[Ramses Sanchez-Hernandez (ramsessanchez)]

No issue is closed by this audit.

Changes proposed in this pull request

Current Authentication-target revalidation is blocked by #3886's ordinary PATCH-refetch header contract. Both full builds, strict source audit, compiled routes, dependency ownership, profile/cloud routing, and targeted tests pass. The real offline HTTP gate intentionally exits 2 because a bound header reaches PATCH but is lost on its 204-response GET refetch. This failure is not waived or fixed by copying unmerged framework code.

• Audit all 17 shared DirectoryObjects cmdlet directive groups, preserving every original active AutoRest selector. Fifteen groups have no compatible operation (including one duplicate); two literal Mg/MgBeta-prefixed subjects match no legacy subject and are not silently repaired. Actual legacy beta contains 16 PKI operations; legacy v1.0 and both compatible profiles contain no PKI paths. No speculative override, broad subtree suppression, alias, or operation-ID translation is added.
• Preserve existing naming and suppression behavior, including seven live v1.0 derived action renames, the v1.0 restore suppression, and the existing absent upload rename. The reviewed ledger/tests retain exact original selector and legacy method/path/operation-ID evidence; all 17 original active blocks remain unchanged.
• Normally merge powershell-v3 at 844672d7c2238f6b29a208f9ba73fe28e9e29cef (Sync current v2 Authentication into powershell-v3 #3891) and regenerate both profiles. Emitted adapters explicitly carry their run profile, generated projects retain only the three owned DLLs, and new manifests require the source-equivalent packaged Authentication 2.41.2 without Kiota/RMS/UriTemplate/Multipart preloads or copies.

Only src/DirectoryObjects/DirectoryObjects.md shared cmdlet directives are in scope. All profile-local directives, including v1.0/readme.md and beta/readme.md, and src/readme.graph.md are explicitly ignored and untouched. Parameter aliases/transforms and schema/response directives remain deferred; this shared file contains no such groups. Both v1.0 and beta are available and required; no profiles are excluded. Existing wrapper/Beta output casing is preserved. PowerShell 7/Core only is supported by this validation.

Current normal integration and persistent commits

Current pushed head: 06c276e39feee1f02c8a83fd3703c1cf525e9e12; existing PR and base powershell-v3 are unchanged.

Commit	Boundary
e5e6c06e795890b3585cb1f2e4edd768f05b9814	Normal merge of Authentication target 844672d7c2
0b4db313899394b8dd35435b44116aa1a5d58421	Fresh combined v1.0 client/cmdlet/project generation and Release build
06c276e39feee1f02c8a83fd3703c1cf525e9e12	Fresh combined beta client/cmdlet/project generation and Release build

No authored configuration or module test correction was needed for this target. All previous migration, correction, normal merge, and separate profile-generation commits remain intact, with no rebase, amend, cherry-pick, or force-push. New commits include the Copilot App coauthor trailer.

Actual generation deltas: 14 v1.0 and 15 beta direct-calling cmdlet files now use GetRequestAdapter("v1.0")/GetRequestAdapter("beta"); each wrapper project removes dependency retention exceptions. Kiota client source and lock files are Git-identical for this wave. Release manifests are freshly generated with RequiredModules Authentication 2.41.2 and no RequiredAssemblies preload. Binaries/manifests/logs are retained as evidence, not committed from bin/obj.

Authentication provenance and full builds (2026-11-02, target 844672)

The normal locally built adapted Authentication 2.41.2 module is imported from:

C:\Users\ramsess\.copilot\session-state\4aa86cf9-d43c-4d2b-a4a3-aeaed01b8f29\files\authentication-v2-sync\final-source\modules

All 64 package-file SHA256s match auth-package-hashes.json; package SHA256 is 2FC09BFE6B70D313BC56DF8ADCCFB1976FB4E90A1898BF8A916B4B8B792898EB. Shipping Authentication/runtime/emitter/template/builder source is unchanged from the normally merged target. This is not a stock gallery package, old 2.38.1 acceptance module, manually injected DLL bundle, or load-context shim.

Process-local environment used isolated Kiota 1.36.1+fd3bf87790149b87f40f7eae1a5feb9016625943, model-generation parallelism 1, .NET SDK 10.0.403, and the exact adapted Authentication root first in PSModulePath. Fresh child imports verified Authentication version and module source.

pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\Invoke-QueuedModuleBuild.ps1' -RepoRoot $PWD.Path -Module DirectoryObjects -ApiVersion v1.0 -Configuration Release
pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\Invoke-QueuedModuleBuild.ps1' -RepoRoot $PWD.Path -Module DirectoryObjects -ApiVersion beta -Configuration Release

Both ran sequentially through the unchanged four-mutex queue and full compatible-spec builder, with no SkipKiota, GenerateOnly, NoCollisionData, or legacy fallback.

Profile	Full Release result	Compiled exports	Exact compatible compiled routes
v1.0	OK, exit 0, 14.4s	15	14: every operation except the existing restore suppression
beta	OK, exit 0, 27.3s	16	15: every operation

Fresh normal-manifest imports pass. Each profile's bin contains exactly Microsoft.Graph.Wrapper.DirectoryObjects.dll, its owned client DLL, and Microsoft.Graph.Wrapper.Runtime.dll, with no dependency DLLs. Compiled routes, no-PKI suppression outcomes, ordinary List default/item binder, count/function neighbors, and WhatIf/Confirm parameter contracts are retained. No authored variant groups are introduced.

Current compatible-spec blobs remain v1.0 6d237252fa7ac6b410321be9e84e6eefeb675909 and beta 25d21d2e462cd6cba6d27f0938af0f11540018d6.

Strict source and actual TRX gates

.\tools\Get-WrapperDirectiveMigrationInventory.ps1 -Module DirectoryObjects -FailOnUnresolved
dotnet test .\tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --no-restore --filter 'FullyQualifiedName~DirectoryObjectsDirectiveMigrationTests|FullyQualifiedName~CmdletConfiguratorTests|FullyQualifiedName~NamingTests' --logger 'trx;LogFileName=directoryobjects-targeted.trx' --results-directory 'C:\Users\ramsess\.copilot\session-state\979faf10-416b-492e-b722-1d0cdce1ad80\files\directoryobjects-post3891-844672' --verbosity minimal

Results: 17/17 Mapped (15 reviewed absences, two literal selector no-ops); actual retained TRX counters total/executed/passed 100, failed 0, command exit 0. Both-profile derived data isolation remains explicit. No reserved Legacy translation ledger fields were added.

Fresh compiled and real authenticated HTTP gates

Evidence root:

C:\Users\ramsess\.copilot\session-state\979faf10-416b-492e-b722-1d0cdce1ad80\files\directoryobjects-post3891-844672

$evidenceRoot = 'C:\Users\ramsess\.copilot\session-state\979faf10-416b-492e-b722-1d0cdce1ad80\files\directoryobjects-post3891-844672'
pwsh -NoProfile -NonInteractive -File "$evidenceRoot\Verify-CompiledDirectoryObjects.ps1" -RepoRoot $PWD.Path -ApiVersion v1.0 -EvidenceRoot $evidenceRoot
pwsh -NoProfile -NonInteractive -File "$evidenceRoot\Verify-CompiledDirectoryObjects.ps1" -RepoRoot $PWD.Path -ApiVersion beta -EvidenceRoot $evidenceRoot
pwsh -NoProfile -NonInteractive -File "$evidenceRoot\Test-DirectoryObjectsTransport.ps1" -RepoRoot $PWD.Path -ApiVersion v1.0 -Environment Global -EvidenceRoot $evidenceRoot
pwsh -NoProfile -NonInteractive -File "$evidenceRoot\Test-DirectoryObjectsTransport.ps1" -RepoRoot $PWD.Path -ApiVersion v1.0 -Environment USGov -EvidenceRoot $evidenceRoot
pwsh -NoProfile -NonInteractive -File "$evidenceRoot\Test-DirectoryObjectsTransport.ps1" -RepoRoot $PWD.Path -ApiVersion beta -Environment Global -EvidenceRoot $evidenceRoot
pwsh -NoProfile -NonInteractive -File "$evidenceRoot\Test-DirectoryObjectsTransport.ps1" -RepoRoot $PWD.Path -ApiVersion beta -Environment USGov -EvidenceRoot $evidenceRoot

Compiled gates pass, exit 0. The HTTP gates use real Connect-MgGraph in-memory test sessions, Authentication's real GraphHttpClientFactory token-handler pipeline, and a terminal offline DelegatingHandler; no live Graph/OAuth, credential store, bare marker-client substitute, dependency injection, or assembly preload.

Profile/cloud	Passed contracts	Captured requests	Genuine declined prompts	Gate result
v1.0 Global	13	14	3	exit 2: explicit #3886 blocker
v1.0 USGov	13	14	3	exit 2: explicit #3886 blocker
beta Global	14	15	3	exit 2: explicit #3886 blocker
beta USGov	14	15	3	exit 2: explicit #3886 blocker

Passing contracts include typed GET/list/item results, default dispatch and existing GET-query/header binding, escaped IDs, count/delta function neighbors, invalid bindings before HTTP, typed POST/PATCH JSON and returned models, bodyless DELETE, typed member-check action, beta bodyless restore, WhatIf and genuine declined Confirm sending zero HTTP, same-client profile alternation without BaseAddress mutation, and single normally packaged Authentication/Kiota/RMS identity/load context.

Actual compiled requests use /beta for beta and retain Global/USGov hosts, even though the real factory HttpClient's default BaseAddress is https://graph.microsoft.com/v1.0/. All 58 captures are offline. Cloud/profile correctness and the closed RMS gap are not substitutes for the failing bound-header contract.

Remaining blocker: in each profile/cloud, Update-MgDirectoryObject -Headers @{ 'x-module-proof' = 'Update-proof' } sends the marker on PATCH, receives 204, and sends GET to the same correct item URL without the marker. The generated ordinary refetch uses .GetAsync() with no request configuration. This is the actual #3886 dependency, not an Authentication/source migration failure; no fix or acceptance waiver is included here. Native DELETE here has no required-query contract needing #3882. Broader service validity, live tenant behavior, and unsupported framework policies are not certified by these offline captures.

Raw parity and historical evidence

pwsh -NoProfile -NonInteractive -File .\tools\Compare-WrapperCmdletNames.ps1 -GeneratedPath .\src\DirectoryObjects\wrapper\v1.0\Cmdlets -OutLedger "$evidenceRoot\v1-raw-parity.csv"
pwsh -NoProfile -NonInteractive -File .\tools\Compare-WrapperCmdletNames.ps1 -GeneratedPath .\src\DirectoryObjects\wrapper\Beta\Cmdlets -OutLedger "$evidenceRoot\beta-raw-parity.csv"

These current unnormalized commands report v1.0 15/15, exit 0, beta 0/16, exit 1. Existing Mg-vs-MgBeta prefixes, structural beta action naming, and restore's missing oracle row are unchanged; no naming normalization or unrelated sweep is included. NU1903 for existing Microsoft.OpenApi.YamlReader 3.7.0 remains outside scope.

The earlier target 08e409a6aa and adapted predecessor Authentication 2.38.1 evidence belongs to the 2026-10-29 wave only: prior normal merge 3508b09571, correction e5f272178d, separate profile commits 53aec6b325 and cced992ab8, strict 17/17, tests 100/100, builds 50.1s/133.0s. Those logs, commits, and older migration boundaries f5bedec235/3148e7893c/608e9e0337 are preserved and are not relabeled as current Authentication proof.

Current raw logs/exits, full Auth file hashes, source/spec/tool provenance, targeted TRX, compiled assembly/manifest hashes, generated manifests, actual HTTP captures/assembly contexts, parity ledgers, and explicit blocker summary are retained in the new evidence root. No separate wrapper nupkg was produced by this full-build path; normal bin ownership and manifest are verified without claiming an unrun pack gate. Original failed test-harness assumptions are retained alongside corrected final evidence.

Other links

• Sync current v2 Authentication into powershell-v3 #3891: normally merged source-equivalent Authentication, dependency ownership, and runtime profile routing.
• Preserve generic headers on PATCH refetch requests #3886: actual ordinary PATCH-refetch bound-header blocker; no unmerged source copied.
• Support compatible natural-ID operation variants #3849 / Align Kiota-compatible OpenAPI operation IDs with PowerShell #3861 / Update kiota compat openapidocs #3863 / Align operation IDs for required shared directive paths #3847: preserved normal framework/operation-ID integration, with no rejected Legacy helper.