From 3a09cf0ef210aa0f8fab7f096b7e2b2b4889ddc5 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 12 Sep 2026 16:40:46 +0000
Subject: [PATCH] docs(ado-script): fix garbled text, bundle count, and missing
 ado-proxy/azure-wif-refresh entries

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 docs/ado-script.md | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/docs/ado-script.md b/docs/ado-script.md
index 6d952203..fa1c726e 100644
--- a/docs/ado-script.md
+++ b/docs/ado-script.md
@@ -82,7 +82,7 @@ pipeline** as runtime helpers. Today it produces the following shipped bundles:
   the target tip at depth 1. Cross-org repositories are partitioned into a
   separate trusted credential scope and passed with validated
   organization/project/repository coordinates. The checkout remote must match
-  those coordinates exactly before the Bearer reaches REST or git; mismatch or
+  those coordinates exactly before attempting REST or git; mismatch or
   preparation failure stops the trusted task before Agent/executor execution.
   Same-org per-dir failures remain isolated warnings. The bearer remains
   shell-local or in masked `SYSTEM_ACCESSTOKEN` env and spawned-git
@@ -207,7 +207,7 @@ Resolution is single-pass: nested markers inside an inlined body are not
 re-expanded.
 
 The bundle lives at `import.js` and ships in the same
-`ado-script.zip` release asset as `gate.js` and the ten
+`ado-script.zip` release asset as `gate.js` and the nine
 `exec-context-*.js` bundles listed in the workspace layout, so
 pipelines download it through the same Agent-job asset flow.
 `import.js` uses only the Node standard library, so the ncc bundle is
@@ -654,6 +654,18 @@ scripts/ado-script/
 │   ├── prepare-pr-base/         # prepare-pr-base.js entry point + create-pull-request base-ref fetch/deepen
 │   │   ├── index.ts             # main(): fetch/deepen target branch + set origin/HEAD so mcp.rs finds a diff base
 │   │   └── __tests__/           # unit tests for fetch/deepen + origin/HEAD + benign-failure paths
+│   ├── ado-proxy/               # ado-proxy.js entry point + credential-isolated ADO policy proxy
+│   │   ├── index.ts             # main(): starts the trusted HTTP proxy server
+│   │   ├── server.ts            # HTTP server, request routing
+│   │   ├── policy.ts            # scope/capability policy evaluation
+│   │   ├── scope.ts             # organization-relative current/additional scope index
+│   │   ├── catalog.ts           # versioned deny-by-default read-operation catalog
+│   │   ├── catalog.gen.json     # generated by `cargo run -- export-ado-proxy-catalog`
+│   │   ├── route.ts / upstream.ts / response.ts / headers.ts / token.ts / config.ts / api-version.ts / ca.ts / log.ts
+│   │   └── *.test.ts            # per-module unit tests + `proxy.e2e.test.ts`
+│   ├── azure-wif-refresh/       # azure-wif-refresh.js entry point + renewable WIF assertion sidecar
+│   │   ├── index.ts             # main(): rotate a private token file for user-defined stdio MCP servers
+│   │   └── __tests__/           # unit tests for rotation and isolation behaviour
 │   ├── trigger-e2e/             # test-only: FACT_META gate-spec table + trigger-evaluation E2E scenarios (not a bundle)
 │   │   ├── gate-spec.ts         # FACT_META mirror of Rust Fact::ALL; drift-guarded by export-fact-catalog + fact-catalog.gen.json
 │   │   ├── fact-catalog.gen.json # generated by `cargo run -- export-fact-catalog`; deep-compared by gate-spec.test.ts
@@ -675,7 +687,9 @@ scripts/ado-script/
 ├── conclusion.js                # ncc bundle output (gitignored)
 ├── approval-summary.js          # ncc bundle output (gitignored)
 ├── github-app-token.js          # ncc bundle output (gitignored)
-└── prepare-pr-base.js           # ncc bundle output (gitignored)
+├── prepare-pr-base.js           # ncc bundle output (gitignored)
+├── ado-proxy.js                 # ncc bundle output (gitignored)
+└── azure-wif-refresh.js         # ncc bundle output (gitignored)
 ```
 
 The release workflow (`.github/workflows/release.yml`) runs
@@ -685,8 +699,9 @@ captures every bundle, including `gate.js`, `import.js`,
 `exec-context-manual.js`, `exec-context-pipeline.js`,
 `exec-context-ci-push.js`, `exec-context-workitem.js`,
 `exec-context-schedule.js`, `exec-context-pr-checks.js`,
-`exec-context-repo.js`, `conclusion.js`, `approval-summary.js`, and
-`github-app-token.js` — into the
+`exec-context-repo.js`, `conclusion.js`, `approval-summary.js`,
+`github-app-token.js`, `prepare-pr-base.js`, `ado-proxy.js`, and
+`azure-wif-refresh.js` — into the
 `ado-script.zip` release asset. Pipelines download that asset at
 runtime by URL pinned to the compiler's `CARGO_PKG_VERSION`, verify
 its SHA-256 against the `checksums.txt` asset, then extract.