[Travis Angevine (trangevi)]

Stack: layer 3 of 3

Depends on #10739 (targeted toolbox deploy/create fix), which depends on #10738 (core Foundry helpers). Base: trangevi/toolbox-targeted-fix at 1d55dbc78d964358cd0fb5e947526e275b49cafe; the exact core commit 143bfc5962613ca79a8b41d208f3246d3762b900 is also in the ancestry.

Split from #10736, using verified source commit 7aa122c50ff86fabe45add0846353231bceb1319. Related to #10718. This is the broader integration layer, deliberately separate from the issue-targeted deployment/create changes in #10739.

Changes

• Migrate agent predeploy to shared core pkg/foundry probe-first access preparation, including grant-attempt, propagation-wait, and confirmed-readiness progress using agents' existing output conventions. Migrate read-only role diagnostics to shared role inspection without automatic grants.
• Remove redundant agent principal/assignment helpers while preserving hosted-only role-assignment-write checks and classic/ABAC ACR checks.
• Extend the existing endpoint-aware toolbox adapter to connection add/remove, skill add/remove, and publish. Pass each command's injected diagnostic writer through access preparation; preserve JSON stdout.
• Validate local files, explicit empty flags (including --from-version=), conflicts, and duplicate skill entries before authentication or mutations.
• Remove the now-unused toolbox-local credential copy and classify azidentity as indirect without a wholesale dependency tidy.
• Update extension README/AGENTS/help snapshots and architecture/contributor documentation. Carry the Tier 2 shared-agent setup scenario's access/readiness contract.

Preserved lower-layer behavior

No core changes in this PR. Keep the optional nil-safe core Progress callback with no terminal printing in core; readiness is reported only after a successful post-grant probe. Keep the endpoint-aware adapter (not a context-only callback), probe-first effective/custom-role access, precise 409 handling, deterministic assignment IDs, bounded readiness, cancellation, strict ARM/endpoint/subscription identity, guest-user user-access credentials and resource-tenant principals, skip precedence, and deployment's fallback tenant behavior. Provisioning, read/delete, local authoring, and bring-your-own endpoint reuse never auto-grant.

The original 32-file cumulative scope was accounted for against the verified source; differences preserve newer lower-layer improvements and main-branch changes, plus injected writers, explicit help, expanded regressions, and removal of the redundant credential file. Lower-layer branches and PRs were not modified.

Release gate

Both extensions still pin core SDK v1.37.0, which lacks these APIs. Release the core helpers in #10738 first, then bump consumer SDK dependencies to that actual release before merging/releasing independently publishable consumers. No invented version, repository-local replace, or committed Go workspace. Local validation used an external session-artifact GOWORK containing this checkout's core, agents, and toolboxes, with GOTOOLCHAIN=go1.26.4.

Validation

• Core: go test ./pkg/foundry/....
• Agents: go test ./internal/project/... ./internal/cmd/... -short and extension build.
• Toolboxes: full go test ./..., expanded write-route/validation/injected-writer regressions, and extension build.
• Targeted go vet, go fix -diff, sequential golangci-lint (zero issues), changed-file spelling, copyright headers, and git diff --check.
• Tier 2 2.00-setup-deploy-shared-agent.yaml: static MCP list_scenarios enumeration via the exact WSL-mounted worktree, plus local YAML shape, tags, known placeholders, fixture, cleanup, and readiness-contract checks. No scenario was executed and no Azure resources were created. Live verification remains cost-gated through the foundry-extension-scenario-orchestrator.
• Optional race checks could not run because CGO is disabled in this Windows environment.

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).
25 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.