[Ramses Sanchez-Hernandez (ramsessanchez)]

N/A (no linked issue).

Changes proposed in this pull request

• Migrate all 70 shared Identity.Governance directive groups against both supported Kiota-compatible profiles. Preserve the original 237 v1.0 / 808 beta surviving selected operations, with 253 genuine historical beta removals retained in the one-time audit. The reviewed source-specific selector excludes only 88 v1.0 / 182 beta newer API routes from this suppression; the independently reviewed group-70 prefix naming remains unchanged. The ordinary literal inventory is 70/70 Mapped, with no Legacy bridge/translation schema.
• Preserve every reviewed endpoint through the existing 871 exact authored suppressions, shared natural mandatory-path-ID alternatives and evidence-backed distinct body-contract names. Keep all ten authored groups/defaults, standalone/nested program body-vs-path IDs, required QueryId reference DELETEs (two surviving routes per profile), item-reference neighbors and existing exclusions. Ignore src\readme.graph.md and all profile-local directive files. Parameter aliases/transforms and schema/response changes remain deferred; this shared source contains zero groups in those classes.
• Regenerate/build both complete profiles in the required v1.0 then beta order on normally merged target 6475f3f, with isolated Kiota 1.36.1 (parallelism 1) and the normally packaged adapted Authentication 2.41.2 closure (all 64 hashes verified). Update coupled PATCH expectations to the merged one-operation behavior: 204 = one PATCH, no object, no implicit GET; 200 = one PATCH, actual typed response. An explicit caller GET has independent headers/result/error; no readback flag was added. Generated output is not hand-edited; client/cmdlet/project/lock changes remain in separate profile commits, including honest byte-identical client/lock outputs where regeneration produced no delta.

Current validation (PowerShell 7/Core):

Exact command	Result
dotnet test .\tools\WrapperGenerator.Tests\WrapperGenerator.Tests.csproj --filter 'FullyQualifiedName~IdentityGovernanceDirectiveMigrationTests|FullyQualifiedName~IdentityGovernanceRequiredQueryTests|FullyQualifiedName~DerivedCollisionResolutionsTests|FullyQualifiedName~NamingTests|FullyQualifiedName~CmdletConfiguratorTests' --logger 'trx;LogFileName=targeted.trx' --results-directory 'C:\Users\ramsess\.copilot\session-state\945ba215-91d7-4537-8f46-90b5e0850e1c\files\post3886-6475-final' --verbosity minimal --nologo	PASS: 158 executed, 158 passed, 0 failed, 0 not executed; actual TRX retained.
pwsh -NoProfile -NonInteractive -File .\tools\Get-WrapperDirectiveMigrationInventory.ps1 -Module Identity.Governance -FailOnUnresolved -OutputPath 'C:\Users\ramsess\.copilot\session-state\945ba215-91d7-4537-8f46-90b5e0850e1c\files\post3886-6475-final\strict-inventory.json'	PASS: 70 Mapped, zero Deferred/Unresolved/Invalid groups.
pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\Invoke-QueuedModuleBuild.ps1' -RepoRoot 'C:\Users\ramsess\Repos\copilot-worktrees\msgraph-sdk-powershell\ramsessanchez-curly-winner' -Module Identity.Governance -ApiVersion v1.0 -Configuration Release	PASS: exit 0 / status OK, 2033 exports, 1060.7s module time. Full Kiota generation and Release build; no skip/fallback flags. The unchanged builder's bounded Kiota timeout retry is retained in the raw log.
pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\871a5292-dc5b-423e-8083-5165b0006603\files\Invoke-QueuedModuleBuild.ps1' -RepoRoot 'C:\Users\ramsess\Repos\copilot-worktrees\msgraph-sdk-powershell\ramsessanchez-curly-winner' -Module Identity.Governance -ApiVersion beta -Configuration Release	PASS: exit 0 / status OK, 2607 exports, 351.7s module time. Full generation/build after v1.0.

Each build invocation uses the documented process-local Kiota/Auth environment and the unchanged four-mutex queue. No global installation, dependency preloads, copied DLL closure, Auth shims, candidate overlays or skipped generation were used.

Fresh normal-manifest compiled and real authenticated offline transport gates were run separately for each row below:

pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\945ba215-91d7-4537-8f46-90b5e0850e1c\files\post3886-6475-final\Test-GovernanceCompiled.ps1' -RepoRoot 'C:\Users\ramsess\Repos\copilot-worktrees\msgraph-sdk-powershell\ramsessanchez-curly-winner' -Profile <v1.0|beta> -Environment <Global|USGov>

pwsh -NoProfile -NonInteractive -File 'C:\Users\ramsess\.copilot\session-state\945ba215-91d7-4537-8f46-90b5e0850e1c\files\post3886-6475-memory-final\Test-GovernanceFinalRuntime.ps1' -RepoRoot 'C:\Users\ramsess\Repos\copilot-worktrees\msgraph-sdk-powershell\ramsessanchez-curly-winner' -Profile <v1.0|beta> -Environment <Global|USGov>

Profile / environment (actual invocation values)	Compiled + HTTP result	PATCH 204 / 200 cases	Required-query routes	Genuine single prompts
v1.0 / Global	PASS	1 / 1	2	10
v1.0 / USGov	PASS	1 / 1	2	10
beta / Global	PASS	5 / 5	2	32
beta / USGov	PASS	5 / 5	2	32

The full compiled modules verify migrated suppressions, names, all natural-ID alternatives/defaults/mandatory path IDs and unaffected neighbors. Real Connect-MgGraph + in-memory test store + GraphHttpClientFactory terminal captures verify native escaped Ivan Dyachkov (@id), missing/null/empty/obsolete-ID rejection before HTTP, bodyless DELETE + typed IfMatch/custom headers, typed POST/PUT/PATCH/action/media results, independent ProgramId1 body values, 204/no-readback and 200 response behavior with GET configured to reject 403, WhatIf/accepted/declined confirmation counts, Global/USGov beta URLs, reconnect/request-context cache invalidation and normal assembly identities. The real factory's global/v1.0 BaseAddress is not mutated. Zero live Graph/OAuth requests; these are offline behavior proofs, not tenant certification.

Offline isolation is guarded, not assumed: the existing Set-MgTestDataStore helper is reapplied after all main and additional-runspace imports and before Connect. The reflected actual store type is checked before invocation/lifecycle/logout, and every terminal request records Microsoft.Graph.Authentication.Test.Mocks.MockDataStore. Earlier unguarded runtime reports are preserved and superseded only for this probe-setup isolation proof; the valid original builds/TRX/source/generation commits were not rerun or relabeled. No production Authentication/loader changes or credential-I/O claims are inferred from a datastore type.

Commit boundaries and inputs

• Final authored correction: d07958ab93902398298a7cdc8334c697bc45ee84. All prior migration/normal integration/correction/profile-generation commits and the coupled derived-name test correction are retained.
• Final v1.0 combined generation: d737246cf41e053d5ce30ba3dc22cfbe3e7bfc90; spec blob cc4b644c099cdf6e3158afd01709207d2cc9f3d2.
• Final beta combined generation: 7f9ae2b203d9f9d8c72702f2299084afcabc5519; spec blob 625e577e80c542da82d1708a2a67d5efcca0ed1e.
• Full uncapped native-Git scope was checked across 9116 files, including deletions/renames; only module-owned source/generated output and its three coupled test files are changed. No bin/obj/DLL/package/log/session artifacts are committed.

Honest existing limits

• Raw oracle-name parity is not claimed as passed: v1.0 1773/2033 matched (113 mismatches / 147 no-oracle); beta 0/2623 matched (2173 mismatches / 450 no-oracle). No beta-prefix rewriting or unrelated naming sweep was performed; metadata can omit secondary routes.
• Baseline unsupported content/call/parameter-alias surfaces remain explicit in module notes and captured generator warnings, not hidden by new suppressions. Desktop 5.1 is unsupported; acceptance is on PS7/Core.
• The existing Microsoft.OpenApi.YamlReader 3.7.0 NU1903 advisory remains outside this module migration. Fix Kiota PostPath typed navigation without renaming operation types #3881 is not copied/integrated here; optional-query follow-up [v3 wrappers] Support arbitrary optional query parameters #3897 remains tracking only.

Exact raw logs, TRX, source/spec/Auth/package/manifest hashes, full compiled captures and command/exit evidence are retained in C:\Users\ramsess\.copilot\session-state\945ba215-91d7-4537-8f46-90b5e0850e1c\files\post3886-6475-memory-final\handoff.json and its artifact manifest. Earlier failures and candidate proofs remain immutable historical records and are not relabeled as current success.

Other links

• Normal shared operation-variant support: Support compatible natural-ID operation variants #3849; finite required-path ID alignment: Align operation IDs for required shared directive paths #3847.
• Normal Authentication ownership/profile cache: Sync current v2 Authentication into powershell-v3 #3891; mandatory Query-prefixed inputs: Support mandatory Query-prefixed parameters for required queries #3882.
• User-directed one-operation PATCH contract: Remove automatic GET after successful PATCH #3886.