Foundry Iq

Bounded File CU MI validation

Read only for File MI uncertainty or explicitly requested live validation. Not automatic setup, benchmark or release evidence; live validation needs separate approval.

Evidence and limits

Inspected AzureSearch service commit 2e241af8939a0891836b78278df113dab31a5964:

ContentUnderstandingClientBuilder.cs 33–68 selects MI without a key; AIServicesHelpers.cs 68–126/181 binds Search system MI and Cognitive Services token audience. The MI test was not run; simulated identity fixtures are not deployment proof.

Mapping paths under /Source/Search/Product/SearchAgentCore/:

• DocumentExtraction/FileUploadProcessor.cs 38–43,225–246,308–328,547–571: Standard CU chunks map Content to snippet, file ID to snippet_parent_id, filename to metadata_storage_path. Owner metadata is separate; uid is a chunk key, not the original file ID.

• Models/KnowledgeSources/Dependencies/FileKnowledgeSourceDependencyHandler.cs 81–89,364–368 creates the index through the manager and retains createdResources.index.

• RestClient/SearchRestIndexingPipelineManager.cs 45–54,564–569,664–705,777–805,895–905: File has no language-routed alternate field. snippet is Edm.String, searchable/retrievable true, filterable/sortable/facetable false.

This is a pinned implementation contract, not public documentation or deployed proof. CU may create an analyzer. One image-only PDF; omit embeddingModel and keep disableImageVerbalization: true. No KB/chat is needed.

Local preparation and proposed plan

Use an existing private, owner-controlled directory. Bootstrap primitives validate it without directory creation or ACL rewrites. Private output is optional; canary checkpoints are not cleanup producer receipts.

Resolve <skill-root> to the loaded skill directory; use native local paths.

python "<skill-root>/helpers/file_cu_canary.py" --prepare "<existing-private-directory>"

Local preparation exclusively creates cu-mi-probe.pdf and cu-mi-probe-manifest.json; it never overwrites files or calls Azure. The one-page PDF contains only a generated raster image. Its random CUOCR plus eight-digit marker is not a PDF text layer. Plan/apply inspect the actual multipart producer's names, owner, metadata and headers for contamination. Retain the manifest's marker and SHA-256.

Resolve Search/CU/role IDs from read-only discovery. Do not select financial scope, create roles/accounts, disable local auth, revoke access or probe models to prepare. Missing prerequisites go to the existing native bootstrap owner with concrete separate approval. Both CU local-auth-enabled and disabled accounts are eligible; this typed path requires existing public CU reachability without default-deny ACLs.

Create a UTF-8 canary request using the ordinary File request contract:

{
  "schema_version": "1.0",
  "marker": "<manifest marker>",
  "content_field": "snippet",
  "receipt_directory": "<existing-private-directory>",
  "bounds": {"timeout_seconds":120,"max_requests":60,"max_poll_attempts":3,"poll_interval_seconds":2},
  "file_request": {
    "schema_version":"1.0",
    "api_version":"2026-08-01-preview",
    "endpoint":"https://<selected-search>.search.windows.net",
    "name":"<approved-unique-canary-name>",
    "owner":"<resolved-owner>",
    "local_root":"<prepared-private-directory>",
    "paths":["cu-mi-probe.pdf"],
    "service_tier":"<observed-tier>",
    "extraction_mode":"standard",
    "vectorization":"none",
    "rbac":{"assignments":[{"id":"<observed-caller-assignment>"}]},
    "network":{"posture":"<observed-posture>","evidence":"<readback-reference>"},
    "content_understanding":{
      "endpoint":"https://<selected-cu>.services.ai.azure.com",
      "resource_id":"<exact-CU-ARM-ID>",
      "auth":"system-assigned",
      "managed_identity":{
        "search_resource_id":"<exact-Search-ARM-ID>",
        "role_assignment_id":"<CU-ARM-ID>/providers/Microsoft.Authorization/roleAssignments/<GUID>"
      },
      "prerequisites":{
        "resource":"<capability-region-readback>",
        "configuration":"<selected-CU-processing-evidence>",
        "identity":"<scoped-role-readback>",
        "network":"<CU-reachability-evidence>"
      }
    }
  }
}

Replace placeholders; examples never authorize resources or costs. Canary v1.1 pins this OCR mapping; old/changed plans need fresh approval. content_field must be snippet; there is no override or caller-attested mapping. Missing or mismatched generated schema returns partial, never a fallback field.

python "<skill-root>/helpers/file_cu_canary.py" --plan "<canary-request.json>"

Planning uses GETs/local reads only, with Entra authentication for ARM/Search; no CU key acquisition. It requires exact-name absence, one immutable synthetic PDF, verified Search system identity/CU-scoped Cognitive Services User, and fresh account/API/network bindings. It retains an unapproved private execution_input_ref and displays the source/auth/data/cost scope, bounds and 15-minute expiry.

Separate live approval and execution

Approve the unchanged outer plan fingerprint only after reviewing synthetic content movement, possible cross-region processing, CU/analyzer charges, retained Search data and cleanup ownership. Set its approval.confirmed to true; do not edit nested plans, expiry, bounds or fingerprints.

python "<skill-root>/helpers/file_cu_canary.py" --input "<approved-private-canary-envelope.json>"

The executor composes the File planner's approved v1.2 workflow: one conditional source PUT (If-None-Match: *), one multipart file upload, and bounded GETs. No listKeys, API-key/ENV channel, KB, chat, embeddings, role grants or direct CU calls. It rechecks identity/role/account and synthetic hash before mutation, then verifies upload markers, Standard configuration, source ETag and generated schema. Each of at most three rows per poll must bind the uploaded file's exact ID/path through snippet_parent_id/metadata_storage_path; only snippet proves OCR.

Timeout/request/poll limits stop client work; they are not monetary caps or remote cancellation. Backend work and costs may continue after a timeout. This stricter one-upload approval forbids even queue-429 retry, auth changes or cleanup.

Result, recovery and cleanup

Private checkpoints record start, source/upload HTTP ACK, File result and final result. Status-only ACK is not ingestion/OCR proof; interruptions are non-atomic. Retain checkpoints and inspect exact resources; do not replay. Upload ACK persistence faults are terminal partial results, never ambiguous-upload recovery. Preserve the first diagnostic and earlier writes even if later receipts fail.

keyless-functional-pass requires the indexed OCR marker, not only create/upload. Search principal/role readbacks are recorded separately; backend CU principal attribution and deployment provenance remain unverified without independent telemetry. Do not promote this to a full release or universal MI support claim. Absent OCR, changed bindings, denied access, schema gaps or exhausted bounds return blocked/partial with existing writes and uncertainty, not a success-shaped stub.

Retain source name/ETag/definition digest, file identity/hash, generated index and approval records. Cleanup is separately approved through the cleanup owner, requiring original verified producer receipts, fresh ETags and exact owned scope. Canary checkpoints cannot substitute; without those receipts, retain inventory and stop for scoped recovery review. Do not guess deletion scope, claim ownership from ambiguous CREATE, delete shared Search/CU/roles, or invent producer receipts.

Authorities: failure/conflict/uncertainty only.

File source, Search documents GET.