[Knapp-Kevin]

Scope

Eight distinct changed-existing canonical Microsoft Skills packages at immutable upstream 1a63e5f771987a9a13e9f0571823dc1e80741583. The crosswalk was used to avoid repeat/alias exposure. Exact manifest blob + whole package-tree identities, controlled tags, all ten rubric dimensions, dependency and authority findings, explicit not-run security/behavioral states, and individual dispositions are recorded in registry/freshness/microsoft-skills-azure-governance-eight-2026-10-27.json; macro synthesis in docs/reviews/2026-10-27-microsoft-azure-governance-eight-freshness.md.

Frozen changed-existing frontier: 40/76 → 48/76; 28 remain, four removals and latest canonical denominator still unresolved. Five REJECT unchanged, three REFERENCE-ONLY pending complete package/security qualification. This is bounded freshness screening, not eight newly verified/admitted skills.

Key findings

• azure-validate workflow helper records caller-supplied completion markers without independently checking validation output; azure-deploy relies on a validation status handoff.
• Key Vault expiration fallback can disclose secret values; ARG inventory and topology artifacts need scoped data authority.
• Capacity Reservation Groups incur charges even without VM usage; distinct approval needed.
• Preserve stronger risk-acknowledged gates in enterprise planner and staged reliability remediation.
• Upstream Azure plugin telemetry hooks are source-owned and require separate privacy/installation qualification; no repository-owned runtime introduced.

Accounting and security

Zero admissions, source pins, canonical governed companions, scanner receipts, and public inventory changes. Five public surfaces remain 44 first-party / 22 sources / 12 pinned corpora / 721 reviews, with Microsoft 186/186 at the July pin. No external cloud operation, source script, SkillSpector scan, CI, or behavioral test was run. [skip ci] commits; no GitHub Actions introduced. Independent first-party PRs #416, #412, #413 remain separately blocked.

Acceptance

Read both files, confirm exact upstream identities and scores, no public-count mutation, no runtime/CI additions, and merge with expected-head protection if still correct.