[Alex Weininger (alexweininger)]

Summary

Azure Resources Query could open for incidental lookups during diagnosis, deployment or configuration. 0.1.6 narrows activation to explicit inventory browsing, explicit canvas opening, and refinements of its current results, leaving other workflows in control.

Import the exact qualified package without rebuilding or editing its generated README/skill. This includes the generated runtime and shared subscription-picker changes from that source, not just launcher wording. Advance only ARQ's marketplace version and matching test fixture; update its root README row to describe the candidate accurately. Other products and release refs are unchanged.

Candidate: extension preview · customer README.

Planned immutable URL — not live until post-merge tagging: https://github.com/microsoft/azure-dev-tools/tree/azure-resources-query-v0-1-6-84aba81/canvases/azure-resources-query/com.github.copilot/extensions/azure-resources-query

Awesome Copilot source.sha: pending production squash merge. Neither the source SHA nor candidate commit is that value.

• Dry-run preparation and qualification passed; all 101 committed package files match its receipt.
• ARQ production product verification and all six package-receipt tests pass.
• Resolve or explicitly review the disclosed production-check, documentation and license-metadata findings; no waiver is claimed.
• Obtain independent production review and approval. This handoff stops before merge or publishing.

Release and governance checks

• This change contains only content approved for this repository.
• Any required security, legal, licensing, and third-party-notice reviews are complete.
• No internal-only information, credentials, or unapproved payloads are included.
• If this distributes a canvas package, the release process in docs/release-process.md has been followed.

Package preparation and integrity checks are complete; the release is not claimed fully compliant or approved. Applicable governance review and the findings below remain for the release owner and production reviewer. No governance approval or release-check waiver is inferred from past PRs.

Copy/paste team announcement

Candidate facts only, not a public rollout announcement. The release owner decides when to communicate or publish; these links do not make 0.1.6 available in Awesome Copilot.

• Azure Resources Query 0.1.6: Review candidate for narrower inventory-only activation; not merged or promoted. Rollout owner: Alex Weininger (@alexweininger). Dark-deployed: not evaluated; no deployment or enablement performed.
• Install: customer channel: Awesome Copilot, copilot plugin install azure-resources-query@awesome-copilot (check the listed version). Package references: latest (prior release, unchanged) https://github.com/microsoft/azure-dev-tools/tree/azure-resources-query-latest/canvases/azure-resources-query/com.github.copilot/extensions/azure-resources-query; README https://github.com/microsoft/azure-dev-tools/blob/azure-resources-query-latest/canvases/azure-resources-query/README.md; exact version (planned, not live) https://github.com/microsoft/azure-dev-tools/tree/azure-resources-query-v0-1-6-84aba81/canvases/azure-resources-query/com.github.copilot/extensions/azure-resources-query.

Exact release evidence, guideline comparison and known failures

Provenance and integrity

• Reviewed source and package-build revision: 84aba81d405f8b09577354003985c30e78dc28b1, merged source PR coreai-microsoft/canvases-cloud-foundation#343. The workflow generated the package from this revision; there is no separate source-package commit to substitute.
• Qualified artifact: dry-run 39995396340, artifact 12519363374, canvas-production-candidate-84aba81d405f8b09577354003985c30e78dc28b1-azure-resources-query. Artifact digest: e6a04e75e10c115ec2b982660d82409ec3204d454cc35dd015200574674dc6cf.
• Production base: 670e53112f7d887559367fbf430fa8c229316571, rechecked against protected production main. Candidate: bd78a0e65ea30e02e86f2b9d066bd5318bd9cde2. If production main changes before merge, fresh candidate evidence is required; do not silently rebase and reuse this receipt.
• Selection receipt SHA-256: 29db61a7260604dce1bc4214bab4d97f7894d1f85f20f7db91634505fc87a12f.
• Complete package receipt SHA-256: 859dfabde0c961aafc11a3504a9c351f107306e95eda2bc126aaf267cd28231c.
• SHA256SUMS: 97 protected entries; file SHA-256 b29b24f75a6ba9bfe52e276815fce0bb34be49cad5fb9aac3047d0f53d6cb208. All 101 committed files, including mutable documentation and this receipt, match the selection receipt. Unrelated marketplace entries are unchanged. Integrity hashes are not signatures.

Checks actually run

• Workflow node scripts/release/production-pr.mjs test-selection azure-resources-query artifacts/production-candidate/selection.json: passed, including node scripts/ci/validation.mjs source-tests --apps=azure-resources-query (743 passed) and node scripts/ci/validation.mjs source-harness --apps=azure-resources-query (19 browser/CSP tests passed). Candidate writing was skipped as requested for a dry-run; no automatic production PR was attempted.
• Local node --input-type=module -e 'import fs from "node:fs";import {verifyPlugin} from "./scripts/verify-plugin-marketplace.mjs";const p=JSON.parse(fs.readFileSync(".github/plugin/marketplace.json")).plugins.find(p=>p.name==="azure-resources-query");console.log(verifyPlugin(p,{candidate:true}));': passed, azure-resources-query@0.1.6 (candidate; immutable tag pending). This is the unmodified production product verifier, not a full-marketplace pass.
• node --test --test-reporter=tap test/canvas-release-receipts.test.mjs: passed, 6/6.
• (cd canvases/azure-resources-query && shasum -a 256 -c SHA256SUMS): passed; committed-file parity additionally checked against every selection-receipt hash. git diff --check: passed.
• node scripts/verify-plugin-marketplace.mjs --candidate and node scripts/verify-plugin-marketplace.mjs: both failed, Marketplace must contain exactly the reviewed production products, also reproduced before importing ARQ. Production retains the Storage identity mismatch addressed separately in Fix Storage identity in production release verification #34. No temporary verifier patch or waiver is included.
• node --test --test-reporter=tap test/*.test.mjs: 33 passed, 12 failed. Failures include Storage identity/fixture drift, SRE version/README drift, and the ARQ guide assertion expecting exact 0.1.6 pin, wait while the qualified guide still says 0.1.5. Unrelated stale entries remain untouched.
• GitHub license/cla: passed at comparison time; this is not a substitute for dependency-license or governance review.
• Native App activation/routing, installation, marketplace visibility and live Azure acceptance: not run; outside this preparation handoff. Source prose assertions and browser fixtures do not prove live host routing. The release owner owns any requested host acceptance; no provider reload or App configuration change was performed.

Comparison with prior releases and written guidelines

Compared with exact-artifact releases #35 (Storage) and #31 (Containers), prior ARQ release #19, and template-aligned SRE patch #32. This PR follows the same source/base/artifact/receipt separation, selected-product scope, candidate preview, planned tag, pending production squash SHA and human-review handoff. Unlike #35's diagnostic verification with #34 temporarily applied, no full-marketplace pass is claimed here. Historical PRs are precedent, not permission to waive current requirements.

Remaining findings are explicit, not repaired by altering qualified bytes:

• Customer documentation: docs/release-process.md requires the customer README itself to include nested latest and README links, an exact canvas-open prompt and a numbered quickstart. The qualified top-level README delegates installation details to docs/advanced.md and does not contain all those items itself. The advanced guide has the numbered quickstart and canvas-open prompt, but still calls out an exact 0.1.5 pin and directs full-plugin installation through azure-dev-tools, whereas the main README correctly directs customers to Awesome Copilot. These are documentation-policy gaps, not proof of runtime failure. No overlay was applied. Any correction must be reviewed in source and return through the qualified-artifact path, rather than hand-editing this candidate.
• License metadata: release.json adds @cloud-foundation/azure-resources-query-core@0.1.0 with license: null; the package's THIRD_PARTY_NOTICES.txt is unchanged. This does not establish that a license is missing, but coverage has not been established by this handoff. The source/release owner must confirm applicable license and notice treatment before marking governance review complete.
• Production checks: the full verifier and suite are not green. The exact errors/results above remain visible; the ARQ-only pass must not be presented as release-wide qualification.

Human handoff

Production reviewer and release owner evaluate the disclosed findings and applicable governance requirements; no independent release-delay decision or waiver is asserted here. The authorized task stops at this reviewable PR. If approved and separately authorized, the normal sequence is production squash merge, verify its full SHA and package, publish/verify the immutable tag, then move/verify only ARQ latest. Awesome Copilot listing is a separate owner decision and uses the verified production squash SHA. No merge, tags, latest movement, catalog changes, installation, provider reload or rollout announcement was performed.