v0.1.0-beta.26

Developer Usage Insights v0.1.0-beta.26

Centralizes version metadata so macOS, Linux, and Windows all report the same tagged release.

New: --version

Every platform now answers the same question the same way:

$ developer-usage-insights --version
Developer Usage Insights v0.1.0-beta.26 (0.1.0, build 0.1.0.26)

It exits immediately, before any network call, so it works offline and is safe to script.

Version metadata is now derived from one place

The release tag is the only version string maintained by hand; everything else is derived from it.

• macOS — Info.plist now records the prerelease number. Earlier betas all reported a bare 0.1.0, so Finder and mdls could not tell beta.23, beta.24, and beta.25 apart. CFBundleVersion is now 0.1.0.26, and CFBundleGetInfoString carries the full tag.
• Linux — PLATFORM-REQUIREMENTS.txt now opens with the release, version, build, platform, and architecture. Previously the tarball recorded no version at all.
• Windows — the .exe still inherits Node.js's embedded PE version resource in its file properties. --version is the reliable way to identify a Windows copy. See "Known gaps" below.

Guardrails

The platforms cannot silently drift apart again:

• The Windows and Linux CI smoke test asserts --version reports the tag.
• The macOS release test asserts it on both the launcher and the executable inside the mounted DMG, and checks the tag and build number in Info.plist.
• Unit tests cover tag-to-version derivation, rejection of malformed tags, and parity between the product version and all six workspace manifests.

Known gaps

• The Windows .exe file properties still show Node.js's product name and version. Stamping a proper PE version resource needs an extra Windows-only native tool; --version covers the need in the meantime.
• macOS and Linux notify about updates rather than installing them. Rewriting an ad-hoc-signed multi-file bundle in place would break its Gatekeeper seal, so those platforms link to the release instead. Windows single-file builds continue to self-update.

Verifying a download

SHA256SUMS.txt covers the DMG, the Windows executable, and the Linux tarball.

v0.1.0-beta.25

Press Enter to quit

Running the app now prints Press Enter to quit. beneath the startup banner, and pressing Enter shuts the server down and closes the terminal window cleanly. This applies to Windows, Linux, and macOS.

Previously the only ways to stop the app were Ctrl+C or closing the window outright — neither is obvious for a non-developer audience, and on macOS the launcher opens a Terminal window that contains nothing but the banner.

Details:

• The listener only attaches when stdin is a terminal, so piped, scripted, and CI runs are unaffected and keep exiting on signals as before.
• Ctrl+D, and a terminal that disappears without sending a signal, now also trigger the same clean shutdown.
• Keypress and signal exits share one idempotent teardown path, so in-flight sign-ins are cancelled exactly once.

Verification

Scenario	Server stops
Enter pressed at 6s	6s
No key pressed, stdin held 25s	26s

Install

macOS (Apple Silicon): download the .dmg, drag the app to Applications, then right-click → Open the first time (the build is ad-hoc signed, not notarized).

Windows: download developer-usage-insights.exe. Linux: download and extract developer-usage-insights-linux-x64.tar.gz.

Verify downloads against SHA256SUMS.txt.

v0.1.0-beta.24

Prerelease build of Developer Usage Insights.

Fixed

Incomplete installs now say so. Launching a copy of the app whose bundled web
assets are missing previously failed with only The local web application has not been built. — which gave no indication of which copy was broken or where the
app had looked. This most commonly happened when a CI artifact zip was extracted
incompletely rather than installing from the DMG.

The app now:

• Names every directory it searched for the web assets in the HTTP 503 body, and
  links to the latest release so the broken copy can be replaced.
• Prints a warning to stderr at startup (visible in the Terminal window the macOS
  launcher opens) when the bundled assets are absent.
• Resolves the web assets relative to the module and the bundled Node runtime
  rather than the current working directory, so the launch method no longer
  affects resolution.

Hardening

• package:posix now asserts Contents/Resources/app/index.html exists right
  after staging, so a gutted bundle can never be packaged.
• test:macos now launches the packaged app and the DMG-mounted copy, fetches
  / plus a hashed JS asset, and fails the build if either does not return 200.

Verification

The macOS DMG in this release was mounted, launched, and confirmed to serve the
UI (HTTP 200 on / and on the hashed bundle) before publishing.

Install

macOS: open the DMG and drag the app to Applications. Do not run the app from an
extracted CI artifact zip.

v0.1.0-beta.23

Highlights

Update notifications on macOS and Linux. The bundled .app and the Linux
tarball now check for a newer published release at startup and print the new
version plus its download link into the terminal window the launcher already
opens.

Previously the auto-updater only ran for the single-file Windows executable, so
macOS and Linux users had no signal that a newer build existed. Those bundles
cannot safely replace themselves in place — the macOS app is ad-hoc signed and
not notarized, so downloading and running a replacement would be blocked by
Gatekeeper — so the check is advisory rather than automatic.

The check fails open: if you are offline, behind a proxy, or rate limited, the
app launches exactly as before with no error and no delay. Windows self-update
behaviour is unchanged.

Verification

• macOS .app and DMG validated with the full macOS release test suite.
• Update notice exercised end-to-end against the real GitHub API from inside the
  packaged app bundle, in both the "update available" and "already current"
  cases.
• Format, lint, typecheck, and the full unit suite (235 tests) pass.

Install

• macOS (Apple silicon): download developer-usage-insights-darwin-arm64.dmg.
• Windows: download developer-usage-insights.exe.
• Linux (x64): download developer-usage-insights-linux-x64.tar.gz.

Checksums for every binary are published in SHA256SUMS.txt.

Developer Usage Insights v0.1.0-beta.22

Developer Usage Insights v0.1.0-beta.22

Bug-fix release. The repository inventory on the Insights tab applied only one of its two security
filters at a time, so narrowing by a security feature and by that feature's state could not be
combined. Packaging, sign-in, collection, and the bundled Azure CLI and GitHub CLI runtimes are
unchanged from v0.1.0-beta.21.

Users of v0.1.0-beta.21 should upgrade if they use the Insights repository filters. The defect was
confined to which rows the dashboard displayed; no collected or exported data was wrong.

Changes

Repository security filters no longer cancel each other out

The Insights tab filters the repository inventory by security feature and by that feature's state.
The two conditions were combined with a logical OR against their respective "all" sentinels, so
either filter being left at all satisfied the whole expression and the other filter was silently
discarded:

• feature all, state enabled matched every repository instead of none, because the state select
  is disabled while no feature is chosen and its stale value was never meant to apply.
• feature Code Security, state all matched every repository instead of only those that report
  the feature.

Both filters now nest correctly. Choosing all features disables the state select and applies no
filtering, matching the control's existing disabled state. Choosing a feature with state all
narrows to repositories that report that feature, and choosing a feature with an explicit state
narrows to repositories where that feature is in that state. Repositories that do not report a
selected feature continue to be treated as unknown rather than being dropped.

A regression test drives all four filter combinations through the rendered panel and asserts the
visible-repository count after each change, including that the state select returns to disabled when
the feature filter is cleared.

Installing on macOS

Open the disk image, drag the application to /Applications, then clear the quarantine flag:

xattr -dr com.apple.quarantine "/Applications/Developer Usage Insights.app"

This step is required because the build is ad-hoc signed rather than Developer ID signed and
notarized. Verify the checksum below before running it.

Validation

• npm run ci (format, lint, type-check, tests, executable build, packaged smoke test) passes for
  the release commit.
• The regression test was confirmed to fail against the pre-fix code and pass against the fix, so it
  genuinely covers the defect rather than the corrected behaviour alone.
• The published macOS disk image was downloaded, checksum-matched, and mounted. codesign --verify --deep --strict reports the shipped bundle valid and satisfying its designated requirement, and
  bin/az version runs from the read-only image and reports Azure CLI 2.90.0.
• Checksums below are taken from the CI artifacts; verify them before running anything.

Limitations

• Unsigned evaluation prerelease. The macOS bundle is ad-hoc signed only and is not notarized,
  so the quarantine step above is required on first launch. Checksums verify integrity, not
  publisher identity. Do not bypass organization security policies to run this.
• The Entra publisher is unverified, so Microsoft sign-in shows an unverified-publisher consent
  prompt.
• Azure CLI bundling applies to the Windows and macOS packages. The Linux build still expects az
  on PATH when Microsoft sign-in is used.
• Exported reports contain potentially sensitive data and reflect the full collected report rather
  than the current dashboard filter.
• No provider permission changes or new collection APIs are included in this release.

Verifying a download

Download SHA256SUMS.txt next to the file you downloaded and run:

shasum -a 256 -c SHA256SUMS.txt

SHA256SUMS.txt covers all three distributables, so it reports No such file or directory for the
platforms you did not download; that is expected. Each distributable also ships a single-line
.sha256 file if you would rather check just one.

sbom.spdx.json, azure-cli.spdx.json, and github-cli.spdx.json describe the application and the
two bundled CLI runtimes.

Developer Usage Insights v0.1.0-beta.21

Developer Usage Insights v0.1.0-beta.21

Maintenance release. The macOS disk image now ships a working az entry point inside the embedded
Azure CLI, and the packaging scripts document the invariants that the last two releases depended on
but never explained. The Windows and Linux distributables are functionally unchanged, as is the
application itself on every platform.

Users of v0.1.0-beta.20 are not affected by a defect and do not need to upgrade urgently.

Changes

Embedded Azure CLI console scripts are relocatable

pip bakes the absolute path of the building interpreter into the shebang of every console script
it installs. On CI that path is long enough that macOS truncates it against the 127-byte shebang
limit, so all twenty-one console scripts in the embedded Azure CLI — including bin/az itself —
failed to run from the shipped bundle.

The application never executed those scripts. It invokes the bundled interpreter directly as
python3 -m azure.cli, so Microsoft sign-in worked in v0.1.0-beta.19 and v0.1.0-beta.20
regardless. The defect was only reachable by running bin/az by hand from inside the bundle.

Each console script now carries a relocatable sh/Python polyglot header that resolves the
interpreter next to itself at run time, which is the technique virtualenv uses for the same
problem. Packaging fails the build if bin/az is not rewritten, so a future change to how pip
emits console scripts cannot silently ship a broken entry point again.

Windows is unaffected: that package ships az.cmd, which has no POSIX shebang.

Documentation

The packaging and release-test scripts now explain the non-obvious mechanics they rely on:

• how the polyglot shebang header is parsed differently by sh and by Python, and why
  dirname -- "$0" is used in place of realpath or readlink -f,
• why shebang rewriting is scoped to scripts that point at this build's interpreter, which also
  makes a second pass a no-op,
• why a missing bin/az is treated as a build break rather than a warning, and
• why the ; terminating find -exec is passed as a literal argument rather than escaped the way
  a shell requires.

Installing on macOS

Open the disk image, drag the application to /Applications, then clear the quarantine flag:

xattr -dr com.apple.quarantine "/Applications/Developer Usage Insights.app"

This step is required because the build is ad-hoc signed rather than Developer ID signed and
notarized. Verify the checksum below before running it.

Validation

• npm run ci (format, lint, type-check, tests, executable build, packaged smoke test) passes for
  the release commit.
• The published macOS disk image was downloaded, checksum-matched, and mounted. The shipped bundle
  has no broken symlinks, no references to the CI build path, and codesign --verify --deep --strict reports it valid and satisfying its designated requirement.
• bin/az version runs from the mounted, read-only image and reports Azure CLI 2.90.0. The same
  command on the v0.1.0-beta.20 image fails to execute.
• Checksums below are taken from the CI artifacts; verify them before running anything.

Limitations

• Unsigned evaluation prerelease. The macOS bundle is ad-hoc signed only and is not notarized,
  so the quarantine step above is required on first launch. Checksums verify integrity, not
  publisher identity. Do not bypass organization security policies to run this.
• The Entra publisher is unverified, so Microsoft sign-in shows an unverified-publisher consent
  prompt.
• Azure CLI bundling applies to the Windows and macOS packages. The Linux build still expects az
  on PATH when Microsoft sign-in is used.
• Exported reports contain potentially sensitive data and reflect the full collected report rather
  than the current dashboard filter.
• No provider permission changes or new collection APIs are included in this release.

Verifying a download

Download SHA256SUMS.txt next to the file you downloaded and run:

shasum -a 256 -c SHA256SUMS.txt

SHA256SUMS.txt covers all three distributables, so it reports No such file or directory for the
platforms you did not download; that is expected. Each distributable also ships a single-line
.sha256 file if you would rather check just one.

sbom.spdx.json, azure-cli.spdx.json, and github-cli.spdx.json describe the application and the
two bundled CLI runtimes.

Developer Usage Insights v0.1.0-beta.20

Developer Usage Insights v0.1.0-beta.20

Repairs the macOS disk image published in v0.1.0-beta.19, which macOS refused to open with
"Developer Usage Insights is damaged and can't be opened." That build is unusable on macOS;
use this one instead. The Windows and Linux distributables are functionally unchanged.

Changes

macOS disk image no longer ships a corrupt application

The disk image staging step copied the signed .app with Node's fs.cp, which resolves symlink
targets by default. All ten symlinks in the embedded Azure CLI tree were rewritten to absolute
build-machine paths, so the copy that shipped inside the image had:

• a broken code-signature seal, which is what macOS reports as a damaged application, and
• a dangling azure-cli/bin/python3, which would have broken Microsoft sign-in even if Gatekeeper
  had been bypassed.

The bundle is now staged with ditto, Apple's copy tool for signed bundles, which preserves
symlinks, permissions, and extended attributes verbatim. Packaging additionally verifies the
signature of the staged copy rather than only the pristine source bundle, and staples the
notarization ticket when signing credentials are present.

Release testing covers the artifact customers receive

The macOS smoke test previously ran hdiutil imageinfo on the disk image and verified the source
bundle in the build directory, so it never inspected the copy inside the image. It now mounts the
image, asserts that no symlink in the shipped bundle is broken, and verifies that bundle's
signature. This defect would have been caught before release.

Documentation

• Document the first-launch quarantine step in README.md and in the generated
  PLATFORM-REQUIREMENTS.txt.
• Correct a stale claim that macOS users must install the Azure CLI and put it on PATH. The
  macOS package has bundled Node.js, the GitHub CLI, and the Azure CLI since v0.1.0-beta.19.

Installing on macOS

Open the disk image, drag the application to /Applications, then clear the quarantine flag:

xattr -dr com.apple.quarantine "/Applications/Developer Usage Insights.app"

This step is required because the build is ad-hoc signed rather than Developer ID signed and
notarized. Verify the checksum below before running it.

Validation

• npm run ci (format, lint, type-check, tests, executable build, packaged smoke test) passes for
  the release commit.
• The macOS disk image was mounted and inspected after packaging: ten symlinks, none broken, and
  codesign --verify --deep --strict reports the bundle valid and satisfying its designated
  requirement. The equivalent check on the v0.1.0-beta.19 image failed with
  a sealed resource is missing or invalid.
• syspolicy_check distribution reports no structural defects. The remaining findings are the
  expected ad-hoc signature and missing notarization ticket.
• Checksums below are taken from the CI artifacts; verify them before running anything.

Limitations

• Unsigned evaluation prerelease. The macOS bundle is ad-hoc signed only and is not notarized,
  so the quarantine step above is required on first launch. Checksums verify integrity, not
  publisher identity. Do not bypass organization security policies to run this.
• The Entra publisher is unverified, so Microsoft sign-in shows an unverified-publisher consent
  prompt.
• Azure CLI bundling applies to the Windows and macOS packages. The Linux build still expects az
  on PATH when Microsoft sign-in is used.
• Exported reports contain potentially sensitive data and reflect the full collected report rather
  than the current dashboard filter.
• No provider permission changes or new collection APIs are included in this release.

Verifying a download

Download SHA256SUMS.txt next to the file you downloaded and run:

shasum -a 256 -c SHA256SUMS.txt

SHA256SUMS.txt covers all three distributables, so it reports No such file or directory for the
platforms you did not download; that is expected. Each distributable also ships a single-line
.sha256 file if you would rather check just one.

sbom.spdx.json, azure-cli.spdx.json, and github-cli.spdx.json describe the application and the
two bundled CLI runtimes.

Developer Usage Insights v0.1.0-beta.19

Developer Usage Insights v0.1.0-beta.19

Caution

The macOS .dmg in this release is broken. Do not use it — install
v0.1.0-beta.20 instead.

The packaging step that copied the signed .app into the disk image rewrote every
relative symlink inside the bundled Azure CLI into an absolute build-machine path. That
invalidated the code-signature seal, so macOS reports the extracted app as
"is damaged and can't be opened", and it left the bundled Python interpreter dangling.
The Windows and Linux assets in this release are unaffected.

First release with a self-contained macOS application. The .dmg now carries every
runtime the app needs, so Microsoft sign-in works on a machine that has never had
Node.js, the GitHub CLI, or the Azure CLI installed.

Changes

macOS application

• Package the macOS build as a real .app bundle inside a .dmg, launched by a native
  Mach-O stub in Contents/MacOS rather than a shell wrapper. (See the caution above: a
  packaging defect in this release reintroduced the "damaged" warning; it is fixed in
  v0.1.0-beta.20.)
• Bundle the Node.js runtime, the GitHub CLI (gh), and the Azure CLI (az) under
  Contents/Resources. The app resolves its own copies first and only falls back to PATH,
  so no Homebrew or system install is required. The Azure CLI payload is reduced to the
  modules the app actually uses to keep the bundle size down.
• Fix Microsoft sign-in on macOS. Builds without a DEVELOPER_USAGE_INSIGHTS_CLIENT_ID
  previously refused to sign in at all; they now fall back to the bundled Azure CLI device-code
  flow, which needs no pre-approved client application registration.
• Add a GitHub sign-in option to the sign-in page alongside Microsoft sign-in.
• Stop the Dock icon from bouncing indefinitely after launch. The launcher declares
  LSUIElement so macOS no longer waits for an app activation that a console process never sends.
• Open a visible Terminal window when the app is started from Finder, so collection progress and
  device-code prompts are readable. Closing that window now quits the application instead of
  leaving an orphaned background process.
• Keep command-line use working. The launcher previously chose between the Terminal window and a
  direct run based only on whether stdin was a terminal, so any invocation with redirected stdin
  (developer-usage-insights --help from a script, for example) opened a Terminal window instead of
  answering on the calling stream. The Terminal path is now taken only when the app is started with
  no arguments and no controlling terminal, which is what Finder and open actually do.
• Replace execFile with spawn for Azure CLI calls so sign-in subprocesses are terminated with
  the app rather than orphaned.
• Generate the application icon and bundle metadata as part of the build, and use the product icon
  consistently across the app.
• Resolve the application root independently of process.cwd(), so the packaged app behaves the
  same regardless of the directory it is launched from.
• Ad-hoc sign the macOS bundle so it launches without being quarantined as an incomplete bundle.

Documentation

• Correct the macOS requirements in README.md and PLATFORM-REQUIREMENTS.txt. They previously
  told macOS users to install the Azure CLI and put it on PATH, which is no longer true.
• Document the launcher's two start modes and the close-the-window-to-quit behaviour, both in the
  README and in a header comment in scripts/macos-launcher.c.

Validation

• Unit tests cover bundled-versus-system Azure CLI resolution, the DEVELOPER_USAGE_INSIGHTS_AZ_HOME
  contract, the reduction step's keep/drop rules, and the symlink and copy handling that previously
  corrupted the bundled runtime.
• The macOS bundle integrity gate runs in CI and checks the packaged structure before release.
• npm run ci (format, lint, type-check, tests, executable build, packaged smoke test) passes for the
  release commit, and the packaging jobs produce the published artifacts.
• Checksums below are taken from those CI artifacts; verify them before running anything.

Limitations

• Unsigned evaluation prerelease. The macOS bundle is ad-hoc signed only and is not notarized, so
  Gatekeeper will still require an explicit override on first launch. Checksums verify integrity, not
  publisher identity. Do not bypass organization security policies to run this.
• The Entra publisher is unverified, so Microsoft sign-in shows an unverified-publisher consent prompt.
• Azure CLI bundling applies to the Windows and macOS packages. The Linux build still expects az on
  PATH when Microsoft sign-in is used.
• Exported reports contain potentially sensitive data and reflect the full collected report rather than
  the current dashboard filter.
• No provider permission changes or new collection APIs are included in this release.

Verifying a download

Download SHA256SUMS.txt next to the file you downloaded and run:

shasum -a 256 -c SHA256SUMS.txt

SHA256SUMS.txt covers all three distributables, so it reports No such file or directory for the
platforms you did not download; that is expected. Each distributable also ships a single-line
.sha256 file if you would rather check just one.

sbom.spdx.json, azure-cli.spdx.json, and github-cli.spdx.json describe the application and the two
bundled CLI runtimes.

Committer Insights v0.1.0-beta.18

Committer Insights v0.1.0-beta.18

Changes

• Add COMMITTER_INSIGHTS_AUTO_UPDATE=true|false to control packaged Windows startup update checks, enabled by default. The existing --skip-update-check flag still skips checks for one launch; download integrity checks are unchanged.
• Align standalone HTML reports with the dashboard's typography, spacing, metric tiles, tables, and responsive navigation. Desktop reports use a section sidebar; smaller screens use wrapping navigation.
• Preserve the current dashboard's light or dark theme when downloading HTML, including downloads from the synthetic demo. Reports retain all providers and collected evidence, remain script-free, and require no external assets or network access to read.
• Keep recommendation navigation reachable and include links to other Azure DevOps service estimates when present. Printed reports retain a light, readable layout.
• Reorganize the README with navigation and current public guidance. Consolidate maintenance instructions into it and remove the separate maintainer guide.
• Document collection endpoints, API versions, retained fields, pagination and date rules, identity matching, local calculations, exclusions, and official Microsoft/GitHub references. Explicitly flag the existing GitHub enterprise-discovery routes that are absent from the reviewed public specification; this release does not change those collectors.

Validation

• Updater regressions cover environment defaults, accepted and invalid values, command-line precedence, help availability, and startup without calling the updater when disabled.
• Export and dashboard regressions cover theme preservation, full-report content, HTML escaping, and self-contained output.
• Synthetic browser checks exercise light/dark HTML downloads at 1440px and 390px, compare theme colors and typography, check section targets and page overflow, and block network requests while reading the exported file.
• Publication requires full local validation, build and CodeQL success for the exact release commit, and checksum verification and packaged smoke tests of the downloaded CI artifact.

Limitations

• Unsigned Windows x64 evaluation prerelease. Checksums verify integrity, not publisher identity; do not bypass organization security policies.
• Exported reports contain potentially sensitive data. The HTML preserves the full collected report, not the current dashboard filter, and shows provider sections together rather than interactive dashboard tabs.
• Directly generated HTML uses the default dark theme; downloads through the dashboard carry its selected theme. No theme scripts or provider collection are embedded in the file.
• No provider permission changes, new collection APIs, or Sources and Options workflow redesign are included. Documentation references do not certify complete tenant coverage or customer invoice accuracy.

Use --skip-update-check or COMMITTER_INSIGHTS_AUTO_UPDATE=false only for deliberate rollback or offline/candidate startup. Normal startup checks published releases, including prereleases.

Committer Insights v0.1.0-beta.17

Committer Insights v0.1.0-beta.17

Changes

• Prepare the bundled Microsoft sign-in runtime during application startup, after update handoff and before the browser opens. Sign-in and token requests reuse the verified runtime for that process.
• Reduce Azure CLI 2.90.0 at build time while preserving single-executable delivery, shared authentication dependencies, certificates and detected legal notices. The smaller runtime still extracts into the per-user cache; no global installation or elevation is required.
• Verify all runtime files on each application launch. Keep separate source and reduced-payload checksums, deterministic ZIP packaging, and companion SBOM provenance.
• Report startup preparation progress. A preparation failure leaves GitHub available and requires an application restart before Microsoft sign-in.
• Default new report drafts to Azure DevOps and GitHub reported billing, with opt-out controls. Azure billing diagnostic details remain off unless selected; no provider permissions or billing settings are changed.
• Default activity collection and the results view to 90 days, capped to available data. Provider snapshots and monthly billing periods keep their actual dates.
• Check Azure DevOps datasets independently during source review using the report collectors. Show partial access, per-product estimates, repository history, settings and requested billing results instead of a blanket Ready status. Preserve safe HTTP/schema/timeout explanations and distinguish uncollected invoice meters from denied billing access. Successful reads do not prove visibility of hidden projects or repositories.

Measured Reduction

Local candidate measurements, using decimal MB:

Component	Before	After
Runtime files	11,312	4,470
Extracted runtime	273.9 MB	105.6 MB
Embedded CLI archive	90.2 MB	44.1 MB
Complete executable	229.1 MB	182.0 MB

The published executable is rebuilt by CI; use its attached checksum rather than a local candidate checksum.

Validation and Acceptance

• The runtime-reduction candidate passed 286 automated tests, executable packaging, isolated offline authentication checks, upgrade handoff and fresh-user startup smoke checks. Two initial Windows test timeouts passed on an unchanged rerun. The access/defaults update passes 295 automated tests, including partial and all-denied access, safe HTTP diagnostics, billing defaults and 90-day display coverage.
• On 2026-09-25, the maintainer reported successful live Microsoft sign-in with the reduced candidate and explicitly cleared the publication gate. This is user-reported acceptance; automated checks do not sign in.
• Publication requires build and CodeQL success for the exact release commit and checksum verification and packaged smoke checks of the downloaded CI artifact.

Limitations

• Unsigned, Windows x64 evaluation prerelease. Checksums verify integrity, not publisher identity.
• Successful live sign-in does not certify every tenant's Conditional Access policies, cross-tenant discovery or live token renewal. No tenant policies or global CLI settings are changed.
• Runtime integrity is checked at startup, not before every token request. Changes to the cache after startup are detected on the next launch.
• The reduced runtime is not a general-purpose Azure CLI installation. Its retention policy is pinned to 2.90.0 and requires review for upgrades.
• Headless CI cannot validate native console-parent UI behavior. Customer invoice reconciliation and clean-machine certification remain separate checks.

Use --skip-update-check for deliberate rollback or candidate testing. Normal startup checks published releases, including prereleases.