@knowttl/mg-axi 0.1.2 → 0.1.4

package/dist/docs.js

@@ -37,6 +37,8 @@ const READ_AREA_LABELS = [
     ["entra user ", "users"],
     ["entra group ", "groups"],
     ["entra directory-role ", "roles"],
+    ["entra directory-role-template ", "roles"],
+    ["entra scoped-role-membership ", "roles"],
     ["entra role-assignment ", "roles"],
     ["entra pim ", "roles"],
     ["entra device ", "devices"],
@@ -70,6 +72,7 @@ const READ_AREA_LABELS = [
     ["entra tenant-information ", "tenant information"],
     ["entra sign-in ", "sign-ins and audit logs"],
     ["entra directory-audit ", "sign-ins and audit logs"],
+    ["entra provisioning ", "sign-ins and audit logs"],
     ["entra application ", "applications and consent grants"],
     ["entra service-principal ", "applications and consent grants"],
     ["entra risky-user ", "risk"],
@@ -204,6 +207,9 @@ export function skillDocument() {
         "",
         "Configuration defaults to `~/.mg-axi/config.json`; `MG_AXI_CONFIG` selects a separate file.",
         "`mg-axi setup` shows the selected path and writes nothing.",
+        "Application profiles authenticate headlessly through credential references: the profile names an env var or file and the environment supplies the value at acquisition time.",
+        "Container examples for client secrets, certificate keys and workload federation live in [README.md](../../README.md#mg-axi).",
+        "A client secret is weaker than a certificate or federated credential and needs scheduled rotation.",
         "",
         "Agent discovery has two install paths, and either suffices alone.",
         "For ambient context at every agent session start instead of the skill, install the CLI globally and opt into the session hook:",
@@ -232,7 +238,7 @@ export function skillDocument() {
         "Writes preview before sending and need `--execute` plus a typed `--confirm` repeating the target; an already-desired value is a no-op with exit 0, never an error.",
         "Output is TOON on stdout; diagnostics use stderr.",
         "Text truncates at 500 characters (`--full` restores text, never redaction); row caps resume through opaque cursors.",
-        "Secrets stay in protected storage references, never in argv, config files or output; credential fields carry expiry metadata only.",
+        "Secrets stay in credential references, never in argv, config files or output; credential fields carry expiry metadata only.",
         "Tests run offline with fixture credentials; never point tests at a real tenant.",
         "",
     ].join("\n");
@@ -242,14 +248,14 @@ export function skillDocument() {
 // remains unimplemented. Family membership comes from the inventory
 // owningSlice and shipped status comes from the catalogue, so a merged
 // write slice flips its own row without touching this template. Blocked,
-// deprecated and unavailable variants never count as pending.
+// deprecated, unavailable and deferred-out-of-v1 variants never count as pending.
 function initialWriteStatus(rows) {
     const families = new Map();
     for (const row of rows) {
         const operation = /^v1\.0:(.+)$/.exec(row.id)?.[1];
         if (operation === undefined || row.owningSlice === null || !/^WRITE-0[1-9]$/.test(row.owningSlice))
             continue;
-        if (row.disposition === "intentionally-blocked" || row.disposition === "deprecated" || row.disposition === "unavailable")
+        if (row.disposition === "intentionally-blocked" || row.disposition === "deprecated" || row.disposition === "unavailable" || row.disposition === "deferred")
             continue;
         families.set(row.owningSlice, [...(families.get(row.owningSlice) ?? []), operation]);
     }
@@ -264,7 +270,79 @@ function initialWriteStatus(rows) {
     }
     return { shipped, pending };
 }
-const DISPOSITIONS = ["named-command", "reviewed-raw-read", "scheduled", "intentionally-blocked", "deprecated", "unavailable", "excluded"];
+const DISPOSITIONS = ["named-command", "reviewed-raw-read", "scheduled", "deferred", "intentionally-blocked", "deprecated", "unavailable", "excluded"];
+// FULL-01 audit record (2026-10-07, latest origin/main at PR #78): the cutoff
+// is met when no v1.0 row is left scheduled, so the counts below are read
+// from the same generated inventory the Counts section reports. Beta stays
+// scheduled by definition and was never agreed for v1.
+function auditRecord(rows) {
+    const v1 = (disposition) => rows.filter(row => row.id.startsWith("v1.0:") && row.disposition === disposition).length;
+    const betaScheduled = rows.filter(row => row.id.startsWith("beta:") && row.disposition === "scheduled").length;
+    const named = v1("named-command");
+    const raw = v1("reviewed-raw-read");
+    const scheduled = v1("scheduled");
+    if (scheduled !== 0)
+        throw new Error(`FULL-01 audit blocked: ${scheduled} v1.0 rows remain scheduled`);
+    return [
+        "## FULL-01 audit record",
+        "",
+        "FULL-01 audit (2026-10-07): every agreed v1.0 read has a named command or an",
+        "explicit reviewed blocked/unavailable/deprecated/deferred disposition, and no",
+        "v1.0 row is left scheduled. The deferred tail is declared out of v1.",
+        `- v1.0 named-command: ${named}, reviewed-raw-read: ${raw}, scheduled: ${scheduled}`,
+        `- v1.0 deferred (out of v1): ${v1("deferred")}, intentionally-blocked: ${v1("intentionally-blocked")}, deprecated: ${v1("deprecated")}, unavailable: ${v1("unavailable")}`,
+        `- beta scheduled (never agreed for v1): ${betaScheduled}`,
+        `PR #78 (historical point-in-time) proposed 275 named / 19 raw (294 backed); the generated inventory carries ${named} named / ${raw} raw (${named + raw} backed).`,
+        "",
+    ];
+}
+// COMPLETE-01 audit record (2026-10-07, latest origin/main at this change):
+// the full agreed Entra capability audit including later writes. Five writes
+// ship as named, gated commands through the WRITE-00 mutation coordinator,
+// WRITE-N carries explicit reviewed deferred/blocked/deprecated dispositions
+// rather than scheduled, and no agreed v1.0 operation, read or write, is
+// left merely scheduled. Beta stays scheduled by definition and was never
+// agreed for v1. The declined EXT-02c access-review history reads stay out.
+function completeAuditRecord(rows) {
+    const v1 = (disposition) => rows.filter(row => row.id.startsWith("v1.0:") && row.disposition === disposition).length;
+    const betaScheduled = rows.filter(row => row.id.startsWith("beta:") && row.disposition === "scheduled").length;
+    const named = v1("named-command");
+    const raw = v1("reviewed-raw-read");
+    const scheduled = v1("scheduled");
+    const writeRows = rows.filter(row => row.id.startsWith("v1.0:") && row.disposition === "named-command" && !row.id.includes(":GET:"));
+    const writeN = (version, disposition) => rows.filter(row => row.owningSlice === "WRITE-N" && row.id.startsWith(`${version}:`) && row.disposition === disposition).length;
+    const writeNScheduled = rows.filter(row => row.owningSlice === "WRITE-N" && row.disposition === "scheduled").length;
+    const declinedOut = rows.filter(row => row.owningSlice === "EXT-02c"
+        && (row.disposition === "named-command" || row.disposition === "reviewed-raw-read"));
+    if (scheduled !== 0)
+        throw new Error(`COMPLETE-01 audit blocked: ${scheduled} v1.0 rows remain scheduled`);
+    if (writeNScheduled !== 0)
+        throw new Error(`COMPLETE-01 audit blocked: ${writeNScheduled} WRITE-N rows remain scheduled`);
+    const writeStatus = initialWriteStatus(rows);
+    const expectedWrites = ["WRITE-01", "WRITE-02", "WRITE-03", "WRITE-04", "WRITE-05"];
+    const missing = expectedWrites.filter(slice => !writeStatus.shipped.some(entry => entry.startsWith(`${slice} `)));
+    if (writeStatus.pending.length > 0 || missing.length > 0) {
+        throw new Error(`COMPLETE-01 audit blocked: pending writes: ${[...missing, ...writeStatus.pending].join(", ")}`);
+    }
+    if (declinedOut.length > 0)
+        throw new Error(`COMPLETE-01 audit blocked: declined EXT-02c rows ship: ${declinedOut.map(row => row.id).join(", ")}`);
+    return [
+        "## COMPLETE-01 audit record",
+        "",
+        "COMPLETE-01 audit (2026-10-07): the full agreed Entra capability audit including later writes.",
+        "Five writes ship as named, gated commands through the WRITE-00 mutation coordinator; WRITE-N carries explicit",
+        "reviewed deferred/blocked/deprecated dispositions rather than scheduled; no agreed v1.0 operation, read or",
+        "write, is left merely scheduled. Beta stays scheduled by definition and was never agreed for v1.",
+        "The declined EXT-02c access-review history reads (ReadWrite least privilege, SAS URLs) stay out.",
+        `- v1.0 named-command: ${named} (${named - writeRows.length} reads plus ${writeRows.length} writes below), reviewed-raw-read: ${raw}, scheduled: ${scheduled}`,
+        `- v1.0 deferred (out of v1): ${v1("deferred")}, intentionally-blocked: ${v1("intentionally-blocked")}, deprecated: ${v1("deprecated")}, unavailable: ${v1("unavailable")}`,
+        `- beta scheduled (never agreed for v1): ${betaScheduled}`,
+        `- shipped writes: ${writeStatus.shipped.join(", ")}.`,
+        `- WRITE-N (remaining agreed mutations): deferred ${writeN("v1.0", "deferred")}, intentionally-blocked ${writeN("v1.0", "intentionally-blocked")} v1.0 plus ${writeN("beta", "intentionally-blocked")} beta, deprecated ${writeN("v1.0", "deprecated")} v1.0 plus ${writeN("beta", "deprecated")} beta, scheduled ${writeNScheduled}.`,
+        "- outstanding upstream limitations (already documented in the repo): P1 for Conditional Access and P2 for risk-based CA, PIM P2 or ID Governance, riskyUsers P2 and Workload Identities Premium for workload risk with hidden riskDetail/riskLevel without it (docs/graph-coverage.md); conservative P1/P2 Graph prerequisite for sign-in/audit logs, registration report excludes disabled users, no tenant-wide method enumeration (docs/graph-coverage.md); v1.0 group-members route omits service principals (README.md member-read warning); 14 unavailable rows with no documented v1.0 GET contract, invitation Create-only Methods table, org-scoped certificateBasedAuthConfiguration routes only, contacts sync-behavior reads without operation permission docs (inventory reasons); EXT-02c history reads need AccessReview.ReadWrite.All with no read scope and return SAS download URLs (docs/coverage.md); write-side limits beside each command, revoke lag/external-user scope/unknown outcome, CA update lockout gates with no concurrency promise, dismissal is not remediation (README.md, docs/execution.md).",
+        "",
+    ];
+}
 // The capability report is generated from the catalogue: every executable
 // read leaf owns one row with its inventory disposition and owning slice,
 // and the counts separate implemented leaves from inventory dispositions.
@@ -309,6 +387,7 @@ export function capabilityDocument() {
     const deferredCustomSecurityRows = rows.filter(row => row.owningSlice === "EXT-01" && row.reason.startsWith("Deferred by firstmate custom-security-attributes scope "));
     const deferredAccessReviewRows = rows.filter(row => row.owningSlice === "EXT-02c");
     const deferredEntitlementRows = rows.filter(row => row.owningSlice === "EXT-02" && row.reason.startsWith("Deferred by firstmate entitlement-management scope "));
+    const deferredAppLookupRows = rows.filter(row => row.owningSlice === "READ-07" && row.reason.startsWith("Deferred by firstmate application-lookups scope "));
     const readCount = readLeaves.length + 2;
     const localCount = LEAVES.length - readCount - writeLeaves.length;
     return [
@@ -318,9 +397,11 @@ export function capabilityDocument() {
         "",
         "This is the supported Entra read surface, not full Entra coverage.",
         "Only the commands below have an implemented, tested leaf; every other",
-        "operation remains scheduled, blocked, deprecated or excluded until its own slice ships.",
-        "Inventory dispositions are discovery-time records from INV-01; the command",
-        "list below is the implemented truth and never counts scheduled work as complete.",
+        "v1.0 operation is deferred out of v1, and every other beta operation remains",
+        "scheduled (never agreed for v1), blocked, deprecated, unavailable or excluded.",
+        "Inventory dispositions are generated records from INV-01 joined to the catalogue;",
+        "the command list below is the implemented truth and never counts deferred or",
+        "scheduled work as complete.",
         "",
         "## Counts",
         "",
@@ -329,6 +410,8 @@ export function capabilityDocument() {
         `- local leaves: ${localCount} (home, profile, login and setup views)`,
         ...DISPOSITIONS.map(disposition => `- inventory ${disposition}: ${count(disposition)}`),
         "",
+        ...auditRecord(rows),
+        ...completeAuditRecord(rows),
         "## Commands",
         "",
         "| Command | Operation | Inventory (v1.0) | Owning slice |",
@@ -340,61 +423,61 @@ export function capabilityDocument() {
         "## EXT-01 domain scope decisions",
         "",
         "Firstmate decision R1: approve narrowing this change to the eight v1.0 domain reads above.",
-        "The operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.",
+        "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Federation stays out because it can carry signing-certificate material.",
         "Firstmate decision R2: keep the write-family status section as the coverage fix added to scope (resolved-kept).",
         "Both firstmate decisions must also be stated in the PR body by the delivery phase.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredDomainRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredDomainRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-03 identity-provider scope decisions",
         "",
         "This change covers the four v1.0 workforce identity-provider reads above (list, show, count, available-types).",
-        "The four beta operations below remain scheduled with an explicit deferred disposition to a later EXT-03 subfamily.",
+        "The four beta operations below remain scheduled (never agreed for v1) for a later EXT-03 subfamily.",
         "Identity-provider reads support v1.0 only; beta needs its own review.",
         "Workforce context only; no external-customer (B2C/External ID tenant) support is claimed.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredProviderRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredProviderRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-01 federation-configuration scope decisions",
         "",
         "This change covers the four v1.0 workforce directory federation-configuration reads above (federation-configuration list, show, count and available-types).",
-        "The four beta operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.",
+        "The four beta operations below remain scheduled (never agreed for v1) for a later EXT-01 subfamily; no new commands or raw access are approved.",
         "Federation-configuration reads support v1.0 only; beta needs its own review.",
         "signingCertificate carries the public token-signing key only and is omitted from default selects; no private key material exists on these resources and the domains navigation property needs its own review.",
-        "Workforce context only; domain federationConfiguration sub-reads (/domains/{domain-id}/federationConfiguration) stay scheduled in the later domain federation subfamily.",
+        "Workforce context only; domain federationConfiguration sub-reads (/domains/{domain-id}/federationConfiguration) carry the deferred disposition in v1.0 (out of v1) and remain scheduled in beta (never agreed for v1) in the later domain federation subfamily.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredFederationRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredFederationRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-03 data-policy-operations scope decisions",
         "",
         "This change covers the three v1.0 workforce data-policy-operation reads above (data-policy-operation list, show and count).",
-        "The three beta operations below remain scheduled with an explicit deferred disposition to a later EXT-03 subfamily; no new commands or raw access are approved.",
+        "The three beta operations below remain scheduled (never agreed for v1) for a later EXT-03 subfamily; no new commands or raw access are approved.",
         "Data-policy-operation reads support v1.0 only; beta needs its own review.",
         "storageLocation always renders as the redaction marker; export submission (POST /users/{id}/exportPersonalData) belongs to no read slice.",
         "Workforce context only; no external-customer support is claimed.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredDataPolicyRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredDataPolicyRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-03 risk-prevention scope decisions",
         "",
         "This change covers the ten v1.0 workforce risk-prevention reads above (fraud-protection-provider list, show and count; web-application-firewall-provider list, show and count; web-application-firewall-verification list, show, count and provider show).",
-        "The eleven beta operations below remain scheduled with an explicit deferred disposition to a later EXT-03 subfamily; no new commands or raw access are approved.",
+        "The eleven beta operations below remain scheduled (never agreed for v1) for a later EXT-03 subfamily; no new commands or raw access are approved.",
         "Risk-prevention reads support v1.0 only; beta needs its own review.",
         "API keys, client secrets and other key material (Arkose privateKey/publicKey, HUMAN serverToken, Akamai clientSecret/clientToken/accessToken, Cloudflare apiToken) are never selectable and never projected; application profiles are refused before credentials because Graph documents no supported application permission.",
         "Workforce context only; no external-customer support is claimed.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredRiskPreventionRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredRiskPreventionRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-03 invitations scope decisions",
         "",
@@ -410,12 +493,12 @@ export function capabilityDocument() {
         "## EXT-01 organization scope decisions",
         "",
         "The organization scope covers the five organization/branding/localization reads above; the remaining subfamilies need the separate contracts described below.",
-        "The operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.",
+        "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Stream image and CSS bytes stay out because they need a separate binary-output contract; beta-only settings, partner and theme contracts need separate review.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredOrganizationRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredOrganizationRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-01 certificate-auth scope decisions",
         "",
@@ -437,61 +520,61 @@ export function capabilityDocument() {
         "## EXT-01 group lifecycle scope decisions",
         "",
         "This change covers the six v1.0 group lifecycle policy and group setting template reads above (list, show, count per family).",
-        "The operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.",
+        "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Beta policies and templates need their own review; delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads; the POST lookup actions need their own request and projection review.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredGroupLifecycleRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredGroupLifecycleRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-01 custom-security-attributes scope decisions",
         "",
         "This change covers the nine v1.0 attribute-set, custom-security-attribute-definition and allowed-value reads above (list, show, count per family).",
-        "The nine beta operations below remain scheduled with an explicit deferred disposition to a later EXT-01 subfamily; no new commands or raw access are approved.",
+        "The nine beta operations below remain scheduled (never agreed for v1) for a later EXT-01 subfamily; no new commands or raw access are approved.",
         "Beta attribute sets, definitions and allowed values need their own review; definition $expand (inline allowedValues) is not reviewed here and stays on the dedicated allowed-value list/show reads.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredCustomSecurityRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredCustomSecurityRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-01 on-premises-synchronization scope decisions",
         "",
         "This change covers the two v1.0 on-premises-synchronization reads above (on-premises-synchronization list and show).",
-        "The $count scalar and the three beta operations below remain scheduled with an explicit deferred disposition to later EXT-01 subfamilies; no new commands or raw access are approved.",
+        "The $count scalar below carries the deferred disposition (out of v1) and the three beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "On-premises-synchronization reads support v1.0 only; beta needs its own review.",
         "Scalar counts need a separate query and response contract from the approved list/show reads.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredOnPremSyncRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredOnPremSyncRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-01 terms-of-use scope decisions",
         "",
         "This change covers the six v1.0 agreement and agreement-acceptance reads above (agreement list/show, one agreement's acceptance list/show, and tenant-wide acceptance list/show).",
-        "The acceptances $count scalar, the agreement file/localization/files/versions sub-reads and the beta operations below remain scheduled with an explicit deferred disposition to later EXT-01 subfamilies; no new commands or raw access are approved.",
+        "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Terms-of-use reads support v1.0 only; beta needs its own review.",
         "Scalar counts need a separate query and response contract from the approved list/show reads; agreement file contents and localizations need a separate binary-output and projection contract, and file bytes are never downloaded or printed.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredTermsOfUseRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredTermsOfUseRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-01 directory-objects scope decisions",
         "",
         "This change covers the three v1.0 directory-object reads above (directory-object list, show and count).",
-        "The delta sync, the POST lookup/validation actions and the beta operations below remain scheduled with an explicit deferred disposition to later EXT-01 subfamilies; no new commands or raw access are approved.",
+        "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Directory-object reads support v1.0 only; beta needs its own review.",
         "Delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads; the POST lookup and validation actions need their own request and projection review.",
         "Rows are polymorphic: only the base-type properties plus the @odata.type discriminator are projected, so subtype secrets or credentials can never appear.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredDirectoryObjectRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredDirectoryObjectRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-01 deleted-items scope decisions",
         "",
         "This change covers the eleven v1.0 deleted directory-item reads above (deleted-user, deleted-group, deleted-application, deleted-service-principal and deleted-administrative-unit list and count, plus deleted-item show).",
-        "The rows below remain scheduled with an explicit deferred disposition; no new commands or raw access are approved for them.",
+        "The rows below carry the deferred (v1.0, out of v1) or scheduled (beta, never agreed for v1) disposition shown; no new commands or raw access are approved for them.",
         "Deleted-item reads support v1.0 only; beta needs its own review.",
         "Untyped list/count commands do not exist because upstream requires the OData cast as part of the list URI.",
         "Device casts carry no documented v1.0 permission contract: the list/get pages name the supported types and device is not among them.",
@@ -500,12 +583,12 @@ export function capabilityDocument() {
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredDeletedItemsRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredDeletedItemsRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-01 contacts scope decisions",
         "",
         "This change covers the three v1.0 top-level contact reads above (contact list, show and count), the ten v1.0 manager/directReports navigation reads above (show-manager, list/show/count-direct-reports with user/contact casts), and the eighteen v1.0 memberOf/transitiveMemberOf navigation reads above (list/show/count-member-of with transitive and group/administrativeUnit casts).",
-        "The delta sync, the POST lookup actions and the beta operations below remain scheduled with an explicit deferred disposition to later EXT-01 subfamilies; no new commands or raw access are approved.",
+        "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Contact reads support v1.0 only; beta needs its own review.",
         "Delta-token sync needs its own change-tracking contract beyond the approved reads; the POST lookup actions need their own request and projection review.",
         "Contacts are personal data: top-level default rows carry id, displayName, mail and companyName only; navigation rows carry the @odata.type discriminator plus id and displayName only, and identifying fields need an explicit --select.",
@@ -513,43 +596,43 @@ export function capabilityDocument() {
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredContactRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredContactRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         ...unavailableContactRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-04 partner contracts scope decisions",
         "",
         "Firstmate scope: approve narrowing this change to the three v1.0 partner-contract reads above (list, show, count).",
-        "The operations below remain scheduled with an explicit deferred disposition to a later EXT-04 subfamily; no new commands or raw access are approved.",
+        "The v1.0 operations below carry the deferred disposition (out of v1) and the beta operations remain scheduled (never agreed for v1); no new commands or raw access are approved.",
         "Beta contracts need their own review; delta-token sync needs its own change-tracking contract beyond the approved list/show/count reads.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredContractRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`), "",
+        ...deferredContractRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`), "",
         "## EXT-04 delegated-admin scope decisions",
         "",
         "Firstmate scope: approve narrowing this change to the eighteen v1.0 delegated-admin reads above (customer list/show/count, relationship list/show/count, access-assignment list/show/count, operation list/show/count, request list/show/count and service-management-detail list/show/count).",
-        "The operations below remain scheduled with an explicit deferred disposition to a later EXT-04 subfamily; no new commands or raw access are approved.",
+        "The operation below carries the deferred disposition (out of v1); no new commands or raw access are approved.",
         "The tenantRelationship container root needs its own projection review; multi-tenant-organization reads shipped in the section below, and tenant-lookup functions ship as tenant-information show under the mg-ext-04e function-argument contract.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredDelegatedAdminRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`), "",
+        ...deferredDelegatedAdminRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`), "",
         "## EXT-04 multi-tenant-organization scope decisions",
         "",
         "Firstmate scope: approve narrowing this change to the four v1.0 multi-tenant-organization reads above (organization show, join-request show, tenant list/count).",
-        "The single-member read below remains scheduled with an explicit deferred disposition: its documented least privilege is the write scope MultiTenantOrganization.ReadWrite.All in both delegated and application modes, so no named command or raw access is approved for it until its own least-privilege review lands.",
+        "The single-member read below carries the deferred disposition (out of v1): its documented least privilege is the write scope MultiTenantOrganization.ReadWrite.All in both delegated and application modes, so no named command or raw access is approved for it until its own least-privilege review lands.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredMtoRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`), "",
+        ...deferredMtoRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`), "",
         "## EXT-04 reports scope decisions",
         "",
         "Firstmate scope: approve deferring the v1.0 relying-party summary read below; no named command or raw access is approved for it.",
-        "The relying-party summary read below remains scheduled with an explicit deferred disposition: its period function argument needs a new session-guard function-argument binding beyond the three allowlisted tenant-lookup/commerce routes, and the request-path guard must stay byte-identical to origin/main apart from READ_SCOPES additions, so no named command or raw access is approved for it until its own guard review lands.",
+        "The relying-party summary read below carries the deferred disposition (out of v1): its period function argument needs a new session-guard function-argument binding beyond the three allowlisted tenant-lookup/commerce routes, and the request-path guard must stay byte-identical to origin/main apart from READ_SCOPES additions, so no named command or raw access is approved for it until its own guard review lands.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredReportsRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`), "",
+        ...deferredReportsRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`), "",
         "## EXT-04 tenant-lookup scope decisions",
         "",
         "Firstmate scope: approve the mg-ext-04e function-argument contract with the three v1.0 reads it unblocks (tenant-information show by domain name or tenant ID, subscription show by commerce subscription ID).",
@@ -559,7 +642,7 @@ export function capabilityDocument() {
         "## EXT-02 access-review scope decisions",
         "",
         "The access-review scope covers the ten reads above (definition, instance, decision, contacted-reviewer and stage list/show reads).",
-        "The legacy accessReviews and unified alias reads below are split into the EXT-02c follow-up to limit this piece's size; beta-only operations stay deferred (\"beta needs its own review\").",
+        "The legacy accessReviews and unified alias reads below carry the deferred disposition (out of v1) under the captain-declined EXT-02c follow-up (see docs/build-plan.md); beta-only operations remain scheduled (\"beta needs its own review\").", ,
         "The history reads below are blocked: their documented least privilege is the write scope AccessReview.ReadWrite.All (no read scope), and history instances return SAS download URLs in downloadUri.",
         "No new commands or raw access are approved for any row below.",
         "",
@@ -570,18 +653,27 @@ export function capabilityDocument() {
         "## EXT-02 entitlement-management scope decisions",
         "",
         "The entitlement-management scope covers the eighteen reads above (catalog, access-package, assignment-policy and resource-role-scope list/show/count reads plus assignment and assignment-request list/show/count reads).",
-        "Approval and subject reads carry personal data and stay scheduled for later parts with no new commands or raw access approved; so do assignment and request navigation sub-reads (assignment target/accessPackage/assignmentPolicy, request accessPackage/assignment/requestor), the top-level assignment-policy and resource-role-scope lists, catalog navigation reads (accessPackages, resources, resourceScopes, resourceRoles, customWorkflowExtensions), package navigation reads (catalog, incompatible sets), policy navigation reads (questions, custom-extension stages), role/scope link expansion, filterByCurrentUser and additionalAccess functions (parenthesised function segments need their own session-guard binding review), and every beta operation below. Raw $expand review is a separate change: the named assignment and request reads flatten one fixed documented expansion in code, and no user-supplied $expand exists on any route.",
+        "Approval and subject reads carry personal data and stay deferred (out of v1) for later parts with no new commands or raw access approved; so do assignment and request navigation sub-reads (assignment target/accessPackage/assignmentPolicy, request accessPackage/assignment/requestor), the top-level assignment-policy and resource-role-scope lists, catalog navigation reads (accessPackages, resources, resourceScopes, resourceRoles, customWorkflowExtensions), package navigation reads (catalog, incompatible sets), policy navigation reads (questions, custom-extension stages), role/scope link expansion, filterByCurrentUser and additionalAccess functions (parenthesised function segments need their own session-guard binding review), while every beta operation below remains scheduled (never agreed for v1). Raw $expand review is a separate change: the named assignment and request reads flatten one fixed documented expansion in code, and no user-supplied $expand exists on any route.",
         "",
         "| Inventory operation | Disposition | Owning slice | Deferral reason |",
         "|---|---|---|---|",
-        ...deferredEntitlementRows.map(row => `| \`${row.id}\` | ${row.disposition} (deferred) | ${row.owningSlice} | ${row.reason} |`),
+        ...deferredEntitlementRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
         "",
         "## EXT-02 lifecycle-workflows scope decisions",
         "",
         "This change covers the thirty-three v1.0 lifecycle-workflows first-, second-, third- and fourth-part reads above (workflow, workflow-template and task-definition list/show/count reads, the tenant settings show, top-level run and user/subject processing-result list/show/count reads, task-report list/show/count reads with the task and taskDefinition singles, plus run-nested user/subject/task processing-result list/show/count reads).",
-        "Third-level processing results, taskProcessingResults sub-reads under a user or subject result, reprocessed runs, subject sub-reads, workflow tasks, template tasks, versions, insights, deleted items and custom task extensions stay scheduled for follow-up parts with no new commands or raw access approved; so do the six summary functions (the run user/subject summaries plus the four top-level ones), which stay deferred because they need bracketed start/end arguments outside the session-guard function-binding allowlist while the request-path guard cannot change beyond READ_SCOPES additions. Every beta operation and every mutation (no workflow create/update/delete/activate/run, no settings update, no restore) stays out.",
+        "Third-level processing results, taskProcessingResults sub-reads under a user or subject result, reprocessed runs, subject sub-reads, workflow tasks, template tasks, versions, insights, deleted items and custom task extensions stay deferred (out of v1) for follow-up parts with no new commands or raw access approved; so do the six summary functions (the run user/subject summaries plus the four top-level ones), which stay deferred because they need bracketed start/end arguments outside the session-guard function-binding allowlist while the request-path guard cannot change beyond READ_SCOPES additions. Every beta operation below remains scheduled (never agreed for v1) and every mutation (no workflow create/update/delete/activate/run, no settings update, no restore) stays out.",
         "No new commands or raw access are approved for any lifecycle-workflows row outside the thirty-three above.",
         "",
+        "## READ-07 application lookups scope decisions",
+        "",
+        "This change covers seven v1.0 application and service-principal reads above (application and service-principal federated-credential list/show reads with credential metadata only, service-principal app-role-assigned-to list/show reads, and the service-principal app-role-assignment show companion).",
+        "The four parenthesised lookups below carry the deferred disposition (out of v1): the (appId='...') alternate-key forms and the federated-credential (name='...') function forms each need a new session-guard binding, and the request-path guard must stay byte-identical to origin/main apart from READ_SCOPES additions, so no named command or raw access is approved for them until their own guard review lands.", ,
+        "",
+        "| Inventory operation | Disposition | Owning slice | Deferral reason |",
+        "|---|---|---|---|",
+        ...deferredAppLookupRows.map(row => `| \`${row.id}\` | ${row.disposition} | ${row.owningSlice} | ${row.reason} |`),
+        "",
         "## Named writes",
         "",
         "Each write below runs the WRITE-00 mutation coordinator: hand-enabled profile, immutable scope, preview, explicit `--execute`, typed target confirmation for disruptive effects, durable journal intent/outcome and no replay. Inventory dispositions stay discovery-time records until a metadata refresh reviews them; the implemented review lives beside each command.",
@@ -593,7 +685,7 @@ export function capabilityDocument() {
         `Shipped initial writes: ${writeStatus.shipped.length ? writeStatus.shipped.join(", ") : "none"}.`,
         `Pending initial writes: ${writeStatus.pending.length ? writeStatus.pending.join(", ") : "none"}.`,
         "Extended families (EXT-01 through EXT-04) and the full-Entra audit (FULL-01, COMPLETE-01) own the remaining",
-        "scheduled rows; see docs/build-plan.md for their dispatch.",
+        "deferred rows out of v1; see docs/build-plan.md for their dispatch.",
         "",
     ].join("\n");
 }