Add Azure CLI authentication task breakdown AB#1694265

Features/1694265/design-spec.md

@@ -227,3 +227,15 @@ The parent test plan remains the acceptance evidence ledger for all 59 requireme
 ## Implementation Plan
 
 See [implementation-plan.md](implementation-plan.md) for the sequenced workstreams, dependencies, and proposed ADO task breakdown.
+
+## Tasks
+
+| ID | Task | Depends on |
+| ---: | --- | --- |
+| [2216015](task-2216015.md) | Shared executor, authentication coordinator, and interaction policy | None |
+| [2216016](task-2216016.md) | Azure CLI provider and explicit login contract | 2216015 interface alignment |
+| [2216017](task-2216017.md) | Identity binding and atomic auth state | 2216015, 2216016, security decision Q4 |
+| [2216018](task-2216018.md) | Shared chooser and exactly-once continuation | 2216015, 2216017, host decision Q5 |
+| [2216019](task-2216019.md) | Passive/active status, stable errors, and source-local logout | 2216015-2216017 |
+| [2216020](task-2216020.md) | HTTP, SDK bridge, deploy, and batch integration | 2216015-2216019 |
+| [2216021](task-2216021.md) | Release matrix, docs, telemetry, and Skills pilot | 2216015-2216020, rollout/security decisions Q2-Q3 |

Features/1694265/implementation-plan.md

@@ -12,15 +12,15 @@ This plan decomposes the repo-specific [design spec](design-spec.md) into indepe
 
 ## Proposed Task Breakdown
 
-| Slice | Proposed ADO Task | Implementation scope | Primary files | Depends on | Exit criteria |
+| Slice | ADO Task | Implementation scope | Primary files | Depends on | Exit criteria |
 | ---: | --- | --- | --- | --- | --- |
-| 1 | Add shared executor, authentication coordinator, and interaction policy | Unify command-line, auth, REPL, and batch dispatch; classify interaction; resolve effective source; map readiness exits; guarantee exactly-once handler execution | `main.py`, `core/fab_interactive.py`, new coordinator/executor modules, `core/fab_decorators.py` | None | All execution surfaces use one policy; local commands bypass auth; unattended commands do not prompt; readiness errors exit 4 |
-| 2 | Add Azure CLI provider and explicit login contract | Add `azure-identity`; parser flags and conflicts; provider protocol; trusted executable behavior; timeout; sanitization; one-scope allowlist | `pyproject.toml`, `parsers/fab_auth_parser.py`, `commands/auth/fab_auth.py`, new provider modules, `errors/auth.py` | Slice 1 interface alignment | Explicit attended and unattended login paths validate Fabric without invoking Azure CLI login or accepting arbitrary scopes |
-| 3 | Implement identity binding and atomic auth state | Versioned source state; legacy migration; runtime-only environment override; locking; atomic writes; permissions; pinned identity; process cache and concurrency | `core/fab_auth.py`, `core/fab_state_config.py`, `utils/fab_secure_io.py`, new state/cache modules | Slices 1-2; Q4 for principal validation | Failed replacement preserves prior state; fresh tokens match binding; no delegated token reaches disk |
-| 4 | Implement shared chooser and exactly-once continuation | Progressive eligible-user discovery; default defer; alternate direct options; direct-terminal chooser; attended-host abstraction; separate-login fallback | Coordinator, `commands/auth/fab_auth.py`, `utils/fab_ui.py`, host interaction abstraction | Slices 1 and 3; Q5 for host transport | Default Enter defers; cancellation and defer write no state; successful consent invokes one handler/request |
-| 5 | Implement passive/active status, stable errors, and source-local logout | Passive status; `--check`; audience selection; compatibility output; all stable errors; stream separation; capability checks; scoped logout | Auth parser/commands, `core/fab_constant.py`, `errors/auth.py`, output models, `commands/fs/fab_fs_open.py` | Slices 1-3 | Passive status makes zero provider calls; active status checks one audience; logout preserves unrelated and Azure CLI state |
-| 6 | Integrate HTTP, SDK bridge, deploy, and batch paths | Source-aware request acquisition; headless credential factory; deploy preflight before catch-all; claims behavior; fail-fast batch counts; Power BI route compatibility | `client/fab_api_client.py`, `core/fab_msal_bridge.py`, deploy command, `main.py` | Slices 1-5 | No replay; SDK callbacks stay headless; deploy readiness exits 4; Power BI remains mapped to Fabric scope |
-| 7 | Complete release matrix, docs, telemetry, and Skills pilot | Full regression matrix; telemetry safety; docs/examples; feature gates; rollout and rollback evidence; representative Skills runs | Tests, docs, telemetry integration, release configuration | Slices 1-6; Q2-Q3 | All parent test-plan rows have evidence; direct sources regress cleanly; rollout and rollback are approved |
+| 1 | [2216015](task-2216015.md) — Add shared executor, authentication coordinator, and interaction policy | Unify command-line, auth, REPL, and batch dispatch; classify interaction; resolve effective source; map readiness exits; guarantee exactly-once handler execution | `main.py`, `core/fab_interactive.py`, new coordinator/executor modules, `core/fab_decorators.py` | None | All execution surfaces use one policy; local commands bypass auth; unattended commands do not prompt; readiness errors exit 4 |
+| 2 | [2216016](task-2216016.md) — Add Azure CLI provider and explicit login contract | Add `azure-identity`; parser flags and conflicts; provider protocol; trusted executable behavior; timeout; sanitization; one-scope allowlist | `pyproject.toml`, `parsers/fab_auth_parser.py`, `commands/auth/fab_auth.py`, new provider modules, `errors/auth.py` | Slice 1 interface alignment | Explicit attended and unattended login paths validate Fabric without invoking Azure CLI login or accepting arbitrary scopes |
+| 3 | [2216017](task-2216017.md) — Implement identity binding and atomic auth state | Versioned source state; legacy migration; runtime-only environment override; locking; atomic writes; permissions; pinned identity; process cache and concurrency | `core/fab_auth.py`, `core/fab_state_config.py`, `utils/fab_secure_io.py`, new state/cache modules | Slices 1-2; Q4 for principal validation | Failed replacement preserves prior state; fresh tokens match binding; no delegated token reaches disk |
+| 4 | [2216018](task-2216018.md) — Implement shared chooser and exactly-once continuation | Progressive eligible-user discovery; default defer; alternate direct options; direct-terminal chooser; attended-host abstraction; separate-login fallback | Coordinator, `commands/auth/fab_auth.py`, `utils/fab_ui.py`, host interaction abstraction | Slices 1 and 3; Q5 for host transport | Default Enter defers; cancellation and defer write no state; successful consent invokes one handler/request |
+| 5 | [2216019](task-2216019.md) — Implement passive/active status, stable errors, and source-local logout | Passive status; `--check`; audience selection; compatibility output; all stable errors; stream separation; capability checks; scoped logout | Auth parser/commands, `core/fab_constant.py`, `errors/auth.py`, output models, `commands/fs/fab_fs_open.py` | Slices 1-3 | Passive status makes zero provider calls; active status checks one audience; logout preserves unrelated and Azure CLI state |
+| 6 | [2216020](task-2216020.md) — Integrate HTTP, SDK bridge, deploy, and batch paths | Source-aware request acquisition; headless credential factory; deploy preflight before catch-all; claims behavior; fail-fast batch counts; Power BI route compatibility | `client/fab_api_client.py`, `core/fab_msal_bridge.py`, deploy command, `main.py` | Slices 1-5 | No replay; SDK callbacks stay headless; deploy readiness exits 4; Power BI remains mapped to Fabric scope |
+| 7 | [2216021](task-2216021.md) — Complete release matrix, docs, telemetry, and Skills pilot | Full regression matrix; telemetry safety; docs/examples; feature gates; rollout and rollback evidence; representative Skills runs | Tests, docs, telemetry integration, release configuration | Slices 1-6; Q2-Q3 | All parent test-plan rows have evidence; direct sources regress cleanly; rollout and rollback are approved |
 
 ## Dependency Graph
 
@@ -68,4 +68,4 @@ Before creating ADO work items:
 - The ADO organization, project, hierarchy, area path, iteration, and owners must be confirmed.
 - Existing closed Task 1728448 remains decision history and is not reused.
 
-After the readiness gate passes, create the seven work items through the `manage-tasks` workflow so each ADO ID is used to generate its local `task-<ID>.md` file.
+The readiness gate passed and Tasks 2216015-2216021 were created as direct children of ADO User Story 1694265.

Features/1694265/task-2216015.md

@@ -0,0 +1,38 @@
+# Task 2216015 — Add shared executor, authentication coordinator, and interaction policy
+
+## Scope
+
+Implement the Fabric CLI execution foundation for Feature 1694265:
+
+- Route one-shot commands, auth subcommands, REPL commands, and batch commands through one parsed-command executor.
+- Add command classification and a single interaction policy covering direct terminals, attended hosts, JSON, pipes, batch, CI, callbacks, status, and logout.
+- Resolve runtime environment overrides before configured authentication sources.
+- Run authentication readiness before handler dispatch and guarantee exactly-once handler invocation.
+- Map authentication-readiness errors to exit 4 and usage, conflict, and cancellation errors to exit 2.
+- Add focused unit and integration tests for every execution surface.
+
+## Acceptance Criteria
+
+- Auth and non-auth command-line paths use the shared executor.
+- `InteractiveCLI.handle_command` uses the same executor and preserves REPL behavior.
+- Local and passive commands do not acquire tokens.
+- Unattended commands never prompt or probe an unconfigured source.
+- Batch execution fails fast and reports executed, failed, and skipped counts.
+- Successful authentication continuation invokes the parsed handler once.
+- Readiness and usage errors use the documented exit codes and output envelope.
+- Existing command dispatch regression tests pass.
+
+## Dependencies
+
+None. Coordinate the provider interface required by Task 2216016 before merging.
+
+## Design References
+
+- [Shared parsed-command executor](design-spec.md#shared-parsed-command-executor)
+- [Authentication coordinator](design-spec.md#authentication-coordinator)
+- [Errors and output](design-spec.md#errors-and-output)
+- [Implementation plan — Slice 1](implementation-plan.md#proposed-task-breakdown)
+
+## Status
+
+Active

Features/1694265/task-2216016.md

@@ -0,0 +1,38 @@
+# Task 2216016 — Add Azure CLI provider and explicit login contract
+
+## Scope
+
+Implement the explicit Azure CLI authentication source in the Fabric CLI repo:
+
+- Add the `azure-identity` dependency and provider protocol agreed with Task 2216015.
+- Extend `fab auth login` with `--source azure-cli`, `--tenant`, and `--no-prompt` rules.
+- Reject source conflicts and unsupported audiences before invoking Azure Identity.
+- Use `AzureCliCredential` for one allowlisted scope per bounded request.
+- Preserve the four route labels and three existing OAuth scopes.
+- Sanitize Azure Identity and Azure CLI failures into stable Fabric CLI errors.
+- Add parser, provider, process-safety, audience, and timeout tests.
+
+## Acceptance Criteria
+
+- Explicit attended Azure CLI login validates only the Fabric audience.
+- Unattended Azure CLI login requires tenant and no-prompt behavior.
+- The implementation never invokes `az login`, logout, account selection, or tenant selection.
+- Empty, multi-scope, arbitrary, SQL, XMLA, and Kusto audiences fail before the SDK.
+- `powerbi` remains mapped to the Fabric scope.
+- Token acquisition is bounded to 10 seconds and raw process or SDK output is not exposed.
+- Existing direct authentication syntax remains accepted.
+
+## Dependencies
+
+Task 2216015 provider and coordinator interface alignment.
+
+## Design References
+
+- [Provider boundary](design-spec.md#provider-boundary)
+- [Azure CLI provider](design-spec.md#azure-cli-provider)
+- [Command contract](design-spec.md#command-contract)
+- [Implementation plan — Slice 2](implementation-plan.md#proposed-task-breakdown)
+
+## Status
+
+Active

Features/1694265/task-2216017.md

@@ -0,0 +1,41 @@
+# Task 2216017 — Implement identity binding and atomic auth state
+
+## Scope
+
+Implement secure source state and identity binding in the Fabric CLI repo:
+
+- Add the versioned configured-source record and idempotent migration of legacy direct-source state.
+- Refactor environment credentials into runtime-only effective-source overrides.
+- Add interprocess locking and owner-only atomic replacement for `auth.json`.
+- Validate candidate Fabric readiness before committing a replacement source.
+- Pin cloud, canonical tenant, stable principal ID, and principal type.
+- Add process-local token caching keyed by source, tenant, principal, and audience.
+- Coalesce concurrent misses, refresh inside the buffer, and never cache failures.
+- Add migration, permissions, atomicity, drift, concurrency, and rollback tests.
+
+## Acceptance Criteria
+
+- Legacy auth state migrates to source `fabric-cli` without deleting the MSAL cache.
+- Failed validation or replacement preserves the prior source, cache, and unrelated settings.
+- Runtime environment credentials never rewrite configured state.
+- Auth state writes use a lock, atomic replacement, directory mode `0700`, and file mode `0600`.
+- Every fresh token matches the bound cloud, tenant, and principal before service use.
+- Delegated Azure CLI tokens are never persisted.
+- Same-key concurrent cache misses coalesce and failures are not cached.
+- The principal-validation mechanism matches the security-approved Q4 decision.
+
+## Dependencies
+
+- Tasks 2216015 and 2216016.
+- Security decision Q4 before principal-binding implementation is finalized.
+
+## Design References
+
+- [Persistent state](design-spec.md#persistent-state)
+- [Identity binding](design-spec.md#identity-binding)
+- [Azure CLI provider](design-spec.md#azure-cli-provider)
+- [Implementation plan — Slice 3](implementation-plan.md#proposed-task-breakdown)
+
+## Status
+
+Active

Features/1694265/task-2216018.md

@@ -0,0 +1,39 @@
+# Task 2216018 — Implement shared chooser and exactly-once continuation
+
+## Scope
+
+Implement the attended authentication experience in the Fabric CLI repo:
+
+- Add bounded, safe Azure CLI user discovery only when interaction is eligible.
+- Integrate Azure CLI into the existing shared login chooser without removing direct-source choices.
+- Make defer the default and preserve cancellation semantics.
+- Add a host-neutral interaction abstraction for approved attended agents.
+- Support separate-login fallback when a host cannot relay inline interaction.
+- Continue the original parsed handler exactly once after successful consent.
+- Add golden text/JSON and direct-terminal/host behavior tests.
+
+## Acceptance Criteria
+
+- Progressive consent offers Azure CLI only for an eligible user identity.
+- Workload identities are not offered progressively in the first release.
+- Default Enter defers, returns `AuthenticationRequired`, exits 4, and writes no state.
+- Cancellation exits 2 and writes no state.
+- Successful consent validates and stores the binding before one handler/request execution.
+- Unsupported or undeclared hosts remain unattended.
+- Existing browser, service-principal, certificate, federation, and managed-identity choices remain reachable.
+- Attended-host transport follows the approved Q5 decision.
+
+## Dependencies
+
+- Tasks 2216015 and 2216017.
+- Trusted-host interaction decision Q5 for attended-agent integration.
+
+## Design References
+
+- [Authentication coordinator](design-spec.md#authentication-coordinator)
+- [Command contract](design-spec.md#command-contract)
+- [Implementation plan — Slice 4](implementation-plan.md#proposed-task-breakdown)
+
+## Status
+
+Active

Features/1694265/task-2216019.md

@@ -0,0 +1,39 @@
+# Task 2216019 — Implement passive and active status, stable errors, and source-local logout
+
+## Scope
+
+Implement authentication observability and lifecycle behavior in the Fabric CLI repo:
+
+- Make plain `fab auth status` passive and add active `--check --audience`.
+- Preserve the current text ordering and structured envelope while adding source/readiness fields.
+- Retain legacy token keys as `"N/A"` during the deprecation window.
+- Add all documented stable PascalCase errors, remediation, retryability, and exit mappings.
+- Keep prompts and diagnostics off JSON stdout.
+- Replace source-specific user checks with principal-capability checks.
+- Make logout source-local and preserve unrelated Fabric CLI and Azure CLI settings.
+- Add output snapshots, provider-call assertions, error, capability, and logout regression tests.
+
+## Acceptance Criteria
+
+- Plain status performs zero provider calls and exits 0.
+- Active status checks exactly one allowlisted audience and exits 0 when ready or 4 when not ready.
+- Text and JSON output match the compatibility contract without token prefixes.
+- All documented errors expose only safe fields and use the correct exit category.
+- Azure CLI logout clears only Fabric-owned binding and in-process cache.
+- Direct-source logout preserves unrelated CLI configuration.
+- User capabilities work for both direct and Azure CLI user principals.
+
+## Dependencies
+
+Tasks 2216015, 2216016, and 2216017.
+
+## Design References
+
+- [Status and logout](design-spec.md#status-and-logout)
+- [Errors and output](design-spec.md#errors-and-output)
+- [HTTP, SDK, deploy, and user capability integration](design-spec.md#http-sdk-deploy-and-user-capability-integration)
+- [Implementation plan — Slice 5](implementation-plan.md#proposed-task-breakdown)
+
+## Status
+
+Active

Features/1694265/task-2216020.md

@@ -0,0 +1,38 @@
+# Task 2216020 — Integrate HTTP, SDK bridge, deploy, and batch paths
+
+## Scope
+
+Integrate the effective authentication provider across Fabric CLI execution surfaces:
+
+- Route `fab_api_client.do_request` token acquisition through the effective provider without interaction.
+- Generalize the existing public `create_fabric_token_credential` factory for the configured source.
+- Keep SDK callbacks headless and Fabric-scope-only.
+- Preflight Fabric readiness before deploy enters the `fabric-cicd` catch-all.
+- Preserve readiness exit 4 instead of wrapping it as `DeploymentFailed`.
+- Implement claims-challenge cache clearing and `ClaimsChallengeUnsupported` without replay.
+- Complete fail-fast batch counts and Power BI route compatibility.
+- Add HTTP, bridge, deploy, batch, claims, and no-replay tests.
+
+## Acceptance Criteria
+
+- Request-time token acquisition cannot prompt or replay a request.
+- The SDK credential selects the effective provider and accepts only the Fabric scope.
+- Not-ready deploy exits 4 before `fabric-cicd` and is not wrapped as `DeploymentFailed`.
+- Claims challenges clear only the affected process token and do not expose the challenge.
+- Batch execution stops on first failure and reports executed, failed, and skipped counts.
+- `powerbi` continues to resolve to the Fabric scope.
+- Existing HTTP, deploy, and bridge behavior passes regression coverage.
+
+## Dependencies
+
+Tasks 2216015 through 2216019.
+
+## Design References
+
+- [HTTP, SDK, deploy, and user capability integration](design-spec.md#http-sdk-deploy-and-user-capability-integration)
+- [Provider boundary](design-spec.md#provider-boundary)
+- [Implementation plan — Slice 6](implementation-plan.md#proposed-task-breakdown)
+
+## Status
+
+Active