docs(design): define the Windows Azure DevOps authentication slice

[hcoona]

Summary

Define the complete preimplementation design for a WSL caller directly invoking the Windows CLI for a selected personal Microsoft or work account. Select .NET 10, the existing MSAL/Broker dependency baseline, WAM-owned reusable state, protocol 1 CLI/results, an explicit local Profile file, and the legacy Visual Studio candidate without activating it. Include scenario validation and update the native threat model for the concrete configuration input.

Authorization and Governing Records

Accepted main-v2 4af6885052c3bbe42977895bd8f86c5913305172, its current Delivery Wave, and #56 authorize detailed design/contracts, required family activation/routing, public desk research, schema/synthetic checks, and native TMT authoring/analysis. The owner requested completion of this Wave. PR61 corrected design-before-implementation activation under accepted governance review. This PR does not change the Wave or grant implementation.

Scope and Non-Goals

One cohesive Windows design, three versioned public schemas, existing architecture/security/research/validation consumers, catalog activation, navigation, and extending the existing Markdown-link check to designs. No production code, probe, restore/build experiment, authentication, account/cache/resource access, installer, Profile activation/distribution, or release.

Record-System Impact

The existing design and public-contract families become current on creation. The design owns command-line/process semantics and implementation choices; schemas own serialized field shapes; requirements remain behavior authority. Existing hk performs schema metaschema validation. Scenario/negative schema checks and native TMT evidence are recorded here; no additional record family or generic governance layer is introduced.

Evidence and Security

Pin public .NET 10 metadata, existing MSAL 4.83.1 source, WAM and Windows pipe contracts. Retain the .NET 8 personal-account probe as bounded evidence, not .NET 10/company/feed validation. Evaluate all seven rechecks for the selected host/account/interaction/cache/candidate-Profile decisions. Preserve strict identity, original deadline, PAT exclusion, opaque tokens, no browser fallback, broker-owned secure state, unconfirmed-persistence warning, and bounded terminal process behavior.

Validation and Review

Passed synthetic checks: 3 contract metaschemas, 14 embedded examples, 22 negative cases, and additive result-field tolerance. Native TMT final-model load/analysis passed with 96 candidates (76 NeedsInvestigation, 20 NotApplicable, 0 Mitigated); exact input hash, native API reproduction, and disposition comparison are attached in the PR evidence comment. Local hk pre-commit passed, including the 32-group runner-conformance check. Final independent architecture/consistency/minimality/security and accepted record-system/research-evidence reviews passed against base 4af6885052c3bbe42977895bd8f86c5913305172 and tree da5002d20a0952bf6f8e93087fcfc457cc1c64ed, with no material findings. GitHub full repository controls passed. No runtime behavior is claimed from these design checks.

Review and native evidence: independent review, TMT analysis. Final head d8beba106695e6d553f4edcfffa28fc6bacb2ddd has the reviewed tree; the working tree is clean.

[hcoona]

Independent Final Design Review

Reviewer: /root/preparation_review, independent of the change author and implementation agent.

Accepted governing base: 4af6885052c3bbe42977895bd8f86c5913305172.

Exact reviewed tree: da5002d20a0952bf6f8e93087fcfc457cc1c64ed on design/windows-ado-slice.

Carrier: Issue #56 and the Windows Slice design pull request. Accepted AGENTS, Delivery Wave, governance policies, catalogs, controls, requirements, and both repository review Skills govern this review. The final tree differs from the previously reviewed b98a0a5763268cbc561a9310a6df53cf023a9678 only in native TMT dispositions and the corresponding security narrative.

Result

No material findings.

The accepted record-system-review and research-evidence-review Skills and the required independent architecture, consistency, minimality, and security reviews pass for this exact design tree. No finding remains open or requires triage. This is a contextual review result; normal hk and GitHub checks remain separate merge prerequisites.

Design and Authority

The design provides a coherent Windows request boundary, concrete provider and runtime choices, explicit request/Profile/result contracts, and scenario obligations. Strict account resolution and final validation preserve requested identity, exact-tenant precedence, scope semantics, client/cloud context, and opaque tokens. The PAT prohibition remains binding. Broker-owned state avoids an additional application store; absence of a durable-write receipt produces the specified warning without readback or persistence waiting.

The original deadline, request cancellation, rejecting browser fallback, optional caller-lifetime pipe, terminal-result commitment, and bounded process shutdown address the selected host without assuming Linux signals terminate Windows work. Profile parsing and explicit caller ownership do not activate or distribute the compatibility candidate. Native Windows integration, company-account, first-use, WSL lifetime, and downstream feed observations remain distinct future evidence obligations.

Design and public-contract family activation follows the accepted Wave and PR61 catalog amendment. Requirements remain behavior authority, schemas own serialized shapes, and the design owns concrete process semantics. Existing architecture, validation, security, navigation, and hk routing change together. No implementation, experiment, adapter, support commitment, or new governance mechanism is introduced.

Source and Recheck Review

The substantive review independently retrieved the pinned MSAL base client, RuntimeBroker, AuthenticationResult, Broker project, WAM guide, and anonymous-pipe documentation and confirmed their supplied source copies. It also retrieved the pinned .NET 10, Windows Forms, and WSL sources. The pinned .NET metadata independently supports SDK 10.0.401, runtime/Desktop 10.0.12, the September 8 release, Windows x64 artifacts, and the stated LTS lifecycle. These support design inferences, not a new build or authentication observation.

All seven rechecks were evaluated. RECHECK-001/002 preserve separate interaction permission, real-account selection, and final validation; RECHECK-003 preserves explicit WSL-to-Windows invocation and the defined lifetime channel; RECHECK-004/005 retain unselected browser and Linux broker paths; RECHECK-006 preserves WAM state ownership and safe persistence observations; RECHECK-007 retains ordinary-registration limits, bounded legacy MSA evidence, and the separate activation/support gate. Independent API retrieval confirmed the recorded 459/461/465 states; other anonymous API calls returned HTTP errors, so this receipt does not claim that every mutable source was independently refreshed. The supplied dated snapshots and reviewable source records support the bounded dispositions.

Native TMT and Security

Reviewed model SHA-256: a7bcc01a58d53bcf640eaf3e843d192a6366da37a1c95a053ad71125ddbe70d3.

Read-only parsing independently confirmed 17 flows, two boundary containers, complete candidate IDs 1-96, 76 NeedsInvestigation, 20 NotApplicable, and zero Mitigated. All candidates have justifications; original IDs 1-87 retain their states and justifications. New IDs 88-96 address the Profile input with six planned-control obligations and three scenario-specific non-applicable dispositions. Integrity, wrong configuration, interruption, and execution-flow risks remain applicable even though the Profile's deliberately nonsecret fields do not require confidentiality or nonrepudiation controls.

The retained final native input exactly matches the committed model. Independent comparison of the separately saved native output confirms all candidate keys, scalar fields, states, and property dictionaries survive roundtrip. Property ordering changes and clearance of redundant direct StateInformation are serialization differences; the property justifications remain intact. Committed author metadata is sanitized. The native evidence receipt binds TMT 7.3.51110.1, embedded SDL TM Knowledge Base (Core) 4.1.0.11, successful load, generation, full-model processing, and save to the reviewed model. The reviewer inspected retained artifacts and did not rerun TMT.

The security narrative accurately distinguishes generic architectural roles from their concrete Windows specialization, planned controls from implemented mitigations, and native candidate generation from proof of platform security. Its version-specific native API workflow is not represented as a supported command-line analyzer. No new authentication or account-state effect follows from this model review.

Deterministic Validation

Independently inspected and reran the synthetic contract checks using the existing offline cached tooling:

uv run --offline --with jsonschema==4.25.1 --with rfc3339-validator==0.1.4 python /tmp/azureauth-check-contracts.py
PASS: 3 metaschemas, 14 embedded examples, 22 negative cases, additive result field tolerance.

The diff whitespace check passed, and the reviewed tree identity was reconfirmed. No subject, account, cache, authentication, or resource operation was executed. No repository source was edited during review; this temporary review receipt is the only reviewer-authored file.

[hcoona]

Native TMT validation

Executed on 2026-09-11 UTC using the existing Windows installation, TMT 7.3.51110.1 and embedded SDL TM Knowledge Base (Core) 4.1.0.11. This is authorized native model authoring/analysis, not authentication or a platform-support experiment.

Checked-in model SHA-256: a7bcc01a58d53bcf640eaf3e843d192a6366da37a1c95a053ad71125ddbe70d3.

The design-stage copy opened in the desktop tool and Analysis View reported 96 candidates. The final dispositioned file was then loaded and analyzed using the same installed tool's native model API. Observed output:

TMT model assembly: 7.3.51110.1
Input SHA256: A7BCC01A58D53BCF640EAF3E843D192A6366DA37A1C95A053AD71125DDBE70D3
LoadHasIssues: False
Generated: 96
Total: 96
Saved

The final model has 17 flows, 2 boundary containers, and 96 retained candidates: 76 NeedsInvestigation, 20 NotApplicable, 0 Mitigated. Original candidate IDs 1–87 and their dispositions are preserved, except for the request-flow label refinement. IDs 88–96 are native-generated candidates for the new public Profile input, with 6 planned-control obligations and 3 justified non-applicable cases. Every retained candidate has a justification. No observed vulnerability or completed implementation mitigation is inferred from candidate generation.

A parsed comparison with the separately saved native output confirmed all 96 candidate keys, states, property justifications, and other candidate fields. Native SaveAs clears the redundant direct StateInformation field while retaining the same justification in Properties; this serialization detail does not change a disposition. The committed version retains both representations and sanitized author metadata. Native output remains temporary; no machine-specific author identity is committed.

Reproduction

The official getting-started and feature overview did not identify a supported CLI for this version. Prefer one if available in a future tool version. The following is a version-specific API workflow using installed binaries, not a supported public CLI interface.

Run the script with 32-bit Windows PowerShell 5.1 in STA mode (%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -STA -File <script.ps1>). Set the three parameters to the installed TMT directory, a copy of the checked-in model, and a separate output file. No credentials, account state, network authentication, or new installation is involved.

param(
    [string]$TmtDirectory,
    [string]$ModelPath,
    [string]$AnalysisPath
)
$ErrorActionPreference = 'Stop'
Set-Location $TmtDirectory
[void][Reflection.Assembly]::LoadFrom((Join-Path $TmtDirectory 'ThreatModeling.Model.dll'))
[void][Reflection.Assembly]::LoadFrom((Join-Path $TmtDirectory 'ThreatModeling.ViewModel.dll'))
Add-Type -AssemblyName PresentationFramework
[void](New-Object System.Windows.Application)
[void][Reflection.Assembly]::LoadFrom((Join-Path $TmtDirectory 'ThreatModeling.ExternalStorage.Local.dll'))
$file = New-Object ThreatModeling.ExternalStorage.Local.LocalFile($ModelPath)
$model = New-Object ThreatModeling.Model.ObjectModel($file, $false)
try {
    [ThreatModeling.Model.ObjectModel].Assembly.GetName().Version
    Get-FileHash $ModelPath -Algorithm SHA256
    $model.ModelLoadHasIssues
    $model.GenerateThreats().Count
    [void]$model.ProcessModelImmediately([ThreatModeling.Model.ModelProcessingMode]::FullModel)
    $model.allThreats.Count
    [void]$model.SaveAs($AnalysisPath)
} finally {
    $model.Dispose()
}