1.0.0b5

Two commands' worth of honesty about reaching a tenant, and the release gate
that should have existed before 1.0.0b4 went out.

connect: the other half of doctor

doctor reports whether this installation is sound. Nothing reported whether
the application registration in front of you can reach the tenant in front of
you — that was found out several minutes into a collection, from a failure that
looked like a tenant problem rather than a consent problem.

Four words rather than a boolean: established, refused, unreachable,
cancelled. A tenant that answered and would not have us is a different
sentence from one that never answered, and collapsing them sends a person to
check their network when the answer was consent.

Two questions, and one field would answer neither

Address resolution
  <host>  owned by  <directory id>
  Public discovery, and no session was involved.

Authenticated session
  identity   delegated
  observed   not established

Which directory owns an address is answerable by anybody, from public
OpenID discovery, without a token. Which directory a session operated in is
answerable only by the session. A GUID the whole world can obtain without
reaching a tenant is not evidence that a collection looked at it, so
resolved_tenant_id and observed_tenant_id are separate and the second is
null.

The address resolves before the sign-in and is reported whatever the sign-in
does: a tenant that refuses you still has an address, and somebody diagnosing a
consent problem is helped by knowing which directory they were actually pointed
at.

Evidence provenance gains neither by shortcut. That is a change to the evidence
contract, with its own decision.

The gate that was missing after the upload

1.0.0b2 shipped an install command that resolved to nothing. 1.0.0b4
shipped one naming 1.0.0b3. Both uploads succeeded, and a release description
is frozen at upload, so neither could be corrected without spending another
version.

A successful upload proves the file arrived. It proves nothing about whether
anybody can install and run it.

tools/post-release-check.sh installs from the public index into a
throwaway environment and refuses unless the program reports the released
version, doctor is sound, packaged evidence evaluates and decides something,
the documented commands run, and the contract bundle is in the wheel.
publish.yml runs it after every publish.

pipx, with ensurepath

pip install is the wrong command for an application, and on Homebrew's
Python, Debian's and Ubuntu's it is not even possible (PEP 668). Skipping
ensurepath installs successfully and still gives command not found, which
reads like a broken package.

The measured surface stopped counting comments as calls

tools/surface.py decided what the collector calls with a regular expression
over its source, so a comment explaining why a cmdlet was not called made the
published document say it was. It parses the syntax tree now, as the read-only
gate always has.

Status, measured

20 rules, a thirteen-mode collector, 9 profiles, 14 commands, 823 tests at 90
per cent coverage.

Install

brew install pipx        # macOS. Ubuntu 23.04+/Debian 12+: sudo apt install pipx
pipx ensurepath          # then open a new shell

pipx install m365-governance-as-code==1.0.0b5