policy restriction fix attempt

Author: EMaher

.squad/agents/apimexpert/history.md

@@ -99,22 +99,11 @@ the SDK surface, reference docs, or ad-hoc observation.
 
 **Research output:** `.squad/decisions.md` entry (merged from inbox), full analysis in `specs/sku-upgrade.md`
 
-### 2026-05-19: `policyRestrictions` — `scope` is a path, not an enum
+### 2026-05-19: `policyRestrictions` — `scope` is the full ARM resource ID of a policy document
 
-**Resource:** `Microsoft.ApiManagement/service/policyRestrictions` (api-version `2025-09-01-preview`).
+`Microsoft.ApiManagement/service/policyRestrictions`: `scope` is the ARM resource ID of an existing policy document (e.g. `${apim.id}/policies/policy`, or the equivalent for an api/operation/product policy). Enum-like values (`'All'`, `'Tenant'`, etc.) and relative paths (`'/policies/policy'`) compile but fail at deploy with `"The specified scope is not supported for policy restriction."`
 
-`scope` is a **path to a policy document**, not a free-form enum. `'All'` compiles in Bicep but deployment fails with:
+Inferred from the sibling `SubscriptionContractProperties.scope` in the same definitions file (description says `"Scope like /products/{productId}"` but real examples use full ARM IDs, e.g. `/subscriptions/{sub}/.../service/{name}/products/{id}`). All Microsoft policy-restriction examples use the placeholder string `"Sample Path to the policy document."`, so this is the best inference; verify by deployment. Classic Developer/Premium SKU only.
 
-> ValidationError: "The specified scope is not supported for policy restriction."
-
-Valid values: `Tenant`, `Workspace/{id}`, `Product/{id}`, `Api/{id}`, `Operation/{apiId}/{opId}`.
-
-**SKU:** classic `Developer`/`Premium` only — not `StandardV2`/`PremiumV2`. Guard with `isClassicSku`.
-
-**Refs:**
-- ARM template: <https://learn.microsoft.com/azure/templates/microsoft.apimanagement/service/policyrestrictions>
-- REST API: <https://learn.microsoft.com/rest/api/apimanagement/policy-restriction>
-- Source specs: <https://github.com/Azure/azure-rest-api-specs/tree/main/specification/apimanagement/resource-manager/Microsoft.ApiManagement>
-
-**Fix:** `tests/integration/all-resource-types/source-apim.bicep`: `scope: 'All'` → `scope: 'Tenant'`.
+- <https://learn.microsoft.com/rest/api/apimanagement/policy-restriction>
 

.squad/agents/securityexpert/history.md

@@ -19,4 +19,8 @@
 
 ## Learnings
 
-- When using PowerShell transcript/trace logging, always pass `-UseMinimalHeader` to `Start-Transcript` to prevent machine/host environment details from being written to logs.
+- `Start-Transcript -UseMinimalHeader` keeps machine/host details out of logs.
+- **ARM async-operation URLs** (`Azure-AsyncOperation` / `Location`) include `t/c/s/h` query params that act as short-lived bearer credentials. Regex-mask them. <https://learn.microsoft.com/azure/azure-resource-manager/management/async-operations>
+- **`x-ms-routing-request-id`** carries `REGION:UTC:GUID` — mask the whole value, not just the GUID. <https://learn.microsoft.com/azure/azure-resource-manager/management/request-limits-and-throttling>
+- **PowerShell `Start-Transcript` double-emits native stderr** when paired with `2>&1 | Write-Host`. Either regex-mask in `Protect-LogLine` (so both copies get masked) or redirect the child's stderr to a pipe via `System.Diagnostics.Process` so the transcript never sees the raw line. Both layers together = defense in depth.
+- **Do not mask all GUIDs.** Azure built-in role-definition IDs and ARM template hashes are public constants useful for debugging. Anchor secret regex to the path segment, header name, or query-parameter context that makes the value sensitive.

.squad/agents/testengineer/history.md

@@ -160,3 +160,16 @@
 - History updated with dual-mode package consumption patterns
 
 <!-- Append new learnings here after each session -->
+
+### 2026-05-19: MaskingHelpers — capture child stderr directly
+
+Rewrote [tests/integration/all-resource-types/MaskingHelpers.psm1](tests/integration/all-resource-types/MaskingHelpers.psm1) around `System.Diagnostics.Process` with `RedirectStandardOutput/Error = $true` so the child's raw bytes bypass PowerShell's ErrorRecord promotion and never reach the parent transcript. Per-stream `Start-ThreadJob` readers drain into `ConcurrentQueue[string]`s; main runspace polls every 100 ms and emits through `Protect-LogLine`.
+
+Breaking signature: helpers now take `-Arguments [string[]]` instead of `-Command [scriptblock]`. All four call sites updated.
+
+Gotchas for future PowerShell work:
+
+- `Register-ObjectEvent` Action handlers do not drain reliably while the main runspace is in `Start-Sleep`. Use `Start-ThreadJob` (PS 7+) to bypass the engine event pump.
+- `$x = if ($cond) { [List[T]]::new() }` assigns `$null` — PowerShell enumerates the empty list. Use `$x = $null; if ($cond) { $x = ... }`.
+- `ProcessStartInfo.StandardOutputEncoding/StandardErrorEncoding` default to OEM on Windows; force UTF-8 or `az --debug` output mangles.
+

tests/integration/all-resource-types/expected-structure.json

@@ -292,7 +292,7 @@
           "files": ["policyRestrictionInformation.json"],
           "spotChecks": {
             "policyRestrictionInformation.json": {
-              "properties.scope": "All",
+              "properties.scope": "exists",
               "properties.requireBase": "true"
             }
           }

tests/integration/all-resource-types/source-apim.bicep

@@ -667,7 +667,7 @@ resource policyRestriction 'Microsoft.ApiManagement/service/policyRestrictions@2
   parent: apim
   name: 'src-restriction-ip'
   properties: {
-    scope: 'Tenant'
+    scope: servicePolicy.id
     requireBase: 'true'
   }
 }