docs(research): define bounded Windows MSAL metadata probe

[hcoona]

Summary

Prepare a bounded native Windows MSAL probe for Issue #35: explicitly enumerate Windows accounts, acquire silently only for one exact email match, observe authoritative token-result metadata after operator-controlled WAM interaction when needed, and check subsequent broker reuse in a fresh process.

Authorization and Governing Records

The architecture/research entry accepted on main-v2 at fd5198dcf5364e6f5c0f4f68ee90a12b64a8ddde permits minimal non-product probes, exact protocol preparation, and necessary record admission. The experiment policy accepted by #39 governs existing machine/account state. This PR's protocol authorizes execution only after acceptance on main-v2; its branch cannot authorize itself.

Scope and Non-Goals

One owner-designated Windows host with WSL used for source transfer, process launch, and sanitized results. The first experiment covers acquisition/metadata and broker reuse, with at most two preparation attempts, one inspection, two silent attempts, and one operator-controlled interactive attempt. It makes no protected-resource calls and does not establish Azure DevOps resource authorization, intended registration reuse, Profile eligibility, first-use guarantees, or platform support. No token crosses into WSL, no corporate-account comparison is included, and no product code or public schema is frozen.

Record-System Impact

Add one Markdown protocol/execution-history family and its navigation route; retain the exact probe as five source/configuration files under tools. Local typed result JSON and the sequential journal are operational artifacts; the reviewed Markdown execution history is the committed evidence carrier. The existing text hygiene/secret selectors explicitly include nuget.config, which automatic file-type detection skipped. This does not extend the historical public-build runner or add a generic framework/control. The research baseline replaces its obsolete proposed experiment with a route to the concrete protocol and pins the source findings that motivate it.

Evidence and Reasoning

MSAL 4.83.1 already exposes ListOperatingSystemAccounts, while V1 0.9.6's Windows broker configuration does not enable it. The probe uses this dependency abstraction, validates selected/result email without exposing identities, owns its parent window, and declines browser fallback. MSAL/Broker 4.83.1 and NativeInterop 0.20.3 match V1's direct pins; the seven package versions are explicit.

Read-only planning metadata identified existing Windows SDK 8.0.425 and Desktop runtime 8.0.31, so no SDK installation is proposed. Public WAM/WSL guidance, AzureAD#460, AzureAD#462 and Azure DevOps guidance were inspected for the bounded host/source recheck assessment. These are desk findings; no authentication, build, restore, cache access, or probe execution has occurred before acceptance.

Identity and Security Effects

After acceptance, preparation may use only the declared public dependency sources and dedicated local artifacts. Broker actions additionally require the designated account's availability and an operator ready at the Windows desktop. The selected email stays in the local UI; output contains fixed flags/buckets without token bytes, emails, private tenants, raw scopes, exception messages, or broker diagnostics. Ordinary authorized broker/session updates may remain; no cache clearing, sign-out, revocation, PAT, private feed, or resource mutation is included.

Validation

PowerShell AST parsing (without execution), XML/JSON syntax, and exact public API/source inspection are complete. Independent record-system/research/safety review reports no material findings on tree d62d4e923ab67ccc0e5179a76e62248c920c7e2f; separately triaged findings P2/P3/P4 are resolved. Both normal pre-commit runs passed, including all 32 historical public-build conformance groups; GitHub Repository Controls passed on PR head 1b63c3fc7be3fa544899b4f44e12d2ff76e2339a (run). Subject compilation and synthetic self-check belong to the protocol's post-acceptance preparation phase and are not claimed here. No broker action may precede successful preparation and verification of the pinned dependencies.

Review and Disposition

Review against the accepted target-branch authorities and both accepted review Skills. Any material finding receives independent triage before remediation. The repository owner authorized continuing the bounded architecture research; the existing Wave risk decision covers the declared account/session effects. No new effects boundary or support commitment is requested by this proposal.

Upstream Provenance

The probe is original research code using public MSAL APIs. Research links pin V1 commit 8ef1b8b00782bf20a51de078289819a79c3cba70 and MSAL commit d5d7de6b103f0d9dd7bca9bf13cbb9f3da37bc9f; no upstream production implementation or private dependency is imported.

Independent triage and final review are recorded on this PR. The owner's instruction to continue the bounded research supplies the merge disposition within the already accepted Wave; the protocol adds no new risk boundary.

[hcoona]

Independent finding disposition — reviewer policy_finding_triage, separate from author /root and originating reviewer principles_review.

Accepted authority base: fd5198dcf5364e6f5c0f4f68ee90a12b64a8ddde. Findings and triage inspected candidate tree 2ab1b06476689f71192e15f565836a7c43242daf. All classifications preceded remediation; no subject execution occurred.

• P2 — true positive, blocking, confidence 10/10. Accepted experiment policy requires a source-built subject in a detached checkout. Archive/hash verification alone omitted this explicit prerequisite. Correction requires a detached accepted-revision checkout in WSL before the five-file archive/copy; no Windows full checkout or policy change is required.
• P3 — true positive, blocking, confidence 9/10. The launcher previously marked termination uncertain only after a timed wait returned false; an interruption could reach the journal-ending finally with an unconfirmed child. Correction tracks uncertainty across launch/lifetime, performs bounded owned-child cleanup in finally, and clears uncertainty only after confirmed exit. Unknown launch or exit keeps the start unresolved. This requires neither shared-broker termination nor a process-supervision framework.
• P4 — true positive, advisory, confidence 10/10. Unqualified “before execution” readiness conflicted with the intended no-auth preparation sequence. Following the stricter wording remained safe. Correction checks host/toolchain before all actions and additionally requires account/operator readiness before each broker action; declared preparation may proceed independently.

Independent focused re-review by principles_review confirms all three resolved in tree d62d4e923ab67ccc0e5179a76e62248c920c7e2f. No effects/attempt-limit expansion or additional owner risk decision is needed.

[hcoona]

Independent review — reviewer /root/principles_review.

Accepted authority base: fd5198dcf5364e6f5c0f4f68ee90a12b64a8ddde. Reviewed final tree: d62d4e923ab67ccc0e5179a76e62248c920c7e2f, all ten changed files and the PR description. The reviewer authored none of the proposal or corrections and performed no subject execution or GitHub write. This comment transcribes that independent review.

Applied the accepted record-system and research-evidence review Skills, accepted AGENTS/Wave/governance/catalog/controls, Issue #35, experiment policy, and affected requirements/architecture/research boundaries. P2/P3/P4 received separate independent triage before remediation and are resolved on focused re-review.

The singleton Markdown protocol/history has a distinct operator/evidence consumer, one authority, catalog admission, and navigation. The original five probe/config files and existing text-selector extension introduce no general runner, new control, or historical Issue #1 mutation. Static review covers public source/package/API pins, exact account selection and returned identity checks, finite cumulative attempts, process/journal boundaries, host/WSL/account/network effects, selector/output privacy, retention, and stops. Pinned MSAL broker-first/custom-Web-UI-fallback behavior was independently inspected.

RECHECK-003/005 are evaluated for this bounded WSL-initiated Windows experiment using public AzureAD#460/AzureAD#462 and official guidance; no V2 WSL bridge or Linux path is selected. RECHECK-007 remains unresolved for registration/account-type/resource behavior and intended reuse; acquisition alone cannot satisfy that Profile gate. RECHECK-001/002/006 retain existing bounded dispositions; RECHECK-004 is not activated because browser fallback is declined. No Wave change or release creates another all-entry fallback.

Acceptance permits only protocol-bound preparation/execution afterward. Mechanical checks and per-action prerequisites remain required. Compilation and runtime effectiveness are not asserted by this review.

No material findings.