v0.10.6 Canary Evidence

This document defines the evidence contract for v0.10.6 operational canaries and records the current sanitized access results. A valid passing canary entry records real commands and sanitized results for install, update, default-workflow, and Azure DevOps checkout validation when an accessible Azure DevOps checkout exists.

Do not record tokens, credential helper output, auth headers, private prompt content, or full environment dumps.

Required canary scope

For each reachable azlin host:

1. Install v0.10.6.
2. Verify the installed binary version and path.
3. Run update from the installed binary.
4. Run default-workflow in a disposable or explicitly selected validation repository.
5. Validate Azure DevOps behavior only when an accessible Azure DevOps checkout is present.
6. Record limitations explicitly when a host or checkout is unavailable.

Standard command set

Set the Node memory preference for workflows that spawn Node-based tools:

export NODE_OPTIONS=--max-old-space-size=32768

Install v0.10.6:

npx --yes --package=git+https://github.com/rysweet/amplihack-rs.git#v0.10.6 -- \
  amplihack install

Verify version and path:

command -v amplihack
amplihack --version

Run update:

amplihack update
amplihack --version

Run default workflow in the selected validation repository:

cd /path/to/validation/repo
amplihack recipe run default-workflow \
  -c task_description="Canary: verify v0.10.6 default workflow" \
  -c repo_path=.

Validate Azure DevOps only when a checkout exists:

cd /path/to/azure-devops/checkout
git remote -v
amplihack recipe run default-workflow \
  -c remote_host_type=azure-devops \
  -c task_description="Canary: verify Azure DevOps workflow routing" \
  -c repo_path=.

Evidence record format

Use one record per host.

### Host: azlin-N

| Field | Value |
| --- | --- |
| Host reachable | yes/no |
| OS | sanitized `uname -a` summary |
| Shell user | non-secret user label |
| `NODE_OPTIONS` | `--max-old-space-size=32768` |
| Install command | command run |
| Install result | pass/fail + short output excerpt |
| Version after install | `amplihack 0.10.6` |
| Update result | pass/fail + short output excerpt |
| Version after update | `amplihack 0.10.6` |
| Default workflow repo | sanitized repo path or repo name |
| Default workflow result | pass/fail + PR/run link if created |
| Azure DevOps checkout | present/absent/blocked |
| Azure DevOps result | pass/fail/not run + reason |
| Issues filed | links |

Current authoring environment observation, not passing canary evidence

This implementation branch was authored from a non-canary environment on 2026-06-07. The following checks were run locally:

test -f ~/.ssh/config && grep -E '^Host[[:space:]]+.*azlin|azlin' ~/.ssh/config || true
command -v amplihack && amplihack --version
find /home/azureuser/src -maxdepth 4 -name .git -type d |
  while read -r gitdir; do
    repo=${gitdir%/.git}
    url=$(git -C "$repo" remote get-url origin 2>/dev/null || true)
    case "$url" in
      *dev.azure.com*|*visualstudio.com*|*ssh.dev.azure.com*) echo "$repo $url" ;;
    esac
  done

Field	Observed value
Host	devo
Installed amplihack --version	amplihack 0.10.0
Current repo origin	https://github.com/rysweet/amplihack-rs.git
azlin aliases in ~/.ssh/config	none found
Azure DevOps checkouts under /home/azureuser/src	none found by remote URL scan

Because this host is not an azlin canary host, has no configured reachable azlin alias, has no accessible Azure DevOps checkout under /home/azureuser/src, and the installed binary is not v0.10.6, these observations are recorded as an availability limitation only. They do not count as a passing v0.10.6 canary.

Pass/fail rules

Check	Pass condition
Install	Command exits zero and amplihack --version reports 0.10.6.
Update	Command exits zero and keeps or moves to the expected version.
Default workflow	Recipe completes or reaches a documented successful terminal state such as no_diff or already_merged.
Azure DevOps checkout	When present, workflow detects or is explicitly told remote_host_type=azure-devops and avoids GitHub-only PR handling.
Limitation record	Unavailable host, missing checkout, or auth limitation is named directly with the blocked command.

Failed canaries require an issue with:

• host label,
• command,
• short sanitized output,
• expected result,
• actual result,
• reproduction steps that do not require secrets.