[Craig Alvord (craxal)]

Summary

Azure Storage 0.3.2 does not report product usage. This candidate updates the packaged canvas to 0.3.3 with the reviewed telemetry from coreai-microsoft/canvases-cloud-foundation#332: canvas opens, operations, outcomes and backend duration, without storage resource names or payloads.

Changes

Imports the exact qualified Storage package and advances only its marketplace version. Corrects the verifier's obsolete Storage identity and current-release pairing assumption to follow the existing independent-product release policy. Historical immutable-tag pins, ancestry and protected-file checks remain enforced. Other product payloads, release tags and customer READMEs are unchanged.

Independent review complete: the package and telemetry review found no code or package defects; the revised verifier is independently satisfactory at 63e67a0f9be99d8c5e36796d9599ba91dad5afd5. Normal human approval and squash merge remain required.

The gateway accepted a deployment package, but exact deployment completion and Storage ingestion are not verified; its public health endpoint alone does not prove either. This PR does not claim telemetry is live. The existing source collector sends a numeric GitHub account ID alongside bounded usage events; it does not include Storage resource names or payloads. Common telemetry controls are separate source work in coreai-microsoft/canvases-cloud-foundation#445, not silently added to this frozen package.

Release and governance checks

• Selected package is production-allowlisted and built from merged source.
• Retained selection receipt and source package verification pass.
• Selected-product source and browser qualification passed in the linked workflow.
• Production candidate verifier passes all seven products.
• Independent quality review is complete at the current head; focused Storage and marketplace tests pass 21/21.
• Full production suite is green: 45/47 pass; two unrelated production-links failures reproduce on unchanged production main.
• Required production human approval and squash merge are complete.
• Immutable and latest release tags have been verified after merge.
• Awesome Copilot catalog update has been requested by the release owner.

Candidate links

• Candidate preview 0.3.3 — available now; not the final release.
• Planned immutable install URL — planned; live only after the post-merge tag.
• Awesome Copilot source.sha: pending production squash merge.

Copy/paste team announcement

Not drafted: the release owner has not supplied rollout or dark-deployment status.

Technical evidence and handoff

• Merged source: beb224f3910dc56b5d238d35fc92928b0073b4f0.
• Production base: a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2.
• Candidate head: 63e67a0f9be99d8c5e36796d9599ba91dad5afd5. Initial package import: faaa1692fb9a2af519fee06aca7e81bca92aa7ec; Storage package bytes are unchanged by the verifier correction.
• Qualification workflow: preparation and qualification passed; writer failed because the release App installation was not found. The documented manual path imported the exact retained artifact, not a rebuilt payload.
• Selection receipt SHA-256: 95cd7e60e9fd6460d0a77cb9ea0f3673ebd0395cd0432aaf1f9ae19e07dc4f64.
• Product receipt SHA-256: 36bd2784fee7c976ef27c25d67c75332ab426b47d5618b45dee47b765746ccb5.
• Local retained-artifact/preflight verification passed, including source/production freshness, allowlist, every retained file hash and version advancement. Source artifact verifier: 15 files, version 0.3.3. git diff --check passed.
• All 14 protected SHA256SUMS entries pass. Candidate verifier passes all seven products; independent reviewer reran it and the focused tests (21/21 pass).
• Full production suite: 45/47 pass. production catalog matches all installable plugins in order and SRE package has its catalog identity, official preview logo and customer connection steps also fail at unchanged base (production-links 9/11 pass). No unrelated SRE documentation was changed.
• The earlier conflicted verifier identity correction in Fix Storage identity in production release verification #34 is covered here together with the current-release correction; that PR is not modified or merged.
• Related open production PRs: Fix Storage view restoration and browsing in 0.3.1 #33 overlaps the Storage package (older 0.3.1 candidate); Fix SRE action availability and connector recovery in 0.4.3 #39 shares the catalog. The owner determines ordering; refresh against current production main after a competing merge.
• Gateway run 40026397829 accepted deployment 6e3127ff-879e-4471-a6e3-bb5d97c165bc, then exact OneDeploy status polling failed. Read-only reconciliation returned SCM 403, and the local Azure profile lacks the target subscription. No blind redeployment or synthetic-event retry was performed.
• Next owners: eligible human reviewer and maintainer for normal production approval/merge; release operator for post-merge package verification and tags. No tags, latest moves, catalog update or live-provider reload performed.

[Craig Alvord (craxal)]

Verification follow-up: the identical production candidate verifier error reproduces at unchanged production main a71d514, before this PR. All 14 protected SHA256SUMS entries pass. This does not waive the existing verifier requirement; the draft remains open while the identity mismatch is resolved. Independent Quality Reviewer is reviewing candidate head faaa169. Awesome Copilot source.sha remains pending production squash merge.

[Craig Alvord (craxal)]

Updated candidate head: 63e67a0. The production candidate verifier now passes all seven products. Commit63e67a0 corrects the obsolete Storage identity, derives current fixture versions from the catalog, and allows independently published current products while retaining historical immutable pins, ancestry and protected-file checks. Qualified Storage bytes and its receipts remain unchanged. Full production suite:45/47 pass, including all21 focused Storage/marketplace tests. The two production-links failures also reproduce on unchanged production main (9/11 pass); no unrelated SRE documentation changed. Revised-head independent review remains pending, so this PR stays draft. Current preview: https://github.com/microsoft/azure-dev-tools/tree/63e67a0f9be99d8c5e36796d9599ba91dad5afd5/canvases/azure-storage/com.github.copilot/extensions/azure-storage . Planned immutable URL remains azure-storage-v0-3-3-beb224f, not live until post-merge tag. Awesome Copilot source.sha: pending production squash merge. Gateway completion/ingestion remain unverified. The dedicated PR-body editor returned404 under its connected identity; this comment records current evidence without silently overwriting the description through another edit path.

[Craig Alvord (craxal)]

Release update following owner-relayed feedback from Alex: do not merge this telemetry-only 0.3.3 candidate ahead of the common telemetry disable mechanism and customer README disclosure. Runtime source coreai-microsoft/canvases-cloud-foundation#448 and disclosure source coreai-microsoft/canvases-cloud-foundation#446 are being coordinated. This candidate contains neither change. Once reviewed changes merge, Storage will need a newly versioned, rebuilt and qualified candidate, not edited bundle bytes or reuse of 0.3.3 for changed protected content. Existing verifier correction remains relevant and must be preserved in the successor. No tags/catalog publication performed. Awesome Copilot source.sha remains pending production squash merge.

[Craig Alvord (craxal)]

Returning this 0.3.3 candidate to draft because merged source changes coreai-microsoft/canvases-cloud-foundation#448 and #446 added the required opt-out and customer disclosure after this package was built. A new source version-bump PR is open: coreai-microsoft/canvases-cloud-foundation#494 (0.3.4). This candidate does not include those controls and must not merge or publish. We will rebuild from the reviewed merged source, then update or replace this production PR with the new qualified package. Preserve the verifier correction in the successor. No tags/catalog update or deployment performed.

[Craig Alvord (craxal)]

Superseded by the new Azure Storage 0.3.4 production candidate PR #42. This 0.3.3 candidate was never merged or published; please do not merge it. The 0.3.4 candidate is built from merged source #494 and includes the merged telemetry disclosure and opt-out. The verifier correction from this branch is carried forward.