Repository navigation
EN completion roadmap
Repository home | Français | Validation ledger | Latest execution report
The planning deliverable is complete. The workshop execution is not complete. This roadmap identifies what must be done before that claim is justified. Unchecked tasks are work to execute, not promised or observed outcomes.
The bilingual documentation completion pass covers the repository home, English index, French index, all eight lab units (0, 1, 2, 3, 4, 5.1, 5, 6) and both roadmaps. Each lab has a counterpart, acceptance criteria and evidence links. Use lab coverage and resume tasks for the remaining work, not a whole-lab restart.
Documentation delivery does not close T001/T002/T005/T006/T007/T009/T010/T011/T012/ T014/T015/T016/T017. The current separate F6 matrix is 8 PASS, 2 PARTIAL, 0 FAIL and 2 NOT_RUN; the original eleven-scenario matrix remains 10/11, with two case-9 failures and no third replay. F6-09 and the two French static wrappers are scoped passes under an explicit language override, not proof of native picker repair, automatic detection or full static localization. Historical failures below remain.
The wiki mirrors these canonical guides: English | Français. Follow the shared publication checks after source changes; delivery of this documentation does not itself publish a new wiki snapshot.
The public F6 crosswalk and synchronized Lab 6 guide/validation ledger deliver reconciliation and publication, not whole-lab runtime completion. T017 remains unchecked. F6-01/02/03 are historical offline PASS; F6-04 is PASS; F6-05 is PASS at document level with the displayed-excerpt limit below. F6-07 is PASS and F6-08 is response-only PASS; F6-06/12 remain PARTIAL. F6-09 is PASS under an explicit language override; F6-10/11 remain NOT_RUN. At the initial offline checkpoint on 2026-10-26, F6-04/05 were NOT_RUN and F6-08 was PARTIAL; that reconciliation submitted zero questions/live attempts.
The exact multi-source check passes F6-07: one question, one completed native MCP invocation, two pinned-corpus records and two applicable groups, investigation procedures and regulatory compliance. The attributed comparison invents no rule and has a noncancelled completed plan. This prospective MCP proof does not join the historical original specialist's tool output.
The routing-repair receipt
preserves the original F6-06 FAIL: the unanchored intake matched hi inside Which.
Only that condition changed, adding ^...$ and reviewing a case; the saved native
topic passed its checker. A separate four-question, four-conversation cohort had no
in-cohort retries. F6-06 now passes supported MCP retrieval with two verified records
and a completed plan, but remains PARTIAL because the original connected-Foundry-child
invocation is unproved. F6-04/05 regressions pass within their existing limits.
F6-09 FAIL is preserved: grounding and core lineage passed, but final prose was English.
Topic component-version proof remains NOT_ESTABLISHED; no agent publish occurred.
The language-configured attempt
added secondary fr-FR, leaving primary en-US unchanged. Its new English Send
displayed Cannot send empty message: one intent/click, zero observed accepted
questions within 240 seconds, server acceptance NOT_ESTABLISHED. French was not
selected or sent; this attempt is NOT_RUN, not a replacement for the completed FAIL.
Test-session language and English restoration remain unverified. Automatic detection
and complete static-topic localization are not proven. Publication submits no questions.
The later single French-text check
proved delivery, not French acceptance: one accepted question after verifying the
real textarea and 60/2000 counter, but activity and reply locales were en-US
and final prose was English. One completed MCP call returned three verified records,
including both core records from the earlier supported English base; its corpus,
instructions and model were unchanged, but French secondary was added afterward.
The noncancelled plan completed in 71.232 seconds from server receipt to reply
(76.134 seconds from Send). No new English question or resubmission occurred.
Both language radios still exposed aria-checked=false after a separate native
keyboard control without a question. That historical F6-09 remains FAIL; its selection cause is
unproved. The previous delivery failure and guarded NOT_RUN remain intact.
The supported localization repair
used official PAC 2.14.1 through the existing enterprise NuGet proxy, without
authentication or TLS changes. The native French upload succeeded; independent
exports prove all 155 English values unchanged and 97 translated runtime values
persisted after label/trigger normalization. Complete Windows extended-length
enumeration verifies all 39 existing core draft files byte-identical and 22 French
translation files added; the earlier 35-file short-path subset was incomplete.
After a full reload, French selection still leaves both
radios aria-checked=false, and a no-question fresh session greets in English.
At that localization-only checkpoint the French question was NOT_RUN and the
last completed F6-09 was FAIL.
Full static localization and the selection cause remain unproved; see #5.
The later explicit language-switch cohort
passes F6-09: executed System.User.Language reads back French, the unchanged
question receives French prose and a completed grounded plan, while actual
posted/reply Activity.Locale remains en-US. The English regression also passes;
F6-06 overall remains PARTIAL because the original Foundry-child route is unproved.
Two fresh conversations contain five accepted messages: two domain questions and
three deterministic controls, no resubmissions. Each domain turn completes one MCP
operation; English retrieves one record and French two, sharing one ATO core record.
English restoration is proven in the same second conversation. All 1,288 historical
files retain hashes/timestamps; a fresh complete clone verifies all 63 non-token
files and 22 translations unchanged. Native picker repair, automatic detection and
continuous execution-version proof remain unproved. Earlier FAIL/NOT_RUN results
and the collector's failed echo wait remain preserved; no message was replayed.
The later two static French wrappers
pass their scoped native checks: one fresh conversation, four accepted messages
(two lookups and two language controls), four Send clicks and zero retries.
CTR and SAR replies exactly match the corrected French resources, retaining all
12 literal quotations and individual references. They are static snapshots, not
live retrieval; native retrieval/MCP/Foundry invocation counts are zero.
French System.User.Language and English restoration are proven; actual posted/reply
Activity.Locale remains en-US. The persisted override is restored, not cleared.
One localization upload persisted both wrappers. Strict candidate-map and two-file-only
guards failed and remain failures: a read-only audit explains 41 reordered positions
with all 42 Escalate phrases preserved, one materialized French fallback component
and component bookkeeping. Complete clone accounting is 64 to 65 files; the native
postflight preserves all 64 non-token files, 23 French translations and 50 components.
All 158 English/153 French resources and 1,814 historical files remain exact at that
postflight. A strict UTF-8 BOM failure is retained; BOM-aware validation used unchanged
files without another export or message. This separate cohort does not prove full
static localization, picker repair, automatic detection or T017 completion.
The exact private-history check
is F6-08 response-only PASS: one question, no replay or extra Hello, on the same
frozen prospective configuration as F6-04/05. The complete final reply acknowledges
that configured evidence cannot establish private customer history and refuses
inference, without invented events or fictional-corpus substitution. A native final
message and matching terminal fallback EndDialog/completed no-answer state are
proven, but plan closure remains unproven: no DynamicPlanFinished within 240 seconds.
One completed local search returned three records. An MCP label lacks correlated
invocation/output; actual MCP and underlying Foundry counts are NOT_ESTABLISHED,
not zero. This is distinct from original matrix case 9, not architecture equivalence
or T017/workshop completion. Publication submits no questions.
The two exact native checks
record the earlier cohort: two questions, one per fresh conversation, no preflight questions
or replay. F6-04 completed clarification with activityProcessed=true, no retrieval
or Foundry/MCP evidence calls (0.118 seconds from server receipt to final reply).
F6-05 completed one local SearchAndSummarizeContent, a noncancelled
DynamicPlanFinished and no Foundry/MCP evidence calls (70.618 seconds).
Document-level support for Account Takeover is proven in another actually retrieved
chunk of the same source; the displayed citation excerpt lacks the ATO row.
Exact citation-chunk support, excerpt fidelity and global citation quality are not
proven. This frozen prospective MCP-adapted existing original specialist
configuration uses actual Ready MIT publisher Markdown, not historical baseline
equivalence; original DOCX ingestion remains Error. Postflight root/settings,
instruction digest, source versions, publisher hashes and archives were unchanged,
without a second full component export. The live checks edited/published nothing
and created no resources. Publication submits no questions. No further export or
secret is needed for these two completed checks.
Source-backed intake/local knowledge/grounded expertise/multi-source work, three datasets and cleanup are distinguished from guide-added checks and exact prompt variants. F6-05 wording in setup instructions was not proof of execution at the initial offline checkpoint; the new receipt closes only these two checks. Different guide wording alone is not a new universal original gate or an instruction to restart verified work. Additional requirements in the protected main source remain UNKNOWN, with no bypass or reconstruction. Native annotation arrays, publisher URLs and verbatim quotations remain excluded as universal original gates; historical failures and quotation passes remain.
Original specialist native 4/4 does not certify the diagnostic extension or independently join its underlying native MCP results. The separate candidate's previous 11/11 includes a retry; current post-control results are 10/11, with two case-9 failures, unproved cause and no third replay. Hosted v3 T003/T004 passed 3/3, but retained hosted v5 is not native-certified or cleaned by older receipts. Lab 5 Search denial and blueprint HTTP 400 do not close F6 Foundry denial or the missing-Activity negative/repair pair. Only unresolved, justified criteria may advance after their own supported prerequisite and approved scope; the workshop remains incomplete.
The planning baseline is commit 94ebcd3 and the retained execution evidence.
Local verification on October 22 passed 47 documentation
tests, 33 extension tests, dependency consistency and Python syntax checks.
Those results do not establish live acceptance. The October 23 continuation below
adds current read-only inventory, not a deployment or a live acceptance pass.
All eight lab units, including supplement 5.1, have execution evidence. No lab is wholly untouched. Lab 6 is not an unstarted lab. An attempted lab is not necessarily a passed lab, and a completed execution task such as T008 does not mean every assertion in that run passed.
The per-lab execution record preserves the earlier runs. The dated continuations below and the backend report record later outcomes. The table identifies remaining gates, not instructions to restart each lab.
| Lab | Work already exercised | Remaining gate | Resume tasks |
|---|---|---|---|
| 0 | Identity, roles, quota, tools and paid-test preflight | Complete readiness, numerical budget and resource ownership review | T001,T002,T009 |
| 1 | PDF retrieval, refusal, directory lookup, email delivery and PDF hash | Historical full answer, original citation and connector error audit | T009 |
| 2 | Private licensing-PDF ingestion and earlier connected answer tests | External PDF citation navigation and current connected-source proof | T010 |
| 3 | Native topic and one genuine event correlated in KQL | Published-channel behavior and the required privacy boundary | T010 |
| 4 | Direct model invocation and actual Standard BYOM dialog inspection | API-key/keyless-policy conflict, then connected prompt acceptance | T011,T012 |
| 5.1 | Corrected paid deployment, private pipeline and guarded cleanup | Retain reviewed deviations; no unchanged-source apply claim | T013 done; T014,T015 |
| 5 | Retrieval, filters, hotel answers and fictional native Search cohorts | Original hotel URLs/corpus limits and paired native denied identity | T014 |
| 6 | Notebook, embeddings, three-source retrieval, MCP, hosted and native tests | Native verified route, remaining assertions and retained-resource scope | T005,T006,T007,T017 |
Lab 6's hosted repair is T003/T004, native verified delivery is T005/T006,
and its eleven-scenario continuation is T007/T008. T017 reconciles the separate
F6-01 through F6-12 acceptance matrix with those retained runs. That mapping
is now delivered in the linked crosswalk; the guide distinguishes exact versus
related evidence. Earlier failures are preserved, not silently upgraded.
Plan numbers are not lab numbers: plan 6.1 is Lab 4 BYOM, not Lab 6.
- Select one unresolved acceptance ID or task and its retained evidence. Preserve verified completed work; do not recreate infrastructure or rerun a whole lab merely because a different criterion is blocked.
- Before a live retest, record the exact blocker and a supported change or newly available prerequisite. Freeze the expected result and a one-shot submission intent. A fresh disposable cohort is a separate attempt, not a repaired past run.
- If the same failure persists, stop that criterion, retain the failure and verify cleanup. Without a new diagnostic or supported change, do not create another equivalent cohort or ask for the same manual secret entry again.
- Advance independent criteria instead. Historical-answer recovery cannot be replaced by a new answer; direct/backend controls cannot replace native acceptance; governance and source facts cannot be invented.
- Update the exact acceptance rows and bilingual evidence after reconciliation. Mark the workshop complete only against the final checklist, not because every lab has been attempted.
A separate integrated-user probe
uses the native Microsoft Entra ID Integrated choice and the ai:// namespace
documented in the Search connector reference.
Exactly one Create stops with the explicit connection-consent popup-blocked
error. OAuth does not complete; Next stays disabled and the index picker never
runs. There is no picker HTTP status, response body or correlation to report.
The VS Code browser documentation
states that popups are blocked. Use normal OAuth in a supported external browser
before another bounded picker diagnostic; do not bypass popup/token handling,
repeat questions or expand permissions.
Cleanup verifies the original seven connections exactly, no persisted probe connection and no guessed deletion. Complete long-path-safe PAC comparison preserves all 63 non-token files, 22 French translations and 49 components across 64-file snapshots. Zero questions, source additions, agent saves, publications or Azure writes. No continuous external-state audit is claimed. This is not a replay or repair of the earlier service-principal HTTP 400. S5-10/T014/T016 and effective native principal/retrieval acceptance remain open.
The two isolated OAuth service-principal cohorts
each saved a Connected connection after manual credential entry and exactly one
native Create. Both index pickers displayed Something went wrong., a console
HTTP 400 and disabled Add to agent. The response body was unavailable; neither
the specific cause nor the effective native runtime principal is established.
The first principal had only Search Index Data Reader at its disposable index,
a documented metadata-listing gap, not proven 400 causation. The second had
exactly two verified assignments: the same index-only Reader plus a separate
custom role at the existing Search service with only
Microsoft.Search/searchServices/indexes/read in Actions, no DataActions,
writes or operations/read. This exposes service-wide index metadata, not
service-wide document access. Direct listing and its own synthetic canary query
passed, but native selection still failed. Metadata addition is not a proven fix.
Neither cohort added a source, bound an index, reached field mapping/readiness, or submitted any native positive, native negative or model question (all zero). Post-revocation direct 403 and no-leak acceptance were not run/proved. Connected and direct controls are not native acceptance or a partial paired pass. The dedicated diagnostic issue asks for a supported picker/GetIndexesSchema diagnostic and minimum permission contract, without asserting a service defect. S5-10, T014 and T016 stay open.
Both independent cleanups verify zero owned resources, explicit credential revocation/deletion and protected secret-file removal. The first retains a PAC environment-filter error and a DNS verification error, each separately recovered without deletion replay; the second guarded cleanup and separate verification had no errors. Five original agents, seven connections, three schemas, full Search configuration/unowned roles and definitions, embedding roles, hosted v5 and 181 historical files remain exact. No original, authentication/network, key-authentication or public-storage change, M365 publish or ZIP import occurs.
The read-only endpoint investigation
follows Microsoft's newly linked
publishing-model guidance.
It distinguishes the legacy Agent Application route from the agent's own stable
endpoint. Both original-agent GETs, with and without the documented feature
header, return 200 and byte-identical complete bodies. The existing agent already
has an endpoint, blueprint and instance identity, enabled state, latest version 5,
Activity/Invocations and unchanged Entra/BotServiceRbac. Protocol configuration
and version selection are nested under agent_endpoint; publication approval is
not_published.
The new model is therefore already present, not an untried migration fix. No agent, endpoint, identity, permission or version selector is written, and no question is submitted. Current authorization guidance retains Entra as an AzureRbac alias and distinguishes direct access from Bot Service publishing. It does not establish the cause of the preserved native error. The six legacy application failures remain failures; T005/T006 and final acceptance stay open.
An offline identity correlation matches the historical error's activity blueprint ID to the approved administrator's directory object ID. The summary ID matches the target blueprint client ID, which is unchanged between saved v3 and current v5; the instance client ID is also unchanged. This localizes the observed mismatch, not its upstream cause or a fix. No new request, question, caller override or permission change occurs.
The separate paired-SP recovery was interrupted before native submission: durable intents record zero authorized and zero denied questions, with no queued or consumed submission operations. Recovery removes the owned short-lived credential, application, service principal, draft, four role grants, Search service/index and resource group. Independent reads verify absence; no disposable connector connection reached a create intent. Five original agents, seven connections, three Search schema hashes, hosted retrieval v5 and the embedding resource's complete role inventory are preserved. All 181 historical files remain unchanged, including the earlier no-create hold.
The actual native portal inventory redirects to sign-in. Official PAC inventory and Dataverse draft 404 are verified, not portal inventory absence. No login, question replay, privilege elevation or shared authentication change occurs during recovery. Spending is not finalized. This is cleanup, not a paired revocation pass; S5-10, T014, T016 and the workshop remain open.
The native connected recovery
supersedes the earlier blocked-popup condition. The formal Entra connector's
documented ai:// namespace fails its native connection test and saves nothing.
A separately guarded HTTPS service endpoint succeeds through real OAuth.
An isolated unpublished Standard draft binds only the two-document fictional
Harbor/Forest index; native knowledge is Ready. Supported portal saves and
independent official clones verify web search and general model knowledge Off,
with the original model, authentication and topics preserved.
The initial frozen four-case cohort passes 3/4: the French question returns
English despite correct facts and citations. That failure is retained.
The agent had no secondary language. Adding French is the only configuration
change; the French test-session language is then selected explicitly.
A separate frozen cohort passes 4/4: Harbor opens at 07:00, Forest closes
at 21:00, the unsupported shuttle price produces an explicit abstention, and
the French answer preserves each fact with its actual citation.
All eight separate conversations have real native Search traces and matching
retrieved citation snippets. No question is automatically replayed or acceptance
combined across configurations. Automatic typed-language detection is not proved.
Eight official diagnostic archives are retained privately. One recovery bicycle
archive has an empty configuration payload; the other three recovery payloads
match, and independent before/after clones verify all 17 authored YAML files
unchanged. The official validator still fails with
Cannot find module '@azure/msal-node-extensions'; native portal/readback success
is not YAML-schema-validation success, and no bundle is patched.
One actual native citation click opens the immutable published fictional source in a new tab with both exact facts visible; the browser drops the section fragment. This establishes S5-04/S5-07/S5-08/S5-09 only in the fictional native scope. The draft, connection and temporary index are deleted, with independent absence checks, five prior agent IDs, seven prior connection name/connector/status rows and all three original Search schema hashes preserved. The owned browser closes normally; no ARM resource, role, policy or original authentication changes. Original hotel URLs/corpus acceptance and the genuine denied-identity test remain open. T014, broader release/governance gates and the workshop remain incomplete.
The separate keyless Search test
fails S5-10: an authorized native baseline passes, but the one later native
question returns Harbor 07:00 with a genuine citation after direct Search
queries return 403. Only a new owned index Reader grant on the isolated service
is removed; no original administrator permission changes. This uses the same
administrator, not an independently unprivileged identity.
The actual native trace has two fixture records and no Search error.
Effective native principal and cause remain unproved.
The interrupted read is preserved; the existing conversation's official snapshot is recovered without question replay. Both configuration payloads match and an independent clone verifies 17 unchanged authored files. All owned test objects, including the billable Search service and cross-resource embedding grant, are deleted and independently checked. Original agents, connections, embedding account/roles and Search schemas are preserved; the owned browser closes normally. Actual spending is not finalized. The earlier 4/4 fictional cohort is unchanged. S5-10, T014 and T016 stay open.
The later read-only identity investigation finds a successful Search-connector sign-in for the approved administrator before revocation. The native Search event is about 165 seconds after the deletion intent, not a measured interval after deletion completion. Azure's general RBAC guidance allows up to ten minutes for propagation. Neither timing nor sign-in establishes the failure's cause or effective per-request principal; Search diagnostics do not expose the accessing identity.
The revocation readiness guard
now rejects premature native test preflights. Run
python scripts\check_revocation_readiness.py <private-preflight.json> from the
repository root. It requires independent assignment 404, direct query 403,
verified native connection principal and a fresh conversation, with ordered
UTC-offset timestamps: confirmed revocation, at least 600 seconds, connection
authentication, direct denial, then fresh conversation. A deletion-intent time
cannot replace confirmed revocation. This checks supplied evidence only; it
does not certify native denial or an organizational revocation SLA. The failed
historical question is not replayed or reclassified.
The JSON fields are assignmentGetStatus, directQueryStatus,
nativeConnectionPrincipalVerified, freshConversationVerified,
revocationVerifiedAtUtc, nativeConnectionAuthenticationVerifiedAtUtc,
directQueryVerifiedAtUtc and freshConversationVerifiedAtUtc.
Use actual independently recorded checks, not estimated or invented timestamps.
Direct denial and conversation verification must be at most 120 seconds old
when the guard runs; this local preflight freshness limit is not a service SLA.
The fresh delayed-denial preflight uses a new keyless Basic Search service and the same two fictional fixtures. The direct authorized baseline and vectorization pass. Owned Reader removal is independently confirmed at 404; the actual wait is 600.001 seconds before creating a new formal Entra connection. Subsequent direct queries return 403. A new unpublished Standard draft binds only this index, reaches native Ready, and preserves source-only instructions with web/general knowledge disabled.
Bounded interactive and noninteractive Graph reads do not establish a successful fresh Search-connector sign-in. Account metadata is not substituted for principal proof, and no authentication timestamp is invented. The executable guard returns BLOCK. The official export confirms zero user questions and zero source executions, with only the greeting displayed. Ready is not query acceptance; the missing audit evidence does not establish an authentication failure or cause. This is not a paired authorized-native/removal test or an S5-10 pass.
The owned draft, connection, four roles, Search/index and group are removed. A separate parent read verifies both ARM objects and all four role GETs at 404, the five original agent rows, seven connection rows, original embedding account/ complete roles and three schemas exactly preserved. Both owned browser generations close normally with no pending commands. Actual spending is not finalized; existing workshop resources are not claimed absent. The historical failure is unchanged; S5-10, T014 and workshop acceptance remain open.
A separate later read at 00:57:46 UTC finds one successful approved-admin Search-connector sign-in timestamped 00:36:59 UTC, inside that completed cohort's authentication window. Earlier bounded reads had not established it; exact audit-availability latency is not measured. The receipt retains both observations separately. This read makes no resource/permission write or native question and does not recreate the deleted cohort, retrospectively pass its guard or establish a native query result. A future cohort must establish its own authentication evidence, not reuse this event.
The fresh guarded recovery executes the closing-time question exactly once on another isolated fictional cohort. Its direct authorized baseline succeeds. Reader removal is confirmed at 404, followed by 600.002 seconds before new connection creation. The new cohort's successful connector sign-in is independently observed before testing; no authentication evidence from a deleted cohort is reused.
The unchanged public guard passes immediately before submission. Direct 403
evidence is 38.226 seconds old and the fresh conversation check 0.136 seconds
old. Native Search returns ConnectorRequestFailure / AzureAISearchClientError,
with zero returned/verified records and zero citations. The native trace
exposes no HTTP status; this is not claimed as native HTTP 403. The complete
parent reply is: “I'm sorry, I'm not sure how to help with that. Can you try
rephrasing?” The UI also displays “No information was found that could help
answer this.” No source fact is returned, but a permission-specific parent error
is not established.
This is direct authorized baseline plus native denied-from-first-use, not a paired authorized-native/removal test or an independent unprivileged identity. It does not establish effective per-request caller, historical root cause or S5-10/T014 acceptance. Neither the earlier no-leak failure nor the blocked preflight is reclassified, and acceptance is not combined across cohorts. Official export and unchanged authored configuration are preserved. Owned draft, connection, four roles, Search/index and group are independently absent; a parent read confirms the original five agent rows, seven connection rows, embedding account/complete roles and three schemas exact. The owned browser closes normally, with zero pending commands. Actual spending and broader workshop gates remain open.
The read-only original-history follow-up separates recovered directory authentication from Dataverse authorization. A Graph CAE challenge and timed-out normal browser login remain recorded. A later independent Graph read succeeds for the approved administrator, with Global Administrator membership and the approved subscription verified. No device login starts; the cause or exact latency of recovery is not established.
Power Platform's admin environment read succeeds, but Dataverse's original-agent
transcript query returns 403, missing prvReadconversationtranscript.
After authentication recovery, its direct roles remain Basic User and
Environment Maker; transcript-read and role-create/assign capabilities remain
absent. A new five-defined-privilege audit succeeds without reclassifying an
earlier incomplete assertion that requested a nonexistent privilege name.
No role or transcript policy is changed and no broad self-elevation is attempted.
The exact October 19 History run still shows In progress, its greeting and the original question, with no complete answer. No question is replayed, historical answer reconstructed or newer answer substituted. T009 remains open; a tenant administrator read is not a transcript-access or historical-accuracy pass.
The original licensing History follow-up recovers the exact October 19 question in the original agent. Its run remains In progress, with no completed answer exposed, including after one normal Refresh. No answer is reconstructed. A separate October 24 completed history contains a different question and cannot replace the original audit. Its nine inline citations have empty destinations; one normal citation click exposes no source dialog, PDF viewer, download or new tab. Only UI controls change. The retained approved PDF is unchanged. No new question or configuration write occurs, and the owned browser closes normally. T009 remains open.
The wiki publication checkpoint
records the actual public destination without changing visibility. All 133
previously tracked wiki files match the prior generated canonical baseline,
so no divergent human edit is overwritten. The 38-page validated bilingual
snapshot is normally pushed to the actual master branch; independent remote
revision reads and rendered English/French pages verify publication, including
the incomplete 10/11 regression. A failed first English browser open and normal
navigation recovery are retained. This closes the publication portion, not
T016 or workshop acceptance. Private evidence and original PDFs are not published.
The new scoped inventory independently verifies the approved administrator, tenant and subscription, then reads six exactly owned ARM resources: the retained Foundry account/project, Search and Bot, plus the isolated MCP App Service and B1 plan. Provisioning succeeds and the site is Running. This is not a fresh audit of every model, hosted definition, identity permission or tenant resource.
The narrowly filtered billing query initially returns HTTP 429. One separately recorded recovery after backoff succeeds; the original failure remains. It reports USD 11.26126391 pretax for October 20 through the October 25 query cutoff. Only two of the six resource IDs have posted cost rows. This is neither a final invoice nor complete current spending; missing rows do not mean free resources, and Copilot credits are excluded. No configuration, inference or native question is submitted during this refresh.
The governance form returns only user-unavailable placeholders, not an owner, review date, numerical budget or attributable Product Owner/Security/Tech Lead sign-offs. None is invented. T001/T002 and dependent release gates remain open; general deployment and spending authorization is preserved, not requested again.
Human-assisted administrator sign-in now succeeds. The candidate recovery receipt records independently verified PAC identity/environment, official clone and scoped draft pushes. This supersedes the earlier authentication/clone blockers below, not the retained plugin dependency-policy failure. No policy is bypassed.
The first strict-lookup native test failed: orchestration chose Search sources rather than the intended topic. Independent readback also found distinct CTR/SAR component identities carrying identical CTR dialog bodies. The intermediate copy cause is unknown; the evidence does not establish that PAC caused it. That failure remains unchanged.
Author corrected both topics to narrow anchored message gates with literal
responses and explicit conversation completion. Eight local tests and 31 schema
checks pass. The three changed authoring files match an independent remote clone.
The corrected native run
passes original CTR, narrow SAR deadline and source-free intake cases, once each.
All 12 local table values, individual attributions, conditions and snapshot
disclosures match. These static snapshots are not live retrieval or native
citation-navigation repairs; selected-topic traces and DynamicPlanFinished
are not exposed.
The broad SAR routing regression preserves the specialist route but fails quotation fidelity and completeness. A one-component parent-instruction correction passes 33 local checks and seven schema checks, is pushed and exactly read back. Its separate repaired native run passes routing and coverage across two visible messages, but only 15/16 quoted excerpts are exact. An earlier provisional limitation also conflicts with the later local insider-abuse exception. Correct final synthesis does not erase earlier user-visible errors. The actual external Activity action exposes no supported per-action suppression/capture switch in the installed schema. No unsupported YAML or change to the protected retriever is applied. A documented non-emitting evidence contract remains an integration prerequisite, not an implemented or accepted substitute.
The final current-draft regressions again pass CTR, narrow SAR and intake 3/3, with one final answer each, no extra paraphrase and no retries. The independent preservation check verifies the original parent and all 26 complete component rows unchanged. The candidate has exactly 28 components: two owned topics and one existing instructions-only edit. Diagnostic Off, both specialists On, published timestamp, authentication/access/trigger 2/2/1, all four uploaded file hashes and both approved bindings are preserved. No publication occurs.
T007/T008 remain open at whole-output fidelity and the eleven-case matrix. Native hosted-diagnostic authorization, actual Lab 1 navigation, historical full-answer provenance, Lab 2 restoration, other connected lab criteria, retention ownership/budget and attributable signoffs remain separate gates.
The actual tenant onboarding check finds Streamable HTTP and manual OAuth configuration in the candidate's MCP wizard. It is cancelled without entering credentials, creating a connection or submitting another native question. No unavailable design response is counted as human approval; isolated local work continues under existing authorization.
An optional MCP entry point now reuses the existing verified retrieval and renderer as a structured data tool, without sending chat activities. Non-loopback exposure requires full Entra configuration: tenant, API audience, allowed OAuth clients/users and delegated scope. Signed-token and real HTTP protocol tests cover rejection, provenance, literal output, abstention, parser/body limits and cancellation. The existing Activity/Invocations entry point and production manifest are unchanged.
The real local MCP proof
uses the official client and one unchanged original SAR question, without retry.
It returns two exact records, rc-002 and ip-006, with matching renderer text
and structured provenance; the protected retriever definition is identical
before and after. This is local data-contract evidence, not real Entra MCP OAuth,
remote MCP deployment, candidate binding or native whole-output acceptance.
No additional Azure resource is created for this local proof. The subsequent
hosted continuation below supersedes its remote-deployment boundary.
The hosted preflight
now verifies a separate Python 3.13 App Service: HTTPS only, TLS 1.2 minimum,
FTP disabled and both basic publishing policies disabled. Missing and invalid
bearers each receive 401; protected-resource discovery returns 200 with
the intended tenant, resource and Evidence.Read scope. The allowlisted source
package contains five Python files and two dependency manifests, not credentials,
environment files, caches or tests. The original Foundry deployment is untouched.
Two owned single-tenant registrations separate the API and connector client. Only the dedicated delegated scope is requested, with no Graph permission or tenant-wide consent. The server explicitly selects managed identity for outbound calls and has one existing-account-scoped OpenAI User role. This configuration is read back; at this preflight checkpoint, genuine delegated access and managed-identity retrieval are not yet verified. The runtime continuation below supersedes only the outbound-retrieval boundary. A seven-day client credential is kept in current-user DPAPI; the supported PAC input is access-restricted and deleted after use.
Official PAC creates one MCP connector after correcting its first local title-length validation failure. Its actual native catalog entry and generated unique OAuth callback are independently read back; that callback is registered and verified on the owned client. The original failed attempt is retained.
The browser administrator is independently confirmed, but the native connection's consent popup is blocked. The VS Code browser documentation confirms that popups are blocked while new tabs are allowed. A normal new-tab authorization-code/PKCE flow reaches the intended administrator's password prompt. The user-response tool reports unavailable, not approval or successful sign-in. The bounded loopback helper is stopped, its port is verified closed and its temporary redirect is removed; the actual connector callback remains. There are zero new paid MCP tool calls, native questions or candidate bindings.
The fresh preservation readback again verifies all 26 original rows, the same 28 candidate components, exact authoring hashes, files, bindings and Off/On/On states. The protected retriever, current hosted version-5 definition and its principal/client IDs also match. No Storage policy/network change or publication occurs.
The separate Sweden Central Linux B1 plan remains running and billable. The published compute estimate is USD 0.018/hour, not an actual bill, Copilot-credit total or approved numerical budget. Retention owner/review date and attributable signoffs remain missing.
This handoff originally planned current-user-only evidence consent in a popup-capable browser. The user's later explicit tenant-wide approval, recorded below, supersedes that planned consent boundary. Historical receipts remain unchanged; deployment permission alone was not treated as tenant-wide consent.
The actual hosted runtime proof
now passes the unchanged original SAR question inside the App Service app
container, not the separate deployment container. Microsoft's signature,
tenant and owned identity are verified without persisting tokens. The selected
credential chain contains only managed identity; all five deployed source hashes
and the retrieval configuration match their baselines. Both returned records,
rc-002 and ip-006, and the complete rendered text independently match the
pinned corpus. The protected retriever is unchanged before and after.
Two earlier real retrieval attempts remain recorded as HTTP 403 failures.
An existing-response read identifies agents/read; no-inference authorization
probes separate permission propagation from actual retrieval success.
The project Responses route requires the compatibility role's two data actions:
Microsoft.CognitiveServices/accounts/AIServices/agents/read and
Microsoft.CognitiveServices/accounts/AIServices/agents/write.
The write action also permits agent authoring; no agent-authoring request is made.
Only this project-scoped custom assignment remains on the owned app identity.
The account-scoped model role and two trial runtime/consumer assignments are
removed and independently read back. No Foundry User/Owner, Storage or Search
permission is added.
Fresh native preservation again verifies the original 26 rows, candidate 28 components, exact authoring, files, bindings, authentication and Off/On/On states. Missing/invalid inbound bearers still receive 401. This is shared retrieval under the real outbound identity, not a successful delegated MCP connection, candidate binding or native whole-output pass. No new native question or MCP tool call is submitted. T007/T008, the eleven-case native matrix and the full roadmap remain open.
The native MCP continuation
now verifies the intended administrator in a dedicated Edge profile, one real
OAuth connection and independent PAC Connected status. The user explicitly
confirms consent on behalf of the tenant. Graph readback verifies
AllPrincipals, no individual principal and only the dedicated Evidence.Read
scope. No assistant Graph grant-write request is made. Existing profiles and
cookies are not copied; neither npm policy nor browser security policy is
overridden. The earlier no-grant/current-user-only receipts remain historical.
After the interrupted Add/configure attempt, independent readback still finds
28 candidate components. Its unacknowledged queue command is archived, not
replayed. A responsive native continuation then saves one MCP component and
discovers retrieve_verified_workshop_evidence. Dataverse independently verifies
the generated ModelContextProtocolMetadata binding to the exact connected
connector and connection. The candidate now has 29 components.
Author replaces the candidate's emitting retrieval route with the data-only MCP
tool, retaining local retrieval for broad SAR and hybrid requests. Native UI saves
the validated instructions and disables only the old retrieval specialist.
Independent readback verifies exact instructions, unchanged non-instruction
fields, all other definitions/states, diagnostic Off, validation On and MCP On.
The original parent and all 26 complete original rows remain unchanged.
The management bundle fails with MODULE_NOT_FOUND: @azure/msal-node-extensions;
it is not patched. Supported native UI is used instead.
One fresh native submission of unchanged original case 6 completes with one
user-facing domain answer, not the earlier extra specialist draft. Both quoted
passages equal the complete pinned rc-002 and ip-006 records and retain their
own exact canonical markers. The actual local knowledge search and its native
reference are visible. Threshold exceptions, form, timing conditions, narrative
and investigation coverage, ongoing-activity guidance and applicability limits
pass the whole-turn check. The greeting and runtime connection-consent card are
retained, not discarded from the captured turn.
Missing and malformed bearer controls still return 401. No publication or
Storage/network-policy change occurs. This closes the bounded native SAR
delivery/fidelity defect, not the full regression matrix: raw
DynamicPlanFinished, all eleven fresh cases, original diagnostic/SDK contract,
other lab gates, budget/retention facts and attributable role signoffs remain
open. T007/T008 and the overall roadmap are not marked complete.
The initial native matrix
passes original cases 1-4, then stops at case 5: seven factual bullets lack
individual source markers. Official native exports distinguish deterministic
topic completion for cases 1-3 from actual non-cancelled DynamicPlanFinished
for generative cases. Capability discovery is not an evidence-tool invocation.
Author's saved attribution repair passes a fresh case 5, with all three factual paragraphs individually supported. The next SAR turn fails source attribution: it quotes a renderer-added applicability notice as if it appeared in a source record. The subsequent saved source-boundary repair removes that error and preserves two exact complete MCP quotations, but the next SAR turn fails local quotation punctuation. An added period inside a quoted local table cell is not an exact quotation.
No failed question is automatically resubmitted or certified. The last turn contains two completed evidence calls with the unchanged question, not two user submissions; both are counted and their actual returned records are audited. Generated local facts need unquoted cited paraphrases while deterministic literal lookup topics remain unchanged. Every instruction change requires a new complete eleven-case cohort; earlier successes are not combined across configurations. T007/T008, publication and the broader roadmap remain open.
The complete native matrix supersedes the preceding matrix limit, not its historical failures. All eleven unchanged original questions now pass on one saved configuration. Full final replies, official native exports, source comparisons and direct semantic reviews are retained privately. All thirteen agent-content exports, including one failed attempt and the independent control, have the same SHA-256.
There are twelve original-question submissions: case 7 initially receives no domain reply or plan within the bounded wait. Its actual user message and failed export are retained. Exact configuration preservation and 401 controls pass, then a normal portal reload and acknowledged fresh session precede one explicitly counted successful retry. No platform cause is invented or failed attempt erased.
Cases 1-3 retain deterministic processed-topic completion and twelve exact local
quotations. Cases 4-11 retain actual non-cancelled DynamicPlanFinished.
The seven domain MCP invocations forward the complete unchanged questions and
return exact pinned records/rendered evidence. Broad SAR and all four hybrids
also prove output from the intended uploaded Markdown component and its actual
native reference. Their final replies use individually attributed, source-audited
paraphrases, not purported literal MCP quotations.
T008 is complete for this run. T007 remains open at the separate validation control: the unchanged topic followed by a direct validation action produces two identical constant replies. Both are retained; successful control transport is not a single-reply pass. Original root and all 26 complete rows, candidate 29 components, other definitions/states, authentication and publication timestamp remain preserved. No publication, policy change, new role or resource occurs. The original diagnostic/SDK contract, other labs and governance gates remain open.
The later control-repair regression changes only the demonstrated validation-control topic through one normal native Save. Author's exact message gate retains the existing validation action and adds processed cancellation. After one preserved timeout and a separately counted recovery, native evidence proves one actual validation invocation, one binding and one exact reply. Two cancellation trace records are not two invocations. No hardcoded success reply is added.
The required fresh regression accepts 10/11 distinct original cases, not all eleven. Case 9 first completes both intended evidence searches and a non-cancelled plan but produces no parent answer during 240 seconds. Its separately guarded retry produces neither plan nor answer. Both official exports remain failures; no cause is established and no third attempt is submitted. Cases 10 and 11 pass their own complete source, attribution, coverage and applicability reviews.
Thirteen original-question submissions and two control submissions total fifteen. The original-case retries are cases 2 and 9; case 2's first visible reply loses its official export during a controller sharing-lock failure and is not accepted. The unread export command is quarantined, never replayed. All fourteen available agent-content exports are byte-identical. Seven actual MCP calls include the successful evidence call in failed case 9. Current case 7 has two exact attributed MCP quotations and permitted, independently verified additional local evidence.
Final readback preserves original root/26 complete rows, candidate 29 components, all other complete candidate rows, parent instructions, authentication and publication timestamp. The owned browser closes normally. No publication, Azure deployment, resource, role, grant or policy change occurs. T007 remains open for the incomplete current regression; T008 retains only its preceding accepted run. Successes across these different configurations are not combined.
This earlier checkpoint retains its historical browser and authentication limitations; the candidate continuation above supersedes those limitations.
The verified transport release adds stateless Invocations to the existing deterministic Activity host. Version 4 first passed the unchanged SAR question locally and remotely. Version 5 adds explicit rejection of JSON parser limits; all 54 service tests and dependency checks pass. Its deployment CLI timed out after service registration, but fresh read-only checks found version 5 active and doctor returned 11 passed, zero failed, two skipped. No deployment was repeated after that timeout.
The final real local and hosted SAR responses match the exact two-record renderer output. Seven hosted controls pass: no-token HTTP 401, authenticated OpenAPI, blank-input HTTP 400, integer-parser-limit HTTP 400, body-limit HTTP 413, astronomy abstention and Activity compatibility. Correlated session logs exclude model calls for the three invalid authenticated requests. The initial direct Activity request lacked the now-required API version and returned HTTP 400; a separately guarded corrected request passed HTTP 200 with exact source rendering. Neither request changes native caller identity or payload semantics.
Both protocols, Entra plus BotServiceRbac, hosted identity, original retriever version 4 and the original four resources/roles are independently verified. The native preservation check also preserves both parents, all component definitions, file hashes, approved bindings, delegated grants, owned cache and PAC profile. No Storage policy or network setting changes. Raw answers and credentials remain private.
T005 and native/full-matrix acceptance remain open. The existing shared browser reports hidden visibility; normal foreground activation and account-menu clicks do not restore actionable UI. No new native question or configuration write occurs. The additional generated evaluation suite is deferred while the user is unavailable, not treated as selected or approved. Retention ownership, review date, numerical budget and attributable organizational signoffs remain missing.
The checked release is pushed to main as commit 1f41cd6. The
fresh protocol investigation
recovers normal browser visibility and independently verifies the expected website
administrator. The catalog still shows ten legacy operations, not hosted
Invocations/Responses. The application preview exposes no parameter contract
before configuration; it is cancelled with Tools still empty. This does not
prove backend operation absence or a migration cause.
One native local-citation check uses unchanged original CTR case 2 on the isolated fraud candidate. A final parent-visible answer and clickable source dialog are observed, but the displayed quick-reference passage does not support the threshold. This is a demonstrated candidate citation-grounding failure, not the original licensing-PDF Lab 1 acceptance test. No runtime plan-finished event, historical full-answer audit or connector error-body fidelity is established. No configuration is changed.
Candidate-only authoring preparation is blocked before clone: Manage reports its
required copilot-studio:manage-agent skill unavailable. No agent YAML is
fabricated, remote configuration changed or original parent touched. T005/T007
and T009 remain open; supported connector-contract resolution and management
tool recovery are required before that correction.
The management recovery
locates the installed management instructions and invokes the unmodified clone
bundle. It fails with MODULE_NOT_FOUND for @azure/msal-node-extensions.
PAC supports clone, but its current identity is in a different tenant; neither
authentication nor the installed scripts is changed. The extension exposes a
clone command, but no callable extension tool is available here. The requested
human recovery choice is unavailable; this is not permission to bypass the
documented script-error boundary.
The separate actual Lab 1 check verifies the existing licensing advisor and Ready PDF. One unchanged question retrieves the intended guide; two passages match physical pages 6–7. Clicking the actual PDF source exposes no observable viewer, details or page anchor, so navigation acceptance fails. This result does not reuse the fraud check or certify the historical full answer.
The actual Lab 2 inventory check finds no unambiguously configured permitted Lab 2 agent; retained evidence records the prior Search source/connection removal. No substitute agent, new question or citation click is used. T010 remains blocked rather than passed. T009/T010 and candidate authoring require the supported prerequisites to be restored; no source, account, consent or acceptance result is invented.
The subsequent supported dependency recovery locates the plugin's official
SessionStart setup and native-dependency manifest. Its plugin-data directory
contains the manifest but none of the three required packages. Both the normal
manifest-based installation and offline-cache alternative fail with
EALLOWREMOTE: fetching remote package types is disabled. No registry, package
source or policy override is attempted. This is an installation-policy blocker,
not a reason to patch the management bundle or reuse the wrong tenant.
The local historical Lab 1 audit verifies the retained approved PDF hash, edition and page count but cannot locate the complete historical October 19 answer with matching provenance. Partial captures and newer answers are not substituted. Atomic claim totals remain unknown; the original full-answer criterion remains unavailable, not passed.
The renewed supported authentication recovery independently confirms the release commit exists on GitHub. The supported plugin update succeeds but reports version 1.0.11 already latest. Normal PAC interactive authentication does not complete; username-only authentication explicitly requires a password, which is not supplied. Two bounded documented device-code attempts reach the browser entry page, but normal click/keyboard activation does not advance it. The browser reports hidden visibility despite normal foreground activation. No MFA or consent prompt is observed, so neither is asserted as the cause. Both auth helpers are stopped, the shared page returns to Agents, and the original PAC profiles remain intact. No code/token, policy override or unverified administrator profile is used for cloning.
The fresh read-only Azure checks verify the admin/tenant separately in Azure extensions and Azure CLI; neither establishes the browser website identity. All four retained ARM resources remain. Both model deployments are Succeeded in Sweden Central. Exact returned quota meters show chat usage 26 of 5,000 and embedding usage 1 of 1,000, labeled thousands of tokens per minute. Search Basic remains running in West US 2 with one replica/partition, system identity and local authentication disabled. All four required providers are registered; the lowercase Insights namespace is verified by a separate GET after the case-sensitive list filter omits it.
Cost Management now reports USD 7.650361288 before tax for the four retained resource IDs and their descendants, including USD 7.373 for Search, from October 20 through the partial October 24 reporting period. No unrelated subscription costs are included. Reporting may lag; this is neither a final invoice nor a Copilot-credit total. No inference, new question, configuration write, role/policy change, provider registration, billing change or deletion occurs. T001/T009 remain open for owner, deadline, numerical budget, tenant credits and the other acceptance criteria.
Microsoft Graph independently verifies the current administrator and returns four license records with seven filtered maker-related plans in provisioning status Success. This is assignment evidence, not proof of complete premium entitlement, tenant credits or an environment billing binding.
The application preflight
checks a separate supported route rather than replaying the failed native
diagnostic. Current authenticated connector metadata exposes both SendActivityV2
and SendActivityApplication. Six unchanged source/dependency files are copied
to an isolated hosted agent. The first JSON-only code upload is rejected and
cleaned; supported multipart deployment then produces active version 1 and an
automatically created Azure Bot. Its client matches the owned agent instance.
Deployment is not runtime or native acceptance: zero questions are submitted.
An explicit authorizationPolicy.type=Default receives HTTP 400 for a missing
AuthorizationScheme discriminator. The
documented minimum application body
then succeeds. Independent HTTP 200 readback confirms provisioning Succeeded,
authorizationScheme=Default and Entra isolation, with separate application
blueprint/instance identities. No anonymous or organization-wide sharing is enabled.
The Hosted child deployment receives HTTP 400: the service rejects protocol
Agent during enum conversion and also reports a required definition field.
Agent is the value listed by the
ARM reference
and Microsoft's management SDK. No undocumented protocol name, authentication
relaxation, saved native binding or question replay is used to mask that mismatch.
T005/T006 remain open; no effective native caller or whole-parent output is proved.
The owned agent, application, child deployment, Bot and grants are independently absent after cleanup. All four owned directory-object reads return 404, while the original blueprint control returns 200. This does not claim deleted-directory tombstones were purged. The original version-5 definition, identities and metadata, ARM inventory and account role inventory match exactly. Original endpoint authentication is never modified. Raw evidence remains private; temporary-resource spending is not finalized.
The earlier-API follow-up
tests 2025-10-01-preview and 2026-01-15-preview, independently advertised by
the provider. A new Default-RBAC/Entra application references immutable original
version 5 without writing that agent or endpoint or creating another hosted agent
or Bot. Each API receives one Hosted Agent/2.0.0 deployment request; both return
HTTP 400 for enum conversion and the definition-field error. Each rejected
deployment is independently absent with GET 404. No question, undocumented
protocol name or combined acceptance is used. The new application and both
directory identities are removed; full original agent/version readbacks,
ARM/role/application inventories and the original directory control are verified.
Using an earlier advertised API therefore has not resolved T005/T006.
The October 26 remaining-version probes
test 2026-03-15-preview, 2026-05-15-preview and 2026-07-15-preview
only after independent cleanup of the delayed-denial cohort. Each single Hosted
Agent/2.0.0 deployment request returns HTTP 400 for protocol enum conversion
and the definition-field error; each rejected child returns GET 404. Together
with the three preserved earlier probes, none of the six tested versions resolves
the documented contract mismatch. No native or direct model question is submitted.
Provider metadata advertises those versions for the parent application, not the deployment child. The initial local child-type metadata lookup fails before any write; its empty output directory is verified before a guarded resume using the actual parent type. Parent advertisement is not proof of child API support. The owned application and both directory identities are independently absent; full original agent/version, ARM/role/application inventories and original directory control are preserved. No protocol guessing or weaker authentication is used. T005/T006 remain blocked in issue 2.
The private channel-package preflight checks the documented Microsoft 365/Teams package-only route on another owned agent. The approved administrator's first-party portal shows the original Activity and Invocations endpoints active. Full original agent/version readbacks also match the baselines taken before that read-only portal inspection.
The first deployment stops at a missing local FOUNDRY_PROJECT_ENDPOINT binding;
independent checks prove no agent, ARM resource or role change. One corrected
multipart deployment then creates active version 1 and its matching Azure Bot
using six unchanged source/dependency files. No role assignment is added.
The generated local package's Bot, web application and custom engine identities
all match the owned instance. Its default developer name and product-documentation
privacy/terms links are not workshop legal approval.
One documented /microsoft365/zip request uses Shared scope, not organization-wide
publication. Unapproved privacy/terms URLs are deliberately omitted rather than
invented. The service returns HTTP 400, dependency_error:
PrivacyUrl must be a valid HTTPS URL. This proves the privacy-field blocker,
not the outcome of later terms validation. No validated service ZIP, catalog
publication, package upload, native question or direct model question follows.
Deployment and local package generation do not establish native or channel acceptance.
The owned agent, Bot and directory identities are independently absent after cleanup. Both owned directory reads return 404 and the original blueprint control returns 200. The original full endpoint/agent/version, ARM inventory and account roles remain exact. Temporary spending is not finalized. Approved workshop legal metadata and the separate caller, output, privacy/retention and release gates remain necessary; T005/T006/T016 stay open.
The public upload attempt observes enforced Storage public-network disablement and HTTP 403 despite scoped RBAC. No exemption, key fallback or policy change is made. All temporary resources and roles are removed with the original inventory preserved. The private-network attempt then proves S5-01: exactly two original fictional files, private DNS/IP verification, managed-identity claims and two exact hash roundtrips. Its interrupted resume fails before indexer execution; that failure and a recovered asynchronous DNS cleanup race are retained. The original four-resource inventory is verified restored before a separately guarded retry. Upload success is not S5-02 or connected-answer acceptance, and T014 remains open.
The corrected private verification now closes S5-01/S5-02. The previous retry's successful indexer but HTTP 400 vector readback is preserved; the disposable vector field is explicitly retrievable. Supported CLI authentication recovery resumes the deployed job without another deployment/upload, preserving the expired-token failure and initial cleanup errors. Final private indexing processes two files, zero failed items and zero warnings; both exact passages, parent/source metadata and real 1,536-dimensional vectors are verified. All temporary infrastructure, roles and shared links are deleted, with original Search objects/roles/links and four-resource inventory independently preserved. No Storage policy, public-network/key/anonymous setting, agent or original route is weakened. Together with S5-03/S5-05/S5-06, five Lab 5 criteria pass; connected answers, source navigation, French and denied-identity acceptance still keep T014 open.
The current inventory and repair checks, saved-state readback and independent lab review retain the new evidence separately from earlier failures.
- T001 advanced: the four existing ARM resources, account/project/Search identities, two model deployments and retained ownership IDs were reconciled. Search Basic is running with one replica and one partition. Cost Management returned USD 6.219977042 before tax for October 20 through the partial October 23 reporting period, including USD 6.060 for Search. Billing may lag. The expiry tag has not deleted anything; a named retention owner, review deadline and approved spending boundary remain missing.
- T002/T003 advanced locally: all eight candidate source hashes still match
verified-retrieval-sdk-b4-20261022. The existing 47 documentation tests, 33 extension tests, dependency/syntax checks and canonical/wiki validation passed again. The hosted extension remains active version 1 with unchanged Entra and BotServiceRbac authorization; the SDK repair is still undeployed. - T005/T006 preflight advanced: three authenticated Dataverse GETs verified the diagnostic is Inactive and its exact definition hash is unchanged. The original attachment is Active with matching identity and target. Separate current Foundry reads verify its target selects active version 4 and that version's definition matches its creation receipt. No full historical Dataverse attachment definition was available for byte-for-byte comparison. No native answer was retested.
- T009/T010/T014 were reconciled against individual criteria. Historical subsystem passes remain valid within their original scope, but no outstanding criterion was newly closed. The review identifies the missing citation navigation, connector error body, published-channel/privacy and connected-query evidence.
- The native browser recovery request timed out without returning a page ID. Its side effects are unknown; this is not proof that no page opened. An unshared page does not provide an authenticated native test route.
- The attributable role approvals and retention decision were requested once; the user was unavailable. They remain pending, not inferred from general recovery permission. No cloud configuration, policy, permissions, original agents or source files were changed. No email, evaluation, deployment, deletion or remote publication was performed.
At that read-only checkpoint, all sixteen task checkboxes remained open because each required more than that checkpoint. Exact-candidate approval was then the deployment gate; independent native checks still require a usable authenticated browser.
The user explicitly supplied all required approvals, including Azure deployments and Copilot credit use, at 2026-10-23 16:12:49 -04:00. The authorized-release.json record applies that authorization to the existing isolated repair and its demonstrated follow-up defect. It does not invent named organizational signatories.
- T003 completed: the unchanged SDK candidate deployed as version 2. Its real authenticated positive Activity smoke passed exact whole-record rendering and individual attribution. Same-session logs show managed identity acquisition and successful downstream calls.
- The version-2 negative checks
found a genuine no-evidence defect: a completed trusted MCP call returned only
a newline, which raised
JSONDecodeError. Invalid oversized input correctly failed before model invocation. Both observations remain preserved. - The parser now treats only blank text from a verified completed tool call as empty evidence. Missing/nontext or malformed nonblank output still fails explicitly. Five added regressions bring the extension suite to 38 passing tests. Replaying the retained failed response also passed without new inference. This revised artifact deployed as active version 3, without changing Entra or BotServiceRbac authentication.
- T004 completed within hosted scope: three real version-3 Activity checks passed: unchanged original case 6 returned two exact individually attributed records; the unchanged astronomy question returned the exact abstention; and oversized input returned the explicit error with no model request. These are three fresh requests with zero retries, not native or eleven-case acceptance. Logs do not expose the exact downstream principal or independently join cloud retrieval membership.
- The reported browser login error AADSTS65002 came from requesting Power
Platform permissions with the Microsoft-owned Azure CLI client. Tenant consent
or Azure RBAC cannot replace Microsoft API-owner preauthorization for that
client pairing. Those login attempts stopped. A supported
owned-client recovery
created one single-tenant secretless public client, used PKCE, and granted
only the current user
MakerOperations.ReadandMakerOperations.ReadWrite. The known bot's evaluation list returned HTTP 200, with zero test sets. No tenant-wide consent, directory role, client secret or Azure-profile change was added. - Native canary preparation produced a private two-case import CSV. At that stage, the remaining prerequisite is UI-only: import it on the existing bot, configure the authenticated Microsoft Copilot Studio user profile, then save the profile and test set. Their real IDs are required for a draft API run. No undocumented creation call, anonymous fallback or native evaluation was attempted.
The diagnostic remains Inactive and the original version-4 route is preserved. Six hosted Activity requests were made across versions 2 and 3; their count is not an internal-model total, Copilot-credit total or monetary bill. A post-release Cost Management query returned the same lagged USD 6.219977042 subtotal. Resources and the new owned registration are retained for remaining tests; retention ownership/review and independent organizational approval attribution remain open. No remote repository/wiki publication was performed. Local validation at that stage passed 53 documentation tests, 38 extension tests, dependency/syntax checks, canonical validation, 38-page wiki export and wiki validation. These checks do not certify native or remaining lab acceptance.
The admin/MngEnv browser setup saved the two-case test set, with persistence verified by full navigation. The UI's account/tool selection did not persist, but the documented draft run API supports explicit authenticated connection bindings. The readiness check verified the caller, saved test set and tool mapping without adding connectivity scopes. Independent connection-owner object-ID proof remains unavailable.
After the management worker's optional capability failed to load, a supported state-only Dataverse transition activated only the existing diagnostic. Live state metadata, an exact-definition hash and optimistic concurrency guarded the operation. The original attachment and parent full rows were unchanged.
One authenticated draft native evaluation was accepted with HTTP 202 and completed at 2026-10-24 00:19:34 UTC: two results, one General Quality Pass and one Fail, with zero submission retries. The failure reports abstention Yes, relevance No and completeness No. The returned run owner and connection match the verified caller and request. This proves authenticated evaluation execution, not exact native source delivery. The API does not expose answer text or the question-to-result mapping. The diagnostic-intent-only input is not substantive retrieval acceptance.
The restoration and evidence readback
independently verifies the diagnostic is Inactive again, its exact definition is
preserved, and the original attachment and parent full rows are unchanged.
The hosted extension remains active version 3; its native-facing endpoint selects
@latest and retains Entra plus BotServiceRbac. A narrowly filtered, documented
transcript read returned 403: missing prvReadconversationtranscript.
The verified admin browser was located, but its ordinary foreground request failed;
no keyboard input was sent. No role, consent, endpoint-authentication or publication
change was made. The earlier native tenant-ID 403 is neither reproduced nor
resolved by these grader metrics. T005/T006 and the eleven-case matrix remain open.
The supported recovery alternatives
record the additional attempts, not a native pass. Official PAC 2.14.1 was
restored in an isolated gitignored directory through NuGet's working V2 HTTPS
feed after its V3 endpoint failed TLS negotiation. PAC independently identifies
the same admin/MngEnv user and environment. Existing Global Administrator
membership does not supply the missing Dataverse role. The documented
self-elevation API rejects the owned client for UserManagement.Users.Apply,
which is absent from the live published permission catalog. PAC self-elevation
also returns 403; its assignment alternatives fail environment resolution.
All attempts independently restore the exact original Dataverse role set and
active PAC profile. No new consent, role or endpoint-authentication change occurred.
The official local MCP capability discovery succeeds and the helper is stopped;
it does not provide the missing answer transcript.
T013's infrastructure reconciliation
is complete without another apply. Terraform 1.16.6 was restored with its
official archive checksum verified. A private copy of all 23 original Terraform
files remains byte-identical before and after init, validate and a saved
non-applying plan. Exit codes are 0, 0 and 2 respectively, with zero validation
errors or warnings and 15 proposed instances. Provider auto-registration is
disabled; an independent Azure read confirms the plan-only group does not exist.
Resolved versions are AzureRM 4.45.1, AzAPI 1.15.0, AzureAD 2.48.0,
Random 3.6.1 and HTTP 3.6.3.
The comparison preserves the historical corrected 15-instance apply and cleanup.
The unchanged plan still selects the previously rejected GPT-4o 2024-05-13,
public/local-auth defaults and Standard Search without an attached identity.
It creates no private endpoint, Foundry project or data-plane index. Historical
policy-preserving overrides and separately verified Search system-identity
vectorization are not properties of that unchanged plan. No existing
infrastructure was reapplied. D5-02 and D5-03 now have fresh tool/validation
evidence; full Lab 5.1 and connected Lab 5 acceptance remain open.
The initial SDK fallback obtained a real, byte-preserving clone with both knowledge payloads. Official PAC 2.14.1 then rejected its own clone layout; the Author check did not omit components to force a package. The distinct template/file-API preflight verified live file hashes and an existing approved connection binding, but exported only 21 of 26 components and omitted the parent's routing instructions. Those initial probes produced no candidate, publication or SDK questions. A complete private derivative still needs reconstruction and independent fidelity checks before publication or answer acceptance.
One staging candidate is now created and independently verified unpublished. Both uploaded knowledge payloads match the original hashes and the existing binding is verified; integrated Entra authentication and access policy are preserved. The first create rejected an overlength display name without persisting an agent; the corrected name reuses the same schema. The retained candidate still has 21 components, lacks the omitted routing state and is not SDK-ready. No publication, permission expansion or question has occurred in this phase. The original parent, components, files and connection reference remain unchanged.
The Author reconstruction now covers all 26 source components locally. Twenty-four YAML definitions pass schema validation; the one warning is the source's omitted recommended display name, not an omitted behavior. Fourteen staged operations project to the desired 26-component state, including exact normalized instructions and inactive diagnostic state. These are local authoring results only: management must preflight, apply atomically and independently verify the cloud candidate before any publication or SDK question.
The first managed preflight stopped before submitting the changeset because background synchronization advanced the candidate-root ETag. All 21 component preconditions, file hashes and bindings still match; the source remains unchanged. Only root synchronization metadata differs. The capture receipt therefore records zero publication, questions, activities or permission writes. A metadata-only guard refresh must revalidate all business fields before a separate atomic attempt; it is not permission to ignore concurrent content edits.
The reconciled atomic attempt now succeeds: all 14 subresponses are HTTP 204. Independent readback confirms all 26 candidate components, definitions, references and states, exact normalized instructions, all four source/candidate file hashes, the binding and Entra controls. The source's full rows remain unchanged. At this checkpoint the candidate is still unpublished; the capture record contains no question, activity or final answer. Publication and SDK execution remain distinct operations under the user's existing deployment authorization.
The candidate publication
is now independently API-confirmed Succeeded with a published timestamp.
PAC returned exit 1 because its status parser crashed; publication was not
repeated. All 26 definitions/states, file hashes, bindings and Entra controls
still pass; the original parent and source full rows remain unchanged.
The owned-client capture attempt
stopped when silent authentication returned no Invoke token: zero questions
or activities, no inferred completion. Exact app permissions and current-user
grant are restored, original access/refresh entries retained and the prior PAC
profile restored. Supported error diagnostics and correct-profile browser
authentication remain separate recovery work; publication alone is not acceptance.
The explicit authentication diagnostic
now identifies AADSTS65001, consent_required, without a claims challenge.
One silent-with-error probe and one prompt=none owned-client PKCE flow both
fail for consent. A normal PKCE flow in the verified MCAPS Main Admin profile
receives no callback within its bound; its listener is closed.
The recovery receipt
records zero SDK service requests and independently verified exact grant/manifest
restoration, retained tokens and unchanged source/candidate controls.
No browser cookies or session databases were read. An expired flow is not
usable authorization; any further browser consent requires a fresh active callback.
The bounded consent-recovery result now acquires a verified Invoke token after one five-minute pre-probe wait and one force-refresh attempt. Resource, scope, client and account mappings match. The same configuration includes standard OIDC scopes, so those scopes are not proven causes of the earlier consent error and no plain-OAuth fallback was needed. SDK start returns one typing activity but does not yield a usable completed start; zero questions are submitted. This moves the blocker from authentication to conversation-start capture, not to proven whole-parent delivery.
Transport failures initially interrupt cleanup, but independent recovery verifies the exact manifest and all owned-client current-user grants restored, Maker access and valid refresh entries retained, all source/candidate controls preserved and the prior PAC profile active. UIA cannot verify the entire consent page or identify expired tabs safely: no blind Accept/Close is invoked. Do not accept expired owned-client consent pages.
The header-aware SDK diagnostic
then recovers the server-issued conversation ID. Start suppresses the start
event for diagnosis only, not greeting acceptance, and closes normally.
The two actual question captures
submit Hello and unchanged SAR case 6 once each. All three requests return HTTP
200 and all streams close normally. Hello produces an investigation-clarification
message; SAR produces an Azure AI Foundry Agent Service Adaptive Card requiring
the user to connect their account and select Continue. Neither action is invoked.
Observed SAR events are DynamicPlanReceived, DynamicPlanStepTriggered and
DynamicPlanStepBindUpdate, not DynamicPlanFinished. No domain answer or source
comparison is captured. The blocker is now runtime per-user connector
authorization, despite the stored binding. Exact permission/cache restoration
and source/candidate preservation pass again. T005-T008 remain open.
The connector authorization follow-up stops before Connect: the correct browser profile and environment are identified, but UIAutomation cannot verify the website's signed-in admin account. This is not an observed MFA or OAuth failure. No Connect navigation, Continue submission, new question, permission change or cloud write occurs. Independent source, candidate, file, binding, app/grant, cache and PAC checks pass. A human must visibly verify the MngEnv website account and complete the current approved Foundry connection before Continue; expired OAuth pages must not be accepted.
The window-scoped visual alternative also fails to establish identity: the inspected PrintWindow crop is white with no readable website account or tenant. No Connect/Continue action occurs. The browser's original minimized state is restored and preservation checks pass.
The initial foreground-pixel guard then observes another foreground window and stops without taking focus, changing the target window or capturing any pixels. No unrelated window is inspected. This is a pre-capture guard outcome, not a failed identity comparison.
The single explicit focus request subsequently succeeds: the verified browser is foreground, visible and nonminimized. Its website account control does not support InvokePattern and the account-region bounds guard rejects capture. No screenshot or Connect is attempted. The original minimized state is restored; all preservation checks pass. The remaining account-verification boundary is not waived.
The supported browser-page recovery subsequently verifies the exact admin UPN in the website account menu and the target environment route. The Edge profile label is not exposed; it is not used as identity proof. One current first-party Foundry Connect form is submitted with the approved project endpoint and returns Unable to sign in. Please try again. No connection success is observed, so Continue and a fresh SAR question remain uninvoked. This resolves website identity verification, not connector authorization. One create submission is recorded as a cloud write, not zero writes. Independent source/candidate/file/binding/app/grant/cache/PAC checks pass with no verification or rollback errors. The error alone does not identify an OAuth, MFA, DLP or RBAC root cause; supported diagnosis is still required.
After the user's sign-in update, the human-assisted status check still shows a blank connection form with Create disabled, not a success message. The subsequent read-only connection listing and Details check verifies the exact candidate-referenced Foundry connection as Connected in both views, with the required website administrator and environment verified. Its displayed owner is System Administrator and its last-modified date is October 21; this does not prove the recent sign-in changed the connection or authorized the paused conversation. No new Create, Continue or SAR question occurs in either check. Preservation checks pass. The earlier failed Create's request/response was not retained, so its cause remains unclassified; the connector authentication and endpoint format match the official contract. Existing connection status permits a bounded runtime continuation, not a claim of native answer, source grounding or whole-roadmap acceptance.
The single original-conversation continuation
then sends the exact Retry payload once. HTTP 200 and a normally closed SDK
stream return typing and the same Foundry authorization card, not a SAR answer.
The card's streamType=final is not retrieval or plan completion: no citations,
source passages, DynamicPlanFinished or end-of-conversation event are observed.
No second Retry, fresh SAR, Create or publication occurs in this attempt.
The exact client manifest and all current-user grants are restored; only the
new Invoke access token is removed while Maker access and valid refresh-token
rotation remain. Independent source/candidate/file/binding/authentication/PAC
checks pass with zero primary, cleanup or verification errors. The remaining
boundary is per-user runtime authorization, despite the existing connection's
Connected status.
The instrumented post-sign-in connection attempt uses the Connect target from that newly returned card. The verified runtime form offers Create only, not selection of the existing connection. Entra ID User Login, the approved endpoint and required fields are verified before one submission. The connection PUT returns HTTP 201 Created, the UI reports Unable to sign in. Please try again., and automatic cleanup DELETE returns HTTP 200. Creation is not authorization success. Request/correlation IDs remain private; no OAuth popup event, callback error or service error body is captured. The underlying sign-in cause remains unclassified. No additional Create, Continue or SAR is sent; all independent preservation checks pass without verification or cleanup errors. Connector-specific human sign-in, rather than website sign-in alone, remains the next boundary; no new role, tenant-wide consent or endpoint change is justified by this evidence.
The additional read-only sign-in audit
uses existing administrator access to Microsoft Graph v1.0, without new consent.
The exact-user 19:22–19:25 UTC query returns no events; a separate noninteractive
query also returns none. A wider 19:00–19:30 UTC query returns four successful
Power Apps/Office shell sign-ins around 19:12, not a connector failure code.
The rejected signInEventTypes filter is preserved; isInteractive eq false
succeeds on v1.0, without a beta API. Logging latency and query scope prevent
treating absent events as proof of no authentication attempt or popup blocking.
The current runtime form still reports the sign-in error. No connector
submission, Continue, question, permission or policy change occurs in this
diagnostic; the underlying cause remains unclassified.
The reloaded-page, measured-click recovery
checks a different hypothesis after browser network-change/reset errors.
Public tenant OIDC metadata returns HTTP 200 with credentials omitted.
The approved endpoint and Entra User Login option are verified before one
supported browser Create click. Its captured event has isTrusted=true and
active user activation. The UI nevertheless shows Adding connection, then
Deleting connection, then the same sign-in error. Lack of trusted activation
does not explain this measured submission. Network errors are not established
as the cause, and metadata reachability is not connector authorization.
This attempt does not capture the created identifier or PUT/DELETE status;
automatic-deletion UI is not independent proof of resource absence.
No Continue, new question, permission change or publication follows.
Independent source/candidate/file/binding/grant/cache/PAC checks pass with zero
verification or rollback errors. The temporary click diagnostic is removed.
The subsequent current-user Connections listing contains six rows and only the
original Connected Foundry entry; no additional Foundry row or pagination
control is observed. This is scoped listing evidence, not an exact-resource
absence check because the attempt's new connection identifier was not captured.
The native Studio test-pane recovery
then establishes a different supported route. The unchanged SAR case returns an
Open connection manager card, whose actual pva-studio link shows the tool
as Not Connected for the verified administrator. Unlike the direct Connect
form, this manager offers Create or pick a connection. One Submit associates
the existing approved connection, without a new connection, OAuth flow or
permission change. The manager then shows Connected via the required
administrator. Returning to Studio reinitializes the test pane, so one fresh
unchanged SAR case is sent after the verified association.
Native delivery now produces three domain-answer messages, with no authorization card and no typing indicator at capture. One visible tool action is Completed in 25.92 seconds. This is a recovered native route, not source-fidelity acceptance: the first answer has seven exact matches among nine quoted passages; the second has five among six. The final generated message has no quoted passages and cannot pass a verbatim-quote check by absence. Comparisons use each excerpt's own rendered canonical source group against the pinned original corpus. Raw answers and protected source text remain private. The initial completion wait times out because it assumes immediate feed children; subsequent capture uses the actual nested Web Chat articles. Neither a hidden typing indicator nor the visible tool status proves a protocol plan-finished event. Published-channel authorization and the full eleven-case matrix remain unproved.
The existing hosted diagnostic
is then enabled only on the candidate and invoked once through the recovered
native connection. It returns HTTP 403, ConnectorRequestFailure, because
BotServiceRbac requires a valid Entra tenant ID for the activity caller.
The tool reports Failed and zero tokens; no domain answer is delivered.
The diagnostic is restored Off, with independent verification of the original
parent, candidate definitions/authentication, file bindings, app/grants,
owned cache and PAC profile.
The already-authorized bounded Entra-only experiment then patches only the isolated endpoint's authorization list, retaining Azure RBAC and never enabling anonymous access. One native diagnostic question gets past the tenant-ID error but returns HTTP 400: the activity caller's blueprint ID does not match the hosted agent summary. This is another failed native delivery, not a source-fidelity pass or proof of an identity-migration cause. The candidate diagnostic returns Off; both other specialists remain On. The exact endpoint/card, Entra plus BotServiceRbac, version-3 definition/identity and original manifest bytes are verified restored, with zero verification or rollback errors. No deployment, new version, publication, corpus edit or role change occurs. The five-minute maximum window ends early after the test. The next step is a supported protocol/connector contract investigation, not another connection Create or permanent removal of BotServiceRbac.
The read-only native connector contract check finds ten visible actions after See all. The public connector reference lists hosted Invocations/Responses actions, but neither is observed in this catalog; that does not prove backend absence. The application-based Activity action offers the approved connection, but its preview is cancelled before Add and configure. The tool list remains empty and the diagnostic Off. The official native integration guide requires Activity, which the actual endpoint already exposes. No verified first-party fix for the exact blueprint error or identity-migration cause is established; no caller identity or Activity payload is overridden.
The published SDK retest after Studio association sends exactly one unchanged SAR case, with no retry. Start and question requests return HTTP 200 and both owned streams close normally. The five activities contain typing, three plan-start/binding events and the Foundry Connect your account card, not a domain answer or plan-finished event. Studio association therefore does not establish published-channel authorization. No Connect, Continue, new connection or publication follows. The temporary owned-client manifest scope and current-user-only grant are restored exactly; only the one new Invoke access token is removed, retaining Maker access and valid refresh entries. Source/candidate definitions, files, bindings, authentication, original case fixture and PAC profile pass preservation checks, with no primary, rollback or final verification error.
The actual synthetic Search execution closes S5-03/S5-05/S5-06, not T014. It tests original Harbor/Forest text, keyless 1,536-dimensional query vectorization, lexical/vector/hybrid/semantic retrieval and both filter assertions. The initial statistics-readiness failure remains recorded separately; the corrected attempt uses actual query count. Both temporary indexes are deleted and all three existing index schemas are verified unchanged. Those direct-load checks did not establish Blob/indexer acceptance; the later private verification above closes S5-01/S5-02. Connected answers, navigable citations, French answer consistency and denied identity remain open.
The following extension receipt describes the earlier failure baseline. The authorized version-3 release above supersedes its deployment status only.
The Python extension
verifies retrieved records against a pinned licensed corpus and renders quotations
in code. Local transport tests stub corpus loading and the Azure answer operation.
The retained extension receipt
records hosted version 1, an unrepaired deployed Activity SDK, native HTTP 403,
and a separate authenticated direct HTTP 500 before the application handler.
Local Activity 1.0.0b4 and Microsoft Agents 1.9.0 pass their regression;
deployment and downstream hosted identity permissions remain unverified.
Use existing isoted resources and supported interfaces. Preserve original agents, failed attempts, private evidence and the working version-4 route. Never substitute an SDK call for native Copilot delivery or local checks for cloud behavior. Do not weaken policy, enable anonymous access, reconstruct protected documents, or claim legal/source equivalence for the licensed notebook. No migration or new application architecture is required.
The user's general recovery permission and later explicit deployment/credit authorization are recorded above. Do not ask for the same permission again. Independent Product Owner, Security Team and Tech Lead role attribution is not established by that user statement. Keep that distinction in T002, identify the exact artifacts and preserve the scoped rollback record.
Owners below are execution roles, not assigned people or recorded approvals. P0 removes the immediate blocker or limits ongoing cost; P1 closes runtime acceptance; P2 reconciles evidence and publication.
| Plan item | Priority | Owner | Depends on | Completion evidence |
|---|---|---|---|---|
| 1.1 | P0 | Release owner and cloud owner | None | Owned-resource inventory, costs, artifact and sign-offs |
| 2.1 | P0 | Extension maintainer | 1.1 | Lab 6 hosted Activity repair and exact source records |
| 3.1 | P1 | Copilot Manage and Test | 2.1 | Lab 6 native reply, persisted route and restored control |
| 4.1 | P1 | Copilot Author and Test | 3.1 | Lab 6 F6 mapping and eleven-case whole-turn evidence |
| 5.1 | P1 | Lab owner and Copilot Test | 1.1 | Labs 0, 1, 2 and 3 acceptance receipts |
| 6.1 | P1 | Policy owner and lab owner | 1.1 | Supported connected BYOM run or explicit exclusion |
| 7.1 | P1 | Infrastructure and lab owner | 1.1 | Labs 5/5.1 connected-query and deployment receipts |
| 8.1 | P2 | Evidence and publication owner | 4.1,5.1,6.1,7.1 | Reconciled bilingual evidence, cleanup and release checks |
Items 5.1, 6.1 and 7.1 can proceed independently after 1.1 only when their cloud resources and browser sessions do not overlap. Avoid concurrent changes to a shared agent. No completion date is asserted while entitlement, policy and sign-off dependencies remain unresolved.
Requirements: REQ-001. Input: retained ownership records and the extension receipt.
- T001 [Plan:1.1] Re-inventory the isolated extension, Bot, project, Search, embeddings and identities using the retained private ownership records. Compare actual resource IDs, provisioning state, versions and billing status. Set an owner and review deadline for each retained resource; an expiry tag is not deletion.
- T002 [Plan:1.1] Record the release artifact, scoped rollback plan and attributable Product Owner, Security Team and Tech Lead sign-offs before deployment. Keep private identifiers outside the repository; add only a sanitized approval reference to the execution report.
Exit: ownership and current resource state are verified; spending and release boundaries are explicit. If approval is unavailable, dependent deployment stays blocked, but independent documentation and inventory work may continue.
Lab coverage: Lab 6, hosted extension checkpoint.
Requirements: REQ-002. Inputs: extension instructions and deployment manifest.
- T003 [Plan:2.1] Rerun the service's tests, dependency and syntax checks; deploy the user-authorized extension artifact to the existing project. Record resolved SDK versions, hosted version, startup logs and rollback target without erasing the old failure. Completed: versions 2 and 3 deployed; all 38 current tests pass.
- T004 [Plan:2.1] Send authenticated Activity requests with complete envelopes, including
serviceUrl. Verify real hosted sessions, retrieval and selection, exact rendered records, and explicit error/abstention behavior using hosted identity credentials. Completed: version-3 positive, abstention and invalid-input checks pass; native and independent retrieval-membership claims remain excluded.
Exit: the constructor failure is absent in the real host and source-grounded delivery passes. HTTP readiness alone is insufficient. Keep endpoint authorization unchanged for this initial SDK repair so authentication changes are not conflated.
Lab coverage: Lab 6, native connected-agent checkpoint.
Requirements: REQ-003. Input: the saved inactive diagnostic and existing control route.
- T005 [Plan:3.1] Resolve the native protocol/identity contract using supported caller metadata and scoped logs. The bounded Entra-only diagnostic is executed and exactly restored: HTTP 403 changes to a blueprint-ID HTTP 400, not successful delivery. Retain Azure RBAC and BotServiceRbac; grant no anonymous access or broad permissions. Have Manage perform managed configuration changes and Author handle any YAML change.
- T006 [Plan:3.1] Have Test execute one native diagnostic and one unchanged control question. Capture the native action, hosted correlation, whole-parent completion and exact displayed answer. Disable the diagnostic afterward, independently read back its saved inactive state, and verify the working original route remains intact.
Exit: a native response proves verified evidence delivery, not merely a successful direct Activity request. If Entra-only configuration is unsupported or does not fix caller metadata, preserve the failure and escalate through supported platform support rather than bypassing authorization.
Lab coverage: Lab 6, scenario continuation and original F6 matrix.
Requirements: REQ-004. Input: the original questions and complete-turn audit in the execution report.
- T007 [Plan:4.1] Have Author correct only demonstrated quotation fidelity, per-bullet attribution, conditional-duty scope and detailed-example coverage gaps in the isolated candidate. Preserve source-free intake, local-only lookups, hybrid routing and the working control.
- T008 [Plan:4.1] Have Test run all eleven unchanged scenarios in a fresh native session after an acknowledged readiness preflight. Preserve full final replies and
DynamicPlanFinished, expected handler routes, source comparisons, individual attribution, relevance, applicability and example-coverage results per case. Count retries separately. - T017 [Plan:4.1] Reconcile each Lab 6 criterion F6-01 through F6-12 with its exact retained run, artifact, question, route and assertion result. Update the Lab 6 guide and validation ledger together; preserve historical failures and distinguish the original matrix from the eleven-scenario continuation. Reuse evidence only where the actual assertion matches. Identify remaining native denied-identity and missing-Activity negative tests explicitly; do not substitute Lab 5 Search denial, a blueprint-ID error or direct transport success. Preserve the inaccessible original-source limitation. Run only a genuinely missing criterion after its prerequisite or supported fix exists, and verify cleanup of that attempt.
Delivered documentary substep, 2026-10-26: twelve provenance-labelled dispositions and synchronized bilingual guide/ledger/roadmap publication in the crosswalk. Runtime completion remains open; guide-added variants are not automatically universal original requirements. Current documentary update: exact F6-04 PASS and F6-05 document-level PASS are linked in the synchronized guide, ledger and crosswalk. F6-05's displayed excerpt lacks ATO; no exact citation-chunk or global citation-quality acceptance. The prospective adapted configuration does not establish historical equivalence.
Exit: every justified required case and criterion has matching acceptance evidence, without restarting verified work. Earlier merged captures, four extractive backend successes and generic quality grades do not replace this matrix. Stop on failed criteria, retain the failure, fix the cause, and repeat affected cases plus routing regressions. T017's documentary reconciliation is delivered independently of 3.1; dependent native retests still require their supported fix. A missing protected original does not authorize reconstructing it or certifying unknown additional requirements.
Requirements: REQ-005. Inputs: current rerun table and the individual lab guides.
- T009 [Plan:5.1] Recheck Lab 0 entitlement, capacity, policy, permissions, quota, tools and budget. For Lab 1, close the historical full-answer audit, citation navigation and downstream connector error-body fidelity. Use synthetic/approved recipients; do not resend mail unless a missing criterion needs it.
- T010 [Plan:5.1] For Lab 2, verify actual external PDF source navigation and recheck connected positive/negative answers. For Lab 3, verify published-channel telemetry and the required privacy boundary with event/KQL correlation. Prior success of one genuine event does not certify absence of all platform identifiers.
Exit: each lab has its own observed receipt for all mandatory acceptance IDs. Preserve the original failed evaluation and clarify any requirement that the platform cannot satisfy instead of claiming a full pass.
Requirements: REQ-006. Input: Lab 4 and its recorded dialog/policy evidence.
- T011 [Plan:6.1] Have the policy owner establish whether the current connector supports Entra authentication under enforced
disableLocalAuth=true. If not, obtain a formal owner-governed exception or approve an explicitly documented substitute/exclusion. Do not toggle local auth or evade the policy through resource tags or YAML. - T012 [Plan:6.1] When a supported path exists, have Test verify direct invocation, parsed retrieval, connected prompt execution, grounded answers, empty results and error behavior. Record the chosen path and evidence in both Lab 4 guides and the ledger.
Exit: connected BYOM criteria pass. An approved exclusion changes the declared workshop scope; it is not a pass of the unchanged original lab.
Requirements: REQ-007. Inputs: Lab 5, Lab 5.1 and private-pipeline receipts.
- T013 [Plan:7.1] Reconcile the corrected Terraform deployment against required resources, provider versions, private networking and identities. Preserve reviewed plan/apply evidence and identify deviations from unchanged-source deployment; do not reapply merely to reproduce already-proven infrastructure. Completed within reconciliation scope: fresh original-source init/validate/plan, explicit network/identity/model deviations, and preserved historical corrected apply/cleanup; no new deployment or whole-lab pass.
- T014 [Plan:7.1] Have Test execute remaining connected corpus queries, filters, ranking and expected fields using source-stated locations. Verify original hotel URL navigation where required. If the corpus lacks URLs, record a source/requirement limitation and obtain an approved scope decision rather than fabricating links.
Exit: the required connected query behaviors pass with traceable sources and documented infrastructure deviations. Prior private ingestion and projection passes remain valid subsystem evidence, not whole-lab certification.
Requirements: REQ-008. Inputs: every new acceptance receipt and publication procedure.
- T015 [Plan:8.1] Update the English/French execution reports, validation ledgers, lab guides and sanitized JSON receipts together. Preserve chronological failures and distinguish passed, failed, blocked, excluded and not-run criteria. Remove only independently verified owned disposable resources; otherwise record owner, cost review date and explicit retention decision.
- T016 [Plan:8.1] Run documentation tests, canonical validation, wiki export and wiki validation. Review actual repository visibility, wiki destination and human changes before authorized publication; verify remote revisions and both language pages afterward. The October 25 in-progress snapshot publication is verified, not full release acceptance. Mark workshop completion only against the final acceptance checklist below.
Exit: every mandatory requirement has current evidence, publication is verified if performed, and no unowned, unexpectedly billable or unexplained test resource is left behind. Cleanup is never inferred from a deletion request alone.
These IDs organize the remaining work; they are not newly invented lab criteria. The linked lab guides and retained acceptance records remain authoritative.
| Requirement | Remaining outcome | Plan item | Tasks | Required evidence |
|---|---|---|---|---|
| REQ-001 | Owned, approved and cost-controlled run | 1.1 | T001,T002 | Inventory and attributable release record |
| REQ-002 | Lab 6 real hosted SDK repair | 2.1 | T003,T004 | Hosted Activity and exact-source receipt |
| REQ-003 | Lab 6 native authenticated delivery | 3.1 | T005,T006 | Whole-turn trace and saved-state readback |
| REQ-004 | Lab 6 F6 and eleven-scenario acceptance | 4.1 | T007,T008,T017 | Per-criterion mapping and whole-turn audit |
| REQ-005 | Labs 0 through 3 acceptance closure | 5.1 | T009,T010 | Per-lab positive/negative/privacy evidence |
| REQ-006 | Supported Lab 4 BYOM outcome | 6.1 | T011,T012 | Policy decision and connected prompt receipt |
| REQ-007 | Labs 5 and 5.1 connected acceptance | 7.1 | T013,T014 | Deployment and connected-query receipts |
| REQ-008 | Honest bilingual release and cleanup | 8.1 | T015,T016 | Validated docs, publication and cleanup reads |
Run the repository's existing commands from its root:
.\.venv\Scripts\python.exe -m unittest discover -s scripts -p 'test_*.py' -v
.\.venv\Scripts\python.exe scripts\validate_docs.py
.\.venv\Scripts\python.exe scripts\build_wiki.py --output .wiki-build
.\.venv\Scripts\python.exe scripts\validate_docs.py --wiki .wiki-buildUse the service instructions for its own virtual environment and tests. For live testing, require an authenticated supported browser or API route, approved isolated resources, actual source data and unique synthetic correlation. If native browser access is unavailable, direct APIs can diagnose the backend but leave native acceptance blocked.
Before declaring full completion, require all of the following:
- All required tasks and original lab acceptance criteria have passed, with no unresolved mandatory failure hidden by an exclusion.
- Every lab, including Lab 6's F6-01 through F6-12, has an explicit evidence-to-assertion mapping; no lab is omitted because its work used an extension, MCP tool or a different task heading.
- Native and hosted evidence uses the approved artifact and preserves exact source content, applicability, routing and required negative behaviors.
- Approval records, bilingual reports and sanitized receipts agree with actual outcomes; no secrets, protected originals or fabricated results are published.
- Owned resources have verified cleanup or an explicit cost-controlled retention decision, and original agents and unrelated resources remain intact.
- Local validation passes and any claimed repository/wiki publication has been independently read back.
Source screenshots are not new executions. Les captures d'origine ne sont pas de nouvelles exécutions. See validation / voir le registre.