption/Premium to Container Apps
+
+## Why Functions on Container Apps?
+
+| Feature | Functions (Flex) | Functions on ACA |
+|---------|-----------------|------------------|
+| Programming model | Functions v4 | Functions v4 |
+| Triggers/bindings | ✅ Full support | ✅ Full support |
+| Scaling | Flex Consumption | KEDA (Container Apps) |
+| Networking | VNet integration | Container Apps VNet |
+| Container support | Managed | Full Dockerfile control |
+| Dapr integration | ❌ | ✅ |
+| Side-cars | ❌ | ✅ |
+
+## Project Structure
+
+```
+project-root/
+├── azure.yaml
+├── Dockerfile
+├── host.json
+├── src/
+│   └── (Functions code)
+└── infra/
+    ├── main.bicep
+    └── app/
+        └── functions-app.bicep
+```
+
+## Dockerfile
+
+```dockerfile
+# Example: Node.js Functions on ACA
+FROM mcr.microsoft.com/azure-functions/node:4-node20
+
+ENV AzureWebJobsScriptRoot=/home/site/wwwroot
+COPY . /home/site/wwwroot
+RUN cd /home/site/wwwroot && npm install --production
+```
+
+## azure.yaml
+
+```yaml
+name: my-functions-aca
+metadata:
+  template: container-apps-functions
+services:
+  api:
+    host: containerapp
+    project: .
+    language: js
+```
+
+## Bicep — Functions on Container Apps
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param envId string
+param containerRegistryName string
+param imageName string
+param userAssignedIdentityId string
+param uamiClientId string
+param storageAccountName string
+
+resource funcApp 'Microsoft.App/containerApps@2024-03-01' = {
+  name: name
+  location: location
+  tags: union(tags, { 'azd-service-name': 'api' })
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: { '${userAssignedIdentityId}': {} }
+  }
+  properties: {
+    managedEnvironmentId: envId
+    configuration: {
+      ingress: {
+        external: true
+        targetPort: 80
+        transport: 'auto'
+      }
+      registries: [
+        {
+          server: '${containerRegistryName}.azurecr.io'
+          identity: userAssignedIdentityId
+        }
+      ]
+    }
+    template: {
+      containers: [
+        {
+          name: 'functions'
+          image: imageName
+          resources: { cpu: json('0.5'), memory: '1Gi' }
+          env: [
+            {
+              name: 'AzureWebJobsStorage__accountName'
+              value: storageAccountName
+            }
+            {
+              name: 'AzureWebJobsStorage__credential'
+              value: 'managedidentity'
+            }
+            {
+              name: 'AzureWebJobsStorage__clientId'
+              value: uamiClientId
+            }
+            {
+              name: 'FUNCTIONS_EXTENSION_VERSION'
+              value: '~4'
+            }
+          ]
+        }
+      ]
+      scale: {
+        minReplicas: 0
+        maxReplicas: 30
+      }
+    }
+  }
+}
+```
+
+## Supported Triggers
+
+All Functions triggers work on Container Apps:
+
+| Trigger | KEDA Scaler | Notes |
+|---------|-------------|-------|
+| HTTP | `http` | Built-in HTTP scaling |
+| Timer | `cron` | Cron-based scheduling |
+| Service Bus | `azure-servicebus` | Queue/topic scaling |
+| Event Hubs | `azure-eventhub` | Partition-based scaling |
+| Cosmos DB | `azure-cosmosdb` | Change feed scaling |
+| Blob Storage | `azure-blob` | Blob count scaling |
+| Storage Queue | `azure-queue` | Queue length scaling |
+
+## KEDA Scale Rules for Triggers
+
+```bicep
+scale: {
+  minReplicas: 0
+  maxReplicas: 30
+  rules: [
+    {
+      name: 'servicebus-scale'
+      custom: {
+        type: 'azure-servicebus'
+        metadata: {
+          queueName: 'myqueue'
+          namespace: 'my-sb-namespace'
+          messageCount: '5'
+        }
+        identity: userAssignedIdentityId
+      }
+    }
+  ]
+}
+```
+
+## Key Differences from Standard Functions
+
+1. **You manage the Dockerfile** — base image must be `mcr.microsoft.com/azure-functions/<runtime>`
+2. **Scaling is KEDA-based** — configure scale rules explicitly
+3. **Storage is still required** — Functions runtime needs `AzureWebJobsStorage`
+4. **No Flex Consumption billing** — billed as Container Apps
+
+> ⚠️ **Always use the official Functions base images** from MCR.
+> Custom base images may break the Functions runtime.
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/job.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/job.md
new file mode 100644
index 000000000..a599ac887
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/job.md
@@ -0,0 +1,192 @@
+# Container Apps Job Template — REFERENCE ONLY
+
+Scheduled, event-triggered, and manual jobs on Azure Container Apps.
+
+## When to Use
+
+- Scheduled tasks (cron-based)
+- Event-driven batch processing
+- One-shot manual execution
+- ETL pipelines, data imports, cleanup tasks
+
+## Job Types
+
+| Type | Trigger | Example |
+|------|---------|---------|
+| **Scheduled** | Cron expression | Nightly data sync, hourly report |
+| **Event** | KEDA scaler (queue, event hub) | Process uploads, handle messages |
+| **Manual** | API call / CLI | Ad-hoc migration, one-time import |
+
+## Project Structure
+
+```
+project-root/
+├── azure.yaml
+├── Dockerfile
+├── src/
+│   └── (job code)
+└── infra/
+    ├── main.bicep
+    └── app/
+        └── job.bicep
+```
+
+## azure.yaml
+
+```yaml
+name: my-job
+metadata:
+  template: container-apps-job
+services:
+  job:
+    host: containerapp
+    project: .
+```
+
+## Bicep — Scheduled Job
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param envId string
+param containerRegistryName string
+param imageName string
+param userAssignedIdentityId string
+param cronExpression string = '0 0 * * *'
+
+resource job 'Microsoft.App/jobs@2024-03-01' = {
+  name: name
+  location: location
+  tags: union(tags, { 'azd-service-name': 'job' })
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: { '${userAssignedIdentityId}': {} }
+  }
+  properties: {
+    environmentId: envId
+    configuration: {
+      triggerType: 'Schedule'
+      replicaTimeout: 1800
+      replicaRetryLimit: 1
+      scheduleTriggerConfig: {
+        cronExpression: cronExpression
+        parallelism: 1
+        replicaCompletionCount: 1
+      }
+      registries: [
+        {
+          server: '${containerRegistryName}.azurecr.io'
+          identity: userAssignedIdentityId
+        }
+      ]
+    }
+    template: {
+      containers: [
+        {
+          name: 'job'
+          image: imageName
+          resources: { cpu: json('0.5'), memory: '1Gi' }
+        }
+      ]
+    }
+  }
+}
+
+output name string = job.name
+```
+
+## Bicep — Event-Triggered Job
+
+```bicep
+resource eventJob 'Microsoft.App/jobs@2024-03-01' = {
+  name: '${name}-event'
+  location: location
+  tags: tags
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: { '${userAssignedIdentityId}': {} }
+  }
+  properties: {
+    environmentId: envId
+    configuration: {
+      triggerType: 'Event'
+      replicaTimeout: 600
+      replicaRetryLimit: 2
+      registries: [
+        {
+          server: '${containerRegistryName}.azurecr.io'
+          identity: userAssignedIdentityId
+        }
+      ]
+      eventTriggerConfig: {
+        parallelism: 1
+        replicaCompletionCount: 1
+        scale: {
+          minExecutions: 0
+          maxExecutions: 10
+          rules: [
+            {
+              name: 'queue-trigger'
+              type: 'azure-servicebus'
+              metadata: {
+                namespace: '<sb-namespace>'
+                queueName: '<queue>'
+                messageCount: '1'
+              }
+              identity: userAssignedIdentityId
+            }
+          ]
+        }
+      }
+    }
+    template: {
+      containers: [
+        {
+          name: 'job'
+          image: imageName
+          resources: { cpu: json('1'), memory: '2Gi' }
+        }
+      ]
+    }
+  }
+}
+```
+
+## Bicep — Manual Job
+
+```bicep
+configuration: {
+  triggerType: 'Manual'
+  replicaTimeout: 3600
+  replicaRetryLimit: 0
+}
+```
+
+Start manually:
+
+```bash
+az containerapp job start -n <job-name> -g <resource-group>
+```
+
+## Common Cron Expressions
+
+| Schedule | Expression |
+|----------|-----------|
+| Every hour | `0 * * * *` |
+| Daily at midnight UTC | `0 0 * * *` |
+| Every 15 minutes | `*/15 * * * *` |
+| Weekdays at 9 AM UTC | `0 9 * * 1-5` |
+| First day of month | `0 0 1 * *` |
+
+## Key Configuration
+
+| Setting | Description | Default |
+|---------|-------------|---------|
+| `replicaTimeout` | Max seconds per execution | 1800 |
+| `replicaRetryLimit` | Retry count on failure | 1 |
+| `parallelism` | Concurrent replicas | 1 |
+| `replicaCompletionCount` | Required successful replicas | 1 |
+
+> ⚠️ **Jobs exit after completion.** Ensure your container exits with code 0 on success
+> and non-zero on failure. Container Apps tracks execution history.
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/microservice.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/microservice.md
new file mode 100644
index 000000000..62c47ab35
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/microservice.md
@@ -0,0 +1,158 @@
+# Microservice Template — REFERENCE ONLY
+
+Multi-service architecture on Azure Container Apps with service discovery.
+
+## When to Use
+
+- Multiple independent services communicating via HTTP/gRPC
+- Mono-repo or multi-repo microservice architecture
+- Services with independent scaling requirements
+- Dapr-enabled service mesh
+
+## Project Structure
+
+```
+project-root/
+├── azure.yaml
+├── src/
+│   ├── frontend/
+│   │   └── Dockerfile
+│   ├── api-gateway/
+│   │   └── Dockerfile
+│   └── worker-service/
+│       └── Dockerfile
+└── infra/
+    ├── main.bicep
+    └── app/
+        ├── frontend.bicep
+        ├── api-gateway.bicep
+        └── worker-service.bicep
+```
+
+## azure.yaml
+
+```yaml
+name: my-microservices
+metadata:
+  template: container-apps-microservices
+services:
+  frontend:
+    host: containerapp
+    project: ./src/frontend
+  api-gateway:
+    host: containerapp
+    project: ./src/api-gateway
+  worker-service:
+    host: containerapp
+    project: ./src/worker-service
+```
+
+## Bicep — Multi-Service Environment
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param logAnalyticsWorkspaceId string
+@secure()
+param logAnalyticsSharedKey string
+
+// logAnalytics resource must be declared or passed as parameter
+// Shared Container Apps Environment
+resource env 'Microsoft.App/managedEnvironments@2024-03-01' = {
+  name: '${name}-env'
+  location: location
+  tags: tags
+  properties: {
+    appLogsConfiguration: {
+      destination: 'log-analytics'
+      logAnalyticsConfiguration: {
+        customerId: logAnalyticsWorkspaceId
+        sharedKey: logAnalyticsSharedKey
+      }
+    }
+  }
+}
+```
+
+## Service Discovery
+
+Container Apps in the same environment discover each other by name:
+
+```
+https://<app-name>.internal.<default-domain>
+```
+
+### Internal Communication Pattern
+
+```bicep
+// Frontend (external ingress)
+ingress: {
+  external: true
+  targetPort: 3000
+}
+
+// API Gateway (internal ingress)
+ingress: {
+  external: false
+  targetPort: 8080
+}
+
+// Worker (no ingress — processes messages only)
+// Omit ingress block entirely
+```
+
+### Environment Variables for Service URLs
+
+Pass internal URLs via environment variables:
+
+```bicep
+env: [
+  {
+    name: 'API_GATEWAY_URL'
+    value: 'https://${apiGateway.properties.configuration.ingress.fqdn}'
+  }
+]
+```
+
+## Scaling Per Service
+
+Each service scales independently:
+
+| Service | Min | Max | Scale Rule |
+|---------|-----|-----|------------|
+| Frontend | 1 | 10 | HTTP concurrency |
+| API Gateway | 2 | 20 | HTTP concurrency |
+| Worker | 0 | 30 | Queue depth (KEDA) |
+
+## With Dapr
+
+For microservices using Dapr, apply the [Dapr recipe](recipes/dapr/README.md) to enable:
+- Service-to-service invocation
+- State management
+- Pub/sub messaging
+- Distributed tracing
+
+```bicep
+configuration: {
+  dapr: {
+    enabled: true
+    appId: 'api-gateway'
+    appPort: 8080
+    appProtocol: 'http'
+  }
+}
+```
+
+## Deployment Order
+
+Deploy services with dependencies in correct order:
+
+```bash
+azd provision --no-prompt
+sleep 60  # RBAC propagation
+azd deploy --no-prompt
+```
+
+> 💡 **Tip:** `azd deploy` deploys all services defined in `azure.yaml`.
+> Individual services: `azd deploy --service api-gateway`.
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/README.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/README.md
new file mode 100644
index 000000000..2b1bb85f3
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/README.md
@@ -0,0 +1,72 @@
+# Container Apps Template Recipes — REFERENCE ONLY
+
+Composable IaC + configuration modules that extend base Container Apps templates
+to support specific Azure service integrations.
+
+## Architecture
+
+```
+Base Template (web-app, api, worker, job, etc.)
+       │
+       ├── Dockerfile + app code
+       ├── IaC (Container Apps Environment, ACR, UAMI, RBAC)
+       └── AZD config (azure.yaml)
+
+       + Recipe (per integration)
+       │
+       ├── IaC module (new resource + RBAC + networking)
+       ├── Environment variables
+       └── Scaling rules (KEDA, if applicable)
+       │
+       = Complete deployable project → `azd up`
+```
+
+## Available Recipes
+
+| Recipe | IaC Delta | Scaling Rules | Status |
+|--------|-----------|---------------|--------|
+| [dapr](dapr/README.md) | ✅ Dapr components | ❌ | ✅ Available |
+| [cosmos](cosmos/README.md) | ✅ Cosmos account + DB + RBAC | ❌ | ✅ Available |
+| [servicebus](servicebus/README.md) | ✅ SB namespace + queue + RBAC | ✅ KEDA azure-servicebus | ✅ Available |
+| [redis](redis/README.md) | ✅ Redis cache + RBAC | ❌ | ✅ Available |
+| [acr](acr/README.md) | ✅ ACR + RBAC | ❌ | ✅ Available |
+| [postgres](postgres/README.md) | ✅ PostgreSQL Flexible + RBAC | ❌ | ✅ Available |
+
+## How It Works
+
+### Step 1: Select Base Template
+
+Choose from [selection.md](../selection.md) based on workload type.
+
+### Step 2: Apply Recipe(s)
+
+Read each recipe's README for:
+- **IaC modules** to copy into `infra/`
+- **RBAC roles** with exact GUIDs
+- **Environment variables** for the container app
+- **Scaling rules** (KEDA) for event-driven scenarios
+
+### Step 3: Wire Into Base
+
+**Bicep:** Add `module` reference in `main.bicep`
+**Terraform:** Copy `.tf` files, merge environment variables
+
+### Step 4: Deploy
+
+```bash
+azd env set AZURE_LOCATION eastus2
+azd provision --no-prompt
+sleep 60
+azd deploy --no-prompt
+```
+
+## Design Principles
+
+| Principle | Why |
+|-----------|-----|
+| **Never synthesize base IaC** | Always use proven templates |
+| **Never modify base; only extend** | Recipes are additive — no risk of breaking core |
+| **Recipes own their RBAC** | Exact role GUIDs, no LLM guessing |
+| **Stack-agnostic** | Container Apps runs any container — recipes work with any language |
+| **Same algorithm for Bicep & Terraform** | Only IaC files differ, not composition logic |
+| **UAMI everywhere** | Managed identity for all service connections |
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/acr/README.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/acr/README.md
new file mode 100644
index 000000000..577c133cb
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/acr/README.md
@@ -0,0 +1,114 @@
+# ACR Recipe — REFERENCE ONLY
+
+Azure Container Registry build and push workflow for Container Apps.
+
+## When to Use
+
+- Building container images in Azure (no local Docker needed)
+- CI/CD pipeline for Container Apps
+- Private container registry with managed identity pull
+
+## Bicep — ACR Module
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param appPrincipalId string       // Container App MI — gets AcrPull only
+param deployerPrincipalId string  // CI/deployer MI — gets AcrPush
+
+resource acr 'Microsoft.ContainerRegistry/registries@2023-07-01' = {
+  name: name
+  location: location
+  tags: tags
+  sku: { name: 'Basic' }
+  properties: {
+    adminUserEnabled: false
+  }
+}
+
+// RBAC — AcrPull for Container App (least privilege — pull only)
+resource acrPull 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(acr.id, appPrincipalId, '7f951dda-4ed3-4680-a7ca-43fe172d538d')
+  scope: acr
+  properties: {
+    roleDefinitionId: subscriptionResourceId(
+      'Microsoft.Authorization/roleDefinitions',
+      '7f951dda-4ed3-4680-a7ca-43fe172d538d'
+    )
+    principalId: appPrincipalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// RBAC — AcrPush for build agent / deployer (separate principal)
+resource acrPush 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(acr.id, deployerPrincipalId, '8311e382-0749-4cb8-b61a-304f252e45ec')
+  scope: acr
+  properties: {
+    roleDefinitionId: subscriptionResourceId(
+      'Microsoft.Authorization/roleDefinitions',
+      '8311e382-0749-4cb8-b61a-304f252e45ec'
+    )
+    principalId: deployerPrincipalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+output loginServer string = acr.properties.loginServer
+output name string = acr.name
+```
+
+## Container App Registry Configuration
+
+```bicep
+configuration: {
+  registries: [
+    {
+      server: acr.outputs.loginServer
+      identity: userAssignedIdentityId
+    }
+  ]
+}
+```
+
+## ACR Build (Cloud Build)
+
+Build images in Azure without local Docker:
+
+```bash
+az acr build \
+  --registry <acr-name> \
+  --image myapp:latest \
+  --file Dockerfile .
+```
+
+## AZD + ACR Workflow
+
+With `azd`, image build and push is handled automatically:
+
+```yaml
+# azure.yaml
+services:
+  web:
+    host: containerapp
+    project: .
+    docker:
+      path: Dockerfile
+```
+
+`azd deploy` automatically:
+1. Builds the image via ACR Tasks
+2. Pushes to the linked ACR
+3. Updates the Container App with the new image
+
+## RBAC Roles
+
+| Role | GUID | Access |
+|------|------|--------|
+| AcrPull | `7f951dda-4ed3-4680-a7ca-43fe172d538d` | Pull images |
+| AcrPush | `8311e382-0749-4cb8-b61a-304f252e45ec` | Push + pull images |
+| AcrDelete | `c2f4ef07-c644-48eb-af81-4b1b4947fb11` | Delete images |
+
+> ⚠️ **Never enable admin user** (`adminUserEnabled: false`).
+> Use managed identity for image pull.
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/composition.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/composition.md
new file mode 100644
index 000000000..d14c8ee01
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/composition.md
@@ -0,0 +1,145 @@
+# Composition Algorithm — REFERENCE ONLY
+
+Step-by-step algorithm for composing a Container Apps base template with integration recipes.
+
+> **This is the authoritative process. Follow it exactly.**
+
+## Algorithm
+
+```
+INPUT:
+  - base:        web-app | api | microservice | worker | job | functions-on-aca
+  - recipes:     dapr | cosmos | servicebus | redis | acr | postgres (zero or more)
+  - iac:         bicep | terraform
+
+OUTPUT:
+  - Complete project directory ready for `azd up`
+```
+
+### Step 1: Select Base Template
+
+Choose the base template from [selection.md](../selection.md) based on the workload type.
+Use `-t <template-name>` when initializing new projects so the project starts from proven IaC. Only omit `-t` if you are inside an existing template directory.
+
+```bash
+ENV_NAME="$(basename "$PWD" | tr '[:upper:]' '[:lower:]' | tr ' _' '-')-dev"
+azd init -t "<template-name-from-selection.md>" -e "$ENV_NAME" --no-prompt
+```
+
+### Step 2: Check if Recipes Needed
+
+```
+IF no integrations detected:
+  → DONE. Base template is complete.
+
+IF recipes detected:
+  → Continue to Step 3 for each recipe.
+```
+
+### Step 3: Add IaC Module (per recipe)
+
+Read the recipe's README for IaC patterns, env vars, RBAC roles, and scaling rules:
+
+- [recipes/acr/README.md](acr/README.md) — Container Registry build + push
+- [recipes/cosmos/README.md](cosmos/README.md) — Cosmos DB NoSQL
+- [recipes/dapr/README.md](dapr/README.md) — Dapr components (state, pub/sub, invocation)
+- [recipes/postgres/README.md](postgres/README.md) — PostgreSQL Flexible Server
+- [recipes/redis/README.md](redis/README.md) — Redis cache / state store
+- [recipes/servicebus/README.md](servicebus/README.md) — Service Bus messaging + KEDA scaling
+
+**Bicep:**
+1. Create recipe Bicep module in `infra/app/` based on the recipe's documented patterns
+2. Add module reference in `infra/main.bicep`:
+   ```bicep
+   module cosmos './app/cosmos.bicep' = {
+     name: 'cosmos'
+     scope: rg
+     params: {
+       name: name
+       location: location
+       tags: tags
+       principalId: app.outputs.principalId
+     }
+   }
+   ```
+
+**Terraform:**
+1. Copy recipe `.tf` file into `infra/`
+2. Merge recipe app settings into container app environment variables
+
+### Step 4: Add Environment Variables
+
+Read the recipe's `README.md` for required env vars. Add them to the container app config.
+
+> **CRITICAL: User Assigned Managed Identity (UAMI)**
+>
+> Use managed identity for all service connections. Never use connection strings or keys.
+>
+> ```bicep
+> env: [
+>   { name: 'COSMOS_ENDPOINT', value: cosmos.outputs.endpoint }
+>   { name: 'AZURE_CLIENT_ID', value: uami.outputs.clientId }
+> ]
+> ```
+
+### Step 5: Add RBAC Role Assignments
+
+Each recipe defines required RBAC roles. Use exact role definition GUIDs from recipe docs.
+
+```bicep
+resource cosmosRbac 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2024-05-15' = {
+  parent: cosmos
+  name: guid(cosmos.id, uami.id, 'data-contributor')
+  properties: {
+    roleDefinitionId: '${cosmos.id}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002'
+    principalId: uami.outputs.principalId
+    scope: cosmos.id
+  }
+}
+```
+
+### Step 6: Add Scaling Rules (if applicable)
+
+For workers and event-driven apps, add KEDA scaling rules from the recipe:
+
+```bicep
+scale: {
+  minReplicas: 0
+  maxReplicas: 30
+  rules: [
+    // From recipe scaling configuration
+  ]
+}
+```
+
+### Step 7: Validate and Deploy
+
+```bash
+azd env set AZURE_LOCATION eastus2
+azd provision --no-prompt
+sleep 60                         # Wait for RBAC propagation
+azd deploy --no-prompt
+```
+
+## Multiple Recipes
+
+Recipes are additive. Apply each recipe independently:
+
+```
+Base (web-app)
+  + cosmos recipe   → adds Cosmos module + RBAC + env vars
+  + redis recipe    → adds Redis module + RBAC + env vars
+  + acr recipe      → adds ACR build pipeline
+  = Complete project
+```
+
+> ⚠️ **Each recipe is independent.** No recipe should modify another recipe's resources.
+
+## Critical Rules
+
+1. **Never synthesize IaC from scratch** — always extend base template
+2. **Don't replace or remove base IaC resources** — extend base files only by adding module references and additive resources
+3. **Always use recipe RBAC role GUIDs** — never let the LLM guess role IDs
+4. **Always use UAMI** — never use connection strings or access keys
+5. **Always use `--no-prompt`** with azd commands
+6. **Always wait for RBAC propagation** — use two-phase deploy
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/cosmos/README.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/cosmos/README.md
new file mode 100644
index 000000000..edffd1193
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/cosmos/README.md
@@ -0,0 +1,104 @@
+# Cosmos DB Recipe — REFERENCE ONLY
+
+Azure Cosmos DB integration for Container Apps.
+
+## When to Use
+
+- NoSQL document database
+- Global distribution requirements
+- Low-latency reads/writes
+- Change feed processing
+
+## Bicep — Cosmos DB Module
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param principalId string
+
+resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2024-05-15' = {
+  name: name
+  location: location
+  tags: tags
+  kind: 'GlobalDocumentDB'
+  properties: {
+    databaseAccountOfferType: 'Standard'
+    disableLocalAuth: true
+    locations: [
+      { locationName: location, failoverPriority: 0 }
+    ]
+    capabilities: [
+      { name: 'EnableServerless' }
+    ]
+  }
+}
+
+resource database 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2024-05-15' = {
+  parent: cosmos
+  name: 'appdb'
+  properties: {
+    resource: { id: 'appdb' }
+  }
+}
+
+resource container 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2024-05-15' = {
+  parent: database
+  name: 'items'
+  properties: {
+    resource: {
+      id: 'items'
+      partitionKey: { paths: ['/partitionKey'], kind: 'Hash' }
+    }
+  }
+}
+
+// RBAC — Cosmos DB Built-in Data Contributor
+resource rbac 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2024-05-15' = {
+  parent: cosmos
+  name: guid(cosmos.id, principalId, 'data-contributor')
+  properties: {
+    roleDefinitionId: '${cosmos.id}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002'
+    principalId: principalId
+    scope: cosmos.id
+  }
+}
+
+output endpoint string = cosmos.properties.documentEndpoint
+output databaseName string = database.name
+output containerName string = container.name
+```
+
+## Environment Variables
+
+```bicep
+env: [
+  { name: 'COSMOS_ENDPOINT', value: cosmos.outputs.endpoint }
+  { name: 'COSMOS_DATABASE', value: cosmos.outputs.databaseName }
+  { name: 'COSMOS_CONTAINER', value: cosmos.outputs.containerName }
+  { name: 'AZURE_CLIENT_ID', value: uami.outputs.clientId }
+]
+```
+
+## RBAC Roles
+
+| Role | GUID | Access |
+|------|------|--------|
+| Cosmos DB Built-in Data Contributor | `00000000-0000-0000-0000-000000000002` | Read + write data |
+| Cosmos DB Built-in Data Reader | `00000000-0000-0000-0000-000000000001` | Read-only data |
+
+## SDK Connection (Node.js Example)
+
+```javascript
+const { CosmosClient } = require("@azure/cosmos");
+const { DefaultAzureCredential } = require("@azure/identity");
+
+const client = new CosmosClient({
+  endpoint: process.env.COSMOS_ENDPOINT,
+  aadCredentials: new DefaultAzureCredential({
+    managedIdentityClientId: process.env.AZURE_CLIENT_ID,
+  }),
+});
+```
+
+> ⚠️ **Always set `disableLocalAuth: true`** — use RBAC only, never keys.
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/dapr/README.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/dapr/README.md
new file mode 100644
index 000000000..fdc8c5731
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/dapr/README.md
@@ -0,0 +1,100 @@
+# Dapr Integration Recipe — REFERENCE ONLY
+
+Dapr (Distributed Application Runtime) integration for Container Apps
+providing service invocation, state management, and pub/sub messaging.
+
+## When to Use
+
+- Service-to-service communication (HTTP/gRPC invocation)
+- Distributed state management
+- Pub/sub messaging between microservices
+- Distributed tracing across services
+
+## Capabilities
+
+| Component | Description | Use Case |
+|-----------|-------------|----------|
+| Service Invocation | Call other services by app ID | Microservice communication |
+| State Store | Key/value state management | Session state, caches |
+| Pub/Sub | Publish and subscribe to topics | Event-driven messaging |
+| Bindings | Input/output bindings to external systems | Trigger from / push to services |
+
+## Bicep — Enable Dapr on Container App
+
+```bicep
+configuration: {
+  dapr: {
+    enabled: true
+    appId: 'my-service'
+    appPort: 8080
+    appProtocol: 'http'  // or 'grpc'
+  }
+}
+```
+
+## Bicep — Dapr State Store Component (Cosmos DB)
+
+```bicep
+resource stateStore 'Microsoft.App/managedEnvironments/daprComponents@2024-03-01' = {
+  parent: env
+  name: 'statestore'
+  properties: {
+    componentType: 'state.azure.cosmosdb'
+    version: 'v1'
+    metadata: [
+      { name: 'url', value: cosmosEndpoint }
+      { name: 'database', value: 'daprdb' }
+      { name: 'collection', value: 'state' }
+      { name: 'azureClientId', value: uamiClientId }
+    ]
+    scopes: ['my-service']
+  }
+}
+```
+
+## Bicep — Dapr Pub/Sub Component (Service Bus)
+
+```bicep
+resource pubsub 'Microsoft.App/managedEnvironments/daprComponents@2024-03-01' = {
+  parent: env
+  name: 'pubsub'
+  properties: {
+    componentType: 'pubsub.azure.servicebus.topics'
+    version: 'v1'
+    metadata: [
+      {
+        name: 'namespaceName'
+        value: '${serviceBusNamespace}.servicebus.windows.net'
+      }
+      { name: 'azureClientId', value: uamiClientId }
+    ]
+    scopes: ['publisher-service', 'subscriber-service']
+  }
+}
+```
+
+## Service Invocation Example
+
+```python
+# Call another service via Dapr sidecar
+import requests
+
+DAPR_PORT = 3500
+response = requests.get(
+    f"http://localhost:{DAPR_PORT}/v1.0/invoke/order-service/method/orders"
+)
+```
+
+## Required RBAC Roles
+
+| Service | Role | GUID |
+|---------|------|------|
+| Cosmos DB (state) | Cosmos DB Built-in Data Contributor | `00000000-0000-0000-0000-000000000002` |
+| Service Bus (pub/sub) | Azure Service Bus Data Owner | `090c5cfd-751d-490a-894a-3ce6f1109419` |
+
+## Environment Variables
+
+No additional env vars needed — Dapr sidecar handles connections via component metadata.
+
+> 💡 **Tip:** Scope Dapr components to specific app IDs using `scopes` to enforce
+> least-privilege access between services.
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/postgres/README.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/postgres/README.md
new file mode 100644
index 000000000..801fa4699
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/postgres/README.md
@@ -0,0 +1,139 @@
+# PostgreSQL Recipe — REFERENCE ONLY
+
+Azure Database for PostgreSQL Flexible Server integration for Container Apps.
+
+## When to Use
+
+- Relational database for CRUD applications
+- PostgreSQL-compatible workloads
+- Applications requiring SQL queries, joins, transactions
+- Django, Rails, Spring Data, Prisma backends
+
+## Bicep — PostgreSQL Module
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param principalId string
+param principalName string
+param databaseName string = 'appdb'
+
+resource postgres 'Microsoft.DBforPostgreSQL/flexibleServers@2024-08-01' = {
+  name: name
+  location: location
+  tags: tags
+  sku: {
+    name: 'Standard_B1ms'
+    tier: 'Burstable'
+  }
+  properties: {
+    version: '16'
+    storage: { storageSizeGB: 32 }
+    authConfig: {
+      activeDirectoryAuth: 'Enabled'
+      passwordAuth: 'Disabled'
+    }
+    highAvailability: { mode: 'Disabled' }
+  }
+}
+
+resource database 'Microsoft.DBforPostgreSQL/flexibleServers/databases@2024-08-01' = {
+  parent: postgres
+  name: databaseName
+  properties: { charset: 'UTF8', collation: 'en_US.utf8' }
+}
+
+// Entra ID administrator
+resource admin 'Microsoft.DBforPostgreSQL/flexibleServers/administrators@2024-08-01' = {
+  parent: postgres
+  name: principalId
+  properties: {
+    principalType: 'ServicePrincipal'
+    principalName: principalName
+    tenantId: tenant().tenantId
+  }
+}
+
+output fqdn string = postgres.properties.fullyQualifiedDomainName
+output databaseName string = database.name
+```
+
+## Environment Variables
+
+```bicep
+env: [
+  { name: 'PGHOST', value: postgres.outputs.fqdn }
+  { name: 'PGDATABASE', value: postgres.outputs.databaseName }
+  { name: 'PGPORT', value: '5432' }
+  { name: 'PGSSLMODE', value: 'require' }
+  { name: 'AZURE_CLIENT_ID', value: uami.outputs.clientId }
+  { name: 'PGUSER', value: uami.outputs.name }  // Entra principal name configured as PG admin
+]
+```
+
+## Authentication
+
+Use Entra ID (passwordless) authentication:
+
+```python
+# Python example
+from azure.identity import DefaultAzureCredential
+import psycopg2
+import os
+
+credential = DefaultAzureCredential(
+    managed_identity_client_id=os.environ["AZURE_CLIENT_ID"]
+)
+token = credential.get_token("https://ossrdbms-aad.database.windows.net/.default")
+
+conn = psycopg2.connect(
+    host=os.environ["PGHOST"],
+    database=os.environ["PGDATABASE"],
+    user=os.environ["PGUSER"],
+    password=token.token,
+    sslmode="require",
+)
+```
+
+## Node.js Connection
+
+```javascript
+const { DefaultAzureCredential } = require("@azure/identity");
+const { Client } = require("pg");
+
+const credential = new DefaultAzureCredential({
+  managedIdentityClientId: process.env.AZURE_CLIENT_ID,
+});
+const token = await credential.getToken(
+  "https://ossrdbms-aad.database.windows.net/.default"
+);
+
+const client = new Client({
+  host: process.env.PGHOST,
+  database: process.env.PGDATABASE,
+  user: process.env.PGUSER,
+  password: token.token,
+  ssl: { rejectUnauthorized: true },
+  port: 5432,
+});
+```
+
+## Firewall
+
+For Container Apps with VNet integration, use private endpoints or service endpoints.
+Without VNet, allow Azure services:
+
+```bicep
+resource firewallRule 'Microsoft.DBforPostgreSQL/flexibleServers/firewallRules@2024-08-01' = {
+  parent: postgres
+  name: 'AllowAzureServices'
+  properties: {
+    startIpAddress: '0.0.0.0'
+    endIpAddress: '0.0.0.0'
+  }
+}
+```
+
+> ⚠️ **Always disable password auth** — set `passwordAuth: 'Disabled'`
+> and use Entra ID authentication only.
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/redis/README.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/redis/README.md
new file mode 100644
index 000000000..15a401e37
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/redis/README.md
@@ -0,0 +1,120 @@
+# Redis Recipe — REFERENCE ONLY
+
+Azure Managed Redis (or Azure Cache for Redis) integration for Container Apps.
+
+## When to Use
+
+- Application caching (session, output, data)
+- Distributed state store
+- Rate limiting
+- Dapr state store backend
+
+## Bicep — Redis Module
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param principalId string
+
+resource redis 'Microsoft.Cache/redis@2024-03-01' = {
+  name: name
+  location: location
+  tags: tags
+  properties: {
+    sku: {
+      name: 'Standard'
+      family: 'C'
+      capacity: 1
+    }
+    enableNonSslPort: false
+    minimumTlsVersion: '1.2'
+    redisConfiguration: {
+      'aad-enabled': 'true'
+    }
+  }
+}
+
+// Data access — Redis uses its own access policy system, not ARM roleAssignments
+resource accessPolicy 'Microsoft.Cache/redis/accessPolicyAssignments@2024-03-01' = {
+  parent: redis
+  name: guid(redis.id, principalId, 'data-owner')
+  properties: {
+    accessPolicyName: 'Data Owner'
+    objectId: principalId
+    objectIdAlias: 'appIdentity'
+  }
+}
+
+output hostName string = redis.properties.hostName
+output sslPort int = redis.properties.sslPort
+```
+
+## Environment Variables
+
+```bicep
+env: [
+  { name: 'REDIS_HOSTNAME', value: redis.outputs.hostName }
+  { name: 'REDIS_PORT', value: string(redis.outputs.sslPort) }
+  { name: 'AZURE_CLIENT_ID', value: uami.outputs.clientId }
+  { name: 'REDIS_USER_OID', value: uami.outputs.principalId }  // objectId for Redis username
+]
+```
+
+## Access Policies
+
+Redis uses its own data access policy system (not ARM roleAssignments):
+
+| Policy | Access |
+|--------|--------|
+| Data Owner | Read + write data, manage access policies |
+| Data Contributor | Read + write data |
+| Data Reader | Read-only data |
+
+> ⚠️ **Do not use ARM `roleAssignments`** for Redis data access — those are control-plane only. Use `Microsoft.Cache/redis/accessPolicyAssignments` as shown above.
+
+## SDK Connection (Node.js Example)
+
+```javascript
+const { createClient } = require("redis");
+const { DefaultAzureCredential } = require("@azure/identity");
+
+const credential = new DefaultAzureCredential({
+  managedIdentityClientId: process.env.AZURE_CLIENT_ID,
+});
+
+async function createRedisClient() {
+  const { token } = await credential.getToken("https://redis.azure.com/.default");
+  const client = createClient({
+    url: `rediss://${process.env.REDIS_HOSTNAME}:${process.env.REDIS_PORT}`,
+    username: process.env.REDIS_USER_OID,  // objectId (principalId), not clientId
+    password: token,
+  });
+  await client.connect();
+  return client;
+}
+```
+
+## Dapr State Store
+
+Redis can also be used as a Dapr state store component:
+
+```bicep
+resource stateStore 'Microsoft.App/managedEnvironments/daprComponents@2024-03-01' = {
+  parent: env
+  name: 'statestore'
+  properties: {
+    componentType: 'state.redis'
+    version: 'v1'
+    metadata: [
+      { name: 'redisHost', value: '${redis.outputs.hostName}:${redis.outputs.sslPort}' }
+      { name: 'enableTLS', value: 'true' }
+      { name: 'azureClientId', value: uamiClientId }
+      { name: 'useEntraID', value: 'true' }
+    ]
+  }
+}
+```
+
+> ⚠️ **Always enable Entra ID authentication** via `aad-enabled: true`
+> and disable non-SSL port.
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/servicebus/README.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/servicebus/README.md
new file mode 100644
index 000000000..754f94ed4
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/servicebus/README.md
@@ -0,0 +1,121 @@
+# Service Bus Recipe — REFERENCE ONLY
+
+Azure Service Bus integration with KEDA scaling for Container Apps.
+
+## When to Use
+
+- Reliable message queuing between services
+- Pub/sub with topics and subscriptions
+- Worker scaling based on queue depth
+- Ordered message processing
+
+## Bicep — Service Bus Module
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param principalId string
+param queueName string = 'tasks'
+
+resource sb 'Microsoft.ServiceBus/namespaces@2024-01-01' = {
+  name: name
+  location: location
+  tags: tags
+  sku: { name: 'Standard', tier: 'Standard' }
+  properties: {
+    disableLocalAuth: true
+  }
+}
+
+resource queue 'Microsoft.ServiceBus/namespaces/queues@2024-01-01' = {
+  parent: sb
+  name: queueName
+  properties: {
+    maxDeliveryCount: 10
+    lockDuration: 'PT1M'
+    deadLetteringOnMessageExpiration: true
+  }
+}
+
+// RBAC — Azure Service Bus Data Owner
+resource rbac 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(sb.id, principalId, '090c5cfd-751d-490a-894a-3ce6f1109419')
+  scope: sb
+  properties: {
+    roleDefinitionId: subscriptionResourceId(
+      'Microsoft.Authorization/roleDefinitions',
+      '090c5cfd-751d-490a-894a-3ce6f1109419'
+    )
+    principalId: principalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+output namespace string = sb.name
+output fqdn string = '${sb.name}.servicebus.windows.net'
+output queueName string = queue.name
+```
+
+## Environment Variables
+
+```bicep
+env: [
+  { name: 'SERVICEBUS_FQDN', value: sb.outputs.fqdn }
+  { name: 'SERVICEBUS_QUEUE', value: sb.outputs.queueName }
+  { name: 'AZURE_CLIENT_ID', value: uami.outputs.clientId }
+]
+```
+
+## KEDA Scaling Rule
+
+Scale workers based on queue message count:
+
+```bicep
+scale: {
+  minReplicas: 0
+  maxReplicas: 30
+  rules: [
+    {
+      name: 'servicebus-scale'
+      custom: {
+        type: 'azure-servicebus'
+        metadata: {
+          namespace: sb.outputs.namespace
+          queueName: sb.outputs.queueName
+          messageCount: '5'
+        }
+        identity: userAssignedIdentityId
+      }
+    }
+  ]
+}
+```
+
+> 💡 **Tip:** Set `identity` to the UAMI resource ID to authenticate the KEDA scaler via managed identity instead of connection strings.
+
+## RBAC Roles
+
+| Role | GUID | Access |
+|------|------|--------|
+| Azure Service Bus Data Owner | `090c5cfd-751d-490a-894a-3ce6f1109419` | Full access |
+| Azure Service Bus Data Sender | `69a216fc-b8fb-44d8-bc22-1f3c2cd27a39` | Send only |
+| Azure Service Bus Data Receiver | `4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0` | Receive only |
+
+## SDK Connection (Python Example)
+
+```python
+from azure.servicebus import ServiceBusClient
+from azure.identity import DefaultAzureCredential
+import os
+
+credential = DefaultAzureCredential(
+    managed_identity_client_id=os.environ["AZURE_CLIENT_ID"]
+)
+client = ServiceBusClient(
+    fully_qualified_namespace=os.environ["SERVICEBUS_FQDN"],
+    credential=credential,
+)
+```
+
+> ⚠️ **Always set `disableLocalAuth: true`** — use RBAC only, never SAS keys.
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/selection.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/selection.md
new file mode 100644
index 000000000..674a9189a
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/selection.md
@@ -0,0 +1,97 @@
+# Template Selection Decision Tree — REFERENCE ONLY
+
+**CRITICAL**: Run Part A once to choose exactly one base template, then always run Part B to layer every matching recipe.
+
+**Architecture**: All deployments start from an appropriate base template for the workload (e.g., [web-app.md](web-app.md), [api.md](api.md), [worker.md](worker.md)).
+Integrations are applied as [composable recipes](recipes/README.md) on top of the base.
+See [composition.md](recipes/composition.md) for the merge algorithm.
+
+Container Apps hosts **any** containerised app — any language, any framework, any SDK.
+Event-driven processing with triggers/bindings uses [Functions on Container Apps](functions-on-aca.md).
+
+### Part A — Pick the Base Template
+
+```
+1. Is this event-driven with Functions triggers/bindings?
+   Indicators: BlobTrigger, ServiceBusTrigger, EventHubTrigger,
+               TimerTrigger, CosmosDBTrigger, DurableOrchestration,
+               host.json, @app.service_bus_queue, @app.schedule
+   └─► YES → Functions on Container Apps (see functions-on-aca.md)
+
+2. Is this a Container Apps Job (not a long-running service)?
+   Indicators: scheduled task, cron job, one-shot batch,
+               event-triggered processing, manual job
+   └─► YES → Job template (see job.md)
+
+3. Is this a microservices architecture?
+   Indicators: multiple services, service discovery, Dapr,
+               docker-compose with 3+ services, mono-repo with services/
+   └─► YES → Microservice template (see microservice.md)
+
+4. Is this a background worker / queue processor?
+   Indicators: queue consumer, long-running task, KEDA scaling on queue depth,
+               no HTTP ingress needed, worker process
+   └─► YES → Worker template (see worker.md)
+
+5. Is this a REST or gRPC API?
+   Indicators: REST API, OpenAPI/Swagger, gRPC, API gateway,
+               /api/ routes, Express/FastAPI/ASP.NET controllers
+   └─► YES → API template (see api.md)
+
+6. DEFAULT → Web app template (see web-app.md)
+```
+
+### Part B — Layer Integration Recipes
+
+After selecting the base template, always check whether the app needs integration recipes.
+Recipes are additive — apply every matching recipe independently on top of the base.
+See [composition.md](recipes/composition.md) for the merge algorithm.
+
+```
+Does it use Dapr?
+  Indicators: dapr.io/enabled annotation, Dapr SDK imports,
+              state store, pub/sub, service invocation
+  └─► YES → Add dapr recipe (recipes/dapr/README.md)
+
+Does it need a database?
+  Indicators: Cosmos DB, PostgreSQL, Redis, SQL
+  └─► YES → Add database recipe (recipes/cosmos/, recipes/postgres/, or recipes/redis/)
+
+Does it use messaging?
+  Indicators: Service Bus, Event Hubs, Storage Queues
+  └─► YES → Add messaging recipe (recipes/servicebus/README.md)
+
+Does it build/push container images?
+  └─► YES → Add ACR recipe (recipes/acr/README.md)
+```
+
+## Recipe Index
+
+| Integration | Recipe | Description |
+|-------------|--------|-------------|
+| Dapr | [recipes/dapr/](recipes/dapr/README.md) | Service invocation, state, pub/sub |
+| Cosmos DB | [recipes/cosmos/](recipes/cosmos/README.md) | NoSQL database |
+| Service Bus | [recipes/servicebus/](recipes/servicebus/README.md) | Messaging with KEDA scaling |
+| Redis | [recipes/redis/](recipes/redis/README.md) | Cache / state store |
+| ACR | [recipes/acr/](recipes/acr/README.md) | Container registry build + push |
+| PostgreSQL | [recipes/postgres/](recipes/postgres/README.md) | PostgreSQL Flexible Server |
+
+## Base Templates
+
+| Template | Use Case | File |
+|----------|----------|------|
+| Web app | General-purpose serverless web app | [web-app.md](web-app.md) |
+| API | REST / gRPC API services | [api.md](api.md) |
+| Microservice | Multi-service architecture | [microservice.md](microservice.md) |
+| Worker | Background processing | [worker.md](worker.md) |
+| Job | Scheduled / event / manual jobs | [job.md](job.md) |
+| Functions on ACA | Event-driven triggers/bindings | [functions-on-aca.md](functions-on-aca.md) |
+
+## Critical Rules
+
+1. **Container Apps is stack-agnostic** — any language, any framework, any container image
+2. **Use UAMI (User Assigned Managed Identity)** for all service connections — never connection strings
+3. **Always use `--no-prompt`** with azd commands
+4. **Never synthesize Bicep/Terraform from scratch** — use AZD templates or proven modules
+5. **Use KEDA scaling rules** for event-driven workloads (queue depth, HTTP concurrency, cron)
+6. **Disable local auth** on all backing services (Cosmos, Service Bus, etc.)
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/web-app.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/web-app.md
new file mode 100644
index 000000000..2bc241b89
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/web-app.md
@@ -0,0 +1,147 @@
+# Web App Template — REFERENCE ONLY
+
+High-scale serverless web app on Azure Container Apps.
+Supports any language/framework: Node.js, Python, .NET, Java, Go, Rust, etc.
+
+## When to Use
+
+- General-purpose web application with HTTP ingress
+- Frontend + backend in a single container
+- Any framework: Express, FastAPI, ASP.NET, Spring Boot, Gin, etc.
+
+## Project Structure
+
+```
+project-root/
+├── azure.yaml
+├── Dockerfile
+├── src/
+│   └── (application code)
+└── infra/
+    ├── main.bicep          # or *.tf
+    ├── main.parameters.json
+    └── app/
+        └── container-app.bicep
+```
+
+## azure.yaml
+
+```yaml
+name: my-web-app
+metadata:
+  template: container-apps-web-app
+services:
+  web:
+    host: containerapp
+    project: .
+    language: <js|ts|python|csharp|java|go>
+```
+
+## Bicep — Container App Module
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param containerRegistryName string
+param imageName string
+param envId string
+param userAssignedIdentityId string
+
+resource app 'Microsoft.App/containerApps@2024-03-01' = {
+  name: name
+  location: location
+  tags: union(tags, { 'azd-service-name': 'web' })
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: { '${userAssignedIdentityId}': {} }
+  }
+  properties: {
+    managedEnvironmentId: envId
+    configuration: {
+      ingress: {
+        external: true
+        targetPort: 3000
+        transport: 'auto'
+      }
+      registries: [
+        {
+          server: '${containerRegistryName}.azurecr.io'
+          identity: userAssignedIdentityId
+        }
+      ]
+    }
+    template: {
+      containers: [
+        {
+          name: 'main'
+          image: imageName
+          resources: { cpu: json('0.5'), memory: '1Gi' }
+        }
+      ]
+      scale: {
+        minReplicas: 1
+        maxReplicas: 10
+        rules: [
+          {
+            name: 'http-scale'
+            http: { metadata: { concurrentRequests: '100' } }
+          }
+        ]
+      }
+    }
+  }
+}
+
+output fqdn string = app.properties.configuration.ingress.fqdn
+output name string = app.name
+output principalId string = app.identity.userAssignedIdentities[userAssignedIdentityId].principalId
+```
+
+## Deployment
+
+```bash
+ENV_NAME="$(basename "$PWD" | tr '[:upper:]' '[:lower:]' | tr ' _' '-')-dev"
+azd init -e "$ENV_NAME" --no-prompt
+azd env set AZURE_LOCATION eastus2
+azd up --no-prompt
+```
+
+## Scaling
+
+| Rule | Trigger | Default |
+|------|---------|---------|
+| HTTP | Concurrent requests | 100 per instance |
+| Min replicas | Baseline instance count | 1 |
+| Max replicas | Burst limit | 10 |
+
+## Language-Specific `targetPort`
+
+| Framework | Default Port |
+|-----------|-------------|
+| Node.js (Express) | 3000 |
+| Python (FastAPI/Gunicorn) | 8000 |
+| .NET (Kestrel) | 8080 |
+| Java (Spring Boot) | 8080 |
+| Go (net/http) | 8080 |
+
+> ⚠️ **Set `targetPort` to match your app's listen port.** Mismatched ports cause 502 errors.
+
+## Health Probes
+
+Always configure liveness and readiness probes. See [health-probes.md](../health-probes.md).
+
+```bicep
+probes: [
+  {
+    type: 'liveness'
+    httpGet: { path: '/healthz', port: 3000 }
+    periodSeconds: 10
+  }
+  {
+    type: 'readiness'
+    httpGet: { path: '/ready', port: 3000 }
+    periodSeconds: 5
+  }
+]
+```
diff --git a/plugin/skills/azure-prepare/references/services/container-apps/templates/worker.md b/plugin/skills/azure-prepare/references/services/container-apps/templates/worker.md
new file mode 100644
index 000000000..73b5d8590
--- /dev/null
+++ b/plugin/skills/azure-prepare/references/services/container-apps/templates/worker.md
@@ -0,0 +1,189 @@
+# Worker Template — REFERENCE ONLY
+
+Background processing and long-running tasks on Azure Container Apps.
+
+## When to Use
+
+- Queue consumer (Service Bus, Storage Queue, Event Hubs)
+- Long-running background processing
+- No HTTP ingress required
+- Event-driven scaling with KEDA
+
+## Project Structure
+
+```
+project-root/
+├── azure.yaml
+├── Dockerfile
+├── src/
+│   └── (worker code)
+└── infra/
+    ├── main.bicep
+    └── app/
+        └── worker.bicep
+```
+
+## azure.yaml
+
+```yaml
+name: my-worker
+metadata:
+  template: container-apps-worker
+services:
+  worker:
+    host: containerapp
+    project: .
+    language: <js|ts|python|csharp|java|go>
+```
+
+## Bicep — Worker Container App
+
+```bicep
+param name string
+param location string = resourceGroup().location
+param tags object = {}
+param envId string
+param containerRegistryName string
+param imageName string
+param userAssignedIdentityId string
+param uamiClientId string
+// Service Bus params — provided by servicebus recipe, omit if not using SB
+param serviceBusNamespace string
+param queueName string
+
+resource worker 'Microsoft.App/containerApps@2024-03-01' = {
+  name: name
+  location: location
+  tags: union(tags, { 'azd-service-name': 'worker' })
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: { '${userAssignedIdentityId}': {} }
+  }
+  properties: {
+    managedEnvironmentId: envId
+    configuration: {
+      // No ingress — worker has no HTTP endpoint
+      registries: [
+        {
+          server: '${containerRegistryName}.azurecr.io'
+          identity: userAssignedIdentityId
+        }
+      ]
+    }
+    template: {
+      containers: [
+        {
+          name: 'worker'
+          image: imageName
+          resources: { cpu: json('0.5'), memory: '1Gi' }
+          env: [
+            {
+              name: 'SERVICEBUS_NAMESPACE'
+              value: '${serviceBusNamespace}.servicebus.windows.net'
+            }
+            { name: 'QUEUE_NAME', value: queueName }
+            {
+              name: 'AZURE_CLIENT_ID'
+              value: uamiClientId
+            }
+          ]
+        }
+      ]
+      scale: {
+        minReplicas: 0
+        maxReplicas: 30
+        rules: [
+          {
+            name: 'queue-scale'
+            custom: {
+              type: 'azure-servicebus'
+              metadata: {
+                namespace: serviceBusNamespace
+                queueName: queueName
+                messageCount: '5'
+              }
+              identity: userAssignedIdentityId
+            }
+          }
+        ]
+      }
+    }
+  }
+}
+
+output name string = worker.name
+```
+
+## Scaling Patterns
+
+### Service Bus Queue Scaling (KEDA)
+
+```bicep
+rules: [
+  {
+    name: 'queue-scale'
+    custom: {
+      type: 'azure-servicebus'
+      metadata: {
+        namespace: '<namespace>'
+        queueName: '<queue>'
+        messageCount: '5'  // scale up when > 5 messages
+      }
+      identity: userAssignedIdentityId
+    }
+  }
+]
+```
+
+### Event Hubs Scaling (KEDA)
+
+```bicep
+rules: [
+  {
+    name: 'eventhub-scale'
+    custom: {
+      type: 'azure-eventhub'
+      metadata: {
+        eventHubNamespace: '<namespace>'
+        eventHubName: '<eventhub>'
+        consumerGroup: '$Default'
+        storageAccountName: '<checkpoint-storage-account>'
+        blobContainer: '<checkpoint-container>'
+        unprocessedEventThreshold: '64'
+      }
+      identity: userAssignedIdentityId
+    }
+  }
+]
+```
+
+### Storage Queue Scaling (KEDA)
+
+```bicep
+rules: [
+  {
+    name: 'storage-queue-scale'
+    custom: {
+      type: 'azure-queue'
+      metadata: {
+        accountName: '<storage-account>'
+        queueName: '<queue>'
+        queueLength: '5'
+      }
+      identity: userAssignedIdentityId
+    }
+  }
+]
+```
+
+## Key Differences from Web App
+
+| Aspect | Web App | Worker |
+|--------|---------|--------|
+| Ingress | External HTTP | None |
+| Scale trigger | HTTP concurrency | Queue depth / events |
+| Min replicas | 0–1 | 0 (scale to zero) |
+| Health probes | HTTP liveness/readiness | TCP or none |
+
+> ⚠️ **Workers with no ingress cannot use HTTP health probes.**
+> Use TCP probes or omit probes and rely on container restart policy.