[Alex Weininger (alexweininger)]

Summary

Canvas Authoring previously had no way to count use of its create-canvas-app companion. This candidate adds the reviewed canvas-less session provider and usage notice, carrying the invocation-counting change as 0.1.2. Counts describe skill use, not successful app creation or deployment. The native create-canvas skill and existing starter workflows remain unchanged.

Real authoring-event ingestion is unverified: the independent gateway deployment is still failing schema preflight. The sole unknown setting is isTroubleshootingAllowed; its type, mutability and update-preservation behavior need service-owner/Support confirmation. This PR does not deploy the gateway or claim that ingestion works.

Release facts and handoff

• Frozen source: 94baa3c75e4d5203fca7049a4e6bded3b963be49, including feature coreai-microsoft/canvases-cloud-foundation#321 (squash 6e8154d2ff896387c9d6222cc0b255b90027a717) and version bump coreai-microsoft/canvases-cloud-foundation#361 (squash 1de7a3f0eb0951593d0b909d36082a162eb59857). The later source merge is gateway guidance/runtime-snapshot work, not another authoring payload edit.
• Reviewed source package: workflow run 40000961246, artifact 12522495857, built at that exact source commit. Archive SHA-256: 7ca5bd0e213ccda053e0517b9318caab44950908288019b176f0749e37706a4c.
• Production base: 670e53112f7d887559367fbf430fa8c229316571. Candidate commit: c93eda0c9afa093b322f94a46977c64b39c96c7b.
• Available candidate preview: installable plugin folder · customer README. These are candidate links, not a released version.
• Planned immutable URL — live only after the post-merge tag: https://github.com/microsoft/azure-dev-tools/tree/canvas-authoring-v0-1-2-94baa3c/plugins/canvas-authoring
• Awesome Copilot source.sha: pending production squash merge. Neither the source nor candidate commit is the catalog SHA. No Awesome Copilot update is included or authorized.
• 27-file SHA256SUMS: b4df3e9bba627cc26c4b573d1aefac80751baeb935dfe9ad4c6f1fedb6035dd2. The receipt was derived from the frozen artifact, not a rebuild. Selection receipt SHA-256: 930c0c4ab162273d480f47a076c93691c86f5293919e57a6f5f8ae0711ddc0ba; package file-map receipt: 01029f0d0496eb81736c259e997c7fde050547cc639d80ebf30c8fb042a27abc.
• Scope: all 27 committed plugin files are byte-identical to the workflow artifact, including the reviewed EMU customer README (SHA-256 e4f0de3656e1835a295b9a0963b35bb87af4163adf113b4248ea1cce90125c5c). No customer-copy overlay or raw source publication. Every other production marketplace entry is preserved. The external receipt is version-selected; the historical 0.1.1 receipt and immutable tags are unchanged.
• Coordination: Fix over-eager canvas activation with Azure Resources Query 0.1.6 #36 shares the marketplace file but not this package. If another release merges first, refresh against the new production base and requalify rather than merging stale evidence. Reviewer/authorized maintainer owns the next review decision; no merge, tag, latest move, catalog update or Azure deployment is authorized by this candidate work.

Checks, workflow fallback, and known limitations

Workflow checks actually run at the frozen source:

• node scripts/release/production-pr.mjs prepare canvas-authoring 94baa3c75e4d5203fca7049a4e6bded3b963be49 670e53112f7d887559367fbf430fa8c229316571 artifacts/production-candidate — passed, including protected-base/read-only preflight.
• node scripts/release/production-pr.mjs test-selection canvas-authoring artifacts/production-candidate/selection.json — passed: 34 authoring tests and 4 exported-package/browser tests; zero failures or skips. Azure/counter builds, focused synthetic browser/CSP checks, toolkit installation and relocation were exercised. Synthetic browser evidence is not live Azure or native GitHub App acceptance.
• Candidate job source/base/selected-byte verify recheck — passed. App token mint — failed, repository-installation lookup returned Not Found; PR write step was skipped. Used the authorized manual production-worktree fallback with the retained artifact. No App key was read. Earlier successful run 39995396340 selected Azure Resources Query and skipped its candidate job; it was not an authoring release or proof that PR creation was unsupported.

Production checks actually run on this candidate:

• node --test --test-name-pattern='canvas-authoring' test/plugin-marketplace.test.mjs test/canvas-release-receipts.test.mjs — passed, 3/3. Covers all current exported bytes/toolkit provenance, unchanged historical 0.1.1 receipt, missing/corrupt runtime and manifest receipt rejection, strict missing-tag refusal, and a subsequent version without another verifier edit.
• Authoring-only verifyPlugin using the current catalog with { candidate: true } — passed, canvas-authoring@0.1.2 (candidate; immutable tag pending).
• Independent committed-tree SHA-256 comparison with every selection-receipt file and complete catalog equality except authoring's version — passed, 27/27 source-package files identical; no unrelated catalog edits.
• git diff --check — passed.
• node scripts/verify-plugin-marketplace.mjs --candidate — failed, Marketplace must contain exactly the reviewed production products. Reproduced unchanged on production base 670e531 (existing Storage identity mismatch); not waived or fixed here.
• node --test test/*.test.mjs — 36 passed, 11 failed (47 total). Untouched production base: 34 passed, the same 11 failed (45 total). Baseline failures cover catalog/Storage identity drift, SRE fixture/metadata drift, related global verification tests, and existing tag-source assertions. The two additional tests introduced here pass. This is not a green full production suite.

Not run: native GitHub App installation/acceptance at this candidate; real installed-plugin-to-gateway/database ingestion; full EMU npm test/npm run harness rerun for this candidate beyond the workflow's selected qualification. The source PRs disclose incomplete/non-green full-suite history. Post-merge immutable/latest URL verification and strict released-state verification are not run because release refs must not be created before an authorized merge. These are separate owner/operator follow-ups, not evidence of completed rollout.

Release and governance checks

• This change contains only content approved for this repository.
• Any required security, legal, licensing, and third-party-notice reviews are complete.
• No internal-only information, credentials, or unapproved payloads are included.
• If this distributes a canvas package, the release process in docs/release-process.md has been followed.

The governance review checkbox remains unasserted: no new security/legal approval is invented. This is a pre-merge candidate; subsequent release-ref steps have not been performed.

Copy/paste team announcement

Factual candidate handoff only; no public rollout announcement is approved or implied.

• Canvas Authoring 0.1.2: adds reviewed skill-invocation counting; production review candidate only, real ingestion unverified. Rollout owner: not specified for an announcement. Dark-deployed: not claimed; no deployment or rollout performed.
• Install: latest (existing 0.1.1; not this candidate) https://github.com/microsoft/azure-dev-tools/tree/canvas-authoring-latest/plugins/canvas-authoring; README (existing latest) https://github.com/microsoft/azure-dev-tools/blob/canvas-authoring-latest/plugins/canvas-authoring/README.md; exact version planned, not yet live https://github.com/microsoft/azure-dev-tools/tree/canvas-authoring-v0-1-2-94baa3c/plugins/canvas-authoring.

[Alex Weininger (alexweininger)]

Post-merge release-ref evidence: Awesome Copilot source.sha is VERIFIED as 1cf279c (the production squash commit), superseding the historical pending value in the locked merged-PR description. The PR-edit tool refused merged-body edits; no bypass was used.

Published the previously absent immutable canvas-authoring-v0-1-2-94baa3c at that squash commit, verified it, then advanced canvas-authoring-latest from freshly checked a6d394b using an exact force-with-lease. Remote readback confirms BOTH refs equal 1cf279c. All27 file hashes (including reviewed customer README), marketplace0.1.2 and external receipt at BOTH refs match the frozen reviewed artifact/merge. Authoring-only strict verifyPlugin passes with the real immutable tag. Public GitHub package/README API reads at both refs succeed; README blob cb5be4fd22fde590bd32ebd81a40eb896dd3f702 (4761bytes).

Live exact package: https://github.com/microsoft/azure-dev-tools/tree/canvas-authoring-v0-1-2-94baa3c/plugins/canvas-authoring
Live latest package: https://github.com/microsoft/azure-dev-tools/tree/canvas-authoring-latest/plugins/canvas-authoring
Live latest README: https://github.com/microsoft/azure-dev-tools/blob/canvas-authoring-latest/plugins/canvas-authoring/README.md
Receipt SHA256 remains b4df3e9bba627cc26c4b573d1aefac80751baeb935dfe9ad4c6f1fedb6035dd2.

Full strict marketplace verifier was run and still fails the independently reproduced pre-existing product/catalog identity mismatch (Marketplace must contain exactly the reviewed production products); no integrity check was relaxed or waived. No full suite rerun or native App installer acceptance claimed. No Awesome Copilot catalog update, Azure deployment, real ingestion verification or rollout announcement performed. The owner decides separately whether to request Awesome Copilot version0.1.2/source.sha pickup.