fix: make boundary diagnostics safe and simplify exception validation

[Paulo Lacerda (placerda)]

Problem and outcome

Correct 23 payload-bearing diagnostic paths without changing error outcomes, and simplify exception-policy approval as explicitly requested by the maintainer.

Type of change

• Bug fix
• Quality/exception policy and developer documentation
• Release preparation

Related backlog item

Azure/agent-landing-zone#695; full-stack Azure acceptance is not complete.

Changes

• All 30 boundaries reviewed: seven unchanged, 23 payload-free corrections. Logging preserves static operation, exception class and terminal code location without dependency text, chains, locals or raw citation URL.
• Replace mandatory independent approval and automatic rejection merely because exception records changed with technical validation.
• Preserve exact-source fingerprints, expiry/stage, fresh passing bound behavior evidence, actual broad-handler matching and individual records. Expiry remains 2027-01-06; no blanket BLE001 suppression or fabricated approval.
• Preserve protected checker/tool/workflow integrity, read-only CI and fail-closed aggregation. Existing branch rulesets remain disabled as found; this PR does not change repository settings.

Evidence

Latest published head: 02e3d0b.

Check	Result
Focused policy regressions	56 passed
Full suite including installed wheel	555 passed
Candidate lint, typing, architecture, exceptions	Zero findings; all 30 records validated
Protected policy integrity	Changed checker still requires incorporation into the base
Remote CI	Running; not claimed green

The candidate checker was exercised against the genuine protected base. Existing remote CI executes the old base checker until this policy implementation is incorporated. Local technical results are not a remotely passing gate.

Contracts, data, security and accessibility

No runtime public API/schema, persistence, authentication/authorization or accessibility behavior changed. Quality governance changes deliberately; policy mutation regression coverage retained.

Cross-repository dependencies

Platform ADR-0020 and quality-contract/data-model updates prepared separately. Operator guidance for safe diagnostics is in Azure/AI-Landing-Zones#149.

Documentation

Developer guidance, agent instructions, changelog and policy regression fixtures updated. Central docs searched; no exception-governance page requires editing.

Residual risks

Independent reviewer requests withdrawn at maintainer request. The proposed policy no longer requires independent exception approval. Incorporating a changed protected evaluator remains a deliberate merge operation, not a self-issued passing check. No merge, bypass, release or deployment performed. Full S1–S7, delegated-user OBO and document-authorization acceptance remain outside this PR.

Checklist

• Tests updated and technical checks executed.
• Documentation updated.
• No unrelated runtime change.
• Draft retained while remote validation and policy incorporation remain outstanding.

[Paulo Lacerda (placerda)]

CI diagnosis for head 0496a7a: unit-tests, container-tests, typing and architecture passed in run 37997815095. The failures are approval-related: lint reports 21 BLE001 sites whose corrected fingerprints are not protected approvals; exceptions reports 23 pending records plus 23 unapproved handlers; policy reports that exception changes require protected review; quality-gate correctly fails because those jobs failed. No independent human approval or reviewer request is recorded. This PR is now draft, as originally intended, not merge-ready. Do not activate candidate records, copy old approvals, change the base, suppress diagnostics, or disable required checks to make it green. Technical fixes and tests are published, but protected adoption and independent review are outstanding.

[Paulo Lacerda (placerda)]

Review requests withdrawn at Paulo (Paulo Lacerda (@placerda)) request. Paulo will perform the approval himself; this statement is not an approval already granted. Technical evidence remains on head 0496a7a: unit/container/typing/architecture pass; protected adoption of 23 changed exception fingerprints remains pending. No gate disabled, approval fabricated, or merge performed.