Implement Stage A: rule engine, validation, audit, and safety gates

Completes 109 of 121 tasks. Every remaining task needs a tenant connection
(T055, T056, T101-T103) or an Azure Automation account (T115-T121).

  354 offline Pester tests      PASS
  Engine purity (Principle IV)  PASS
  Sanitization (SC-013)         PASS  (156 files)
  Graph module loaded in tests  none  (SC-008 holds)

What landed
  - Four-layer configuration validation with stable finding codes, covering
    every VR-002 and VR-003 condition, plus a 23-fixture invalid-config corpus
  - Run loop, audit records (NDJSON through a single sink), summaries,
    reconciliation, and exit codes 0-6
  - Persistence behind a single write-body builder whose result always has
    exactly one key
  - Invoke-PersonaEngine.ps1 and Edit-PersonaEngineConfig.ps1
  - Six docs, two pipelines, traceability matrix, V-5a and sanitization records

Three deviations from tasks.md, each recorded in its status block

  T033 is not in Resolve-UserPersona. evaluationErrorThreshold is run-level
  state and the rule engine is pure; a counter there would break Principle IV.
  It lives in New-PersonaRunCounter and is applied in the run loop.

  A new src/Engine/ layer holds Invoke-PersonaEngineRun. The entry script
  imports the manifest, which requires Microsoft.Graph.Authentication, so a
  loop living only inside it could not run on a machine without the Graph SDK
  and SC-004 could not be proven at all. The entry script is now a thin
  wrapper and what ships is what is tested.

  The invalid-config corpus is generated by a committed script, with the
  generated fixtures committed too, so a reviewer sees the fixture in the diff.

Defects found by running the code, not by reading it

  Group and role ID lists were double-wrapped: @(Get-PersonaGroupIdPage ...)
  around a comma-returned array collapsed every membership list into one
  bogus space-joined entry. That is a silent false non-match, exactly what
  FR-013 exists to prevent.

  A 403 whose status appears only in the exception message parsed as $null,
  which the retry policy treats as a transport error - five requests per
  account against a tenant already refusing. Status extraction now falls back
  to the message text, bounded to 400-599.

  The sanitization scan walked tracked files only, so it covered 34 of 156
  files and none of this phase's code. It now scans untracked non-ignored
  files too, and a negative control confirms it catches a planted leak.

  Test-Json reports one error per violating location, not first-failure-only
  as the V-5a draft claimed. Record and pin corrected.

Enforcement remains blocked on the V-4 security sign-off.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/Safety/ShouldProcessGate.Tests.ps1

@@ -0,0 +1,119 @@
+#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }
+
+<#
+    The write gate has exactly one origin: ShouldProcess.
+
+    The tests that matter here are the negative ones. -Debug and -Verbose are the two
+    switches an operator is most likely to reach for believing they make a run safe,
+    and neither does. If that ever changes silently, someone will run an enforcing
+    pass believing they are looking rather than touching.
+#>
+
+BeforeAll {
+    $repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+    . (Join-Path $repoRoot 'tests/TestHelpers.ps1')
+    foreach ($file in (Get-PersonaSourceFile -RepoRoot $repoRoot)) { . $file }
+
+    $script:target = 'extension_<EXTENSION-APP-ID>_<PERSONA>'
+    $script:config = New-TestRuntimeConfiguration -TargetAttribute $target
+    $script:population = @(New-TestPopulation -Count 12 -TargetAttribute $target)
+
+    $script:entryScript = Join-Path $repoRoot 'Invoke-PersonaEngine.ps1'
+}
+
+Describe 'Mode derives from the gate alone' -Tag 'Safety' {
+
+    BeforeEach {
+        Mock Get-PersonaUsers { $script:population }
+        Mock Write-Host { }
+        # Two of these tests raise the verbose and debug preferences deliberately.
+        # Without this the per-user diagnostic lines flood the whole suite's output.
+        Mock Write-Verbose { }
+        Mock Set-UserPersonaAttribute { [pscustomobject]@{ Succeeded = $true } }
+    }
+
+    It 'writes when -Debug is active and the gate allows it' {
+        # -Debug must not imply read-only. An operator who believed otherwise would
+        # reach for it as a safety control and get an enforcing run.
+        $DebugPreference = 'Continue'
+
+        $outcome = Invoke-PersonaEngineRun -Configuration $config -TargetAttribute $target `
+            -Context (New-TestAuditContext -Mode 'Enforce') `
+            -IsEnforcing -Tracing `
+            -ShouldProcessGate { param($t, $d) $true }
+
+        $outcome.Counters.Updated | Should -BeGreaterThan 0
+        Should -Invoke Set-UserPersonaAttribute -Times $outcome.Counters.Updated -Exactly
+    }
+
+    It 'writes when -Verbose is active and the gate allows it' {
+        $VerbosePreference = 'Continue'
+
+        $outcome = Invoke-PersonaEngineRun -Configuration $config -TargetAttribute $target `
+            -Context (New-TestAuditContext -Mode 'Enforce') `
+            -IsEnforcing `
+            -ShouldProcessGate { param($t, $d) $true }
+
+        $outcome.Counters.Updated | Should -BeGreaterThan 0
+    }
+
+    It 'refuses every write when the gate refuses, regardless of IsEnforcing' {
+        # IsEnforcing shapes the Action label; the gate decides the write. A
+        # disagreement between them must resolve in favour of not writing.
+        $outcome = Invoke-PersonaEngineRun -Configuration $config -TargetAttribute $target `
+            -Context (New-TestAuditContext -Mode 'Enforce') `
+            -IsEnforcing `
+            -ShouldProcessGate { param($t, $d) $false }
+
+        Should -Invoke Set-UserPersonaAttribute -Times 0 -Exactly
+        $outcome.Counters.Updated | Should -Be 0
+        $outcome.Counters.WouldUpdate | Should -BeGreaterThan 0
+    }
+
+    It 'honours a gate that allows some accounts and refuses others' {
+        # A per-account gate, as ShouldProcess is when the operator answers "Yes"
+        # rather than "Yes to All". Both buckets must be populated in one run.
+        $script:gateCalls = 0
+
+        $outcome = Invoke-PersonaEngineRun -Configuration $config -TargetAttribute $target `
+            -Context (New-TestAuditContext -Mode 'Enforce') `
+            -IsEnforcing `
+            -ShouldProcessGate { param($t, $d) ($script:gateCalls++ % 2) -eq 0 }
+
+        ($outcome.Counters.Updated + $outcome.Counters.WouldUpdate) | Should -BeGreaterThan 0
+        $outcome.Counters.Updated | Should -BeGreaterThan 0
+        $outcome.Counters.WouldUpdate | Should -BeGreaterThan 0
+    }
+}
+
+Describe 'The entry script declares the safety contract it promises' -Tag 'Safety' {
+
+    BeforeAll {
+        $script:entryText = Get-Content -LiteralPath $script:entryScript -Raw
+    }
+
+    It 'declares SupportsShouldProcess with a High confirm impact' {
+        $entryText | Should -Match 'SupportsShouldProcess\s*=\s*\$true'
+        $entryText | Should -Match "ConfirmImpact\s*=\s*'High'"
+    }
+
+    It 'does not declare a preview or no-write parameter of its own' {
+        # Two sources of truth for the write gate is the defect class Principle III
+        # exists to prevent. -WhatIf is the only approved control.
+        $entryText | Should -Not -Match '\[switch\]\s*\$Preview'
+        $entryText | Should -Not -Match '\[switch\]\s*\$NoWrite'
+        $entryText | Should -Not -Match '\[switch\]\s*\$ReadOnly'
+        $entryText | Should -Not -Match '\[switch\]\s*\$DryRun'
+    }
+
+    It 'derives the mode from ShouldProcess' {
+        $entryText | Should -Match '\$PSCmdlet\.ShouldProcess\('
+    }
+
+    It 'does not derive the mode from DebugPreference or WhatIfPreference' {
+        # Reading the preference variables directly would reintroduce a second source
+        # of truth by the back door.
+        $entryText | Should -Not -Match '\$WhatIfPreference'
+        $entryText | Should -Not -Match 'if\s*\(\s*\$DebugPreference'
+    }
+}