feat: authenticate Exchange PowerShell runtime (Spec 453) #519

ahmido · 2026-07-25T22:44:07Z

ahmido commented

2026-07-25 22:44:07 +00:00

Summary

implements the authenticated, certificate-only Exchange PowerShell runtime contract for Spec 453
keeps credentials and raw process output outside argv, queues, logs, notifications, and OperationRun persistence
preserves the fixed three-command allowlist, trusted provider-operation starter, canonical permission evidence, and default-deny runtime gates
introduces no migration, product-scope promotion, Capture/Evidence consumer, route, or rendered UI change

Validation

Spec453: 119 passed, 568 assertions
Specs 430-437: 286 passed, 1729 assertions
Consumer preflight lane (Specs 436/440/446/447/452): 235 passed, 2352 assertions; 34 expected browser skips
Pint: passed
git diff --check: passed
Fast Feedback: 3031 passed, 21895 assertions, within the Spec budget

Follow-up

T076 remains a separate post-integration, read-only preflight boundary. The Exchange Capture and Evidence Runtime Consumer is not included in this PR.

## Summary - implements the authenticated, certificate-only Exchange PowerShell runtime contract for Spec 453 - keeps credentials and raw process output outside argv, queues, logs, notifications, and OperationRun persistence - preserves the fixed three-command allowlist, trusted provider-operation starter, canonical permission evidence, and default-deny runtime gates - introduces no migration, product-scope promotion, Capture/Evidence consumer, route, or rendered UI change ## Validation - Spec453: 119 passed, 568 assertions - Specs 430-437: 286 passed, 1729 assertions - Consumer preflight lane (Specs 436/440/446/447/452): 235 passed, 2352 assertions; 34 expected browser skips - Pint: passed - git diff --check: passed - Fast Feedback: 3031 passed, 21895 assertions, within the Spec budget ## Follow-up T076 remains a separate post-integration, read-only preflight boundary. The Exchange Capture and Evidence Runtime Consumer is not included in this PR.

ahmido added 6 commits 2026-07-25 22:44:08 +00:00

spec: prepare authenticated Exchange PowerShell runtime contract 8f10b8bebe

feat: authenticate Exchange PowerShell runtime 63111a6a10

test: cover authenticated Exchange PowerShell runtime 9f313b04f6

docs: close Spec 453 implementation f62c894e48

fix: harden Spec 453 authenticated runtime contract f4c7e17d52

merge: integrate Spec 453 session implementation

PR Fast Feedback / fast-feedback (pull_request) Failing after 1m10s

Details

9babbb123b

ahmido merged commit 464a07168d into platform-dev

2026-07-25 22:44:51 +00:00