[Ramses Sanchez-Hernandez (ramsessanchez)]

No linked issue.

Changes proposed in this pull request

• Migrate only src/Security/Security.md shared cmdlet directives, retaining the active source and reviewed annotations. The unchanged original selector matches six actual legacy v1.0 and seven legacy beta operations. Normally merged Align operation IDs for required shared directive paths #3847 alignment makes all six/seven surviving compatible method/path/ID triples equal to those complete original source sets. The ledger uses ordinary literal evidence; all rejected Legacy-integration fields are removed. Both profiles are required, none excluded. Global and profile-local directives are ignored; parameter aliases/transforms and schema directives remain deferred.
• Preserve curated/derived behavior and structural naming. Suppress reviewed nested dataSource operations and beta aggregatedAppsDetails, reuse existing attackSimulation suppression, document actual removed legacy bulk APIs, and retain structural alerts_v2/$count naming. Six body-incompatible collection actions retain their endpoints with meaningful Multiple nouns; seven count alternatives use ByArticle, ByHost, or AcrossHost, leaving published count names on their existing routes. No selectors, authored profile filters, new mutation groups, response-union restrictions, global generator changes, or new suppressions hide collisions. Existing v1 derived suppressions and unaffected neighbors remain unchanged.
• Regenerate Kiota client + cmdlets + projects/lockfiles together for each profile, separately, against actual normally merged Sync current v2 Authentication into powershell-v3 #3891. Fresh normal manifests use adapted Authentication 2.41.2 and profile-aware transport. Each wrapper bin contains exactly its module/client/runtime DLLs, with no dependency copies/preloads. Validate real typed bodies, /v1.0 versus /beta URLs, escaped IDs, queries/headers/results, mandatory bindings, WhatIf, and genuinely declined confirmation without live Graph or credential-store access.

Commit boundaries

Boundary	Commit
Initial migration/evidence/annotations/tests	4d98d2e57f
Historical v1 generation	b78a0f75c6
Collision-contract regression evidence	d7c61f69d1
Normal #3849 integration / API correction	c95f003339, 7e1c9d39ed
Historical separate v1 / beta generations	81016faedf, 711fe3f757
Historical audit / source evidence	65ec1fdaa1, e62c1bec92
Normal 844672d7c2238f6b29a208f9ba73fe28e9e29cef integration	effd25e4ca
Final literal migration/audit correction	ac12a9d126
Final combined v1.0 generation	232a781c4e
Final combined beta generation	571084ded3

Historical failed/prepared/candidate proofs are preserved but are not current-target acceptance.

Final required gates

Profile	Compatible spec Git blob	Full Release build	Exports	Actual authenticated offline transport
v1.0	4d40a982e9b6708c07886c18e02704fab0fde822	Exit 0, OK, 47.40s	662	6 bodyless POSTs + 7 count GETs
beta	e6f5ec76b7d4bd047c5cf0b5a4b0ad61ab86a2aa	Exit 0, OK, 88.80s	1,003	6 bulk JSON POSTs + 6 bodyless POSTs + 14 count GETs

Both pipelines used the unchanged parent four-mutex queue, sequential v1.0 then beta, compatible specs only, Kiota 1.36.1+fd3bf87790149b87f40f7eae1a5feb9016625943, and process-local model generation parallelism 1. Acceptance Authentication was the normally packaged adapted 2.41.2 built from actual merged shipping source, not stock-gallery replacement or old 2.38.1. All 64 package file hashes remained unchanged. No skip flags, fallback, DLL injection, or unmerged candidate overlays.

Exact validation commands and results, run from this Security worktree:

dotnet test .\tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --configuration Release --filter 'FullyQualifiedName~SecurityDirectiveMigrationTests|FullyQualifiedName~NamingTests|FullyQualifiedName~CmdletConfiguratorTests' --logger 'trx;LogFileName=Security-final.trx' --results-directory C:\Users\ramsess\.copilot\session-state\f1a620d0-1a1d-426d-bc63-27a54b002f26\files\security-final-844672-20261102
# PASS: 105 tests, zero failures; explicit runtime profile with derived data ON/OFF.
pwsh -NoProfile -File .\tools\Get-WrapperDirectiveMigrationInventory.ps1 -Module Security -FailOnUnresolved -AsJson
# PASS: exit 0; all six directives Mapped using ordinary literal evidence.
& C:\Users\ramsess\.copilot\session-state\f1a620d0-1a1d-426d-bc63-27a54b002f26\files\Invoke-SecurityFinalBuild.ps1 -Profile v1.0
# PASS: full queue/build exit0, OK, 662 exports, 47.40s.
& C:\Users\ramsess\.copilot\session-state\f1a620d0-1a1d-426d-bc63-27a54b002f26\files\Invoke-SecurityFinalBuild.ps1 -Profile beta
# PASS: full queue/build exit0, OK, 1003 exports, 88.80s.

The retained build runner prepends the isolated Kiota directory, sets cap1 and the full process-local PSModulePath with normal-source Auth2.41.2 first, verifies exact fresh-child ModuleBase/version, and invokes the unchanged queue with -RepoRoot set to this worktree, -Module Security -ApiVersion v1.0 then beta, and -Configuration Release; no SkipKiota, GenerateOnly, or NoCollisionData.

Additional full-module probes are retained outside SDK source. $e is C:\Users\ramsess\.copilot\session-state\f1a620d0-1a1d-426d-bc63-27a54b002f26\files\security-final-844672-20261102. Each was invoked in a fresh child with the same ordered process-local Auth environment:

pwsh -NoProfile -File "$e\Test-SecurityFinalFidelity.ps1" -RepoRoot $PWD.Path -Profile v1.0
pwsh -NoProfile -File "$e\Test-SecurityFinalFidelity.ps1" -RepoRoot $PWD.Path -Profile beta
# Both PASS: nonzero full exports; every migrated suppression absent, 7 unaffected neighbors preserved.
pwsh -NoProfile -File "$e\Test-SecurityFinalRuntime.ps1" -RepoRoot $PWD.Path -Profile v1.0
pwsh -NoProfile -File "$e\Test-SecurityFinalRuntime.ps1" -RepoRoot $PWD.Path -Profile beta
# Both PASS: 7 published count defaults each, beta7 scoped alternatives; mutation mandatory IDs and WhatIf.
pwsh -NoProfile -File "$e\Test-SecurityFinalTransport.ps1" -RepoRoot $PWD.Path -Profile v1.0 -EvidencePath "$e\v1.0-transport.json"
pwsh -NoProfile -File "$e\Test-SecurityFinalTransport.ps1" -RepoRoot $PWD.Path -Profile beta -EvidencePath "$e\beta-transport.json"
# Both PASS using normal Authentication token pipeline and real full compiled Kiota serializers/deserializers.
# v1:13 requests;6WhatIf;6genuine declined Confirm, exactly one prompt each;19binder rejections.
# beta:26 requests;all6typed ids JSON bodies;12WhatIf;12genuine declined Confirm;38binder rejections.
# Safety/invalid calls send zero HTTP; exact escaped URLs, generic headers, reserved $filter/$search,
# typed int32 count=7, and204 empty results verified. Beta requests explicitly use /beta, not /v1.0.
pwsh -NoProfile -File "$e\Test-SecurityFinalPreservation.ps1"
# PASS:128 shipping source blobs match normal target, all64Authhashes unchanged, both bins only3ownedDLLs,
# no preloads/duplicate shared identities, all ledger profiles literal, clean worktree.

Raw parity and scope limitations

pwsh -NoProfile -File .\tools\Compare-WrapperCmdletNames.ps1 -GeneratedPath .\src\Security\wrapper\v1.0\Cmdlets -OutLedger "$e\v1.0-parity.csv"
# Exit1:633 matched/662 routes;28 existing unrelated naming mismatches,1 documented correction.
pwsh -NoProfile -File .\tools\Compare-WrapperCmdletNames.ps1 -GeneratedPath .\src\Security\wrapper\beta\Cmdlets -OutLedger "$e\beta-parity.csv"
# Exit1:0 raw matches/1003 routes;981 mismatches including Mg vs MgBeta,22 no-oracle.

Raw parity is not normalized or claimed passing. Unrelated naming differences remain outside shared-directive scope. No live Graph/service-validity claim, PATCH/refetch expansion, new mutation-group behavior, or Desktop/PowerShell5.1 work. Baseline unsupported/client-only/schema limitations remain visible rather than newly suppressed. Existing Microsoft.OpenApi.YamlReader advisory warnings are unrelated dependency findings.

The final evidence root retains final-result.json, preservation.json, source/spec/package hashes, raw logs/exits, Security-final.trx, compiled route evidence, actual authenticated HTTP bodies/results, binder/safety counts, and reproducer scripts. Earlier candidate/failed logs remain separate.

Other links

• Support compatible natural-ID operation variants #3849: normally merged shared configuration/operation-variant framework.
• Align operation IDs for required shared directive paths #3847: normally merged finite required-path operation-ID alignment, not Legacy helper integration.
• Sync current v2 Authentication into powershell-v3 #3891: normally merged Authentication closure and profile-aware transport.