[Alex Weininger (alexweininger)]

Summary

Azure SRE Agent 0.4.3 fixes action availability and connector recovery so personal diagnostics, KQL, Teams, and evidence operations use the registered sre_personal_* tools instead of being routed to canvas actions. SRE navigation and thread operations remain canvas actions. These fixes do not grant source access or approve queries, SRE execution, or message sends.

Changes

• Import the qualified 47-file generated production package from merged source, including its shared browser toolkit assets and protected receipt. No rebuild, verifier edits, or historical tag changes; all protected package bytes remain source-identical.
• Change only Azure SRE Agent's marketplace version from 0.4.2 to 0.4.3; preserve every other catalog entry.
• Paul's documentation feedback addressed: restore canvases/azure-sre-agent/README.md byte-for-byte to the production base, leaving zero README diff in this PR. Restore the advanced guide's existing Awesome Copilot installation wording and commands too. Its only remaining change is the three-line clarification that personal tools are native tools, not canvas actions. These two inert-document restorations intentionally differ from the downloaded artifact; runtime, protected files, and checksum receipts are unchanged.

Candidate preview (published head verified): nested extension at candidate commit and candidate customer README.

Planned immutable install URL: https://github.com/microsoft/azure-dev-tools/tree/azure-sre-agent-v0-4-3-43f8e0f/canvases/azure-sre-agent/com.github.copilot/extensions/azure-sre-agent -- not live until an authorized operator creates the tag after the production merge.

Awesome Copilot source.sha: pending production squash merge. Neither the source SHA nor candidate head is the future catalog SHA.

Release and governance checks

• This change contains only content approved for this repository.
• Any required security, legal, licensing, and third-party-notice reviews are complete.
• No internal-only information, credentials, or unapproved payloads are included.
• If this distributes a canvas package, the release process in docs/release-process.md has been followed.
• Qualified artifact inventory, selection digest, source and production base checked; all 43 protected receipt entries remain byte-identical after the authorized inert-document restoration.
• README exactly matches the PR base; both customer guides retain Awesome Copilot as the production installation source.
• Committed SRE candidate passes the production verifier's selected-product export; 13 release-integrity tests pass after the documentation correction.
• Repository-wide candidate verifier is green: currently fails the pre-existing Storage catalog/verifier identity mismatch.
• Targeted SRE documentation test is green: currently fails an obsolete UI-copy assertion already absent in the production baseline.
• Production reviewer approval and authorized squash merge are pending; no approval or publication is claimed here.
• Native GitHub App marketplace installation of this candidate is verified: not run; release owner/host tester must supply this evidence separately.

The first four template checks remain unchecked because this manual packaging task does not establish those approvals. Next action: Paul / a production reviewer rechecks the restored customer guidance and package; an authorized maintainer handles any approved squash merge. This PR does not merge, tag, rerun the source workflow, or change Awesome Copilot.

Copy/paste team announcement

No rollout announcement was requested. The current source release guide explicitly separates candidate communication from announcements; no rollout owner or dark-deployment status is inferred. Candidate and planned immutable links are provided above, without claiming publication or installation.

Qualification, provenance, integrity, and exact local validation evidence

Provenance

Field	Value
Version	0.4.3
Source repository	coreai-microsoft/canvases-cloud-foundation
Reviewed source change	coreai-microsoft/canvases-cloud-foundation#400, merged as e1467f648c5e298cee4ffa9df0c13479b2c7b75a
Actual qualified merged-main source	43f8e0f3d5c136e80fd03070142582d0c367f3b8
Production baseline	a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2
Candidate commit	1bd99ae2a2da5bdbb913326c25ac66fa44442ec3
Original artifact-import commit	ba6088d1b1f090fedbc0a6a710bdde2759c5ae3b
Qualified workflow	https://github.com/coreai-microsoft/canvases-cloud-foundation/actions/runs/40055222789
Retained production artifact	https://github.com/coreai-microsoft/canvases-cloud-foundation/actions/runs/40055222789/artifacts/12545157962
Selection SHA-256	6f6a9c197b1a4cd165fab241e3d544e4f87b7f23c3eebaa9f89def87f1080410
Original artifact package receipt identity	c568bac0397c6f15bcfefdfdd60f5ac962fa9a750ef32da9797cf6be55ef2fa5
Unchanged protected SHA256SUMS SHA-256	00d68d84b432d8b447f415da0c2e9c699265e6863ffa4ce944aee4c7e143370d
Unchanged emitted extension SHA-256	0829d5c5987a1de15ea41b2b193c3f61986f502395146dcf34251c92f34cf54c

The qualified workflow passed preparation, selected-source tests, shared toolkit tests, selected browser qualification, and its precredential candidate recheck. Selected SRE source: 848 total, 841 passed, 7 skipped, 0 failed; shared toolkit: 532/532 passed; selected SRE browser: 154/154 passed. These are selected qualification results, not a claim that the root source test suite is green. The workflow then failed its release App installation lookup with HTTP 404 before any write. It was not rerun; this PR uses the retained clean merged-source artifact with the explicitly authorized inert-document restorations described above.

Local validation on the committed candidate

• Original artifact-import assertions at ba6088d: passed exact 47-file inventory, every artifact file's SHA-256 and byte equality, selection SHA-256, source/base, package receipt identity, and isolated SRE catalog version change. This is historical evidence for the import, not an all-document-parity claim for the corrected head.
• Documentation-correction Node assertions at 1bd99ae: passed README byte equality with production base; exactly two inert documents changed relative to the import; all 43 protected receipt entries match their recorded hashes and remain byte-identical to the import; SHA256SUMS itself is unchanged. No receipts were regenerated.
• git diff --check: passed for the documentation correction.
• git diff --exit-code a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2 -- canvases/azure-sre-agent/README.md: passed, zero README diff.
• node --input-type=module -e 'import {readFileSync} from "node:fs"; import {verifyPlugin} from "./scripts/verify-plugin-marketplace.mjs"; const p=JSON.parse(readFileSync(".github/plugin/marketplace.json")).plugins.find(p=>p.name==="azure-sre-agent"); console.log(verifyPlugin(p,{candidate:true}));': passed on corrected committed head, azure-sre-agent@0.4.3 (candidate; immutable tag pending).
• node --test test/mutable-documentation-release.test.mjs test/canvas-release-receipts.test.mjs: passed, 13/13, rerun after the correction. Includes existing historical release receipts; none were rewritten.
• node --test --test-name-pattern='SRE package' test/production-links.test.mjs: previously failed, 0/1, not rerun for the installation-only correction. The existing /Open an agent by URL or resource ID/ assertion and later expected Save connected agent phrase are already absent in the production baseline. Neither this existing assertion nor unrelated UI copy was changed.
• node scripts/verify-plugin-marketplace.mjs --candidate: previously failed, Marketplace must contain exactly the reviewed production products, not rerun for the documentation-only correction. The existing verifier recognizes azure-storage-canvas, while the current production catalog uses azure-storage. Rechecking the baseline catalog with the unchanged verifier reproduces the same failure before SRE payload verification. This unrelated issue was not patched here.
• Original live source/production-head checks: passed, matching the source and baseline above. No competing open SRE production candidate or 0.4.3 immutable tag was found at preparation time.
• Session-only runtime smoke test of the unchanged extension: passed local canvas open, v0.4.3/rev0829d5c598 rendering, native personal diagnostics callback, Connectors/Add Connector UI, and recognition of the existing Kusto MCP provider. All 36 installed runtime files matched the candidate. This was not marketplace installation or live query/Teams/SRE execution qualification; no preview reload was performed for this inert-document correction.
• Strict post-merge/tag verification, native marketplace installation, live SRE investigation/query execution, Teams delivery, and full repository test suites: not run. This is an unmerged candidate; production reviewer/release operator owns subsequent checks and refs.

Hashes are integrity receipts, not signatures. No latest or immutable release refs were moved or created, no source workflow was retried, and no persistent authentication configuration or organization policy was changed.

[Paul Yuknewicz (paulyuk)]

Please undo changes to readme then i will fast approve

[Paul Yuknewicz (paulyuk)]

We should reject all changes to this file. it needs to assume awesome-copilot is the prod source

[Alex Weininger (alexweininger)]

Restored this README byte-for-byte to the PR base in 1bd99ae, so it now has zero diff. I also restored the same Awesome Copilot installation wording and commands in docs/advanced.md; its only remaining change is the native-tool clarification. Runtime files, all 43 protected checksum entries, and the receipt are unchanged. The selected-package verifier and 13 release-integrity tests pass.

[Alex Weininger (alexweininger)]

closing this in favor of #45