[Ramses Sanchez-Hernandez (ramsessanchez)]

N/A - Education shared-directive migration and current Authentication-target revalidation.

Changes proposed in this pull request

• Migrate the single shared src/Education/Education.md operation-ID suppression to seven exact HTTP DELETE/path rules. Keep the original directive active and annotated, preserve the two original curated rules and the two published-oracle count/delta collision repairs, and retain all collection-reference GET/POST and item-reference DELETE neighbors. No new capabilities, variant groups, aliases, invented suppressions, or unrelated naming changes.
• Review both v1.0 and beta, with no excluded profiles. Independently pin the complete original actual legacy selection: seven matches in each profile. Every selected operation survives uniquely by unchanged method/path and the current literal selector selects exactly those same seven operations. The finite ledger uses ordinary supported mappings, without reserved Legacy translation fields. Original old/new-ID lineage remains in history and audit notes; all profile-local directives and src/readme.graph.md remain ignored and untouched. No shared parameter/schema directives are present, so no deferred class is implemented.
• Normally integrate the actual Authentication Sync current v2 Authentication into powershell-v3 #3891 target 844672d7c2238f6b29a208f9ba73fe28e9e29cef, preserve separate runtime profile context, and regenerate complete v1.0 then beta outputs. Education's test now asserts every generated reference neighbor calls GetRequestAdapter("v1.0") or GetRequestAdapter("beta"), never the legacy bare overload. Only module-owned tests/generated output change; no shared Authentication, runtime, emitter, or framework fixes are authored here.

Current validated head: 25a6c981b3cc225caa7ee1265ddbb7fbbc49477e. Normal target merge: d8d308c09a02c5ce8cdad214d47d992f33e4eab1. Prior head e92779024a and all earlier migration/profile-generation commits remain intact; no rebase, amend, cherry-pick, or force-push. Earlier 08e409/post-#3849 and candidate Authentication logs are historical, not current 844672 proof.

Exact source and package inputs

Input	Current evidence
Compatible Education v1.0 Git blob	062d6659bf55e305f450d8dd79a9ea6cfafa4b5f
Compatible Education beta Git blob	e440ad323d7887ad6c67c01a8bc877528f6966cb
Original legacy Education v1.0 / beta blobs	70cf3fb99240cb90e3914b3afb41527a96a9d8e4 / 9e542b610385ae40648b13b8ccfab6e068b7b3ad
Adapted Authentication	Normally packaged local build 2.41.2, first on process-local PSModulePath at the designated authentication-v2-sync\final-source\modules root; not stock gallery Authentication, old 2.38, or a copied DLL closure.
Authentication package SHA256	2FC09BFE6B70D313BC56DF8ADCCFB1976FB4E90A1898BF8A916B4B8B792898EB; all 64 package-file hashes independently verified.
Source equivalence	Actual merged shipping Authentication/Core/Loader/runtime/emitter/template/builder source is identical to verified package producer 7ce0b4746e2aa85b3da89fe1f2a4db8011e83716.
Tools	Kiota 1.36.1+fd3bf87790149b87f40f7eae1a5feb9016625943, process-local model-generation parallelism 1, .NET SDK 10.0.403, PowerShell 7/Core. PowerShell 5.1 is out of scope.

Current 844672 validation

<proof> below is the new evidence directory C:\Users\ramsess\.copilot\session-state\d2c3231b-2ade-435d-b7f7-cc8d42f864f5\files\Education-844672-revalidation.

Exact command/check	Result
pwsh -NoProfile -NonInteractive -File tools\Get-WrapperDirectiveMigrationInventory.ps1 -Module Education -FailOnUnresolved -OutputPath <proof>\strict-inventory-final.json	Passed, exit 0; one shared directive Mapped, exact seven reviewed operations in each profile; no Invalid/Unresolved/candidate entries.
dotnet test tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --filter 'FullyQualifiedName~EducationDirectiveMigrationTests|FullyQualifiedName~CmdletConfiguratorTests|FullyQualifiedName~NamingTests|FullyQualifiedName~DerivedCollisionResolutionsTests' --no-restore --verbosity minimal --logger 'trx;LogFileName=education-targeted-final.trx' --results-directory <proof>	Passed, actual TRX counters 105 total / 105 executed / 105 passed / 0 failed. Includes original-selection fidelity, both profiles with derived data on/off, naming/service/profile transport, suppression boundaries, 21 neighbors and published count/delta policies.
pwsh -NoProfile -NonInteractive -File C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\Invoke-QueuedModuleBuild.ps1 -RepoRoot <Education-worktree> -Module Education -ApiVersion v1.0 -Configuration Release	Passed, actual unchanged FULL builder through four-mutex queue; exit 0, status OK, 450 exports, 27.3 seconds.
Same exact queued command with -ApiVersion beta, after v1.0 completed	Passed, exit 0, status OK, 450 exports, 38.6 seconds.
pwsh -NoProfile -NonInteractive -File <proof>\Confirm-EducationRuntime.ps1 -RepoRoot <Education-worktree> -Profile <v1.0 or beta> -Environment <Global or USGov> -OutputPath <proof>\runtime-<profile>-<cloud>-final.json	Asserted gates passed in all four fresh processes, with the separately reproduced header limitation below. Each normal-manifest import has 450 exports / 450 GraphRoutes / 0 grouped routes, all seven selected DELETE routes absent, 21 unchanged neighbors, both published count/delta routes retained, and mutation neighbors expose WhatIf/Confirm.
Normal wrapper manifest and assembly ownership	Passed: generated manifests require Authentication 2.41.2, no dependency preloads; each bin contains exactly its three owned DLLs. SHA256s for generated manifests/assemblies and actual loaded Authentication/Kiota identities/contexts are retained. No wrapper nupkg was requested or produced; the Authentication package and actual compiled module outputs are the measured artifacts.
pwsh -NoProfile -NonInteractive -File tools\Compare-WrapperCmdletNames.ps1 -GeneratedPath src\Education\wrapper\v1.0\Cmdlets -OutLedger <proof>\v1-parity.csv	Passed, raw 450/450 command routes match.
Same parity command for src\Education\wrapper\beta\Cmdlets and <proof>\beta-parity.csv	Failed with unchanged baseline naming limitations; not claimed as a pass: 450 mismatches, 397 Mg-vs-MgBeta prefix-only / 53 other differences. All 450 names/routes/dispositions in both profiles are unchanged from the preceding accepted surface. No prefix normalization or naming sweep used to manufacture a pass.

The queue invokes Build-WrapperModule.ps1 with the required compatible spec root, including fresh Kiota/client, wrapper source, projects, build and manifest generation. Neither full run uses -SkipKiota, -GenerateOnly, -NoCollisionData, or legacy fallback. The new source-equivalent Authentication root is first in the same invocation's process-local PSModulePath; a fresh child verifies version and exact imported path. Authentication owns RMS, UriTemplate and Multipart; no old wrapper-side retention/preload, stock Authentication replacement, manual assembly injection, or shim is used.

Offline HTTP and binder evidence

The module-specific proof uses the real authenticated GraphHttpClientFactory pipeline with an in-memory MockDataStore and a test-only terminal handler. No live Graph/OAuth/credential-store traffic occurs. It exercises the newly generated compiled cmdlets, not just a marker client.

• Per profile/cloud run: 16 captured authenticated HTTP requests; typed EducationClass GET, Select query alias and encoded IDs; public natural mandatory-ID Get and default streamed List; typed scalar/nested-course POST JSON and typed returned model; PATCH 204 followed by typed GET refetch; bodyless item-reference DELETE with explicitly asserted If-Match; bodyless publish action with typed EducationAssignment result.
• Safety per run: all four representative mutations send zero HTTP with WhatIf, and zero HTTP with a genuine host-selected No (exactly one prompt per declined mutation, four total). Two invalid bindings fail before HTTP. Across four final-head runs: 64 offline requests / 16 genuine declined prompts / 0 live Graph requests.
• Profile/cloud routing: compiled beta calls send /beta, including https://graph.microsoft.us/beta, rather than inheriting the factory's existing https://graph.microsoft.com/v1.0/ BaseAddress. Alternating profile calls keep the selected service root and cloud host without mutating that shared client/BaseAddress. Context invalidation rebuilds the adapter/client; disconnect retains NoGraphSession.
• Load identity: each fresh process observes 12 unique actually loaded Authentication/Kiota-related identities from the designated package. Authentication/Loader are in Default and Core/Kiota/RMS/UriTemplate in the Authentication load context. No duplicate identity or module-local dependency closure is accepted.

Known limitation deliberately reproduced, not waived: #3886 remains unmerged. In every final profile/cloud run, explicitly supplied custom Headers reach PATCH but do not reach the follow-up GET after a 204. Raw captures show x-education-proof=patch-refetch on PATCH and an empty marker on GET. Typed refetch/body/path behavior passes, but this is not a Header propagation pass certificate or an all-runtime-gates pass. No global workaround is copied into this module. The unrelated stale global MultiRoute test #3882 was not run or patched, and no mandatory reference-delete-query capability is invented.

An initial runtime harness attempt expected a collection wrapper where the existing default List correctly streams typed items; that failed attempt remains in <proof>\runtime-v1-Global-attempt1.log. The corrected harness validates the actual established semantics, and all four final-head proof runs are separately retained. Existing NU1903 warnings for Microsoft.OpenApi.YamlReader 3.7.0 remain outside this module change.

Preserved and additive commit boundaries

Commit	Purpose
f0f1c65628	Original configuration, reviewed source evidence, active annotations and module tests.
b8340bc46f, a59e54b222	Original separate full v1.0 and beta client+cmdlet generation boundaries.
305c9243d4	Exact published count/delta collision repair; retained unchanged.
7ffb832ce1, 1422b414ff, 1d6a69b161, 5c02be72a5	Earlier normal target integration, aligned-ID evidence and separate refreshed profile generations.
09c047c4a7, 4536380e82, ae433c49b0, e92779024a	Earlier post-#3849 normal merge, explicit oracle-profile API corrections and honest empty full profile revalidation boundaries.
d8d308c09a	Normal merge of current target 844672d7; all prior history preserved.
50e20cca43	Three surgical assertions pin emitted profile-aware transport in real-spec Education tests.
a509ec056b	Current FULL combined v1.0 regeneration: 403 changed files (402 emitted cmdlets with explicit v1.0 adapter calls plus generated project closure); client/locks regenerate byte-identically, manifest regenerated.
25a6c981b3	Separate current FULL combined beta regeneration: 403 changed files (402 emitted cmdlets with explicit beta adapter calls plus generated project closure); client/locks regenerate byte-identically, manifest regenerated.

Current evidence retained: <proof>\current-head-proof.json contains exact source/spec/tool/package hashes, commit identities, build counts/times and runtime matrix. Current ordinary strict/TRX evidence is strict-inventory-final.json, education-targeted-final.trx, targeted-tests-final.log. Build logs/results are v1-full-release.log, v1-build-result.json, beta-full-release.log, beta-build-result.json. Fresh actual HTTP captures, contexts and manifest/owned-DLL hashes are in runtime-v1-Global-final.json, runtime-v1-USGov-final.json, runtime-beta-Global-final.json, runtime-beta-USGov-final.json, with corresponding .log files. auth-source-package-proof.json retains the complete 64-file package verification. Old proof folders are untouched. No binaries/session logs are committed, no new PR is created, and no PR merge is authorized.

Other links

• Normally merged current Authentication and profile-aware runtime: Sync current v2 Authentication into powershell-v3 #3891
• Merged variant framework: Support compatible natural-ID operation variants #3849
• Known unmerged PATCH-refetch Headers limitation: Preserve generic headers on PATCH refetch requests #3886
• Operation-ID alignment and compatible specs: Align Kiota-compatible OpenAPI operation IDs with PowerShell #3861 and Update kiota compat openapidocs #3863
• Documented generator/build validation: https://github.com/microsoftgraph/msgraph-sdk-powershell/blob/powershell-v3/tools/WrapperGenerator/README.md