- .env: STACK_MODE gains aks; Azure settings block; k8s pinned 1.34 from the try-out (T001/T004)
- specs/001-azure-aks-setup: plan.md, tasks.md, research.md, data-model.md, quickstart.md, azure-cli-contract; spec.md clarifications (spot deferred — 3-vCPU regional spot quota) and checklist
- manual try-out: full-shape redeploy in eastus2 (5 pools, all regular per story-owner decision), 9/9 nodes Ready v1.34.10, gp2 StorageClass applied, MC_ node-resource-group name matched the exact prediction; torn down on owner's go — group gone in ~7 min, exact-name MC_ check gone, nothing left
- infra/scripts/cluster/azure-common.sh (T005): STACK_MODE gate naming eks|local|aks, CLI <2.87.0 warning, four pre-checks (sign-in, subscription, location, all three VM sizes), deterministic names <name>-aks-<code> / sre-stack-<code>; happy path + refusal paths verified live against Azure
- make lint: exit 0
- US1+ not started; blocked on gate:plan-approved

…023/T024)

Phase 2b/2c amendments for specs/001-azure-aks-setup:
- pre-check 5: az vm list-usage decides AZURE_POOL_MODE —
  spot when spot room >= 26, else regular when DSv5 >= 22 and
  FSv2 >= 4, else refuse naming the short family (FR-014, AD-002)
- pre-check 2b: RBAC gate — Owner/Contributor at subscription
  scope, /, or parent MG; custom role only with */write or
  Microsoft.ContainerService/* actions; refuse otherwise
- field shapes validated live against the sandbox subscription
  and recorded in research.md (constitution VIII)

T006: infra/azure/gp2-storageclass.yaml — Azure disk CSI mirror of the
local gp2 class (StandardSSD_LRS, WaitForFirstConsumer, Delete, expandable).

T007: infra/scripts/cluster/setup-cluster-aks.sh — idempotent create of
group > cluster+system pool > 4 workload pools (spot flags only when
AZURE_POOL_MODE=spot) > kubeconfig > storageclass; contract \xc2\xa71 shapes,
\xc2\xa73 partial-failure report, no auto-delete. Verified by a real signed-in
run: cluster came up and a rerun skipped every existing resource.

.env: STACK_MODE=aks for the manual run.

T008: setup-cluster.sh STACK_MODE dispatch — aks execs setup-cluster-aks.sh,
eks/local keep the original body, anything else refused (FR-006).
T009: makefile inspect only; make --dry-run proves setup-cluster reaches
the dispatcher (no edit).
T010: verify-cluster-aks.sh — read-only; az aks show state/power, nodepool
list vs data-model $3 table (system pool matched by mode, spot auto-taint
excluded when mode=spot), namespaces FR-008. Live-tested against real Azure
after a real T007 create/delete cycle: not-found path prints correct
mismatches, rc=1.

…T011/T012)

T011: fake-az.sh logs every full az call, answers from sourced scenario
files with research-A7-shaped JSON (nodepool list built from the data-model
$3 table); unknown command exits 127 so contract drift fails loudly.
fake-kubectl.sh records kubectl calls into the same log (apply -> get
succeeds, scenario PRE_SC flag).

T012: run-offline-tests.sh runs the real setup script with the fake az
first on PATH, one fresh sandbox per case; asserts exit codes, call log
content/order, refusal text. All contract $2 US1 scenarios covered:
happy, already-there, resume, not-signed-in, bad-location, missing-vm-size,
spot-fits, spot-short, no-room, partial — 62 checks, 0 failed.

Bugs the tests caught en route: fake-az missing list-locations branch,
PRE_SC ignored by fake-kubectl, partial-report array name mismatch in
setup-cluster-aks.sh (report now lists created/not-created correctly).

setup-cluster-aks.sh: _mark wrote _typeset_done but the report read
_setup_done — partial runs showed only the system pool. One array now.
AD-003: workload manifests need the Azure spot auto-taint toleration
(recorded from the T010 review discussion).

Fake kubectl recorded as part of the harness; scenario files are sourced
shell knobs with answers shaped like research.md A7; unknown az command
fails loudly. Runner rerun: 62 checks, 0 failed; make lint green.

…-checks

az vm list-skus is a known 90 s-2 min CLI stall (client-side filter of a
multi-MB response; azure-cli #31592/#30389). Size check now reads Resource
Skus List (api-version 2021-07-01, $filter=location; the only supported
server-side filter) via az rest and validates the three names locally —
same --all semantics, refusal text unchanged.\xa0Contract \xc2\xa71 row synced
same commit; fake-az grew the rest/ms.skus branch.

Helper pre-checks 2b-5 (RBAC, locations, resource skus, usage) now run as
four parallel az probes from the same sign-in point instead of serially,
then evaluate results in contract order. Cache idea was dropped after
testing (stale risk, no real win).

Measured wall for the helper: ~15-17 s live vs 40-90+ s before.
Offline suite rerun: 62 checks, 0 failed.

…-T016)

cleanup-cluster.sh: with STACK_MODE=aks delete only the generated resource
group ('nothing to clean' exits 0), then check the one exact predicted
MC_ name and warn + exit non-zero if it lingers; eks/local code unchanged.

azure-common.sh: new AZURE_CLEANUP=1 mode keeps sign-in and the generated
names but skips the create-time probes, so teardown is never blocked by a
changed quota, machine size, or role; refusals say 'Nothing was deleted'.

makefile: the aks cleanup-cluster target skips the Amazon-only
destroy-cluster-autoscaler/destroy-yace prerequisites.

Offline tests: cleanup-full, cleanup-empty, and mc-lingers scenarios plus
the MC_LINGERS stand-in knob; the runner asserts exactly one delete, no
broad MC_* search, no other people's MC groups, and no create-time probes
during teardown. bad-provider scenario dropped by story-owner decision;
contract §2 synced and the departure recorded in plan.md. Also ticks T008,
whose dispatch already shipped in 000a22d.

make setup-cluster exec'd setup-cluster-aks.sh via its shebang and failed
with 'Permission denied'; the offline tests call both scripts through bash,
so they never caught it. Found in the live end-to-end run on Azure.

AD-004: Amazon non-regression is proven by the T017 diff survey plus
T018's unchanged make lint, not a live AWS run (no Amazon access is
available to this story); T019 is dropped accordingly.

T025: the CI job running agent/tests/azure/run-offline-tests.sh landed in
3d008cf. Also records T017/T018 completion and the T025 task text.

T020: quickstart Part B evidence collected — all four B1 refusals on a
live signed-in session (logged out, fake subscription, fake location,
STACK_MODE=nonsense on setup and cleanup), B2 real run + no-op rerun +
verify report (SC-004), B3 offline tests, B4 double cleanup with the
exact-name MC_ check gone. .env restored to demo values.

T021: contract audit found one gap — az version is now listed in §1.
T022: offline tests 80/80, make lint clean, research.md 15/15; quickstart
'Done when' list fully checked and T020-T022 ticked.

- azure-common: role assignment list gains --include-inherited so Azure
  returns only assignments effective at the subscription (its scope, root,
  and its real parent management groups); an unrelated management group
  can no longer pass the T024 check.
- Offline proof: rbac-mg-ancestor and rbac-mg-unrelated scenarios; the
  stand-in mirrors Azure and emits a parent-scope row only when the flag
  is present.
- Contract sections 1 and 2 synced; plan departures now log the az rest
  size-check switch, the parallel pre-check probes, and this fix.
- T028/T029: data-model section 1 wording aligned; quickstart B3 gets the
  real offline-test command and expected summary line.

Verified: offline tests 85 checks, 0 failed; make lint clean.

- T030: mark regular-only spot decision superseded (FR-014/AD-002), fix
  Spot-capable column, update quickstart A6, track AD-003 exception to
  Constitution V in plan.md
- T031: re-sync contract §1 (az account show --query id, kubectl get
  namespaces, drop uncompared provisioningState)
- T032: remove unused _azure_refuse helper

Verified: offline tests 85 checks 0 failed; make lint clean.

- T033: the embedded Python now exits with the mismatch count
  (min(fail, 254)) and the shell adds it to failures, so a cluster whose
  pools do not match the chosen mode no longer ends with
  'report: 0 mismatch(es)' and exit 0. Reproduced with a forced
  spot/regular mismatch: four mismatches reported, rc 1.
- T034: kubectl get namespaces failing or returning nothing is now a
  mismatch instead of an invisible empty list, so the FR-008 'cluster is
  still empty' check fails closed. Reproduced with a failing kubectl:
  report 1 mismatch(es), rc 1; happy path stays report 0, rc 0.

Verified: offline tests 85 checks, 0 failed; make lint clean.

No repo script calls az vm list-skus since the size check moved to
az rest (Resource Skus List; plan.md departures). Removing it makes the
stand-in unknown-command rule match contract section 1 again; the SIZES
knob comment now points at the az rest answer.

Verified: offline tests 85 checks, 0 failed; make lint clean.

- T035 dropped by story-owner decision: aks is the default STACK_MODE,
  recorded in plan.md 'Plan Departures' so convergence stops re-flagging
  T001's 'values untouched' line; .env comment states the default.
- T036: quickstart B5 now matches T019/AD-004 (non-regression proven by
  the T017 diff survey plus T018 lint, not a live Amazon run).
- Phase 9 T033/T034 and T037 ticked.

Verified: offline tests 85 checks, 0 failed; make lint clean.

- T039: gp2 StorageClass uses the Azure Disk CSI key skuName
  (disk.csi.azure.com ignores `type`; grounded in the driver's storage
  class parameter table).
- T040: the always-regular system pool is counted in the allowance
  pre-check — DSv5 need 24 (22 workload + 2 system) and the spot branch
  also requires 2 DSv5 vCPU; contract, data-model and plan synced;
  scenario knobs sharpened and a new system-blocked scenario proves the
  refusal.
- T041: verify reads [provisioningState, powerState.code] as a JMESPath
  multiselect list so TSV order is guaranteed (fake-az updated).
- T042: contract section 1 escapes \$filter in the copied az rest URL.
- T043: a reused cluster whose live kubernetesVersion differs from the
  .env pin warns and points at cleanup+setup; it never upgrades in
  place; data-model section 2 records the rule and already-there covers
  the warning.
- T044: plan size pre-check wording -> filtered Microsoft.Compute/skus
  REST call per the T005/T023 speed pass.
- T045: quickstart A5 drops the invalid --mode System argument.
- T046: quickstart A8 applies infra/azure/gp2-storageclass.yaml instead
  of editing the tracked local manifest (US3 keeps it byte-identical).
- T047: personal identifiers replaced with placeholders in research.md;
  the offline suite uses a fake subscription id.
- T048: spec US3 aligns with AD-004 (diff survey + unchanged lint).
- T049: ci.yml permissions/checkout hardening landed as 84a3e96.

Verified: offline tests 90 checks, 0 failed; make lint clean.

Add verify scenarios to the no-cloud suite: fake az gains a
POOL_MUTATIONS knob for malformed pool rows, fake kubectl gains
FAKE_NAMESPACES/KUBECTL_NAMESPACES_FAIL, and the runner asserts
verify-cluster-aks.sh exits non-zero for pool, namespace, and
fail-closed kubectl mismatches while staying read-only. Contract
section 2 lists the new scenarios in the same commit.

- T050: the allowance check reserves room only for missing pools and
  keeps the mode the existing workload pools already use — a full
  regular cluster reruns and verifies at zero free quota, a partial
  spot cluster never flips to regular; scenarios spot-resume,
  spot-resume-short, regular-full-resume, verify-ok-full-quota.
- T051: cleanup tells a confirmed absent group from a failed read
  (non-zero exit, never "Nothing to clean") and checks the one exact
  MC_ name even when the main group is already gone; scenarios
  cleanup-read-error, cleanup-orphan-retry.
- T052: spec US3 states the accepted outcome (Amazon/local files
  unchanged, repository checks pass) without command names; the live
  Amazon substitute stays referenced to AD-004.
- T053: top-level make setup/cleanup route through the aks
  empty-cluster lifecycle only, with a make-time STACK_MODE refusal;
  runner cases make-setup/make-cleanup/make-refusal (no cloud).
- T054: the machine-allowance answer is JSON parsed by field name; the
  stand-in returns the documented alphabetical TSV order for the legacy
  query so an order-dependent reader fails loudly.
- T055: the verifier checks the kubectl context targets our cluster and
  inspects workloads, not just namespace names; scenarios
  verify-workload-extra, verify-wrong-context.
- T056: setup separates confirmed / submitted-but-unconfirmed / not
  created (an async create with unreadable state is never "Not
  created"); a failed delete reports what remains or what could not be
  checked; scenarios partial-async, cleanup-delete-fail.

Contract, data-model, quickstart and tasks sync in the same commit.

Verified: offline tests 175 checks, 0 failed; make lint clean.

Start a fresh agent session at major phase boundaries (specify/clarify and
plan/tasks pairs keep together), support explicit task-range batching for
implement, and require saved requirements, plan departures, updated tasks
and a short handoff before a session ends. Guidance is grounded in the
upstream Spec Kit docs/discussions cited in the section; session changes do
not replace the approval gates.

Add Principle X "Converge to the Agreed Scope, Then Stop": a convergence
task must trace to an approved requirement, success criterion, acceptance
scenario, plan decision, or constitution rule; the spec's Edge Cases list
closes at approval; only CRITICAL/HIGH findings append; one convergence
round per story; tests sized to acceptance criteria. Stops the unbounded
loop that took story 001 through seven convergence phases and roughly 200
offline checks for an agreed MVP.

Compress the file to short-form wording (1,738 -> 1,476 words). Headings,
MUST rules, paths, tags, numbers, and version metadata verified unchanged;
independent semantic diff reported no differences. Version 1.3.0 -> 1.3.1
(PATCH: wording).

Refs github/spec-kit#4269.