# First authorized Azure trial

On **2026-10-27 (Sydney)** the finite reader protocol was exercised in one disposable resource group in MVP Sub, Australia East. This was an author-authorized, assistant-operated trial, **not an independent reader replay** or proof about other tenants.

The tested environment used two `Standard_B1s` VMs and pinned `Canonical:ubuntu-24_04-lts:server:24.04.202610210`, Azure CLI 2.91.0 and Bicep 0.48.1. Storage public network access, Shared Key and anonymous Blob access were disabled; VM NICs had no public IPs. Private endpoints were approved, and VNet checks found no peering or custom route table. NAT/AzureCloud HTTPS management egress remained an explicit residual path.

## Measured comparisons

Each cell describes three requests in the final retained comparison for that state. R is required, S is the spare container on the same endpoint, C is the separate canary endpoint, and M is the missing object.

| State | R | S | C | M |
|---|---|---|---|---|
| Baseline | Exact marker | Exact marker | Exact marker | BlobNotFound |
| Identity-only | Exact marker | Authorization denied | Authorization denied | BlobNotFound |
| Network-only | Exact marker | Exact marker | Transport timeout | BlobNotFound |
| Combined | Exact marker | Authorization denied | Transport timeout | BlobNotFound |
| Failure, recorded readiness retry | Authorization denied | Authorization denied | Transport timeout | Authorization denied |
| Narrow recovery | Exact marker | Authorization denied | Transport timeout | BlobNotFound |

The complete trial retained **96 read attempts**: initial baseline, identity-only, baseline restoration, network-only, combined, initial failure, one failure readiness retry, and recovery. Three setup writes used the separate seeder. The latest-state validator passed all six named states; this does not erase the earlier failed comparison.

**Important negative result:** after the failure-state role removal was acknowledged at `00:23:55 UTC`, all three R requests at approximately `00:24:18 UTC` still returned the marker. M was denied at `00:26:31 UTC`. A single recorded, no-control-change readiness retry observed R denied at `00:28:09 UTC`. These different requests do not establish an exact revocation time or SLA. Fresh connections and an empty assignment listing did not guarantee immediate denial.

The first deployment also exposed a runner compatibility bug: action Run Command returned combined stdout/stderr under `ProvisioningState/succeeded`, rather than the assumed separate stdout entry. The initial R setup write succeeded, but the runner correctly stopped without claiming a parsed result. That group was deleted; the parser was corrected, regression-tested, and a fresh source-bound run was deployed. Both runs' raw evidence remain private.

## Telemetry and limits

The packaged KQL executed against actual `StorageBlobLogs`. An exact baseline request matched one row with the expected requester, GetBlob operation and HTTP 200. A nonexistent request ID, a different container URI and a different real request ID each returned zero rows. The final bounded collection contained 81 Blob log rows; that is neither a success count nor a completeness guarantee. Management history and effective NSG/route snapshots were also retained.

The network-state snapshot showed the canary deny on the worker NIC and active private endpoint routes. A platform-reported IPv6 outbound deny was also present in effective policy; this was not created by the template and was not a tested IPv6 scenario. A timeout is still not standalone causal proof or a service authorization denial.

The approved aggregate cap was **AUD 50**, with an indicative AUD 20 planning allowance and a 24-hour cleanup deadline. The estimate used dated official retail unit prices plus contingency, not an offer-specific invoice or calculator export. Cost Management initially returned no rows; a subsequent request returned HTTP 429. **Settled attributable cost is unconfirmed**, not zero. Resource-group deletion evidence and the sanitized source hashes are recorded in the accompanying project validation record; billing and independent replay remain release holds.

Do not treat this trial as permission to test production, independent review, a universal containment result or public-release approval. Revalidate region, policy, permissions, prices and current APIs for every new run.