VALIDATION AND PROVENANCE — 11 NOVEMBER 2026

ORIGINAL TENANT MEASUREMENTS
The real tenant test used .NET 8 with Microsoft.Identity.Web 4.18.0.
Same child and synthetic API: A 403 / B 200 with LAB-001 / C 403.
Lab.Read was absent / present / absent in the obtained resource tokens.
Separate inventories confirmed parent Lab.Read assignments 0/1/0 and zero
direct child assignments. Cleanup was verified and the objects removed.
The article's nine figures retain those original observations.

UPDATED PUBLIC PACKAGE
Target: net10.0. Local SDK: 10.0.404. Runtime: 10.0.15.
Microsoft.Identity.Web and AgentIdentities: 4.18.0.
ASP.NET Core JwtBearer and OpenIdConnect packages: 10.0.15.
Dependency lock file included. Release source builds with no warnings/errors.

LOCAL VALIDATION (NOT A SECOND TENANT RUN)
- API rejects missing and invalid bearer tokens with 401.
- Missing certificate stops locally with exit 1, without token acquisition.
- Invalid configuration and missing arguments return exit 2.
- Invalid callback state returns 400; a callback carrying an error is not
  accepted as success even when admin_consent=True.
- Observation decisions distinguish correct A/B/C outcomes from wrong caller,
  401, continued access after revocation, missing role and missing ticket.
- Inventory fixtures cover A/B/C, two-page role resolution, second-page failure,
  throttling, pagination cycles, off-host links, malformed data and wrong IDs.
- Setup fixtures verify target guards, WhatIf, exact operation/readback and
  refusal to overwrite existing credentials, callback or inheritance.
- Inventory fixtures also confirm an inheritance-query 403 remains incomplete.
- Management-consent fixtures verify AllPrincipals and Principal cleanup,
  preservation of baseline/unrelated scopes, exact new-grant deletion only,
  identity guards, changed-grant aborts, baseline capture/no-overwrite,
  pagination failures, WhatIf and pre-existing cleanup authorization checks.

No new tenant objects, credentials, consent or grants were created for these
local checks. The newly packaged helpers were checked with local Graph fixtures;
their underlying tenant operations follow the original lab and Microsoft docs.
No .NET 10 A/B/C tenant measurement is claimed. Before adapting this package to
a different environment, perform and record that environment's own A/B/C run.
