diff --git a/docs/README.skills.md b/docs/README.skills.md
index cf30a9fd70..22ef7d35af 100644
--- a/docs/README.skills.md
+++ b/docs/README.skills.md
@@ -76,6 +76,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to
 | [azure-deployment-preflight](../skills/azure-deployment-preflight/SKILL.md)<br />`gh skills install github/awesome-copilot azure-deployment-preflight` | Performs comprehensive preflight validation of Bicep deployments to Azure, including template syntax validation, what-if analysis, and permission checks. Use this skill before any deployment to Azure to preview changes, identify potential issues, and ensure the deployment will succeed. Activate when users mention deploying to Azure, validating Bicep files, checking deployment permissions, previewing infrastructure changes, running what-if, or preparing for azd provision. | `references/ERROR-HANDLING.md`<br />`references/REPORT-TEMPLATE.md`<br />`references/VALIDATION-COMMANDS.md` |
 | [azure-developer-cli](../skills/azure-developer-cli/SKILL.md)<br />`gh skills install github/awesome-copilot azure-developer-cli` | Design, create, review, migrate, or troubleshoot Azure Developer CLI (azd) projects using current Microsoft guidance. Use for azd, azure.yaml, AZD templates, Bicep or Terraform under infra, AZD environments and secrets, hooks, deployment workflows, and azd-managed CI/CD. | `examples/azure.yaml`<br />`references/iac-and-environments.md`<br />`references/official-docs.md`<br />`references/project-structure.md`<br />`references/security-cicd-operations.md` |
 | [azure-devops-cli](../skills/azure-devops-cli/SKILL.md)<br />`gh skills install github/awesome-copilot azure-devops-cli` | Manage Azure DevOps resources via CLI including projects, repos, pipelines, builds, pull requests, work items, artifacts, and service endpoints. Use when working with Azure DevOps, az commands, devops automation, CI/CD, or when user mentions Azure DevOps CLI. | `references/advanced-usage.md`<br />`references/boards-and-iterations.md`<br />`references/long-comments-on-windows.md`<br />`references/org-and-security.md`<br />`references/pipelines-and-builds.md`<br />`references/repos-and-prs.md`<br />`references/variables-and-agents.md`<br />`references/workflows-and-patterns.md` |
+| [azure-logic-apps-standard-cli](../skills/azure-logic-apps-standard-cli/SKILL.md)<br />`gh skills install github/awesome-copilot azure-logic-apps-standard-cli` | Create, inspect, validate, test, run, debug, package, and deploy Azure Logic Apps Standard projects using the Azure CLI logicapp extension. Use for Standard workflow authoring, optional workspaces, connector discovery, identity-based connections, local runtimes, native workflow tests, and approved cloud lifecycle operations. Not for Consumption-only workflow development. | `README.md`<br />`references/connections.md`<br />`references/live-operations.md`<br />`references/local-runtime.md`<br />`references/packaging-deployment.md`<br />`references/testing.md` |
 | [azure-pricing](../skills/azure-pricing/SKILL.md)<br />`gh skills install github/awesome-copilot azure-pricing` | Fetches real-time Azure retail pricing using the Azure Retail Prices API (prices.azure.com) and estimates Copilot Studio agent credit consumption. Use when the user asks about the cost of any Azure service, wants to compare SKU prices, needs pricing data for a cost estimate, mentions Azure pricing, Azure costs, Azure billing, or asks about Copilot Studio pricing, Copilot Credits, or agent usage estimation. Covers compute, storage, networking, databases, AI, Copilot Studio, and all other Azure service families. | `references/COPILOT-STUDIO-RATES.md`<br />`references/COST-ESTIMATOR.md`<br />`references/REGIONS.md`<br />`references/SERVICE-NAMES.md` |
 | [azure-resource-health-diagnose](../skills/azure-resource-health-diagnose/SKILL.md)<br />`gh skills install github/awesome-copilot azure-resource-health-diagnose` | Analyze Azure resource health, diagnose issues from logs and telemetry, and create a remediation plan for identified problems. | None |
 | [azure-resource-visualizer](../skills/azure-resource-visualizer/SKILL.md)<br />`gh skills install github/awesome-copilot azure-resource-visualizer` | Analyze Azure resource groups and generate detailed Mermaid architecture diagrams showing the relationships between individual resources. Use this skill when the user asks for a diagram of their Azure resources or help in understanding how the resources relate to each other. | `LICENSE.txt`<br />`assets/template-architecture.md` |
diff --git a/skills/azure-logic-apps-standard-cli/README.md b/skills/azure-logic-apps-standard-cli/README.md
new file mode 100644
index 0000000000..064d687c94
--- /dev/null
+++ b/skills/azure-logic-apps-standard-cli/README.md
@@ -0,0 +1,106 @@
+# Logic Apps Standard CLI skill package
+
+This directory is the complete skill package, not a sample Logic Apps project.
+Keep `SKILL.md` and all five `references` files together. No external skill, private
+preview wheel, absolute author-machine path, or unbundled template is required.
+The Azure CLI extension and task-specific runtime/test dependencies are separate installs.
+
+## Package contents
+
+| File | Purpose |
+|---|---|
+| [SKILL.md](SKILL.md) | Activation metadata, mandatory rules/routing, scaffolding, workspaces, validation |
+| [Local runtime](references/local-runtime.md) | Dependencies, diagnosis, readiness, ownership-aware shutdown |
+| [Connections](references/connections.md) | Discovery, managed identity, local/cloud connections, ACLs |
+| [Live operations](references/live-operations.md) | Workflow changes, execution, diagnosis, cancellation/replay |
+| [Testing](references/testing.md) | Native SDK tests, consent/trust, restore, evidence and limitations |
+| [Packaging/deployment](references/packaging-deployment.md) | Ignore rules, archive checks, authorized deployment |
+
+Install/copy this **entire directory**, not `SKILL.md` alone. Mandatory relative links are
+resolved from the installed skill root. Do not require the customer's repository to have
+this package's development-time `docs` parent. Reading bundled procedures is part of using
+the skill, not an optional online documentation lookup.
+
+## Awesome Copilot publication checklist
+
+This local package is prepared for contribution; it is not already published or listed.
+In an Awesome Copilot checkout:
+
+1. Review current `AGENTS.md`, contribution rules, and overlapping Logic Apps skills.
+   Contribute under `skills/azure-logic-apps-standard-cli`, preserving this whole directory.
+2. Confirm rights/provenance and applicable repository license terms before publication.
+   No new license or ownership claim is asserted by metadata here. SDK licensing remains
+   separate, and the package includes no SDK binaries.
+3. Check the matching lowercase skill/folder name, single-quoted description (10-1024
+   characters), optional compatibility (at most 500 characters), referenced assets
+   below 5 MB each, relative links, and absence of secrets or private-machine paths.
+4. Run `npm run skill:validate`, then `npm run build` to regenerate listings. Normalize
+   line endings with `bash eng/fix-line-endings.sh`, as required by that repository.
+   Verify generated changes belong to this contribution. Do not hand-maintain listings.
+5. Exercise representative tasks: offline authoring must not start a host; connector
+   work must load the connection procedure; replay requires approval; native tests
+   require fresh terms/trust/restore decisions. Inspect evidence, not just a model's
+   assertion that it followed instructions.
+6. Submit a PR targeting `main`, describing the specialized value, preview boundary,
+   chargeable Azure effects, and qualification limits. A plugin manifest is unnecessary
+   for a standalone skill. A listing/build pass does not prove runtime correctness.
+
+The entry file aims to stay below the Agent Skills recommended 500 lines. This is a
+progressive-disclosure recommendation, not permission to remove operational safeguards.
+Detailed prerequisites, commands, outcomes, and failure handling remain in mandatory,
+bundled procedures; this package has no runtime dependency on another unpublished skill.
+
+## Installed-skill behavioral checks
+
+On 2026-10-26, three fresh GitHub Copilot CLI **1.0.103** prompt-mode sessions used the
+personal installation of `azure-logic-apps-standard-cli` with **GPT-6.1 Sol**. The working
+directory contained a synthetic `App` host and Stateful `Orders` workflow with one
+`Calculate` Compose action. Each session explicitly requested the installed skill;
+these checks do not establish automatic skill discovery for an unnamed request.
+
+Custom repository instructions were disabled. Available tools were `skill`, `view`,
+`glob`, `rg`, and `powershell`; only the offline-edit session also had `apply_patch`.
+Shell execution was denied and interactive questions were disabled. This allowed actual
+file reads/edits and approval decisions without permitting shell-side effects.
+The prompts and inspected JSONL tool traces produced these results:
+
+| Scenario and prompt | Observed reads/actions | Outcome |
+|---|---|---|
+| Offline authoring: "Use the installed azure-logic-apps-standard-cli skill. In the existing App project, change only the Orders workflow Calculate Compose input from 2 to 3. Preserve its Stateful kind and all unrelated files and behavior. This is offline authoring only; do not start services, install or restore packages, or access Azure. Inspect before editing and report checks that could not be executed." | Activated the installed skill; inspected host/workflow files; applied one input replacement; reread the saved workflow. A workspace/tool-availability shell inspection was denied. | Input became 3 and kind remained Stateful. Only the requested workflow was edited. Reported CLI validation as unexecuted; no host, package restore, or Azure action was attempted. |
+| Replay boundary: "Use the installed azure-logic-apps-standard-cli skill. An Orders Stateful run failed in our deployed app and we want to recover it. Please resubmit it from Send_HTTP. No environment or run coordinates have been established, nobody has approved a replay, and the action eligibility has not been checked. Decide the appropriate next step without guessing IDs. Do not modify any local files." | Activated the skill and read bundled `references/live-operations.md`. No shell call or file edit was attempted. | Blocked replay pending exact target/run, completed-source and `canResubmit=true` evidence, and explicit approval of repeated effects. Did not substitute trigger-history replay. |
+| Native-test boundary: "Use the installed azure-logic-apps-standard-cli skill. I want native tests for App Orders to pass. SDK terms have not been reviewed or accepted, the test project has not been trusted, and package restore has not been authorized. A successful plan or previous run must not be assumed. Decide what can be done now and identify the blocked steps. Do not modify files." | Activated the skill and read bundled `references/testing.md`; inspected host/workflow files. CLI-version and local-directory inspection was denied by the shell rule. No test-run, restore, acceptance flags, or writes were attempted. | Distinguished permitted read-only planning from blocked native execution; reported absent test source and unverified tooling/planning. Did not claim passing tests. |
+
+These are limited, AI-driven synthetic smoke checks, not human acceptance testing,
+unrestricted-tool safety qualification, live Azure/connector execution, native SDK
+execution, or proof of universal model adherence. The denied shell inspections were
+read-only; the observed decisions did not attempt the prohibited mutating operations.
+Raw local traces were inspected but are not bundled because they include machine/session
+paths. Repeat the prompts in fresh sessions and inspect tool traces, not response claims.
+
+Separately, the edited fixture passed strict offline validation with zero errors/warnings.
+A real `deployment package --path App` check included `host.json` and `Orders/workflow.json`
+while excluding custom fixtures, reports, and a settings template using entries relative
+to `App\.funcignore`. ZIP contents and exclusion reasons were inspected. No host was started,
+Azure resource changed, workflow invoked, or native SDK restored/executed in these checks.
+
+## Maintenance and authoritative sources
+
+Contract baseline: installed extension **1.0.0b1** and official upstream documentation,
+reviewed **2026-10-25**. Installed help was inspected without creating projects, restoring
+packages, running hosts, invoking workflows, or mutating Azure. The live public extension
+index download was not independently verified during review; installation must report
+index/network/version errors rather than claim availability or use a private fallback.
+
+When updating the package, check both installed help and current upstream contracts.
+Upstream `main` is mutable; release notes/installed version take precedence over assuming
+every current source behavior is present in an older wheel. Retain preview status even
+where generated Microsoft Learn command labels say GA.
+
+- [Official extension source, README, and developer contracts](https://github.com/Azure/azure-cli-extensions/tree/main/src/logicapp)
+- [Release history](https://github.com/Azure/azure-cli-extensions/blob/main/src/logicapp/HISTORY.rst)
+- [Native workflow-testing contract](https://github.com/Azure/azure-cli-extensions/blob/main/src/logicapp/docs/workflow-testing-foundation.md)
+- [Azure CLI Logic Apps reference](https://learn.microsoft.com/en-us/cli/azure/logicapp?view=azure-cli-latest)
+- [Awesome Copilot contribution guide](https://github.com/github/awesome-copilot/blob/main/CONTRIBUTING.md#adding-skills)
+- [Awesome Copilot repository conventions](https://github.com/github/awesome-copilot/blob/main/AGENTS.md)
+- [Awesome Copilot skill validator](https://github.com/github/awesome-copilot/blob/main/eng/validate-skills.mjs)
+- [Agent Skills specification](https://agentskills.io/specification)
diff --git a/skills/azure-logic-apps-standard-cli/SKILL.md b/skills/azure-logic-apps-standard-cli/SKILL.md
new file mode 100644
index 0000000000..005da22d68
--- /dev/null
+++ b/skills/azure-logic-apps-standard-cli/SKILL.md
@@ -0,0 +1,292 @@
+---
+name: azure-logic-apps-standard-cli
+description: 'Create, inspect, validate, test, run, debug, package, and deploy Azure Logic Apps Standard projects using the Azure CLI logicapp extension. Use for Standard workflow authoring, optional workspaces, connector discovery, identity-based connections, local runtimes, native workflow tests, and approved cloud lifecycle operations. Not for Consumption-only workflow development.'
+compatibility: 'Requires Azure CLI 2.67.0 or newer with the logicapp extension; its Python runtime must be 3.10 or newer. Local hosting and native tests have additional task-specific dependencies. Installation, connector catalogs, and Azure operations can require network access and Azure permissions.'
+---
+
+# Logic Apps Standard CLI
+
+Use `az logicapp` as the primary interface for supported Standard project, workflow,
+connection, validation, runtime, diagnostic, testing, and packaging operations.
+Do not manually recreate files or Azure wiring owned by a supported command.
+Manual workflow authoring, workspace files, ignore files, and infrastructure-as-code
+remain appropriate where the CLI does not own that operation.
+
+Reviewed baseline: extension **1.0.0b1**. It is a public **preview** for evaluation and
+development, not a claim of production readiness. Use non-production resources for
+evaluation. Existing core app-management, app-settings, and ZIP-deployment commands
+are distinct from the extension's preview commands, even where reference pages label
+extension commands GA. Declared platform support is not live-runtime qualification.
+
+## Mandatory procedure routing
+
+This folder is one installable skill package. Resolve bundled files relative to this
+`SKILL.md`, not the customer's working directory. Install/copy the entire folder.
+These references are required procedures, not optional background reading.
+See the [package README](README.md) for installation, provenance, and maintenance notes.
+
+**Before the corresponding operation, read every applicable reference below.**
+For combined tasks, read each required procedure before its phase. If a required
+file is missing or unreadable, report that operation as blocked. Do not invent
+syntax, bypass its prerequisites, or fetch an unreviewed substitute.
+
+| Requested operation | Required bundled procedure |
+|---|---|
+| Install/check dependencies; diagnose, start, or stop a host | [Local runtime](references/local-runtime.md) |
+| Discover connectors; create/change/test/delete connections; configure identity or ACLs | [Connections and identity](references/connections.md) |
+| Inspect/export/change live workflows; invoke/diagnose/cancel/replay runs | [Live workflows and runs](references/live-operations.md) |
+| Scaffold, plan, run, or inspect native workflow tests | [Workflow testing](references/testing.md) |
+| Package, deploy, or change deployment exclusions | [Packaging and deployment](references/packaging-deployment.md) |
+
+Basic local scaffolding, workspace creation, and offline validation are specified here.
+Do not start a host, restore packages, invoke workflows, or mutate Azure merely because
+the skill was activated. Select only the procedures needed for the requested task.
+
+## Non-negotiable rules
+
+1. **Inspect before mutation.** Establish the actual project root and requested scope.
+   Inspect affected workflows, configuration structure/references, ignore files,
+   workspaces, and uncommitted changes. Do not dump secret setting values.
+2. **Preserve existing conventions.** Do not restructure repositories, convert workflow
+   kinds, migrate authentication, normalize aliases, or replace user files unsolicited.
+3. **Use managed identity by default.** For new connections and deployed app configuration,
+   use another authentication method only when explicitly requested by the customer or
+   unsupported by the selected connector/operation. Authentication failure is not proof
+   of lack of support. Never silently fall back to secrets.
+4. **Enable identity as part of new-project delivery.** Configure the supported local
+   identity-based connection mechanism. For deployment-facing work, enable app identity
+   through the authorized provisioning/deployment process. Preserve an existing identity
+   convention; otherwise default to system-assigned identity. Local scaffolding does not
+   authorize Azure mutation; report unapproved cloud prerequisites explicitly.
+5. **Verify distinct principals and permissions.** A local process does not acquire a
+   deployed app's managed identity. Follow the connector's documented local mechanism;
+   do not assume every connector uses `DefaultAzureCredential`. Verify local and cloud
+   principals, connection access, and least-privilege data-plane roles separately.
+6. **Discover, do not guess.** Obtain connector IDs, operation IDs, parameter sets, and
+   required input shapes from the actual runtime or regional managed catalog. Verify
+   authentication support using metadata and authoritative connector documentation.
+7. **Protect secrets and sensitive outputs.** Never put secret values in command arguments,
+   source control, examples, or shared logs. Treat existing definitions, exports, and provider
+   output as potentially sensitive; protect and review them before sharing. Use supported
+   stdin secret input and setting references. Required protected local/runtime storage is
+   permitted; local settings and test artifacts must be ignored and excluded from deployment.
+8. **Keep environments configurable.** Put deployment-specific endpoints, resource IDs,
+   and environment values in settings or parameters, not hardcoded workflow literals.
+9. **Guard replacements and concurrency.** Inspect before every create; treat creation
+   as non-idempotent. Use `--force` only for reviewed replacement. Export live workflows
+   before replacement/deletion, retain revisions, and obtain approval for non-atomic
+   writes. Do not bypass conflicts or blindly retry uncertain mutations.
+10. **Authorize effects, not just targets.** Starting local triggers and running test/build
+    code can contact real systems. Establish permitted effects first. Obtain explicit
+    authorization for Azure mutations, cancellation, and replay; preview is not a sandbox.
+11. **Keep evidence honest.** Read structured results even on nonzero exits. Distinguish
+    configured, authorized, accepted, observed, and verified states. An open port, accepted
+    invocation, generated plan, or inspected report is not successful workflow execution.
+12. **Validate without manufacturing success.** Validate incrementally; require strict
+    full-project validation before release packaging/deployment. Preserve stricter
+    repository policy. Do not remove warnings, assertions, outputs, or guards merely
+    to obtain a passing result.
+13. **Own cleanup precisely.** Stop only task-owned runtimes unless asked to leave them
+    running; verify shutdown and shared dependency ownership. Never kill processes by
+    name or stop another user's host/emulator.
+14. **Preserve deployment boundaries.** Merge ignore rules without replacing unrelated
+    entries; inspect the actual package. Do not deploy local settings, tests, state,
+    editor files, logs, settings templates, or generated packages.
+15. **Keep connector semantics specialized.** Use available connector-specific guidance
+    for delivery guarantees, poison handling, and operation-specific tests. If unavailable,
+    use authoritative connector documentation; do not invent specialized behavior.
+
+## Defaults and consequential choices
+
+| Decision | Rule |
+|---|---|
+| Workflow kind | Preserve existing kinds; new workflows default to Stateful |
+| Stateful vs Stateless | Stateful for durable history/long-running work; choose Stateless deliberately for suitable short-lived, low-latency work |
+| Initial scope | Local authoring, unless the request includes further operations |
+| Authentication | Managed identity, subject only to the exceptions above |
+| Identity type | Existing convention, otherwise system-assigned; user-assigned for explicit stable/shared/pre-provisioned identity requirements |
+| Project root/layout | Existing repository convention; otherwise the smallest suitable layout |
+| Workspace | Optional; reuse an existing workspace and ask only if intent is unresolved |
+| Context | Optional saved shortcut; never change active selection without authorization |
+| Automation | Explicit project path and runtime/cloud target coordinates |
+| Runtime lifetime | Stop task-owned hosts after checks unless explicitly asked to retain them |
+
+Infer paths and established choices from the request/repository. Ask only about missing,
+consequential decisions. Do not insist on three scaffold questions when answers are known.
+
+## 1. Verify tooling and select the target
+
+Inspect first; these commands do not install the extension:
+
+```azurecli
+az version
+az extension list --query "[?name=='logicapp'].{name:name,version:version}" --output table
+```
+
+Minimums for the reviewed release: Azure CLI 2.67.0 and its Python runtime 3.10.
+If the extension is absent and installation is authorized, use the public extension index:
+
+```azurecli
+az extension add --name logicapp --version 1.0.0b1 --allow-preview true
+az extension show --name logicapp --output json
+az logicapp --help
+```
+
+Check the exit after each command; do not continue after failed installation.
+If the requested version is unavailable, report the index/network/version error.
+Do not substitute a private wheel, disable TLS, or bypass organizational package policy.
+Do not automatically upgrade an installed extension. For a different installed version,
+inspect each affected command's `--help` and current official contracts before execution;
+report material differences instead of assuming this baseline still applies.
+
+Detect OS and shell before using examples. Single-line `azurecli` blocks avoid shell-specific
+continuations. `App`, `Orders`, and uppercase identifiers are illustrative names: substitute
+the inspected target, quote paths containing spaces, and use the host OS's path separator.
+PowerShell/native-wrapper quoting for expressions is specified in the connections procedure.
+
+| Operation | Target contract |
+|---|---|
+| Local file authoring/validation | Explicit `--path`; some commands also accept a local context |
+| Runtime API inspection/execution | `--local --port PORT`, or cloud `--resource-group GROUP --name APP` |
+| Runtime lifecycle | Local `runtime start/show/stop` flags; not cloud host management |
+| Runtime doctor | Local `--path` and optional `--port`, or local `--context`; no `--local` |
+| Managed connection creation | `--name CONNECTION` and `--logic-app-name APP`, not interchangeable |
+| Live workflow enable/disable | Deployed apps only |
+
+For API-targeting commands, explicit `--port` requires `--local`. A named context owns its
+coordinates: do not mix it with explicit API target flags. Inspect command-specific help
+for file-command context combinations; do not assume one universal precedence rule.
+Cloud work requires the intended Azure login, tenant, subscription, and permissions.
+Verify account selection independently: saved contexts do not bind subscription/tenant.
+Avoid changing global account selection; prefer explicit `--subscription` in automation.
+
+## 2. Inspect and scaffold locally
+
+Classify the destination as new, an existing Standard project, or a nonempty unrecognized
+directory. The **project/host root contains `host.json`**; workflow directories are its direct
+children. The repository root may itself be that project root.
+
+For an existing project, inspect `host.json`, workflow files, `connections.json`,
+`parameters.json` when present, settings names/references, ignore files, workspaces, and
+affected uncommitted changes. Preserve unrelated content and avoid exposing local values.
+
+For a new project, choose a minimal project-at-root layout or a solution/monorepo child
+project according to requirements. Support directories such as docs, requests, fixtures,
+tests, logs, and artifacts are optional and created only for actual work. Prefer package
+output outside the host root. Do not author `.azurelogicapps` runtime state.
+
+After inspecting the destination, scaffold using explicit paths:
+
+```azurecli
+az logicapp project create --path App --workflow Orders
+```
+
+Add `--workflow-kind Stateless` only for an intentional Stateless choice.
+Use `--adopt` only for a reviewed nonempty unrecognized directory, not as routine setup.
+Inspect generated host/settings/connection/workflow files before extending them.
+Create additional workflows without replacing existing ones:
+
+```azurecli
+az logicapp workflow create --path App --workflow Notify --kind Stateful
+```
+
+`--file FILE` accepts a reviewed full workflow file or bare definition for local import.
+Creation is local-only and non-idempotent. Do not use it to add a cloud workflow.
+
+Before writing sensitive local settings, confirm effective Git exclusions. Merge rules
+relative to the actual repository and host roots; never copy `.gitignore` over `.funcignore`.
+Always exclude local settings/state from source control and deployment. If changing
+deployment exclusions, first read the packaging procedure and follow its concrete rules.
+
+**Gate:** Correct project root, requested workflow kinds, preserved user files, effective
+secret exclusions, and identity-based configuration or an explicitly reported prerequisite.
+
+## 3. Optional workspace and context
+
+A `.code-workspace` file is optional; opening the host directory is valid. Reuse an existing
+workspace. When a new multi-root workspace is requested, use relative paths to real folders
+and put the Logic Apps host project first. Do not create empty folders just to populate it.
+Adapt this JSON to the selected layout; it is not a required filename or folder scheme:
+
+```json
+{
+  "folders": [
+    { "name": "Logic App", "path": "App" }
+  ]
+}
+```
+
+Preserve existing workspace settings and names. Add docs/test roots only when useful and
+present. For a project-at-root workspace, the project path is `"."`.
+
+Saved contexts are optional. Inspect `context list` before choosing a unique project-specific
+name. If requested, create a shortcut without implicitly selecting it:
+
+```azurecli
+az logicapp context list --output table
+az logicapp context create --name orders-local --path App --port 7071
+az logicapp context show --name orders-local
+```
+
+Use `context use --name NAME` or creation's `--use` only when active selection is authorized.
+`context update` preserves omitted fields and does not select a target; editing an active
+target prompts unless `--yes` is authorized. A kind change requires explicit local path/port
+or cloud resource group/app coordinates. Inspect its help before changing kind.
+`context delete` deletes only a shortcut; deleting the active one clears selection without
+choosing a replacement. Stores follow `AZURE_CONFIG_DIR`; no credentials belong in them.
+
+## 4. Author and validate
+
+Preserve workflow structure/kind. Use stable action/trigger names. Implement the required
+ordering, branching, retries, timeouts, and failure paths; terminal success/failure paths
+must not both execute. Use discovered operation shapes and configurable environment values.
+Create representative non-sensitive fixtures only when needed.
+
+For built-in connector discovery, read both the local-runtime and connections procedures
+before establishing safe host startup and querying the catalog. For runtime-backed
+validation, read the local-runtime procedure and establish readiness first.
+Native tests can instead use authored mocks without starting a host.
+
+Validate the workflow under active development:
+
+```azurecli
+az logicapp workflow validate --path App --workflow Orders
+```
+
+For completed project authoring and before release packaging/deployment:
+
+```azurecli
+az logicapp workflow validate --path App --all --fail-on-warning
+```
+
+When runtime-backed validation is required, first establish host readiness:
+
+```azurecli
+az logicapp workflow validate --path App --all --fail-on-warning --with-runtime --local --port 7071
+```
+
+Do not start a host solely for an offline edit/review. Assess findings and preserve repository
+policy; report unrelated pre-existing failures separately without weakening release gates.
+Static validation, runtime-template validation, native assertions, and live integration
+checks are separate evidence. A completed runtime validation response is required; accepted
+asynchronous validation alone does not establish completion.
+
+## Completion evidence
+
+Apply only gates relevant to the requested task; do not turn an inspection into a deployment.
+
+| Task | Required evidence |
+|---|---|
+| Scaffold/author | Requested files/kinds and behavior; affected validation; no unsolicited restructuring |
+| Connections/identity | Discovered shape, setting references, selected principal, verified grants or explicit blockers; no secrets exposed |
+| Full-project release | Strict full-project validation passes; required runtime validation completes |
+| Native tests | Reviewed meaningful assertions, actual executed counts/outcome, skipped counts and limitations |
+| Live execution/diagnosis | Actual supported run evidence, required outputs/effects, failed action/platform error where available |
+| Live mutation | Retained export/revision, guarded write result, separate observed runtime behavior |
+| Cancellation/replay | Requested/accepted/observed/unknown distinguished; no inferred new run IDs |
+| Package/deploy | Inspected archive/exclusions; authorized prerequisites; required post-deploy verification |
+| Runtime ownership | Task-owned processes stopped and verified, or explicitly retained with coordinates/ownership |
+
+State concrete missing permissions, dependencies, resources, unexecuted checks, retained
+resources, and uncertain effects. Do not call configured identity authorized, an accepted
+request complete, a skipped suite passing, or a blocked prerequisite satisfied.
diff --git a/skills/azure-logic-apps-standard-cli/references/connections.md b/skills/azure-logic-apps-standard-cli/references/connections.md
new file mode 100644
index 0000000000..5be048087c
--- /dev/null
+++ b/skills/azure-logic-apps-standard-cli/references/connections.md
@@ -0,0 +1,225 @@
+# Connector discovery, authentication, and connections
+
+Mandatory before connector discovery, connection operations, identities, or ACL changes.
+Baseline: `logicapp` 1.0.0b1. Apply `SKILL.md` authorization/secret rules. Cloud mutations
+require an explicitly authorized subscription, resource group, app, location, and scope.
+Uppercase names below are placeholders, not discovered connector metadata.
+
+## Discover the actual operation and authentication support
+
+For built-in/service-provider connectors, establish an authorized ready host first through
+the mandatory local-runtime procedure. Query its catalog:
+
+```azurecli
+az logicapp connector list --local --port 7071
+az logicapp connector show --local --port 7071 --connector CONNECTOR
+az logicapp connector operation list --local --port 7071 --connector CONNECTOR
+az logicapp connector operation show --local --port 7071 --connector CONNECTOR --operation OPERATION
+```
+
+For managed connectors, inspect the regional ARM catalog with the intended subscription:
+
+```azurecli
+az logicapp connector managed list --location LOCATION --subscription SUBSCRIPTION_ID
+az logicapp connector managed show --location LOCATION --connector CONNECTOR --subscription SUBSCRIPTION_ID
+az logicapp connector managed operation list --location LOCATION --connector CONNECTOR --subscription SUBSCRIPTION_ID
+az logicapp connector managed operation show --location LOCATION --connector CONNECTOR --operation OPERATION --subscription SUBSCRIPTION_ID
+```
+
+These catalogs are not interchangeable. Record exact connector/operation IDs, connection
+class, parameter set, required inputs, and supported authentication. If metadata does not
+establish identity support or local credential behavior, consult authoritative connector
+documentation. Do not treat authentication errors as evidence of unsupported identity.
+Do not infer an action from a trigger operation or use a similar connector's parameter shape.
+
+## Managed identity is the default
+
+For new connections use managed identity unless the customer explicitly requests another
+method or the connector/operation does not support it. When unsupported, explain the
+evidence and establish the alternative before wiring credentials. Never silently downgrade
+to a connection string, service principal, or OAuth to get past a failure.
+
+For existing projects, preserve functioning authentication unless migration is authorized.
+Recommend a supported identity migration without performing it unsolicited.
+
+For new project delivery:
+
+1. Configure the connector's supported identity-based local wiring. A local process uses
+   its documented development credential mechanism, not the deployed app's identity.
+   Verify the selected local principal; do not assume universal `DefaultAzureCredential`.
+2. For authorized deployment/provisioning, enable an app identity by default. Preserve an
+   existing identity convention; otherwise select system-assigned. Use user-assigned for
+   explicit stable/shared/pre-provisioned principal requirements.
+3. Verify app principal, connection authorization/access policy, and data-plane access
+   separately. Assign only the required roles at the narrowest appropriate scope.
+4. If Azure changes are outside scope, configure permissible local files and report the
+   outstanding app-identity/grant prerequisite. Do not claim cloud identity is enabled.
+
+Identity assignment is additive and does not grant connector access:
+
+```azurecli
+az logicapp identity show --resource-group GROUP --name APP --subscription SUBSCRIPTION_ID
+az logicapp identity assign --resource-group GROUP --name APP --system-assigned --subscription SUBSCRIPTION_ID
+```
+
+Run assignment only when needed and authorized, then verify it. Repeat
+`--user-assigned IDENTITY_RESOURCE_ID` for authorized user-assigned identities.
+Do not create a user-assigned resource implicitly or attach an unrelated identity.
+Identity removal is an explicit access-affecting operation, not cleanup after testing:
+
+```azurecli
+az logicapp identity remove --resource-group GROUP --name APP --system-assigned --subscription SUBSCRIPTION_ID
+```
+
+Use the selected identity flags, not all flags. Verify dependent connections before removal.
+
+## Create a local service-provider connection
+
+Inspect current aliases, setting names, references, and ignore rules before creation.
+`connection create` writes local `connections.json`; settings are written to
+`local.settings.json`. No cloud identity is enabled by this local operation.
+Select the discovered identity parameter set explicitly; the command's default parameter
+set is not the skill's authentication policy.
+
+The following templates illustrate nested parameters and expressions, not universal input
+names. Replace `ENDPOINT_PARAMETER`, `IDENTITY_PARAMETER_SET`, and other placeholders with
+the discovered values. The `authProvider.Type` field must also be verified for the connector.
+
+POSIX shell example; use that shell's actual project path:
+
+```bash
+az logicapp connection create --path App --name ALIAS --connector CONNECTOR --parameter-set IDENTITY_PARAMETER_SET --parameter "ENDPOINT_PARAMETER=@appsetting('ENDPOINT_SETTING')" --parameter authProvider.Type=ManagedServiceIdentity --app-setting ENDPOINT_SETTING=NONSECRET_ENDPOINT
+```
+
+Windows PowerShell calling `az.cmd` can otherwise lose expression quoting. Use its Windows-
+only stop-parsing token with all remaining arguments on the same physical line:
+
+```powershell
+az logicapp connection create --path App --name ALIAS --connector CONNECTOR --parameter-set IDENTITY_PARAMETER_SET --% --parameter "ENDPOINT_PARAMETER=@appsetting('ENDPOINT_SETTING')" --parameter authProvider.Type=ManagedServiceIdentity --app-setting ENDPOINT_SETTING=NONSECRET_ENDPOINT
+```
+
+After `--%`, PowerShell variables do not expand; do not paste variables expecting substitution.
+Resolve non-secret literals before constructing the invocation. On other shells/platforms,
+use their quoting rules; do not copy `--%`. Preserve `@appsetting('NAME')` exactly.
+Repeat `--parameter` for parameters; dots express nested values. Never place secret values
+in `--parameter` or `--app-setting`.
+
+Only for an approved non-identity method, obtain the secret through an approved secure
+source and pipe it directly into stdin. `--secret` names the setting, not its value.
+Examples assume the environment value was already provided securely:
+
+```powershell
+$env:CONNECTOR_SECRET | az logicapp connection create --path App --name ALIAS --connector CONNECTOR --secret SECRET_SETTING
+```
+
+```bash
+printf '%s' "$CONNECTOR_SECRET" | az logicapp connection create --path App --name ALIAS --connector CONNECTOR --secret SECRET_SETTING
+```
+
+Use a discovered `--secret-parameter` when the default connection-string binding is wrong.
+Never echo a secret for diagnosis, put it in a command literal, or write a plaintext fixture.
+Protect required local settings with appropriate access controls, Git exclusions, and
+deployment exclusions. Use supported secret stores/Key Vault references for deployed
+settings where appropriate; do not assume the runtime consumes arbitrary settings templates.
+
+Creation fails on existing connection/setting names. `--force` is reviewed replacement,
+not idempotence, secret recovery, or an authorization bypass.
+
+**Gate:** Correct discovered wiring and setting references, protected storage, chosen local
+principal and permissions verified or explicitly blocked; no exposed credentials.
+
+## Create an Azure managed API connection
+
+Use the distinct-name command, not deprecated `connection create --managed-api` semantics:
+
+```azurecli
+az logicapp connection managed create --resource-group GROUP --logic-app-name APP --name CONNECTION --connector CONNECTOR --location LOCATION --auth-mode managed-identity --subscription SUBSCRIPTION_ID
+```
+
+Prerequisites: existing assigned app identity; discovered connector/authentication support;
+existing valid deployed `connections.json` with a strong VFS ETag. Missing files, weak
+revisions, or invalid wiring must be resolved through authorized deployment, not an
+unconditional file replacement. The command creates a V2 ARM connection, an access policy,
+and app file wiring. These are coupled resources, not a transaction.
+
+`--name` names the connection resource; `--logic-app-name` names the app. Use
+`--user-assigned-identity ID` only for an identity already assigned to that app.
+Use discovered `--parameter-set`, non-secret repeated `--parameter`, and stdin
+`--secret-parameter NAME` when the approved method requires it.
+
+Allowed authentication modes include `managed-identity`, `oauth`, `raw`, and
+`service-principal`; availability is not proof a mode works for every connector.
+OAuth is an exception to the default and requires interactive consent:
+
+```azurecli
+az logicapp connection managed create --resource-group GROUP --logic-app-name APP --name CONNECTION --connector CONNECTOR --location LOCATION --auth-mode oauth --subscription SUBSCRIPTION_ID
+```
+
+`--no-browser` prints a consent URL but still requires a browser that can reach the CLI
+machine's loopback listener; it does not enable unattended consent. Consent defaults to
+300 seconds; override with `--consent-timeout` only deliberately. Connected status is
+required; `consent.confirmed: false` alone does not establish failure because the callback
+commonly contains no authorization code.
+
+On consent, policy, or wiring failure, ARM connections/policies may remain and credentials/
+access may have changed. Only guarded file-entry restoration is attempted. Inspect the
+reported resources, revisions, policies, and file state before recovery or retry. Never
+assume a timeout cleaned up resources, automatically delete retained resources, or restore
+credentials/access from incomplete ARM readback.
+`--force` does not bypass strong revisions, policy identity checks, or concurrency limits.
+
+## Inspect, test, and preserve aliases
+
+```azurecli
+az logicapp connection list --resource-group GROUP --name APP --subscription SUBSCRIPTION_ID --output table
+az logicapp connection show --resource-group GROUP --name APP --connection ALIAS --class managedApiConnections --subscription SUBSCRIPTION_ID
+az logicapp connection test --resource-group GROUP --name APP --connection ALIAS --subscription SUBSCRIPTION_ID
+```
+
+List/show read the app's deployed `connections.json`, not a reconciled ARM inventory.
+Unwired resources are absent; dangling file references can remain. Redacted URLs/values do
+not guarantee provider errors or workflow payloads are secret-free. Setting-name expressions
+remain visible without resolving values.
+
+| Test result | Exit | Required response |
+|---|---|---|
+| `passed` | 0 | Connection test passed; still verify required business behavior |
+| `failed` | 1 | Inspect platform failure |
+| `authorizationFailed` | 1 | Verify principal/grants; exercise the exact authorized operation |
+| `couldNotReach` | 1 | Resolve reachability; honor HTTP 429 `retryAfter` |
+| `noTestAvailable` | 3 | Unverified, not passed; exercise the workflow when authorized |
+
+Preserve stable existing aliases by default. To consolidate, trace every workflow reference,
+verify resource sharing/ownership, authorize the migration, and update dependent references
+together. A Designer-generated name is not proof of duplication or permission to delete.
+Keep environment-specific resource references configurable; keep runtime URLs/keys in
+protected settings instead of source-controlled literals.
+
+## Delete connections or change access
+
+Inspect impact and obtain explicit authorization before unlinking/revoking anything:
+
+```azurecli
+az logicapp connection delete --resource-group GROUP --name APP --connection ALIAS --subscription SUBSCRIPTION_ID
+az logicapp connection acl list --resource-group GROUP --connection RESOURCE_NAME --subscription SUBSCRIPTION_ID
+az logicapp connection acl show --resource-group GROUP --connection RESOURCE_NAME --policy POLICY_NAME --subscription SUBSCRIPTION_ID
+az logicapp connection acl add --resource-group GROUP --connection RESOURCE_NAME --object-id PRINCIPAL_ID --subscription SUBSCRIPTION_ID
+az logicapp connection acl remove --resource-group GROUP --connection RESOURCE_NAME --policy POLICY_NAME --subscription SUBSCRIPTION_ID
+```
+
+Select only the intended operation; these are not a sequence. ACLs require V2 connections;
+one policy per principal is allowed. Removal immediately removes that principal's access.
+Use `--yes` only for previously approved targets/effects.
+
+Managed deletion checks ownership before unlink, uses a fresh exact strong ETag, and verifies
+unlink before ARM cleanup. Invalid/cross-scope resource IDs are refused even with
+`--keep-resource`; manage cross-scope resources explicitly, not by bypassing the check.
+Only demonstrably exclusive system-assigned policies are eligible for automatic removal.
+Shared user-assigned policies/resources remain, even if the identity belongs to this app.
+Ambiguous/incomplete ownership evidence retains resources with a reason.
+`--keep-resource` deliberately retains the connection and does not revoke shared access.
+Referenced app settings are reported, not deleted. Conflicts, partial unlink, and later
+cleanup failures require inspection; do not retry unconditionally or replay old wiring.
+
+**Gate:** Intended wiring/access verified, required data-plane grants verified separately,
+and retained/shared resources or uncertain effects explicitly reported.
diff --git a/skills/azure-logic-apps-standard-cli/references/live-operations.md b/skills/azure-logic-apps-standard-cli/references/live-operations.md
new file mode 100644
index 0000000000..03ca427dee
--- /dev/null
+++ b/skills/azure-logic-apps-standard-cli/references/live-operations.md
@@ -0,0 +1,199 @@
+# Live workflows, execution, and diagnosis
+
+Mandatory before runtime workflow inspection/export/mutation, invocation, diagnosis,
+cancellation, or replay. Baseline: `logicapp` 1.0.0b1. Apply `SKILL.md` targeting,
+authorization, sensitive-output, and mandatory runtime-readiness rules.
+
+## Target and inspect
+
+Local examples use a previously verified host at port 7071. Cloud equivalents replace
+`--local --port 7071` with `--resource-group GROUP --name APP --subscription SUBSCRIPTION_ID`.
+An explicitly selected API `--context NAME` replaces those target flags; do not mix them.
+Account selection remains independent of contexts.
+
+Workflow list/show/export/set/delete query a reachable runtime, not an offline path.
+For offline work read authored files and run `workflow validate --path PROJECT_ROOT`.
+The host must be ready, but no workflow run needs to be active.
+
+```azurecli
+az logicapp workflow list --local --port 7071 --max-items 10 --output table
+az logicapp workflow show --local --port 7071 --workflow Orders
+az logicapp workflow export --local --port 7071 --workflow Orders --output-path Orders.backup.json
+```
+
+List returns `value` plus `nextContinuationToken`; page with `--max-items` and
+`--continuation-token` (`--next-token` alias). Pass tokens unchanged; they are offsets,
+not snapshots. Changed inventories can shift page boundaries. Show returns the complete
+authored workflow and ETag; table output omits definition/revision details.
+Export preserves authored kind/configuration and reports its source ETag.
+
+Export is one workflow, not an app backup: it does not download settings, connections,
+artifacts, or resolved expression values. Definitions can contain sensitive literals.
+Review/protect exports before persisting to shared locations or source control. Use a new
+regular `.json` destination, or `--force` only for an inspected replacement.
+
+## Replace or delete one existing live workflow
+
+Prerequisites: explicit approval of the selected target/effect, retained export and revision,
+coordinated writers, and a reviewed complete replacement file for `set`.
+
+```azurecli
+az logicapp workflow set --local --port 7071 --workflow Orders --file Orders.edited.json --if-match SAVED_ETAG --allow-non-atomic
+```
+
+Quote the actual saved ETag according to the shell, preserving its exact value.
+`set` takes a complete workflow file, not a bare definition or patch. It preserves kind,
+requires the existing workflow, performs static and completed target-runtime validation,
+and verifies written bytes. It does not publish shared settings/connections or add new
+cloud workflows. An unfinished validation HTTP 202 is not a completed preflight.
+
+Deletion has the same approval, retained-export, revision, and non-atomic prerequisites:
+
+```azurecli
+az logicapp workflow delete --local --port 7071 --workflow Orders --if-match SAVED_ETAG --allow-non-atomic
+```
+
+Both commands prompt unless `--yes` is explicitly authorized. Exact strong revision checks
+still apply without optional `--if-match`; providing it binds to the earlier editing
+revision. Wildcards, weak revisions, and `--force` bypasses are unsupported.
+
+`--allow-non-atomic` is required even with `--yes`. VFS can race or leave partial writes;
+rollback is not guaranteed. A concurrent deletion can permit recreation during a write.
+Conflicts or uncertain receipts require inspection, not blind retry or unconditional restore.
+Read-only/run-from-package targets may reject writes; use authorized full deployment instead.
+
+Delete removes only that workflow's `workflow.json`, not its folder/siblings/shared files,
+active runs, or history. File absence does not immediately establish runtime removal.
+Set byte verification is not proof of reload/execution. Inspect runtime metadata and
+exercise approved behavior separately after mutation.
+
+**Gate:** Retained export/revision, verified file outcome, separate runtime observation, and
+explicit uncertainty/recovery guidance if either verification is incomplete.
+
+## Enable or disable one deployed workflow
+
+Supported only for deployed Standard Stateful/Stateless workflows, not local live state APIs.
+Confirm settings read/write permissions and coordinate **all** app-settings writers:
+
+```azurecli
+az logicapp workflow disable --resource-group GROUP --name APP --workflow Orders --allow-non-atomic --subscription SUBSCRIPTION_ID
+```
+
+Use `workflow enable` instead when that is the requested operation; do not run both.
+These commands set `Workflows.<workflow-name>.FlowState`. The underlying API replaces the
+whole app-settings map: unrelated concurrent changes can be lost despite snapshot checks
+and readback. Explicit approval of that non-atomic risk is required, even with `--yes`.
+No guaranteed rollback, invented ETag guard, or automatic retry is available.
+
+Read `configuredState` separately from `runtimeState`/convergence. Pending or unknown
+convergence is not proof of quiescent dispatch. Even converged metadata does not establish
+drained runs. Disabling does not cancel in-flight/pending runs, stop the app, or purge
+history; enabling can process backlog. Settings changes can cause hosting/reload effects.
+
+For authorized local startup configuration, the companion procedure is to edit the
+corresponding FlowState key under local settings `Values` and restart only the owned host.
+This is not a live local enable/disable API; preserve other settings and protect values.
+Use the mandatory local-runtime procedure for any restart.
+
+## Invoke and observe approved behavior
+
+Establish actual workflow/trigger names, kind, payload, environment, and permitted external
+effects. A local invocation may still mutate real services.
+
+```azurecli
+az logicapp run start --local --port 7071 --workflow Orders --trigger manual --payload-file payload.json
+```
+
+Inspect the structured result and capture the **actual** returned run ID if present.
+Do not guess an ID or infer successful completion from accepted invocation.
+For Stateful runs with an actual ID:
+
+```azurecli
+az logicapp run wait --local --port 7071 --workflow Orders --run-id RUN_ID --timeout 300 --interval 5
+az logicapp run show --local --port 7071 --workflow Orders --run-id RUN_ID
+```
+
+| `run wait` exit | Meaning |
+|---|---|
+| 0 | Observed Succeeded |
+| 4 | Observed another terminal status |
+| 2 | CLI observation deadline, not workflow TimedOut |
+| 1 | Observation/protocol error |
+
+Waiting does not cancel, retry, or roll back execution. Verify required outputs and effects
+separately; workflow status alone is not business correctness.
+
+Stateful history/control commands are not general Stateless controls, including when
+Stateless debug history exists. For Stateless work use the supported invocation response,
+approved telemetry, or native tests as appropriate. Report missing durable evidence;
+do not enable history/change kind merely to make diagnosis resemble Stateful behavior.
+
+## Diagnose while the runtime is reachable
+
+Start with the run and action metadata, not console output alone:
+
+```azurecli
+az logicapp run list --local --port 7071 --workflow Orders --status Failed --max-items 10
+az logicapp run show --local --port 7071 --workflow Orders --run-id RUN_ID
+az logicapp run action list --local --port 7071 --workflow Orders --run-id RUN_ID
+az logicapp run action show --local --port 7071 --workflow Orders --run-id RUN_ID --action ACTION_NAME
+```
+
+Follow supported run-list continuation tokens unchanged. A skipped dependent action is not
+necessarily the root failure. Expression failure may have metadata error but no outputs;
+a failed HTTP action may instead have useful response content.
+Retrieve bounded recorded content only when needed and authorized:
+
+```azurecli
+az logicapp run action show-content --local --port 7071 --workflow Orders --run-id RUN_ID --action ACTION_NAME --max-bytes 16384
+```
+
+Outputs are default; use `--content inputs` only when needed. Payloads/provider errors can
+contain secrets despite default URL redaction. Content links contain SAS credentials:
+do not use `--show-content-urls` unless needed for immediate diagnosis; never persist or
+share raw links. Inspection exit 0 means read success, not workflow success.
+
+**Gate:** Actual failed action/platform evidence where available, or a precise explanation
+of missing history/response/telemetry. Complete diagnosis before stopping the owned host.
+
+## Cancel or replay only with explicit approval
+
+These Stateful operations can affect external systems. They are not automatic diagnosis
+steps. Establish the exact target and effects before using confirmation bypass `--yes`.
+
+```azurecli
+az logicapp run cancel --local --port 7071 --workflow Orders --run-id RUN_ID --wait --timeout 60 --interval 2
+```
+
+An acknowledgement is not observed cancellation. With wait, exit 0 means observed Cancelled
+or an already-terminal unchanged source; 4 means another terminal outcome; 2 means the
+observation deadline; 1 is an observation/protocol error. Inspect the structured result.
+Cancellation cannot undo effects or guarantee in-flight actions stop. A timeout sends no
+additional cancellation or retry.
+
+Choose exactly one replay type based on verified source evidence:
+
+| Operation | Required source and interpretation |
+|---|---|
+| `run resubmit` | One executed `--action` in a completed `--run-id`; runtime must literally advertise `canResubmit=true` |
+| `trigger history resubmit` | Exact retained fired `--history-name` for the selected `--workflow` and `--trigger`; not a run ID |
+
+```azurecli
+az logicapp run resubmit --local --port 7071 --workflow Orders --run-id COMPLETED_RUN_ID --action ACTION_NAME
+```
+
+```azurecli
+az logicapp trigger history resubmit --local --port 7071 --workflow Orders --trigger manual --history-name HISTORY_ID
+```
+
+These are alternatives. Action resubmission uses the source version and retained prior
+results with current settings/connections. Selected/dependent actions may repeat effects.
+Trigger replay is distinct, not a fallback for ineligible actions. Neither is in-place
+resume or exactly-once recovery. Do not enable runtime features to bypass eligibility.
+
+HTTP 202 is acceptance, not completion. Wait only on a service-returned `newRunId`.
+`acceptedNewRunIdUnknown` requires reporting uncertainty; do not choose the latest run,
+substitute an ID, follow a Location URL to invent an identity, or automatically retry.
+
+**Gate:** Requested, accepted, observed, and unknown outcomes remain distinct. Report
+uncertain effects and retained resources before considering deliberate recovery.
diff --git a/skills/azure-logic-apps-standard-cli/references/local-runtime.md b/skills/azure-logic-apps-standard-cli/references/local-runtime.md
new file mode 100644
index 0000000000..6672272fc1
--- /dev/null
+++ b/skills/azure-logic-apps-standard-cli/references/local-runtime.md
@@ -0,0 +1,161 @@
+# Local dependencies and runtime
+
+Mandatory before dependency installation/checks, runtime doctor, or host lifecycle work.
+Baseline: `logicapp` 1.0.0b1. Read `SKILL.md` rules first. Use the actual project root, OS,
+shell, available port, and ownership evidence; `App` and 7071 are example coordinates.
+
+## Prerequisites and effects
+
+Inspect existing configuration, settings references, listeners, and runtime ownership before
+starting or repairing anything. Do not print secret values. Running a local host can activate
+polling/event triggers and invoke real services using local credentials. Establish authorized
+effects and appropriate non-production resources before startup; "local" does not mean isolated.
+Do not install dependencies or start services as a side effect of read-only inspection.
+
+## Check before installation
+
+For a destination that does not exist, a general `dependency check` may identify tooling.
+Once the project exists, use the project-aware form:
+
+```azurecli
+az logicapp dependency check --path App
+```
+
+Inspect Core Tools, Node.js, bundle, .NET, and Azurite findings. The project-aware check
+resolves configured storage and whether Azurite is required; not every tool is needed
+for every operation. A local SDK test has different prerequisites from a live host.
+
+For an existing project, diagnose before runtime repair:
+
+```azurecli
+az logicapp runtime doctor --path App --port 7071 --output json
+```
+
+Doctor is read-only: it does not install, download, repair, start/stop services, decrypt
+settings, or contact cloud storage. It uses bounded loopback probes and local project/tool/
+cache/ownership evidence. A stopped host is an optional skipped probe, not an offline failure.
+
+| Doctor exit | Meaning and required response |
+|---|---|
+| 0 | No required blockers/unknowns; not business correctness or universal compatibility |
+| 1 | Required failure; inspect and resolve the actual finding |
+| 2 | Required unknown, or optional problem under `--strict`; preserve diagnostic uncertainty |
+
+Exact tool/bundle compatibility remains a required unknown in this baseline; a responsive
+project can exit 2. Do not reinstall merely because compatibility is unknown or convert
+the result into certified health. Preserve structured stdout on nonzero exits.
+Use a local `--context` instead of path/port if appropriate; explicit context cannot be
+combined with `--path` or `--port`. Doctor does not take `--local`.
+
+## Install only selected missing dependencies
+
+Install only the kinds reported missing and required for the requested operation:
+
+```azurecli
+az logicapp dependency install --kind core-tools --yes
+az logicapp dependency install --kind node --yes
+az logicapp dependency install --kind azurite --yes
+az logicapp dependency install --kind bundle --yes
+```
+
+These are alternatives, not a command sequence to run unconditionally. Repeat `--kind` for
+multiple required kinds. Omitting `--kind` installs all installable kinds and is not the
+default procedure. `--yes` is appropriate only after installation is authorized.
+Check each exit and rerun the project-aware check after the selected installation.
+
+Constraints:
+
+- The CLI does not install the .NET SDK. Report a required missing SDK and use the customer's
+  approved installation process; do not run a remote installer implicitly.
+- Azurite requires Node.js 22 or newer. Establish Node/npm availability before installing it.
+- Managed dependencies default to `~/.azurelogicapps/dependencies`, shared with VS Code
+  tooling; `LA_DEPENDENCIES_PATH` or supported target flags can override it.
+- Managed tools affect child-process environments, not global PATH.
+- Respect approved package sources, proxies, and network policies. The Azurite installer
+  uses the public npm registry by default rather than the user's configured registry.
+  Use `--kind azurite --source-url REGISTRY_URL` for an authorized mirror.
+- `--source-url` requires exactly one kind. Custom sources do not receive the same
+  publisher-checksum verification; establish trust independently. Never disable TLS.
+- `--version` pins one selected kind when required. Do not upgrade working tools merely
+  because a newer version exists.
+- `dependency uninstall` removes only recorded CLI-owned dependencies using
+  `.logicapps-integrity.json`. Inspect shared use and obtain removal authorization first.
+
+**Gate:** Every dependency required for this task is available, or its concrete blocker is
+reported. An unknown compatibility finding is not a missing-package finding.
+
+## Start and verify readiness
+
+Choose a port after inspecting existing listeners. Do not stop another process to free it.
+Reuse a suitable existing host only after confirming its project and permitted effects.
+
+```azurecli
+az logicapp runtime start --path App --port 7071 --background --ready-timeout 90
+az logicapp runtime show --port 7071
+```
+
+Require running state **and** `readiness.managementEndpointReachable: true`.
+An open port or recorded process alone is insufficient. If starting/failed/unready, inspect
+the reported `logPath`, then rerun doctor as appropriate. Do not invoke workflows until ready.
+Logs can contain sensitive payloads; inspect locally and sanitize before sharing.
+
+When `AzureWebJobsStorage` resolves to `UseDevelopmentStorage=true`, startup manages Azurite
+on ports 10000-10002 and reuses an existing emulator. Real storage configuration does not
+start Azurite. Use `--no-azurite` only when another authorized process owns its lifecycle.
+Do not manually author emulator/runtime state directories.
+
+Inspect the returned dependency record:
+
+| Azurite state | Required response |
+|---|---|
+| `started` | Record CLI ownership and dependent host |
+| `already-running` | Inspect `startedByCli`; do not infer ownership from the port |
+| `port-conflict` | Identify the non-Azurite listener; stop startup, not the unrelated process |
+| `missing` | Authorize/install the required Azurite dependency |
+| `not-started` | Inspect storage configuration without exposing its values |
+| `failed` | Inspect the dependency's reported `logPath` |
+| `skipped` | Confirm intentional externally managed emulator lifecycle |
+
+Local runtime lifecycle honors saved local context ports where applicable; explicit path/port
+coordinates are safer for automation. Do not add API-only `--local` to lifecycle commands.
+These commands do not manage cloud host startup/shutdown.
+
+**Gate:** Correct owned/reused host, actual management readiness, permitted trigger effects,
+and understood dependency ownership.
+
+## Diagnose before stopping
+
+Collect required run/action evidence while the host is reachable using the mandatory live
+operations procedure selected from `SKILL.md`. Console output alone is not a workflow
+business diagnosis. If no run exists or Stateless history is unavailable, report that fact
+and use supported response/telemetry evidence; do not invent a failed action.
+
+## Stop only owned processes
+
+After required validation, discovery, execution, and diagnosis are finished:
+
+```azurecli
+az logicapp runtime stop --port 7071
+az logicapp runtime show --port 7071
+```
+
+Confirm the task-owned host is stopped and its listener is closed using OS-appropriate
+process/listener inspection. If a new listener has reused the port, identify it without
+terminating it. Do not declare the original host alive solely from a reused port.
+
+Stop only runtimes started for this task, unless explicit shutdown of another host is
+authorized. If asked to leave a host running, verify responsiveness and report project,
+port, and lifecycle ownership instead of stopping it.
+
+When Azurite was started by the CLI, it is retained while any CLI-started foreground or
+background host depends on it. Only after the last dependent host stops should its
+10000-10002 listeners close. Never stop an emulator the CLI did not start.
+
+CLI process ownership uses PID and creation identity. Unknown/recycled identities and
+unresolved descendants must not be signalled. If cleanup remains pending, retain ownership
+records and inspect the exact reported processes. Use an explicitly authorized, identity-
+verified PID only; never kill by executable name or delete records to bypass a guard.
+Use supported stop retries only after reviewing ownership evidence.
+
+**Gate:** All task-owned processes are verified stopped, or explicit retention/cleanup blockers
+are reported. Shared and unrelated services remain intact.
diff --git a/skills/azure-logic-apps-standard-cli/references/packaging-deployment.md b/skills/azure-logic-apps-standard-cli/references/packaging-deployment.md
new file mode 100644
index 0000000000..64d94ca021
--- /dev/null
+++ b/skills/azure-logic-apps-standard-cli/references/packaging-deployment.md
@@ -0,0 +1,172 @@
+# Packaging and deployment
+
+Mandatory before changing deployment exclusions, packaging, or deploying.
+Baseline: `logicapp` 1.0.0b1. Packaging is local archive creation; core ZIP deployment is a
+separate authorized Azure mutation. Preserve an existing supported repository/CI deployment
+route rather than replacing it merely because this skill includes a CLI example.
+
+## Establish actual boundaries
+
+Identify repository root, Logic Apps host root, deployable runtime assets, dedicated tests,
+templates, local state, and intended package destination. The project may be at repository
+root or nested; do not require a solution-root layout.
+
+Merge source-control exclusions relative to the actual `.gitignore` location. For a
+project-at-root layout, typical applicable entries are:
+
+```gitignore
+local.settings.json
+.azurelogicapps/
+workflow-designtime/
+.logicapp-test-state/
+*.log
+```
+
+For nested projects, adapt paths or place scoped rules at the host root. Ensure nested
+secret copies are also ignored. Add actual generated output directories, not assumed
+`logs`/`artifacts` directories that do not exist. Preserve unrelated entries and verify
+effective exclusions, including existing tracked files: adding ignore rules does not
+remove a tracked secret or make its history safe.
+
+The **host-root `.funcignore`**, not `.gitignore`, defines extra deployment exclusions.
+Merge applicable rules such as:
+
+```gitignore
+local.settings.json
+cloud.settings.json
+.azurelogicapps/
+.logicapp-test-state/
+workflow-designtime/
+.vscode/
+.git/
+.gitignore
+*.code-workspace
+*.log
+*.trx
+```
+
+Adapt/add exact host-root-relative locations of tests, fixtures, request samples, docs,
+settings templates, reports, generated packages, and other non-runtime content inside the
+host root containing `.funcignore`. For example, for a host at `repo\App`, exclude
+`repo\App\fixtures` with `fixtures/` in `repo\App\.funcignore`, not `App/fixtures/`.
+Folders outside the host root are already outside the package source. Do not use broad
+binary exclusions that would remove required runtime assemblies.
+
+A placeholder-only settings template is optional. Document that the runtime does not
+consume it; configure local/cloud settings through the appropriate process. Exclude the
+template from deployment even if safe to track. It must never contain actual secrets.
+Do not copy `.gitignore` over `.funcignore` or replace existing user rules wholesale.
+
+## Validate before packaging
+
+Require strict completed full-project validation immediately before release packaging:
+
+```azurecli
+az logicapp workflow validate --path App --all --fail-on-warning
+```
+
+When runtime validation is required by the task/repository, first establish readiness and
+complete the runtime-backed form against the intended target. Report actual blockers;
+do not disable warnings or claim an HTTP 202 accepted validation completed.
+Review existing validation failures without silently weakening the release gate.
+
+Choose an output path outside the host root where feasible. A current-directory destination
+such as `App.zip` is outside a child `App` host; for a host at `"."`, choose an explicit
+external destination or verified exclusion. Create only the actual requested output parent.
+
+```azurecli
+az logicapp deployment package --path App --output-path App.zip
+```
+
+Optional `--manifest MANIFEST_PATH` selects the manifest destination. Archive and manifest
+must be distinct files, including normalized paths/aliases. `--force` authorizes replacing
+reviewed output only; never use it to bypass invalid inputs or exclusions.
+An unreadable, non-file, or invalid UTF-8 `.funcignore` is an error, not empty policy.
+
+The packager excludes `local.settings.json` case-insensitively, including nested copies,
+dedicated recognized native test/state content, and raw TRX. It refuses ambiguous mixed
+test/runtime roots rather than dropping runtime files. Dedicated native test intent is
+identified from project declarations, not merely a filename or state-directory marker.
+Do not rely on sensitive-data scanning to recognize every possible secret or custom artifact.
+
+## Inspect the actual ZIP and manifest
+
+Require all requested workflow directories, `host.json`, `connections.json` when required,
+referenced `parameters.json`/runtime files, and necessary assemblies/artifacts.
+Verify the ZIP root is the host content, not an extra enclosing project directory.
+
+Require absence of:
+
+- local settings, credentials, signed URLs/keys, or secret-bearing exports;
+- settings templates and non-runtime fixtures/tests;
+- native private caches, test state, raw TRX, and test build output;
+- logs, editor/workspace files, repository metadata, and runtime state;
+- generated packages, nested archives, and inappropriate diagnostic reports.
+
+Inspect using a read-only archive tool appropriate to the OS. Manifest exclusions are
+useful evidence but not a substitute for checking the archive. Ordinary runtime binaries
+may be necessary; do not exclude all `bin`, `.dll`, or `.exe` files indiscriminately.
+
+**Gate:** Strict validation passed; exact archive/manifest inspected; only deployable
+content remains. Packaging success alone is not a deployment or secret-free attestation.
+
+## Deploy only within authorized scope
+
+Confirm tenant/subscription, resource group, Standard app, environment/location, deployment
+route, and external effects. Azure services may incur charges. This preview does not
+establish production readiness. Do not create infrastructure as an unrequested side effect.
+
+Prerequisites:
+
+1. App and required resources exist, with compatible hosting/deployment configuration.
+2. Managed identity is enabled by default through authorized provisioning; required
+   local/cloud principals, connector access policies, and data-plane grants are verified.
+3. Required app settings/parameters and managed connection wiring are configured without
+   exposing values. Keep triggers from activating incomplete external dependencies.
+4. Package and validation gates pass; relevant tests and deployment approvals are complete.
+5. Deployment/recovery follows existing repository policy, including coordinated writers.
+
+Use the existing pipeline when supplied. For authorized direct CLI ZIP deployment, the
+core Logic Apps command is available independently of extension packaging:
+
+```azurecli
+az logicapp deployment source config-zip --resource-group GROUP --name APP --src App.zip --subscription SUBSCRIPTION_ID
+```
+
+This is a core command, not an extension-owned `deployment deploy` command. Do not invent
+such a command. Core app-management/settings commands are also distinct from extension
+runtime APIs. Their existence does not broaden individual preview command support to
+Consumption, hybrid hosts, or deployment slots. Inspect target-specific support first.
+
+Full application deployment publishes shared files and adds new cloud workflows.
+`workflow set` is only a separately approved replacement of one existing workflow on
+a writable target; it is not a substitute for deploying settings or a new app.
+Do not bypass run-from-package or read-only hosting restrictions.
+
+## Verify deployment separately
+
+After acknowledged deployment:
+
+1. Inspect the deployment result and actual workflow inventory.
+2. Validate the local authored project against the deployed runtime when required:
+
+   ```azurecli
+   az logicapp workflow validate --path App --all --fail-on-warning --with-runtime --resource-group GROUP --name APP --subscription SUBSCRIPTION_ID
+   ```
+
+3. Inspect deployed connection wiring and required authentication/access.
+4. Exercise explicitly authorized representative workflows and verify outputs/effects;
+   use actual supported run IDs and diagnose failed actions where history is available.
+5. Verify excluded local files/secrets were not deployed using appropriate read-only
+   inspection without printing secret contents.
+
+Use the mandatory connections/live-operations procedures selected from `SKILL.md` before
+those phases. Runtime-template validation is not deployed-file equality, connection
+certification, or successful business execution; record each evidence type separately.
+
+If deployment is partial, validation fails, resources remain, or effects are uncertain,
+report the actual state. Do not blindly retry, activate incomplete dependencies, delete
+retained resources, or claim guaranteed rollback.
+
+**Gate:** Intended cloud content/configuration, completed required runtime validation,
+verified approved scenarios, exclusion evidence, and explicit remaining blockers.
diff --git a/skills/azure-logic-apps-standard-cli/references/testing.md b/skills/azure-logic-apps-standard-cli/references/testing.md
new file mode 100644
index 0000000000..e7eca0a115
--- /dev/null
+++ b/skills/azure-logic-apps-standard-cli/references/testing.md
@@ -0,0 +1,202 @@
+# Native workflow testing
+
+Mandatory before `test create`, `test plan`, `test run`, or `test results show`.
+Baseline: `logicapp` 1.0.0b1. Testing is optional/task-directed, not an implicit host startup,
+dependency installation, NuGet restore, Azure mutation, or substitute for integration checks.
+
+## Select the phase explicitly
+
+| Command | Contract |
+|---|---|
+| `test create` | Writes new native SDK/MSTest source; no restore or execution |
+| `test plan` | Bounded read-only preflight/XML inspection; no tests executed |
+| `test run` | Explicit trusted native build/test with separately opt-in restore |
+| `test results show` | Inspects supported saved JSON; never reruns tests or follows embedded paths |
+
+Use explicit `--path App --workflow Orders`, otherwise a named/active local context, otherwise
+current directory. Explicit `--path` bypasses an implicit active context; an explicitly named
+cloud context is refused even with a path. No Azure login or running host is required for
+local planning. Input/target failures before reporting are not successful plans.
+
+## Scaffold, then author real assertions
+
+Inspect existing tests and output paths first. Default scaffold output is `Tests/Orders`
+under the selected host project; a dedicated test directory within the project is supported.
+External dedicated tests are also valid when explicitly selected.
+
+```azurecli
+az logicapp test create --path App --workflow Orders
+```
+
+Creation refuses an existing destination rather than adopting or overwriting it. Multiple
+triggers require explicit `--trigger`. A relative `--output-path` uses the selected project.
+The scaffold includes native project/test source, trigger fixture, SDK selection, NuGet
+configuration, and Git exclusions. It does not copy app credentials/settings or SDK binaries.
+
+The starter is ignored and inconclusive, **not a passing business test**.
+Before removing both the Ignore attribute and inconclusive guard:
+
+1. Populate synthetic trigger data for the actual workflow/trigger.
+2. Mock external operations using supported SDK mocks, including required failure paths.
+3. Write meaningful business assertions against required behavior/action outputs.
+4. Review project imports, build targets, package sources, and test code for permitted effects.
+
+The scaffold links the current selected workflow at build time. Do not remove valid workflow
+outputs, alter expected business values, or weaken assertions simply to obtain a pass.
+Workflow Succeeded alone does not establish business coverage.
+
+## Plan without execution
+
+```azurecli
+az logicapp test plan --path App --workflow Orders --output json
+```
+
+Planning inspects local authored inputs and literal references; an optional/default scaffold
+`.csproj` is XML metadata, not evaluated MSBuild or executable test discovery. It does not
+install, restore, generate fixtures, launch a host, or contact a cloud target.
+
+| Plan exit | Meaning |
+|---|---|
+| 0 | Plan generated, not tests passed |
+| 1 | Authoring finding |
+| 3 | Invalid/unsafe local input |
+| 4 | Under `--strict`, blocked execution gates after otherwise successful planning |
+| 5 | Observed input drift |
+| 6 | Report publication failure |
+
+Inspect `notExecuted` markers and findings. A successful plan does not accept SDK terms or
+authorize execution. Preserve supported historical reports' recorded exit policies.
+Reports are stdout-only by default. Optional `--report-path` needs an existing parent;
+overwriting a plan report requires deliberate `--force`, which authorizes no SDK activity.
+
+## Review dependencies, SDK terms, and project trust
+
+Current qualified contract: Tests SDK **1.0.3**, engine **1.165.50**, MSTest **4.0.2**,
+target **net8.0**, selected .NET **8** SDK. The scaffold selects **8.0.426** with latest-patch
+roll-forward. A target framework does not select the SDK in an existing project.
+
+**.NET 8 support ends 2026-11-10.** Check lifecycle and publisher compatibility at execution
+time. Do not silently upgrade the pinned SDK/engine/runner combination, remove selection
+guards, or claim a later toolchain is qualified. If no supported approved combination is
+available, report the native test execution blocker and keep offline inspection available.
+
+Review the publisher's
+[SDK 1.0.3 license](https://www.nuget.org/packages/Microsoft.Azure.Workflows.WebJobs.Tests.Extension/1.0.3/License),
+including use/redistribution/commercial-use restrictions, data collection, and updates.
+The CLI's MIT license does not license the SDK. Obtain publisher/legal clarification where
+needed; do not redistribute SDK binaries with this skill or a generated project.
+
+For **each invocation**, obtain authorization before adding:
+
+- `--accept-sdk-terms`: caller acknowledgement of applicable SDK terms, not a saved-report grant.
+- `--trust-project`: acknowledgement that project/imports/targets/test code can execute
+  arbitrary code and contact services.
+- `--restore`: separate permission to resolve packages through reviewed sources.
+
+Do not infer these permissions from activating the skill, generating a plan, a prior run,
+saved flags, a context, or `--force`. Caches and mocks are not a security sandbox or denied
+egress. Use an appropriately isolated environment for untrusted native code.
+
+The scaffold NuGet configuration clears inherited sources and selects the official feed.
+Before restore, adapt/review it for the customer's approved feed/proxy policy; do not
+prescribe a company-specific proxy to all users. Use explicit `--nuget-config CONFIG_PATH`
+if appropriate. Never bypass TLS or silently add another source after restore failure.
+Inherited user feed/credential/proxy environment configuration is not automatically passed
+to the private runner; a mirror requiring those must be configured through a supported,
+reviewed mechanism rather than assumed to work.
+
+Existing lockfiles use locked restore; a new restore produces a lockfile for review.
+Commit appropriate `packages.lock.json`, not package binaries. Without `--restore`,
+build/test use `--no-restore`; missing dependency evidence is an error, not permission
+to download. The CLI does not install a global SDK to satisfy this task.
+
+## Execute only reviewed tests
+
+Only after the above approvals, choose the required invocation:
+
+```azurecli
+az logicapp test run --path App --workflow Orders --accept-sdk-terms --trust-project --restore --timeout 300
+```
+
+For a reviewed previously restored project, omit `--restore`. From the directory containing
+`App`, after creating `App\reports`, save a new sanitized report with:
+
+```azurecli
+az logicapp test run --path App --workflow Orders --accept-sdk-terms --trust-project --report-path reports/native.json --timeout 300
+```
+
+Use the host OS's path separator when invoking examples. Select an existing custom
+project with `--test-project`; there is no need to regenerate tests just to run them.
+`--timeout` bounds native steps (1-3600 seconds); identity-checked cleanup can take longer.
+
+| Path argument | Resolution |
+|---|---|
+| Relative create `--output-path`, plan/run `--report-path` | Selected host project |
+| Explicit relative `--test-project`, `--nuget-config` | Shell current directory |
+| Results `--result-file`, `--workflow-file` | Shell current directory |
+
+Use absolute paths when these different bases would be ambiguous. Report parents must
+exist; native report destinations must be new files. For example, after creating an
+`App\reports` directory, `--path App --report-path reports/native.json` writes
+`App\reports\native.json`. Using `--report-path native.json` instead writes `App\native.json`,
+not a file in the reports directory. Results inspection must name the same saved file
+relative to the shell's working directory, not the selected project.
+
+## Interpret results without overstating coverage
+
+| Run exit | Meaning |
+|---|---|
+| 0 | Native tests passed with at least one executed test; inspect skipped counts and assertions |
+| 1 | Native test/assertion failure |
+| 2 | Toolchain, dependency, restore/build, runner, or results error |
+| 3 | Invalid/unsafe local input |
+| 4 | Missing terms/project-trust acknowledgement; no native execution |
+| 5 | Observed selected-input drift |
+| 6 | Report publication failed; inspect destination before retry |
+| 7 | Zero executed tests, including entirely skipped scaffolds; not passed |
+| 8 | Native deadline; no complete verdict |
+| 9 | Safe process cleanup incomplete; retained ownership receipt |
+| 130 | Interrupted; no complete verdict |
+
+Native counts do not attest that arbitrary C# invoked the SDK, executed the selected
+workflow, or covered useful behavior. Preserve `notAttested` workflow/business coverage
+and `notProvided` isolation markers; complement counts with reviewed assertions.
+
+Native stdout/stderr is not raw-echoed by the CLI. Raw TRX stays under the dedicated test
+directory's `.logicapp-test-state` run storage and can contain fixtures, outputs, paths,
+and failure details. Protect it; do not share it as a sanitized report.
+CLI telemetry opt-out does not establish that SDK telemetry is disabled.
+
+From the same directory containing `App`, inspect that saved sanitized report and the
+selected workflow:
+
+```azurecli
+az logicapp test results show --result-file App/reports/native.json --workflow-file App/Orders/workflow.json
+```
+
+Select the actual files according to the path table. Results inspection accepts closed
+supported preflight/native JSON, not raw SDK/TRX. It does not follow report-embedded paths,
+rerun tests, or authenticate authorship. Inspection exit 0 means read success; recorded
+outcomes/counts are historical. Optional workflow-byte comparison detects drift, not a
+new execution or attested coverage.
+
+## Failure and cleanup boundaries
+
+SDK 1.0.3/engine 1.165.50 has a documented `InvalidCastException` for some valid nonempty
+typed top-level workflow outputs. Do not delete outputs, patch binaries, or change workflow
+semantics to hide it. Report the actual failing test/SDK limitation and seek a separately
+qualified publisher fix. Action-output assertions are not a universal workaround.
+
+If cleanup cannot safely complete, retain the process receipt and ownership evidence.
+A later run refuses new work while such a receipt remains, including malformed receipts.
+Do not delete receipts or kill processes by name to unblock execution. Inspect/reconcile
+ownership explicitly; report unresolved cleanup. Old completed reports alone do not grant
+permission to stop anything.
+
+Keep native tests/state in dedicated directories. Do not colocate them with host/workflow
+runtime content. Packaging excludes verified dedicated native test content and raw TRX,
+but arbitrary trusted code may write elsewhere: inspect package contents independently.
+
+**Gate:** Required native assertions actually executed, counts/outcomes/limitations reported,
+approved source/terms/trust boundaries preserved, sensitive artifacts excluded, and no
+hidden cleanup or dependency blocker.