Azure DevOps Service Hook Reviewer — R10 Local Candidate (MC #105993)

Azure DevOps Service Hook Reviewer — R10 Local Candidate (MC #105993) 
 
 Status: Accepted local exact-SHA candidate only. Not deployed. Live rollout remains blocked. 
 
 Candidate 
 
 Commit: ba1714499a5be29d8112fea16e967f15144df821 
 Tree: 5b5ea20fa17623ba1f9cabf34d145711863aa578 
 Worktree: /private/tmp/alai/flowforge-105961-stage1-r5 
 Accepted base: R4 437e64fd54574e6ff7e6a2665d081c3e6125d080 
 
 R10 adds a separately deployable, dedicated Key Vault prerequisite and preserves the main private-endpoint/DNS integration candidate. It also provides an approval-gated helper for exactly three fixed secret child resources through Azure Resource Manager control-plane APIs. No secret value is stored in source, command arguments, environment variables, files, deployment parameters, logs, or evidence. 
 R10 security remediation 
 Every ARM HTTP response path uses a centralized 64 KiB reader. Content-Length is accepted only when, after trimming HTTP SP / HTAB optional whitespace, it is non-empty ASCII decimal digits 0 – 9 . Plus signs, underscores, Unicode digits, CR/LF, embedded whitespace, empty values, comma/duplicate forms, negatives, and over-limit lengths fail closed before reading. Missing and lying headers remain bounded by read(MAX+1) . 
 Transport is direct and fail closed: 
 
 no ambient proxies ( ProxyHandler({}) ) 
 no redirects 
 HTTPS only to exact management.azure.com on the default/443 port 
 standard platform certificate and hostname verification 
 bounded response reads and sanitized failures 
 
 Preserved controls 
 
 account, token, and locked-vault verification before confirmation or secret prompts 
 hidden in-memory secret collection and local input validation 
 minimal nonsecret Azure CLI environment 
 exact secret-name and child-resource-ID metadata binding 
 dedicated RBAC-enabled, purge-protected, public-network-disabled Key Vault 
 private endpoint and privatelink.vaultcore.azure.net DNS integration 
 closed live gate by default 
 immutable image, managed-identity AcrPull , restricted Service Bus, private Table Storage, NAT egress 
 accepted R4/R11 runtime/provider bytes unchanged 
 
 Validation and acceptance 
 
 Python tests: 18/18 
 Node tests: 157/157 
 lint, local IaC validation, both Bicep compiles, offline production audit, diff check, Gitleaks, and byte comparison: PASS 
 Proveo exact-SHA review: PASS 
 Securion exact-SHA audit: PASS 
 Company Mesh P2P: PASS, mesh-msg-d904645a-7404-42dd-8edf-728769280ffe 
 
 Canonical acceptance evidence:
 /Users/makinja/system/evidence/105993/R10-LOCAL-CANDIDATE-ACCEPTANCE.md 
 Operational gate 
 This page does not authorize Azure what-if , prerequisite deployment, role assignment, helper --execute , secret mutation, image push, main deployment, ingress binding, Service Hook creation, provider invocation, PR comments, repository push/merge, or Bilko v1 retirement. 
 If separately approved, the next action is only the dedicated Key Vault prerequisite what-if . Every later action remains a separate gate. Azure DevOps minimum-permission identity and reviewed ingress snapshot/drift semantics remain unresolved rollout prerequisites.