docs(planning): authorize WSL Windows authentication Slice design

[hcoona]

Summary

Replace the completed high-level architecture grant with a bounded detailed-design and contract grant for the WSL-to-Windows Azure DevOps authentication Slice. The owner selected direct Windows CLI invocation, requested personal and work accounts, and Artifacts inclusion where the authentication capability is shared.

Authorization and Governing Records

This is an owner-approved Delivery Wave proposal whose sole substantive purpose is to replace the current authorization. Accepted base 9f67408d19558205467d3c6c0aa4fcfad04d82ee and its AGENTS, governance policies, catalogs, and Skills govern this proposal. Accepted AGENTS and record-system policy permit preparing and reviewing it; no proposed design work begins before merge. #56 coordinates the proposed Slice. #35 owns the completed high-level architecture, including accepted PR #57's direct-invocation and Artifacts assessment.

Scope and Non-Goals

Authorize detailed Windows request design, CLI/result/Profile contracts, security and scenario validation, and the minimum reviewed activation of existing scheduled design/contract record families. Both personal/company Git scenarios and Artifacts token acquisition/reuse are included. No product implementation, Profile activation/distribution, new experiment, account/cache/resource access, Linux forwarding, downstream adapter, packaging, or release.

Record-System Impact

Only docs/delivery-wave.md changes. The old entry is deleted, ending its authority. The new entry has accepted inputs, a finite design outcome, exclusions, permitted desk/model/check effects, and independent review gates. Catalog/schema/routing changes are future work under their applicable accepted governance requirements, not changes made by this proposal. Design completion does not itself authorize implementation.

Evidence and Reasoning

PR #57 settles WSL deployment and records official WSL guidance and pinned Artifacts/GCM evidence. Previously accepted Windows observations and client/tenant mapping remain bounded research/architecture evidence. No corporate-account, full Git clone, cross-WSL token delivery, or feed operation is claimed as already observed. Artifacts shares the engine's Azure DevOps acquisition capability; package session-credential exchange remains a downstream concern.

Identity and Security Effects

No runtime effects. Preserve exhausted probe limits and private-data boundaries. The future grant permits public-source reads, record/contract checks, and native TMT work with the existing installation. It excludes authentication, installation, cache access, and resource requests. Exact selected accounts and tenants remain constraints, independent of the OS default and consumer protocol.

Validation

Local hk checks passed, including all 32 public-build runner conformance groups. GitHub Repository Controls passed (run).

Review and Disposition

Independent /root/preparation_review review passed both accepted Skills and contextual scope/lifecycle/security/minimality review with no material findings. Accepted base 9f67408d19558205467d3c6c0aa4fcfad04d82ee, exact reviewed tree b7716ae9588f8459db538719851a2e8f4a13b596; Review binding is recorded in this PR. At this Wave transition evaluate all seven rechecks against their current accepted dispositions in PR #57, including WSL outcomes for 003/005 and the retained Profile/store/interaction/account/browser boundaries. No new source conclusion or support claim is introduced. The completed post-merge fallback confirms all seven dispositions, the sole-authority boundary, and design-before-implementation sequencing. No immediate correction is required; later catalog activation receives its own accepted-policy review.

Upstream Provenance

No upstream source imported. PR #57 and the existing public-research baseline contain source provenance and claim limits.

[hcoona]

Independent review by /root/preparation_review, independent of author/implementation agent /root.

• Accepted base: 9f67408d19558205467d3c6c0aa4fcfad04d82ee (accepted PR docs(architecture): select direct Windows CLI invocation from WSL #57, tree 52edf223f171cc1118ff6118bc1b5907597554d1).
• Exact reviewed Wave tree: b7716ae9588f8459db538719851a2e8f4a13b596.
• Work carrier: this PR and Design the WSL-to-Windows Azure DevOps authentication Slice and contracts #56.
• Accepted record-system-review Skill: No material findings.
• Accepted research-evidence-review Skill: No material findings.
• Contextual scope, lifecycle, security, and minimality review: No material findings. No unresolved finding requires triage.

Only docs/delivery-wave.md changes. Its authority preamble is preserved. The replacement entry is owner-directed, finite, and limited to detailed design/contracts for direct WSL-to-Windows authentication with requested personal/work accounts and shared Artifacts token capability. PR #57 acceptance supplies its formerly pending architecture prerequisite. No new substantive design work was performed under the proposal.

The old entry's deletion ends its experimental authority. The proposal preserves exhausted probe accounting, excludes implementation, Profile activation/distribution, private resources, and authentication/cache effects, and separates candidate design from runtime/support acceptance. It permits minimum reviewed catalog/routing work rather than silently activating records: the scheduled design-family trigger presently refers to implementation authorization and needs its separately reviewed amendment before design activation. Public-contract routing follows its existing accepted-Wave trigger.

All seven rechecks were evaluated using the now-accepted PR #57 dispositions. RECHECK-003/005 retain direct-Windows versus separate Linux-broker distinctions; 001/002 retain interaction/account contracts; 004 retains excluded browser expansion; 006 retains store/persistence boundaries; 007 retains conditional Profile/external-registration gates and bounded MSA evidence. No new empirical result or support claim is introduced.

The prospective governance fallback confirms one current grant, no automatic implementation, and no additional governance mechanism needed for this proposal. The actual merged-Wave event still requires its fallback evaluation before the successor grant is used. Normal hk and CI are separate mechanical gates.

[hcoona]

Actual merged-Wave fallback review completed by independent reviewer /root/preparation_review under both accepted Skills.

• Predecessor: 9f67408d19558205467d3c6c0aa4fcfad04d82ee.
• Accepted PR docs(planning): authorize WSL Windows authentication Slice design #58 merge: 89c67730b08736d6fe430f9382d2cbefb50f6864, merged 2026-09-11T05:26:45Z.
• Exact merged tree: b7716ae9588f8459db538719851a2e8f4a13b596, identical to the independently reviewed proposal.
• Only docs/delivery-wave.md changed. Governance, Skills, catalogs, controls, requirements, architecture, research policy/registry, and accepted PR docs(architecture): select direct Windows CLI invocation from WSL #57 evidence are unchanged; Design the WSL-to-Windows Azure DevOps authentication Slice and contracts #56 remains aligned.

All seven registry entries were evaluated at this actual event using unchanged accepted dated outcomes, without claiming new retrieval or observation:

Entry	Actual-event disposition
RECHECK-001	Retain open AzureAD#464 outcome and independent interaction permission.
RECHECK-002	Retain open AzureAD#465 and strict account/result constraints.
RECHECK-003	Retain same-day AzureAD#460, MSAL WSL, and interop findings for direct Windows CLI invocation; cancellation, encoding, and UI remain concrete design obligations.
RECHECK-004	Retain excluded browser work and AzureAD#459/AzureAD#461 limitations.
RECHECK-005	Retain PR AzureAD#462 open/unmerged and its separate Linux implementation/prerequisites; no Linux path is selected.
RECHECK-006	Retain open AzureAD#398 and accepted state/persistence boundaries; no new fallback or support claim.
RECHECK-007	Retain refreshed registration guidance and bounded MSA evidence; candidate design is distinct from Profile activation/support.

No current conclusion or consumer requires an immediate research correction because of this transition.

Governance fallback confirms one sole grant replacing and ending the previous experimental grant. Retained protocols and consumed capacity confer no continuing execution permission. Public-contracts' accepted-Wave activation trigger is met; bounded contract/schema/review work may proceed through the accepted process. Design-records remains scheduled until the authorized catalog/routing amendment receives its separate accepted-policy review. Validation-cases remains conditional on a concrete reusable scenario not already covered. No new case, duplicate authority, missing control, or additional immediate amendment is required merely for the transition.

Both Skills and contextual lifecycle/security/minimality review: No material findings. No open triage. This completes the merged-Wave fallback; later design/contract reviews and decision-trigger rechecks still apply. No product implementation, Profile enablement, authentication, account/cache/resource operation, or experiment was performed.