[Knapp-Kevin]

Scope and result

• 8 distinct canonical changed-existing Microsoft packages at exact upstream 1a63e5f771987a9a13e9f0571823dc1e80741583: six Foundry (parent plus five nested first-class identities), Azure AI, and Azure AI Gateway.
• 6 REJECT unchanged / EXTRACT, 2 REFERENCE-ONLY / unverified pending full package/security qualification. No verified/behavioral/security pass claimed.
• Frozen October 10 changed-existing screening 48/76 → 56/76, 20 remain. The four removed paths and latest eligible denominator remain unresolved.
• Registered Microsoft July pin remains 186/186 current-standard at that exact revision, source pin unchanged. 0 admissions / 0 registered denominator delta / 0 third-party companion count delta.
• Updated all five public accounting surfaces in one commit: README, SYSTEM_STATE, CURATION_QUEUE, INDEX, index.json. Counts remain 44 first-party / 22 sources / 12 pinned corpora / 721 third-party reviews.
• Added one narrative macro review and one eight-record structured evidence file.

Macro findings

• Foundry parent mandates installing the microsoft.foundry azd extension without action-specific authorization.
• Source-owned capacity helper constructs Python code with unescaped interpolated JSON/model inputs, a static potential code-injection boundary. Its manifest is unchanged from July but its package tree changed.
• Preset can create projects/deploy billable resources without standalone spend authorization; fine-tuning includes upload, training, deployment and destructive cleanup paths.
• Azure AI Gateway examples retrieve subscription keys and change RBAC/policies; Azure AI routes sensitive audio/document transmission without explicit privacy authorization.
• Preserve useful target-confirmation, quota-check, baseline-evaluation and policy-ordering mechanisms for extraction.

Qualification

Exact manifest blobs, latest full package-tree SHAs, untruncated file counts, 10-dimension individual rubrics, controlled tags, dependencies, privacy/authority, and security_state=not-run/behavioral_validation=not-run recorded. Full package semantic review is not claimed. No cloud commands, upstream scripts, scanner, behavioral tests, CI or repository runtime executed/added.

Lifecycle

PRs #412/#413/#416 remain blocked on external security evidence and independent acceptance. Issue #400 remains open for the remaining 20, four removals, latest eligible denominator, and pin/security decision. No overlap with their first-party branches.

Validation: 7-file one-commit diff, 8 unique canonical records, exact SHA length, rubric totals, passive-only file set, five-surface candidate note consistency; current main verified at 222859cf368fd7be87d4c3e8ec935ef5b05b5c0c before PR creation. [skip ci]