Implement Stage A: rule engine, validation, audit, and safety gates

Completes 109 of 121 tasks. Every remaining task needs a tenant connection
(T055, T056, T101-T103) or an Azure Automation account (T115-T121).

  354 offline Pester tests      PASS
  Engine purity (Principle IV)  PASS
  Sanitization (SC-013)         PASS  (156 files)
  Graph module loaded in tests  none  (SC-008 holds)

What landed
  - Four-layer configuration validation with stable finding codes, covering
    every VR-002 and VR-003 condition, plus a 23-fixture invalid-config corpus
  - Run loop, audit records (NDJSON through a single sink), summaries,
    reconciliation, and exit codes 0-6
  - Persistence behind a single write-body builder whose result always has
    exactly one key
  - Invoke-PersonaEngine.ps1 and Edit-PersonaEngineConfig.ps1
  - Six docs, two pipelines, traceability matrix, V-5a and sanitization records

Three deviations from tasks.md, each recorded in its status block

  T033 is not in Resolve-UserPersona. evaluationErrorThreshold is run-level
  state and the rule engine is pure; a counter there would break Principle IV.
  It lives in New-PersonaRunCounter and is applied in the run loop.

  A new src/Engine/ layer holds Invoke-PersonaEngineRun. The entry script
  imports the manifest, which requires Microsoft.Graph.Authentication, so a
  loop living only inside it could not run on a machine without the Graph SDK
  and SC-004 could not be proven at all. The entry script is now a thin
  wrapper and what ships is what is tested.

  The invalid-config corpus is generated by a committed script, with the
  generated fixtures committed too, so a reviewer sees the fixture in the diff.

Defects found by running the code, not by reading it

  Group and role ID lists were double-wrapped: @(Get-PersonaGroupIdPage ...)
  around a comma-returned array collapsed every membership list into one
  bogus space-joined entry. That is a silent false non-match, exactly what
  FR-013 exists to prevent.

  A 403 whose status appears only in the exception message parsed as $null,
  which the retry policy treats as a transport error - five requests per
  account against a tenant already refusing. Status extraction now falls back
  to the message text, bounded to 400-599.

  The sanitization scan walked tracked files only, so it covered 34 of 156
  files and none of this phase's code. It now scans untracked non-ignored
  files too, and a negative control confirms it catches a planted leak.

  Test-Json reports one error per violating location, not first-failure-only
  as the V-5a draft claimed. Record and pin corrected.

Enforcement remains blocked on the V-4 security sign-off.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/Safety/WriteBodyRejection.Tests.ps1

@@ -0,0 +1,135 @@
+#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }
+
+<#
+    New-PersonaWriteBody throws for any attribute other than the configured target,
+    and for any target absent from the approved list.
+
+    Throwing rather than correcting is the design. A caller that asked to write the
+    wrong attribute has a defect; silently substituting the right one hides it until
+    the day the substitution is also wrong.
+#>
+
+BeforeAll {
+    $repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+    . (Join-Path $repoRoot 'tests/TestHelpers.ps1')
+    foreach ($file in (Get-PersonaSourceFile -RepoRoot $repoRoot)) { . $file }
+
+    $script:target = 'extension_<EXTENSION-APP-ID>_<PERSONA>'
+    $script:approved = @($script:target)
+}
+
+Describe 'Rejection of a non-target attribute' -Tag 'Safety' {
+
+    It 'refuses <_>' -ForEach @('department', 'jobTitle', 'userPrincipalName', 'accountEnabled', 'onPremisesImmutableId') {
+        { New-PersonaWriteBody -AttributeName $_ -Value 'Employee' `
+                -TargetAttribute $script:target -ApprovedWritableAttributes $script:approved } |
+            Should -Throw -ExpectedMessage '*only the configured target attribute*'
+    }
+
+    It 'refuses a different extension property' {
+        { New-PersonaWriteBody -AttributeName 'extension_<EXTENSION-APP-ID>_<SOMETHING-ELSE>' -Value 'Employee' `
+                -TargetAttribute $script:target -ApprovedWritableAttributes $script:approved } |
+            Should -Throw
+    }
+
+    It 'refuses a casing variant of the target' {
+        # Extension property names are case-sensitive in Graph, so this is a different
+        # attribute, not the same one spelled differently. Accepting it would write to
+        # a property nobody approved.
+        { New-PersonaWriteBody -AttributeName $script:target.ToUpperInvariant() -Value 'Employee' `
+                -TargetAttribute $script:target -ApprovedWritableAttributes $script:approved } |
+            Should -Throw
+    }
+}
+
+Describe 'Rejection of an unapproved target' -Tag 'Safety' {
+
+    It 'refuses a target absent from the approved list' {
+        { New-PersonaWriteBody -AttributeName $script:target -Value 'Employee' `
+                -TargetAttribute $script:target -ApprovedWritableAttributes @('extension_<EXTENSION-APP-ID>_<OTHER>') } |
+            Should -Throw -ExpectedMessage '*not present in approvedWritableAttributes*'
+    }
+
+    It 'refuses when the approved list is empty' {
+        { New-PersonaWriteBody -AttributeName $script:target -Value 'Employee' `
+                -TargetAttribute $script:target -ApprovedWritableAttributes @() } |
+            Should -Throw
+    }
+
+    It 'refuses when the approved list differs only in casing' {
+        { New-PersonaWriteBody -AttributeName $script:target -Value 'Employee' `
+                -TargetAttribute $script:target -ApprovedWritableAttributes @($script:target.ToUpperInvariant()) } |
+            Should -Throw
+    }
+
+    It 'refuses a blank attribute name' {
+        { New-PersonaWriteBody -AttributeName '' -Value 'Employee' `
+                -TargetAttribute $script:target -ApprovedWritableAttributes $script:approved } |
+            Should -Throw
+    }
+}
+
+Describe 'Resolve-TargetAttribute enforces the same rule earlier' -Tag 'Safety' {
+
+    It 'returns the target when it is approved' {
+        $config = [pscustomobject]@{ TargetAttribute = $script:target; ApprovedWritableAttributes = $script:approved }
+
+        Resolve-TargetAttribute -Configuration $config | Should -BeExactly $script:target
+    }
+
+    It 'throws rather than returning null for a blank target' {
+        # A null return would be indistinguishable from a caller forgetting to check,
+        # and that caller writes to whatever name it was holding.
+        $config = [pscustomobject]@{ TargetAttribute = '  '; ApprovedWritableAttributes = $script:approved }
+
+        { Resolve-TargetAttribute -Configuration $config } | Should -Throw -ExpectedMessage '*blank*'
+    }
+
+    It 'throws for an unapproved target' {
+        $config = [pscustomobject]@{ TargetAttribute = 'department'; ApprovedWritableAttributes = $script:approved }
+
+        { Resolve-TargetAttribute -Configuration $config } | Should -Throw
+    }
+}
+
+Describe 'Set-UserPersonaAttribute refuses an unconfirmed call' -Tag 'Safety' {
+
+    It 'throws when -Confirmed is absent' {
+        # Reaching the write adapter without the gate is a control-flow defect. The
+        # only safe response is to refuse, not to infer intent.
+        Mock Invoke-PersonaGraphRequest { @{} }
+
+        { Set-UserPersonaAttribute -UserObjectId '00000000-0000-0000-0000-000000000101' `
+                -AttributeName $script:target -Value 'Employee' `
+                -TargetAttribute $script:target -ApprovedWritableAttributes $script:approved } |
+            Should -Throw -ExpectedMessage '*without a confirmed ShouldProcess gate*'
+
+        Should -Invoke Invoke-PersonaGraphRequest -Times 0 -Exactly
+    }
+
+    It 'returns a failed result rather than throwing when the PATCH fails' {
+        # A failed write is a per-user outcome. Throwing would abandon the rest of the
+        # population over one account.
+        Mock Invoke-PersonaGraphRequest { throw 'Response status code does not indicate success: 403 (Forbidden).' }
+
+        $result = Set-UserPersonaAttribute -UserObjectId '00000000-0000-0000-0000-000000000101' `
+            -AttributeName $script:target -Value 'Employee' -PreviousValue 'Guest' `
+            -TargetAttribute $script:target -ApprovedWritableAttributes $script:approved -Confirmed
+
+        $result.Succeeded | Should -BeFalse
+        $result.FailureReason | Should -Not -BeNullOrEmpty
+        $result.PreviousValue | Should -Be 'Guest'
+    }
+
+    It 'captures previousValue from the value observed before the write' {
+        Mock Invoke-PersonaGraphRequest { @{} }
+
+        $result = Set-UserPersonaAttribute -UserObjectId '00000000-0000-0000-0000-000000000101' `
+            -AttributeName $script:target -Value 'Tier0-Admin' -PreviousValue 'Employee' `
+            -TargetAttribute $script:target -ApprovedWritableAttributes $script:approved -Confirmed
+
+        $result.Succeeded | Should -BeTrue
+        $result.PreviousValue | Should -Be 'Employee'
+        $result.Value | Should -Be 'Tier0-Admin'
+    }
+}