GraphKit 0.3.1 stable dependency bridge for TenantPulse

.github/workflows/ci.yml

@@ -93,4 +93,4 @@ jobs:
           if ($resultFiles.Count -gt 1) {
               throw "Multiple NUnit result files produced: $($resultFiles.Name -join ', ')"
           }
-          pwsh -File ./tests/QA/Assert-GateResult.ps1 -ResultPath $resultFiles[0].FullName -MinimumTests 777 -AllowedSkips 0
+          pwsh -File ./tests/QA/Assert-GateResult.ps1 -ResultPath $resultFiles[0].FullName -MinimumTests 791 -AllowedSkips 0

AGENTS.md

@@ -6,6 +6,8 @@ GraphKit is an app-only, multi-tenant Microsoft Graph execution and analysis lay
 
 **Current release status:** GraphKit `0.3.0` is the current immutable release on PSGallery, published at `2026-08-30T04:38:20.12Z`. The 207381-byte public archive SHA-256 is `45319d7cf4f8333697343ccf9c1089c7e04da87a8df62553cbc140089337536d`; reviewed PR head `a0f0e92a054fe2976ca74a844f5de6161e1b8c67` merged to main as `a1b0b8d54c17671761ef5aee017a453b072d1fe9`. PR-head CI run `33292245900` and exact-main CI run `33292580847` each passed 772 tests across all six Windows/macOS/Ubuntu PowerShell 7.4/7.6 jobs. This deterministic and CI evidence is not live service proof. GraphKit `0.2.2` remains an immutable predecessor; its hard SecretManagement contract matters only to hosts pinned to that version. Phases 1-5 are implemented; live verification remains recorded separately per auth mode, descriptor, and operation because implementation is not evidence of service behavior.
 
+GraphKit `0.3.1` is an unpublished maintenance bridge candidate for TenantPulse's IntuneHealthAutomation successor path. It adds only `AppleEnrollmentProfile.ListByToken` and `ManagedDevice.GetBeta` above the stable `0.3.0` package inputs. Their catalog, route, and result-shape behavior is deterministic-test evidence only; no live-service verification or PSGallery publication is claimed. Keep this stable-line bridge separate from the broader R8 development line.
+
 Phase 1 (Core): descriptor catalog and strategy registry, immutable contexts and locked atomic profile store, four token sources with single-flight, owned transport with tenant-proof binding, semantics-aware retry, scoped throttle with AIMD admission (starting conservatively and ramping to the cap), URI security, paging, batch, vault credential resolution, and the MSAL import guard. Phases 2-4 ship `Get-GraphObject` with tab completion, four-state permission analysis, and `Export-GraphResult` with an evidence DTO allowlist.
 
 **Gate 1.8 passed live against the Ivy24 lab tenant on 2026-08-15**: package digest verified, profile resolved SecretStore -> PFX -> MSAL, token acquired, 13 managed devices / 75 mobile apps / 15 device configurations read, and an app assignment applied to a test group and reverted (revert confirmed independently, not from the script's own report).
@@ -27,7 +29,7 @@ Two things about the container are worth knowing before repeating it. The immuta
 
 Run the suite through `./build.ps1 -Tasks test`, never `Invoke-Pester ./tests` directly: the changelog checks are Sampler-generated and depend on build-injected variables, so a bare Pester run reports two false failures.
 
-**Remote CI contract.** `.github/workflows/ci.yml` runs PowerShell 7.4 and 7.6 across Windows, Ubuntu, and macOS. A source revision is CI-verified only when all six matrix jobs pass for that exact SHA; workflow existence or an older successful run is not evidence. The published `0.3.0` evidence is 772 deterministic tests. The post-release development tree requires 777 deterministic tests under `./build.ps1 -Tasks test`, with zero failures, errors, or skips, and `tests/QA/Assert-GateResult.ps1` enforces the same minimum-count floor used by CI and package verification.
+**Remote CI contract.** `.github/workflows/ci.yml` runs PowerShell 7.4 and 7.6 across Windows, Ubuntu, and macOS. A source revision is CI-verified only when all six matrix jobs pass for that exact SHA; workflow existence or an older successful run is not evidence. The published `0.3.0` evidence is 772 deterministic tests. The `0.3.1` maintenance tree requires 791 deterministic tests under `./build.ps1 -Tasks test`, with zero failures, errors, or skips, and its all-file tested-release proof enforces the same minimum-count floor used by CI and package verification.
 
 **Phase 5 (cutover) implementation and Ivy24 verification are complete.** All eight steps ran and were verified against the Ivy24 lab tenant: legacy-caller inventory, `Import-GraphLegacyProfile`, a private versioned package channel with publish/pin/install, a live read through the *installed* package, a GraphKit-backed data plane in IHA behind a default-off flag, reads and a reverted mutating write through it, and a full credential-generation rollover ending in the old generation's revocation. Catalog coverage of IHA's declared surface is 27 of 27 at the API version it actually calls. The 2026-08-15 cutover record preserved two operator actions because active customer repointing would have required the legacy fallback to remain. Current operator status on 2026-08-29 is that no legacy or customer-tenant consumer uses these paths, so that historical contingency is not a `0.3.0` release blocker; the repository does not independently inventory external consumers. Purging deleted directory data remains policy-controlled housekeeping rather than package work. Read `docs/cutover/2026-08-15-phase5-cutover.md` before revisiting the historical cutover.
 

CHANGELOG.md

@@ -5,6 +5,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+GraphKit `0.3.1` is an unpublished maintenance bridge candidate for TenantPulse's
+successor data path. It has not been published to PSGallery and does not replace
+the immutable `0.3.0` release evidence below.
+
+### Added
+
+- `AppleEnrollmentProfile.ListByToken`, a beta paged collection descriptor for Apple enrollment
+  profiles scoped to an enrollment program token.
+- `ManagedDevice.GetBeta`, a beta singleton descriptor that retains the hardware and attestation
+  detail required by TenantPulse evidence collection.
+- Deterministic catalog, public-route, nested-shape, and subtype-preservation tests for both
+  descriptors. No live-service verification is claimed for either new operation.
+
 ## [0.3.0] - 2026-08-30
 
 GraphKit `0.3.0` was published to PSGallery at `2026-08-30T04:38:20.12Z`. The 207381-byte public

README.md

@@ -24,6 +24,11 @@ descriptors described in `CHANGELOG.md`.
 
 GraphKit `0.2.2` is an immutable predecessor. Its hard SecretManagement contract remains relevant
 only for hosts pinned to that version.
+
+GraphKit `0.3.1` is an unpublished maintenance bridge candidate for TenantPulse. It adds the beta
+Apple enrollment-profile collection and beta managed-device singleton required by the
+IntuneHealthAutomation successor path. Those routes are deterministically tested; no live-service
+verification or PSGallery publication is claimed for `0.3.1`.
 
 ## What it provides
 
@@ -44,13 +49,14 @@ GraphKit does not use `Connect-MgGraph` or `Invoke-MgGraphRequest` as its transp
 - PowerShell 7.4 or later
 - `Microsoft.Graph.Authentication` 2.38.1 or later, used as the MSAL delivery dependency
 - `Microsoft.PowerShell.SecretManagement` 1.1.2 or later only when using vault-backed credentials;
-  `0.3.0` validates and imports it at first vault use
+  `0.3.0` and later validate and import it at first vault use
 - A registered SecretManagement vault extension when using stored credentials
 
 Published `0.2.2` still declares SecretManagement as a hard dependency. The pinned installer
-preserves that immutable package contract while treating SecretManagement as opt-in for `0.3.0`.
+preserves that immutable package contract while treating SecretManagement as opt-in for `0.3.0`
+and later.
 Import, help, catalog inspection, managed identity, injected credentials, and Windows certificate-
-store credentials do not require SecretManagement in `0.3.0`. The certificate example below uses
+store credentials do not require SecretManagement in `0.3.0` and later. The certificate example below uses
 a vault reference and therefore exercises the optional vault path.
 
 ## Typical usage