{
  "schema_version": 1,
  "date": "2026-10-23",
  "last_read_only_verification_utc": "2026-10-23T20:45:12.075643+00:00",
  "roadmap_tasks": ["T005", "T006"],
  "status": "recovered_owned_public_client_native_evaluation_list_http_200",
  "native_api_access_recovered": true,
  "native_evaluation_authentication_gate_cleared": true,
  "paid_native_tests_now_possible": false,
  "paid_native_tests_readiness": "The delegated API authentication gate is cleared, including the documented evaluation run permission. No immediate evaluation can be submitted from the current inventory: the known bot returned zero test sets. Test must prepare an authorized test set and authenticated MCS user profile, and any intended diagnostic re-enablement remains a separate Manage action. No native run has been attempted.",
  "scope_of_claim": "One tenant-owned secretless public client completed supported PKCE browser SSO and read the known saved bot's maker-evaluation testsets endpoint with HTTP 200. This proves native evaluation API read access, not successful native conversation execution or a paid evaluation pass.",
  "executed_routes": [
    {
      "route": "AzureDeveloperCliCredential with existing user context",
      "requested_scope": "https://api.powerplatform.com/.default",
      "token_acquired": true,
      "method": "GET",
      "endpoint": "Known saved bot maker-evaluation testsets, api-version=2024-10-01",
      "http_status": 403,
      "error_code": "InsufficientDelegatedPermissions",
      "exact_error": "Authorization denied: Application missing required delegated permissions: CopilotStudio.MakerOperations.Read"
    },
    {
      "route": "AzureCliCredential with existing user context",
      "requested_scope": "https://api.powerplatform.com/.default",
      "token_acquired": true,
      "method": "GET",
      "endpoint": "Known saved bot maker-evaluation testsets, api-version=2024-10-01",
      "http_status": 403,
      "error_code": "InsufficientDelegatedPermissions",
      "missing_permission": "CopilotStudio.MakerOperations.Read"
    },
    {
      "route": "Official PAC auth token using existing target-environment AzureIdentity profile",
      "pac_version": "2.14.1+g6f517e5",
      "supported_command": "pac auth token",
      "command_accepts_scope_argument": false,
      "token_acquired": true,
      "same_existing_cli_client": true,
      "method": "GET",
      "endpoint": "Known saved bot maker-evaluation testsets, api-version=2024-10-01",
      "http_status": 403,
      "error_code": "InsufficientDelegatedPermissions",
      "missing_permission": "CopilotStudio.MakerOperations.Read",
      "original_pac_profile_restored": true
    },
    {
      "route": "Supported az account get-access-token --scope with the exact delegated read scope",
      "requested_scope": "https://api.powerplatform.com/CopilotStudio.MakerOperations.Read",
      "exit_code": 1,
      "token_acquired": false,
      "error_code": "AADSTS65002",
      "error_timestamp_utc": "2026-10-23T20:35:52Z",
      "existing_client_application_id": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
      "resource_application_id": "8578e004-a5c6-46e7-913e-12f58912df43",
      "exact_error": "Consent between first party application '04b07795-8ddb-461a-bbee-02f9e1bf7b46' and first party resource '8578e004-a5c6-46e7-913e-12f58912df43' must be configured via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API.",
      "user_reported_browser_failure_corresponds_to_this_attempt": true,
      "further_interactive_attempts_stopped": true
    },
    {
      "route": "Supported azd auth token --scope --no-prompt with exact delegated read scope",
      "exit_code": 1,
      "token_acquired": false,
      "detail": "No stderr error detail was returned by the direct CLI capture; SDK wrapper retained ClientAuthenticationError: Authentication with Azure failed. No repeated acquisition to collect stdout."
    },
    {
      "route": "Tenant-owned single-tenant public client; MSAL authorization-code PKCE; supported localhost loopback",
      "approval_reference": "Actual requesting user message 2026-10-23T16:12:49.900-04:00: 'giving you all the approvals needed including deploments to azure as well as using copilot credits'",
      "implementation_instruction_reference": "Parent orchestration at 2026-10-23T16:39:52.807-04:00 scoped implementation to one necessary isolated tenant-owned public-client registration and current-user consent. This was not a new human approval.",
      "app_display_name": "copilot-studio-workshop-native-eval-20261023",
      "application_created_utc": "2026-10-23T20:44:48.927750+00:00",
      "user_scoped_grant_created_utc": "2026-10-23T20:44:50.472364+00:00",
      "auth_started_utc": "2026-10-23T20:45:01.915389+00:00",
      "auth_completed_utc": "2026-10-23T20:45:12.075727+00:00",
      "auth_attempts": 1,
      "browser_prompt": "none",
      "auth_timeout_seconds": 90,
      "token_acquired": true,
      "token_metadata_verified": {
        "audience": "https://api.powerplatform.com",
        "client_matches_owned_registration": true,
        "tenant_matches_target": true,
        "user_matches_grant_principal": true,
        "delegated_scopes": [
          "CopilotStudio.MakerOperations.Read",
          "CopilotStudio.MakerOperations.ReadWrite"
        ]
      },
      "method": "GET",
      "endpoint": "Known saved bot maker-evaluation testsets, api-version=2024-10-01",
      "http_status": 200,
      "sanitized_response": {"value": []},
      "test_set_count": 0,
      "evaluation_runs": 0,
      "loopback_listener_retained": false
    }
  ],
  "sdk_scope_limitations": {
    "azure_cli_credential_explicit_scope_probe": "The installed SDK translates get_token(scope) to az --resource; the explicit permission therefore became an invalid resource and returned AADSTS500011. The direct supported CLI --scope request, not that SDK translation, established the decisive AADSTS65002 failure.",
    "interactive_fallback": "Historical first-party attempt only: the SDK error included a browser-login fallback warning and the user reported AADSTS65002. First-party PPAPI login attempts remain stopped. The later explicitly authorized owned-client SSO is a separate supported route, not a first-party retry."
  },
  "consent_assessment": {
    "stage": "Historical initial first-party-client attempt; see owned_client_consent for the later authorized own-client grant",
    "current_actor_authority_verified": true,
    "basis": "Read-only Microsoft Graph checks confirmed existing delegated grant-management permission and existing Application Administrator / Cloud Application Administrator role membership. No roles were assigned.",
    "requested_read_scope_enabled": true,
    "requested_read_scope_consent_type": "User",
    "narrow_user_grant_executed": false,
    "why_not": "The existing first-party CLI client requires Microsoft API-owner preauthorization. A tenant user-scoped oauth2PermissionGrant is not a supported substitute for that requirement.",
    "existing_cli_service_principal_found_in_tenant": false,
    "existing_tenant_application_registrations_checked": 267,
    "registration_listing_complete": true,
    "existing_registrations_declaring_power_platform_api_resource": 0,
    "eligible_alternative_existing_client_established": false,
    "new_application_or_service_principal_created": false,
    "tenant_wide_consent_added": false,
    "before_after": "No cloud consent, registration, roles, secrets or configuration changes.",
    "rollback": "No cloud rollback required. Original PAC profile restored and verified before the user's urgent stop instruction. No later profile or Azure-context changes."
  },
  "owned_client_consent": {
    "actual_directory_authority_reverified": true,
    "suitable_owned_registration_found_before_creation": false,
    "owned_applications_checked": 46,
    "owned_application_listing_complete": true,
    "applications_created": 1,
    "own_client_service_principals_created": 1,
    "current_actor_is_app_owner": true,
    "account_type": "AzureADMyOrg",
    "public_client": true,
    "redirect_uri": "http://localhost",
    "client_secrets": 0,
    "certificates": 0,
    "application_permissions": 0,
    "graph_permissions_on_new_app": 0,
    "api_resource": "Power Platform API",
    "requested_and_granted_scopes": [
      "CopilotStudio.MakerOperations.Read",
      "CopilotStudio.MakerOperations.ReadWrite"
    ],
    "live_scope_metadata_verified_enabled_and_user_consentable": true,
    "run_permission_verification": {
      "permission": "CopilotStudio.MakerOperations.ReadWrite",
      "source": "https://microsoft.github.io/CopilotStudioSamples/testing/evaluation/EvalGateADO/",
      "basis": "Microsoft's evaluation sample explicitly lists Read and ReadWrite for the Eval API app registration. Both live scopes were verified and both appear in the issued owned-client token.",
      "limitation": "The REST run reference lists only .default. No POST run was sent, so endpoint execution authorization and downstream connection behavior are not yet runtime-proven.",
      "unneeded_sample_permissions_omitted": ["Dynamics CRM user_impersonation", "Tenant-wide admin consent", "Secrets and role assignments"]
    },
    "consent_type": "Principal",
    "principal": "Current authenticated user only; exact ID retained privately",
    "tenant_wide_consent": false,
    "before": {"owned_isolated_app_present": false, "own_client_user_grants": 0},
    "after": {"owned_isolated_app_present": true, "own_client_user_grants": 1},
    "environment_boundary": "OAuth delegated grants cannot be bound to one environment. The single-tenant client and this recovery's requests are restricted to the known tenant, environment and saved bot; the signed-in user's existing service authorization still applies.",
    "shared_azure_profiles_changed": false,
    "microsoft_first_party_applications_changed": false
  },
  "owned_app_retention_and_rollback": {
    "retained": true,
    "purpose": "Isolated workshop T005/T006 native evaluation access for the authorized Test handoff",
    "metadata": ".copilot-tracking/completion-20261023/owned-native-client.private.json",
    "cache": "Dedicated Windows-DPAPI-encrypted MSAL cache under the same ignored private directory; no plaintext token files",
    "rollback_order": [
      "DELETE the newly created current-user oauth2PermissionGrant",
      "DELETE the newly created own-client service principal",
      "DELETE the newly created isolated application registration",
      "Remove only the dedicated protected MSAL cache when no Test handoff depends on it"
    ],
    "exact_resource_ids_and_delete_urls": "Private app metadata rollback array",
    "rollback_executed": false,
    "reason_to_retain": "Successful recovered route is needed by Test; automatic deletion would undo the authorized recovery."
  },
  "chronological_outcomes": [
    {"stage": "Initial existing-client recovery", "status": "Blocked by API-owner preauthorization; no first-party consent bypass"},
    {"stage": "Human authorization source: actual requesting user message 2026-10-23T16:12:49.900-04:00", "status": "User stated: 'giving you all the approvals needed including deploments to azure as well as using copilot credits'"},
    {"stage": "Parent scoped implementation instruction at 2026-10-23T16:39:52.807-04:00", "status": "Parent directed one necessary isolated owned public-client route under the existing human authorization; not an additional human approval"},
    {"stage": "Owned-client creation and user-scoped grant", "status": "One secretless single-tenant app and one Principal grant created; exact before/after and rollback retained"},
    {"stage": "Single PKCE browser SSO", "status": "Succeeded; known bot evaluation test-set GET returned HTTP 200 with an empty list"},
    {"stage": "Stop", "status": "No native diagnostic re-enable, configuration change, test-set creation or evaluation execution"}
  ],
  "read_only_preservation": {
    "observation_time_utc": "2026-10-23T20:37:07.660531+00:00",
    "known_bot_dataverse_get_http_status": 200,
    "diagnostic_component_get_http_status": 200,
    "diagnostic_remains_inactive": true,
    "diagnostic_saved_row_version_unchanged": true,
    "original_attachment_get_http_status": 200,
    "original_attachment_remains_active": true,
    "original_attachment_saved_row_version_unchanged": true,
    "definition_hash_recomputed": false,
    "verification_basis": "Both saved component states, row versions, etags and modification timestamps match the retained authenticated preflight. The selected content property was not the YAML definition, so no definition-hash claim is made."
  },
  "safety": {
    "deployments": 0,
    "agent_configuration_changes": 0,
    "endpoint_authentication_changes": 0,
    "diagnostic_state_changes": 0,
    "original_route_changes": 0,
    "test_questions": 0,
    "evaluation_runs": 0,
    "paid_model_calls": 0,
    "openBrowserPage_calls": 0,
    "browser_session_internals_accessed": false,
    "plaintext_credentials_printed_or_persisted": false,
    "dedicated_dpapi_protected_msal_cache_created": true,
    "cache_storage_note": "Only the explicitly requested isolated MSAL cache persists protected credentials; no tokens appear in JSON receipts or tool output.",
    "first_party_preauthorization_bypass_attempted": false,
    "known_auth_commands_started_by_this_recovery_still_waiting": 0,
    "user_stop_honored": true
  },
  "stop_reason": "The one newly authorized own-client route succeeded. Stop after read-only native API verification; do not create another app, repeat interactive login, re-enable diagnostics, or submit an evaluation. Test owns the missing test-set and authenticated evaluation preparation.",
  "private_evidence_directory": ".copilot-tracking/completion-20261023",
  "private_evidence_files": [
    "native-api-auth-probes.private.json",
    "native-api-pac-probe.private.json",
    "native-api-direct-scope-probes.private.json",
    "native-api-client-discovery.private.json",
    "native-api-registered-clients.private.json",
    "native-api-eligible-clients.private.json",
    "native-api-access-recovery-closeout.private.json",
    "owned-native-preflight.private.json",
    "owned-native-client.private.json",
    "owned-native-test-handoff.private.json"
  ],
  "supported_sources": [
    "https://learn.microsoft.com/en-us/power-platform/developer/cli/reference/auth",
    "https://learn.microsoft.com/en-us/power-platform/admin/programmability-authentication-v2",
    "https://learn.microsoft.com/en-us/graph/api/oauth2permissiongrant-post?view=graph-rest-1.0",
    "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes",
    "https://learn.microsoft.com/en-us/rest/api/power-platform/copilotstudio/bots/list-maker-evaluation-test-sets",
    "https://learn.microsoft.com/en-us/rest/api/power-platform/copilotstudio/bots/run-maker-evaluation-test-set",
    "https://learn.microsoft.com/en-us/microsoft-copilot-studio/analytics-agent-evaluation-rest-api",
    "https://microsoft.github.io/CopilotStudioSamples/testing/evaluation/EvalGateADO/",
    "https://learn.microsoft.com/en-us/entra/identity-platform/scenario-desktop-app-configuration",
    "https://learn.microsoft.com/en-us/entra/msal/python/getting-started/acquiring-tokens"
  ]
}