docs(architecture): define state ownership and persistence observation - #54
Conversation
Clarify broker and engine state responsibilities and classify already available persistence evidence when delivering a validated result. Use pinned MSAL cache contracts to remove the need for an extra persistence check or background writer. Preserve product tenant semantics when interpreting the successful MSA probe, refresh the cache-design recheck, and extend the existing validation scenarios. Refs: #35
|
Independent review by Codex reviewer
The reviewer independently retrieved and matched the cited MSAL cache helper, result RECHECK-006's fired cache-design trigger has the required dated desk disposition; all Existing TMT broker and secure-state roles still cover the same assets, boundaries, |
1 participant
Summary
MSAL acquisition success alone does not confirm that reusable state was persisted.
The architecture now classifies evidence already available at result delivery:
confirmed persistence returns normal success; failed or unconfirmed persistence
adds the required warning without another I/O operation or wait. Broker state
remains behind its API, with an engine-owned store only when an integration needs it.
Authorization and Governing Records
The accepted Delivery Wave
authorizes high-level architecture and relevant public desk research under #35.
The change follows V2-REQ-015, V2-REQ-019, V2-REQ-025, V2-REQ-040, and V2-REQ-041.
It preserves the requirements baseline accepted in #32.
Scope and Non-Goals
Refine the existing C4 container and UML sequence views, state ownership and result
delivery responsibilities, research evidence, and scenario validation. Clarify why
the successful probe's organizations/MSA transfer settings do not themselves define
the product's common/exact tenant mapping.
No product implementation, public schema, selected runtime/store/platform/Profile,
new experiment, support claim, or change to requirements or Wave authorization.
Record-System Impact
Update existing architecture, research, and validation-strategy records. No new record
family, authority, control, schema, or navigation entry. The lifecycle view owns the
architectural allocation; requirements retain behavioral authority, and research
retains source provenance and bounded conclusions.
Evidence and Reasoning
Pinned MSAL .NET source at d5d7de6b103f0d9dd7bca9bf13cbb9f3da37bc9f shows managed
acquisition awaiting cache callbacks and MSAL Extensions catching storage-write
exceptions. Token-source and timing metadata, CacheChanged, and VerifyPersistence
do not report the durable outcome of a particular acquisition's cache write. The
callback cancellation parameter alone does not establish bounded underlying I/O.
The research record links exact source locations and distinguishes findings from
the architectural inference; no runtime store guarantee is claimed.
The 2026-09-11 public Issue AzureAD#398 and comments refresh retains the prior unresolved,
bounded secure-store conclusion. Existing WAM/MSA observations remain unchanged.
Identity and Security Effects
Broker state ownership and existing secure-state trust boundaries remain intact.
No broker-file inspection, shadow refresh-token cache, plaintext fallback, background
writer, extra acquisition, or result-time persistence verification is introduced.
Strict account/result validation, interaction permission, original deadline, and
request-end cleanup retain their existing authority. Public tenant semantics remain
common or exact resource-tenant selection, independently of experimental settings.
The checked-in TMT model still covers these existing broker and secure-state roles;
no data flow, trust boundary, or protected asset is added, so native model analysis
does not need to be rerun for this refinement.
Validation
The normal hk commit hook passed, including all 32 public-build runner conformance
groups, links, schemas, record routing, identifiers, whitespace, and secret scanning.
Repository Controls CI
passed in 4m25s.
The changed Mermaid C4 and UML source is reviewed for ownership and request ordering.
Existing scenario coverage now distinguishes confirmed, failed, and unavailable
persistence evidence and a provider failure before any candidate result. These are
validation obligations, not claims that product tests or platform experiments passed.
Review and Disposition
Independent review applies record-system-review and research-evidence-review, plus
contextual architecture, consistency, security, and minimality review required by
the accepted Wave. The independent review
identifies the reviewer, accepted base, and exact reviewed tree
8e86a8b41d7e29d711b1e61ba14d7bd7e6748885: no material findings across the applicablereviews. Commit
711320f05ab065e84a7516f28c09970b2bc34a4ahas that reviewed tree.The check results above provide the separate mechanical evidence.
RECHECK-006 fires for cache-design and has a current desk outcome. All seven entries
are evaluated in the research record; the other accepted dispositions remain intact,
with no new selected integration, Profile, release, or Wave change. No owner scope
or risk decision is requested by this change. No material finding required triage or remediation.
Upstream Provenance
No source code is imported. Analysis cites public MSAL .NET source pinned to
d5d7de6b103f0d9dd7bca9bf13cbb9f3da37bc9f and the already recorded AzureAuth and
GCM-informed experiment provenance. Public issue retrieval is dated 2026-09-11 UTC.