[Craig Alvord (craxal)]

Summary

Azure Storage 0.3.4 packages the merged telemetry disclosure and opt-out alongside the approved Storage canvas. This production candidate was built from source PR #494's squash merge; it does not claim telemetry ingestion or publication.

Changes

• Import the generated 0.3.4 package and update only Azure Storage's production marketplace version.
• Carry forward the reviewed production verifier correction from the obsolete 0.3.3 candidate, keeping historical release checks intact.
• Enforce a no-downgrade floor based on source-qualified immutable release tags, with coverage that rejects versions below Storage's existing 0.3.2 release without pinning future versions.

Checklist

• Candidate package built from merged source and verified.
• Candidate verifier and focused production checks pass.
• Independent quality review satisfied at 07132c34445795ec4e54b0e8a3ed33856309ebdd.
• Human review and production squash merge completed at 3b4d7fc2c2a56ace4c8e10333b03fcbeb1c0b887.
• Immutable tag azure-storage-v0-3-4-edf749c and azure-storage-latest both verified at 3b4d7fc2c2a56ace4c8e10333b03fcbeb1c0b887.
• Release owner requested the separate Awesome Copilot catalog update; it will use the verified production source.sha below.

Candidate links

• Immutable install 0.3.4 — published and verified.
• Latest install — verified at the same production commit.
• Awesome Copilot source.sha: 3b4d7fc2c2a56ace4c8e10333b03fcbeb1c0b887 (verified production squash merge).

Overlap: production PR #33 also changes the Storage package and remains open. If it merges first, refresh/rebuild this candidate against current production main; this PR does not include #33's changes. Production PR #40 is the obsolete 0.3.3 candidate; do not merge it.

Build and verification evidence

• Source PR: coreai-microsoft/canvases-cloud-foundation#494, merged at edf749c0bfb4e11963e53185d4325b2e4941dfb3.
• Production base: 15afc0483477207c19f64fa59a356a70adbb37c2.
• Candidate PR head before squash: 07132c34445795ec4e54b0e8a3ed33856309ebdd; production squash merge: 3b4d7fc2c2a56ace4c8e10333b03fcbeb1c0b887.
• Built from a clean source checkout with npm run package:plugin -- --repository=microsoft/azure-dev-tools azure-storage; artifact verifier confirms 15 files, version 0.3.4. All 15 emitted files match source byte-for-byte; the verifier/test-only follow-up did not alter packaged bytes.
• node scripts/verify-plugin-marketplace.mjs --candidate passes; focused production release/receipt tests pass 28/28.
• Full top-level production suite: 45/47 pass. The two failures are in test/production-links.test.mjs (stale Canvas Authoring catalog-version assertion and stale SRE README wording); both failures reproduce on unchanged production main at the base SHA above.
• Protected receipt: canvases/azure-storage/SHA256SUMS, SHA-256 90a5d80035760b6df3be4f07a02a50d7962538f70153e3fa6fc80c747986e60c.
• Telemetry delivery/ingestion is not verified. The Awesome Copilot catalog update is a separate follow-up using the verified production source.sha; no catalog change is claimed yet.

Published release refs

• Immutable tag: azure-storage-v0-3-4-edf749c
• Latest tag: azure-storage-latest
• Both refs resolve to production squash commit 3b4d7fc2c2a56ace4c8e10333b03fcbeb1c0b887; strict marketplace verification passes.

[Copilot]

🔵 Needs a closer look

Human confirmation is needed for source-to-artifact provenance and installed-host opt-out behavior because source PR #494 is inaccessible and the generated package enables telemetry with GitHub user IDs by default.

No open issues 🎉

What changed in this PR

Prepares Azure Storage 0.3.4 for production with telemetry disclosure and opt-out support, while correcting release verification for independently released products. Publication, telemetry ingestion, and Awesome Copilot catalog pickup remain separate steps.

Changes:

• Advances Storage’s marketplace entry and package metadata to 0.3.4, with refreshed checksums and dependency notices.
• Adds customer-facing telemetry disclosure and a link to opt-out instructions.
• Corrects Storage’s verifier identity and removes current-release pairing requirements while preserving historical checks.

File	Description
test/​storage-release.test.mjs	Uses canonical Storage identity and the updated verifier in cloned tests.
test/​plugin-marketplace.test.mjs	Adapts release tests to current versions and independent releases.
test/​fixtures/​marketplace.candidate.json	Corrects Storage identity and removes fixed fixture versions.
scripts/​verify-plugin-marketplace.mjs	Corrects Storage paths and permits independent current releases.
docs/​release-process.md	Documents canonical Storage identity and release ancestry requirements.
canvases/​azure-storage/​THIRD_PARTY_NOTICES.txt	Refreshes bundled dependency notices.
canvases/​azure-storage/​SHA256SUMS	Updates protected package checksums.
canvases/​azure-storage/​release.json	Records 0.3.4 build metadata and dependencies.
canvases/​azure-storage/​README.md	Adds telemetry disclosure and opt-out guidance.
canvases/​azure-storage/​package.json	Sets package version to 0.3.4.
canvases/​azure-storage/​com.github.copilot/​extensions/​azure-storage/​studio-package.json	Sets runtime identity version to 0.3.4.
canvases/​azure-storage/​checksums.json	Refreshes protected-file hashes.
canvases/​azure-storage/​.github/​plugin/​plugin.json	Sets plugin version to 0.3.4.
.github/​plugin/​marketplace.json	Advances only Storage’s catalog version to 0.3.4.

_{Review effort: Balanced}