[Alex Weininger (alexweininger)]

Summary

Azure Resources Query 0.1.6 leaves incidental diagnostic, deployment and configuration lookups alone, activating for explicit inventory browsing, canvas opening and refinements of current results. Its corrected customer guides recommend Awesome Copilot, explain published immutable-tag installation, and restore the launch prompt, numbered quickstart, prerequisites and safety guidance.

Supersedes #36 on fresh production main after #37. Only README.md and docs/advanced.md differ from #36's 101-file package. Protected runtime, skills, manifests, notices and receipts are identical, so the version stays 0.1.6. #36 remains open with its history untouched. This PR imports the exact qualified artifact without rebuilding or hand-editing generated files; it also updates only ARQ's catalog/fixture version, root README row and directly related documentation assertion. Canvas Authoring stays 0.1.2; unrelated entries and verifier code are unchanged.

Candidate: nested extension preview · customer README.

Planned immutable install URL — NOT LIVE until post-merge tagging: https://github.com/microsoft/azure-dev-tools/tree/azure-resources-query-v0-1-6-f7a37f9/canvases/azure-resources-query/com.github.copilot/extensions/azure-resources-query

Awesome Copilot source.sha: PENDING PRODUCTION SQUASH MERGE. Neither source nor candidate SHA is that value. No catalog, App, provider or installation change was performed.

• Successful source qualification; exact 101-file import and protected-byte parity with Fix over-eager canvas activation with Azure Resources Query 0.1.6 #36 verified.
• ARQ product verifier, 7 receipt tests and targeted docs test pass; no new failures versus production baseline.
• Review disclosed baseline failures, documentation-policy difference and package-owner licensing decision.
• Independent production review and approval; stop before merge or publishing.

Release and governance checks

• This change contains only content approved for this repository.
• Any required security, legal, licensing, and third-party-notice reviews are complete.
• No internal-only information, credentials, or unapproved payloads are included.
• If this distributes a canvas package, the release process in docs/release-process.md has been followed.

Preparation and integrity evidence are complete, not a claim of release-wide approval or a waiver. Applicable governance remains with the package owner and production reviewer.

Copy/paste team announcement

Candidate facts only, not a public rollout announcement; the owner decides when to communicate.

• Azure Resources Query 0.1.6: Review candidate for inventory-only activation and corrected installation guides; not merged or promoted. Rollout owner: Alex Weininger (@alexweininger). Dark-deployed: not established by this candidate; no deployment or enablement performed.
• Install: latest (prior release, unchanged) https://github.com/microsoft/azure-dev-tools/tree/azure-resources-query-latest/canvases/azure-resources-query/com.github.copilot/extensions/azure-resources-query; README https://github.com/microsoft/azure-dev-tools/blob/azure-resources-query-latest/canvases/azure-resources-query/README.md; exact version (planned, NOT LIVE) https://github.com/microsoft/azure-dev-tools/tree/azure-resources-query-v0-1-6-f7a37f9/canvases/azure-resources-query/com.github.copilot/extensions/azure-resources-query.

Exact provenance, integrity, checks and remaining findings

Qualified artifact and production base

• Reviewed merged source/package-build revision: f7a37f9613c4aeede1f11fa16d238ec2d5a1cde2, coreai-microsoft/canvases-cloud-foundation#383, including activation correction coreai-microsoft/canvases-cloud-foundation#343. There is no separate source-package commit; this revision generated the package.
• Existing qualification run 40005755517: SUCCESS; dry-run candidate-writing job skipped. No new workflow dispatched.
• Artifact 12524471627: canvas-production-candidate-f7a37f9613c4aeede1f11fa16d238ec2d5a1cde2-azure-resources-query; API-reported artifact digest 2df2ce59833ab19a97cd0bf0d7d888d2c88ac8a40ca258e5441378280721ddbe.
• Receipt production base and current main, rechecked immediately before push: 1cf279cfdc7105517d24f34cab56583aed734e75. Candidate head: 0806807e344a5b9a611c2b3cc5c0e1372ffb8932. If main advances, refresh qualification rather than silently rebasing/reusing this receipt.
• selection.json matches selection.sha256: d4c10ba5e9432ac096cb511a1fa28cd4593702fc656f4b44087c644d16fd1e9a.
• Complete package receipt, SHA-256 of localeCompare-sorted file-hash JSON serialized with two-space indentation and trailing newline: dbf727cb6cb11be594f362467f16dee702c0e59bf820612e246ce164c03c5a3f.
• SHA256SUMS: 97 entries, file digest b29b24f75a6ba9bfe52e276815fce0bb34be49cad5fb9aac3047d0f53d6cb208, unchanged from Fix over-eager canvas activation with Azure Resources Query 0.1.6 #36. Independent inventory checks cover all 101 files, including docs and the receipt; no additions/deletions or byte overlays. Hashes are integrity evidence, not signatures.
• All 19 canonical remote immutable refs match local refs; the seven historical commit pins pass verifyPreviousReleaseCommits using precisely those seven canonical refs. Local canvas-authoring-latest is stale relative to remote; no ref was changed or forced. Planned ARQ tag is absent, as expected before merge.
• Reviewed production release process and merged EMU guide blob 3f85a34253ffd8544f3acf4321b3707018e07455.

Actual checks

Source results are taken from this run's logs, not copied from #36:

• node scripts/release/production-pr.mjs test-selection azure-resources-query artifacts/production-candidate/selection.json: passed, including source tests 743/743 and browser/strict-CSP harness 19/19.

Final committed candidate:

• node --input-type=module -e 'import fs from "node:fs";import {verifyPlugin} from "./scripts/verify-plugin-marketplace.mjs";const p=JSON.parse(fs.readFileSync(".github/plugin/marketplace.json")).plugins.find(p=>p.name==="azure-resources-query");console.log(verifyPlugin(p,{candidate:true}));': passed, azure-resources-query@0.1.6 (candidate; immutable tag pending).
• node --test --test-reporter=tap test/canvas-release-receipts.test.mjs: passed, 7/7 (current production includes the additional builder receipt check).
• node --test --test-reporter=tap --test-name-pattern='customer guides link to full-plugin and canvas-only installation instructions' test/production-links.test.mjs: passed, 1/1. Only ARQ assertions were updated to validate linked guide/anchors, user-selected published tags and manifest-derived install paths; Hosted expectations remain unchanged.
• (cd canvases/azure-resources-query && shasum -a 256 -c SHA256SUMS): passed, 97/97. Independent artifact/import checks: 101/101 file hashes, complete inventory, canonical package receipt and exact docs-only difference from Fix over-eager canvas activation with Azure Resources Query 0.1.6 #36 passed.
• git diff --check: passed. Catalog/fixture object comparison against production base: passed, only ARQ version 0.1.5 → 0.1.6.
• node scripts/verify-plugin-marketplace.mjs --candidate and node scripts/verify-plugin-marketplace.mjs: failed, both Marketplace must contain exactly the reviewed production products. Identical before import; Storage identity mismatch is tracked separately in Fix Storage identity in production release verification #34. No verifier patch or waiver.
• node --test --test-reporter=tap test/*.test.mjs: 35 passed, 12 failed on the final candidate, exactly matching a clean detached checkout of production base (35 passed, the same 12 failed). The newly exposed ARQ documentation assertion was corrected and passes; there are no added failing tests.

The 12 baseline failures (retained, not waived) are:

1. every canvas accepts schema-v2 protected-only receipts without migrating historical tags
2. legacy tagged receipts stay historical while each product's docs change on main
3. requires release tags for full verification, then checks every catalog plugin
4. candidate validates every reviewed package and omits only missing immutable tags
5. candidate rejects corrupted protected payloads and checksum receipts
6. a subsequent Cost candidate version validates without a verifier edit
7. canvas-authoring uses versioned receipts without changing historical receipts or verifier versions
8. target tags must identify the package version and a source commit
9. production catalog matches all installable plugins in order
10. SRE package has its catalog identity, official preview logo and customer connection steps
11. the Storage candidate verifies its canonical plugin and protected receipt
12. Storage rejects changes to its protected runtime, launcher, notices, icon and receipt

Actual causes include Storage's catalog identity, SRE fixture/prose drift, the root Canvas Authoring row still describing 0.1.1, and a builder exception assertion after its tag was published. None is repaired by changing this selected package.

Remaining findings and handoff

• Licensing: @cloud-foundation/azure-resources-query-core@0.1.0 still records license: null. Source investigation found no package LICENSE/root grant establishing coverage. The package owner owns this unresolved licensing/notice decision; no grant is inferred and no license, notice or package structure is changed.
• Documentation policy: corrected source now supplies the customer launch/quickstart/prerequisite/safety material and consistent Awesome Copilot guidance. The production guide still literally asks for nested -latest and README-through--latest links in the customer README; reviewed source instead uses published immutable-tag selection. This difference is disclosed for owner/reviewer evaluation, not silently declared compliant or repaired with an overlay.
• Native host evidence: App installation/routing, live Azure acceptance, provider reload and marketplace visibility not run, outside this candidate handoff. Browser/source checks do not establish live host acceptance. The release owner owns any separately requested host validation.

Next owner: independent production reviewer and authorized maintainer assess the candidate and disclosed findings. This handoff stops before merge, tags, latest movement, Awesome Copilot catalog changes, App/provider changes or installation. Leave #36 open unless the owner directs otherwise. Future Awesome Copilot source.sha remains PENDING PRODUCTION SQUASH MERGE.

[Alex Weininger (alexweininger)]

Verified production release refs

Awesome Copilot source.sha: a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2, the verified production squash of this PR. The candidate-body statements saying the merge SHA and release refs are pending are historical preparation evidence, superseded by this comment. The merged-PR body was not edited because the app's body-edit tool supports open PRs only.

Following the owner's explicit release-operator authorization, on 2026-10-23:

• Created the previously absent immutable azure-resources-query-v0-1-6-f7a37f9 without force at the production squash; no existing immutable ref was moved.
• Verified that immutable package, nested install path and README before moving azure-resources-query-latest.
• Moved only ARQ latest from bf0bd07520d004845b727bb40932c24a6e69bb8d with an explicit --force-with-lease against that exact old ref. Both remote refs now point to a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2.
• Compared all remote tags before/after: no other ref changed; only the new immutable ARQ tag was added.

Verified public paths (all HTTP 200):

• Immutable nested extension
• Immutable customer README
• Latest nested extension
• Latest customer README

Integrity and actual post-merge checks

The production squash, immutable tag and latest tag independently match all 101 qualified package files, including customer docs and the unchanged 97-entry protected checksum receipt. Marketplace/plugin/release metadata agree on 0.1.6. No rebuild or payload/README/notice edit was made.

Receipt	SHA-256
Selection JSON, also matched to selection.sha256	d4c10ba5e9432ac096cb511a1fa28cd4593702fc656f4b44087c644d16fd1e9a
Canonical localeCompare-sorted package-hash JSON	dbf727cb6cb11be594f362467f16dee702c0e59bf820612e246ce164c03c5a3f
SHA256SUMS	b29b24f75a6ba9bfe52e276815fce0bb34be49cad5fb9aac3047d0f53d6cb208
Customer README, also verified through raw API at both refs	84887b441444e859c2716bcd48c1d5b87e44f459f962e248b124aa5a282c930c

• node --input-type=module -e 'import fs from "node:fs";import {verifyPlugin} from "./scripts/verify-plugin-marketplace.mjs";const p=JSON.parse(fs.readFileSync(".github/plugin/marketplace.json")).plugins.find(p=>p.name==="azure-resources-query");console.log(verifyPlugin(p));': passed on the production squash with the real immutable tag, azure-resources-query@0.1.6 azure-resources-query-v0-1-6-f7a37f9.
• node --test --test-reporter=tap test/canvas-release-receipts.test.mjs: passed, 7/7 on the merged package.
• (cd canvases/azure-resources-query && shasum -a 256 -c SHA256SUMS): passed, 97/97.
• node scripts/verify-plugin-marketplace.mjs --candidate and node scripts/verify-plugin-marketplace.mjs: both failed with the existing Marketplace must contain exactly the reviewed production products error. No release-wide pass or waiver is claimed.
• node --test --test-reporter=tap test/*.test.mjs: 35 passed, 12 failed after tagging, with exactly the same failing test names as the clean production baseline documented in the PR. The related ARQ documentation assertion passes.
• Public nested folder and README URLs: curl --fail --silent --show-error --location returned HTTP 200 for all four links; GitHub Contents API confirmed extension.mjs, assets/ and ui/, and the raw README hash matched at both refs.

Still unresolved: @cloud-foundation/azure-resources-query-core@0.1.0 has license: null; the package owner retains the licensing/notice decision. No grant, governance approval or waiver is inferred. The previously disclosed documentation-policy difference remains unchanged.

The coordinator and separate Awesome Copilot catalog session received the verified production SHA and ref evidence. No Awesome catalog PR/merge, App/provider change, installation, native host acceptance or public announcement was performed in this session. Catalog publication and host behavior are not established by these HTTP/package checks.