Add Managed Identity v2 KeyGuard mTLS PoP support by gladjohn · Pull Request #1059 · AzureAD/microsoft-authentication-library-for-java

Gladwin Johnson (gladjohn) · 2026-08-16T01:00:15Z

Summary

Adds production-shaped Managed Identity v2 mTLS Proof-of-Possession support for Java using Windows VBS KeyGuard and optional Microsoft Azure Attestation.

Java retains native interop only for KeyGuard/CNG signing and attestation. JCA/JSSE owns TLS, and callers receive a reusable IMtlsBindingContext containing the binding certificate and standard Java SSLContext for independent downstream HTTP calls.

Reviewer entry point: managed-identity-v2-mtls-pop-review-guide.md

Architecture

ManagedIdentityApplication
  -> IMDS v2 platform metadata
  -> KeyGuard non-exportable RSA key
  -> optional MAA attestation
  -> IMDS v2 binding certificate
  -> normal MSAL OAuth token pipeline over JSSE mTLS
  -> mtls_pop token + reusable IMtlsBindingContext

Native signing remains limited to:

JSSE
  -> X509ExtendedKeyManager
  -> CngRsaPrivateKey
  -> CngSignatureSpi
  -> NCryptSignHash
  -> VBS KeyGuard

Changes

Adds managed-identity mTLS PoP and optional fail-closed attestation APIs.
Adds binding-aware token caching keyed by token type, full leaf-certificate DER SHA-256 identity, and attestation mode.
Routes the ESTS mTLS exchange through the normal MSAL token pipeline for claims, client capabilities, telemetry, correlation IDs, retries, error handling, and response parsing.
Adds a ServiceLoader-based optional Windows extension for CNG, KeyGuard, CSR generation, attestation, certificate rotation, and reusable JSSE binding contexts.
Bundles Microsoft-signed Microsoft.Azure.Security.KeyGuardAttestation 1.1.5 AttestationClientLib.dll in the optional extension, verifies its SHA-256 before loading, and includes its license and notice.
Requires exact token_type=mtls_pop and HTTPS token endpoints.
Uses IMDS-specific retry behavior and validates the IMDS response origin.
Disables redirects for credential-bound mTLS requests and defines IMtlsCapableHttpClient for custom transports.
Detects and recreates stale per-boot KeyGuard keys after reboot using a private signing liveness probe.
Keeps the manual Key Vault E2E application in a separate profile-only module.
Adds a detailed reviewer guide with architecture and sequence diagrams, security invariants, file review order, test inventory, VM instructions, threat-model checklists, and completion criteria.

Validation

Full msal4j-sdk and msal4j-mtls-extensions test suites pass.
Production classes remain Java 8 compatible.
Production extension and shaded E2E JARs contain the verified native DLL; the production extension excludes the manual E2E app.
Live validation passed on a Windows Server 2025 Trusted Launch Azure VM without an external DLL or JVM TLS flags:
- acquired an attested mtls_pop token;
- returned the binding certificate and reusable JSSE SSLContext;
- verified JWT cnf.x5t#S256 against SHA-256 of the full leaf certificate DER;
- independently called a token-binding-enforced Azure Key Vault using HttpsURLConnection and received HTTP 200;
- reused the same valid token without presenting the binding certificate and received exact HTTP 401 with error code Unauthorized;
- reacquired through MSAL and received TokenSource.CACHE with the matching live binding context.
The E2E app also supports token-A/binding-B rejection validation when a second managed identity is supplied.

Security properties

Private-key bytes are never exported into Java memory.
TLS is performed by Java JCA/JSSE, not WinHTTP or Schannel as the HTTP stack.
Attestation failures fail closed when attestation is requested.
Bearer, certificate-bound, attested, and unattested cache entries cannot cross-hit.
Same-key certificate renewal creates a new token-cache partition because the full certificate DER changes.
Credential-bound redirects are disabled.
Custom HTTP clients fail fast unless they explicitly support the request-specific mTLS socket factory.
Retired native key handles are cleaned after certificate expiry.

Copilot

Pull request overview

Adds optional Windows KeyGuard-backed Managed Identity v2 mTLS PoP support, including core SDK integration, native CNG/attestation extensions, caching, tests, documentation, and manual validation.

Changes:

Extends token acquisition, HTTP, result, and cache pipelines for mTLS-bound tokens.
Adds the Windows CNG/KeyGuard provider and IMDS v2 credential flow.
Adds unit tests, documentation, Maven modules, and an e2e validation app.

Reviewed changes

Copilot reviewed 61 out of 61 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`run-java-msi-v2-mtls-devapp.ps1`	Builds and runs manual validation.
`README.md`	Introduces the mTLS extension.
`pom.xml`	Registers extension and e2e modules.
`msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/TokenRequestExecutorTest.java`	Tests mTLS OAuth request construction.
`msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/ManagedIdentityMtlsProviderLoaderTest.java`	Tests missing-provider failure.
`msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/ManagedIdentityMtlsParametersTest.java`	Tests parameters, cache partitioning, and token validation.
`msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/ManagedIdentityMtlsBindingTest.java`	Tests token endpoint validation.
`msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/DefaultHttpClientMtlsTest.java`	Tests redirect prevention.
`msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/AuthenticationResultMtlsTest.java`	Tests binding serialization and equality.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/TokenResponse.java`	Parses OAuth token type.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/TokenRequestExecutor.java`	Sends request-specific mTLS token requests.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/TokenCache.java`	Supports explicit extended cache hashes.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/OAuthHttpRequest.java`	Propagates request socket factories.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/MsalRequest.java`	Stores extended cache-key hashes.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/MsalError.java`	Defines mTLS error codes.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityResponse.java`	Parses relative expiration values.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityParameters.java`	Adds mTLS and attestation options.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityMtlsRequest.java`	Defines the provider request contract.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityMtlsProviderLoader.java`	Discovers optional providers.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityMtlsHttpResponse.java`	Defines callback HTTP responses.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityMtlsHttpRequest.java`	Defines callback HTTP requests.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityMtlsBinding.java`	Represents validated binding generations.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/IMtlsCapableHttpClient.java`	Marks mTLS-capable custom clients.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/IMtlsBindingContext.java`	Exposes process-local JSSE bindings.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/IManagedIdentityMtlsProvider.java`	Defines the optional provider SPI.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/IManagedIdentityMtlsHttpClient.java`	Defines the MSAL HTTP callback.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/IAuthenticationResult.java`	Exposes token and binding metadata.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/HttpRequest.java`	Carries request-specific socket factories.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/DefaultHttpClient.java`	Applies mTLS factories and disables redirects.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AuthenticationResult.java`	Stores token type and live bindings.
`msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AcquireTokenByManagedIdentitySupplier.java`	Integrates binding, cache, IMDS, and OAuth flows.
`msal4j-sdk/docs/managed-identity-v2-mtls-pop.md`	Documents architecture and validation.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/Pkcs10BuilderTest.java`	Tests CSR DER generation.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/KeyGuardMtlsBindingContextTest.java`	Tests binding key IDs and contexts.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/KeyGuardManagedIdentityMtlsProviderTest.java`	Tests certificate rotation timing.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/ImdsV2ClientTest.java`	Tests IMDS v2 contracts.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/CngX509ExtendedKeyManagerTest.java`	Tests RSA alias selection.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/CngSignatureParametersTest.java`	Tests PSS parameter validation.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/CngRsaPrivateKeyTest.java`	Tests non-exportability and cleanup.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/CngProviderTest.java`	Tests provider registration and delegation.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/CngKeyGuardTest.java`	Tests stale native-key deletion.
`msal4j-mtls-extensions/src/test/java/com/microsoft/aad/msal4j/mtls/AttestationTokenCacheTest.java`	Tests attestation caching and concurrency.
`msal4j-mtls-extensions/src/main/resources/META-INF/services/com.microsoft.aad.msal4j.IManagedIdentityMtlsProvider`	Registers the KeyGuard provider.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/Pkcs10Builder.java`	Builds PKCS#10 CSRs.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/NCryptLibrary.java`	Defines Windows NCrypt bindings.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/MtlsMsiException.java`	Defines extension failures.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/KeyGuardMtlsBindingContext.java`	Creates JSSE binding contexts.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/KeyGuardManagedIdentityMtlsProvider.java`	Manages binding creation and rotation.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/ImdsV2Client.java`	Implements IMDS v2 requests and parsing.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/CngX509ExtendedKeyManager.java`	Supplies KeyGuard credentials to JSSE.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/CngSignatureSpi.java`	Implements CNG-backed RSA signing.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/CngRsaPrivateKey.java`	Wraps non-exportable CNG keys.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/CngProvider.java`	Registers CNG signature services.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/CngKeyGuard.java`	Implements KeyGuard and attestation interop.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/AttestationTokenCache.java`	Caches fresh attestation JWTs.
`msal4j-mtls-extensions/src/main/java/com/microsoft/aad/msal4j/mtls/AttestationLibrary.java`	Defines attestation DLL bindings.
`msal4j-mtls-extensions/README.md`	Documents extension usage.
`msal4j-mtls-extensions/pom.xml`	Configures the extension artifact.
`msal4j-mtls-extensions-e2e/src/main/java/com/microsoft/aad/msal4j/mtls/e2e/ManagedIdentityMtlsPopKeyVaultDevApp.java`	Implements manual Key Vault validation.
`msal4j-mtls-extensions-e2e/pom.xml`	Builds the shaded validation app.
`.github/copilot-instructions.md`	Documents the new architecture and modules.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 30714a3c-b1e6-4578-8223-e07611e44e1d

Vinay Gera (g2vinay) · 2026-08-26T18:09:23Z

+/**
+ * Manual Java 8 validation for attested managed identity v2 mTLS PoP with Key Vault.
+ */
+public final class ManagedIdentityMtlsPopKeyVaultDevApp {


The unit coverage on the signing and PKCS10 pieces is solid, but the end-to-end path of binding to SSLContext to a real mTLS handshake is only exercised by this manual dev app, which cannot run in CI because it needs KeyGuard hardware. Consider an automated test that stands up a local TLS server requiring client auth and drives it with a software-backed KeyManager double implementing the same contract, so regressions in the SSLContext wiring (protocol, key manager, cert chain) are caught in CI even though the native KeyGuard path cannot run there.

Added a software-backed local mTLS server/client handshake test for CI coverage; the real KeyGuard flow was also validated manually on the VM because the Java pipeline cannot attach that specialized VM.

Vinay Gera (g2vinay) · 2026-08-26T18:09:23Z

+        /**
+         * Requests the KeyGuard managed identity v2 mTLS PoP flow.
+         */
+        public ManagedIdentityParametersBuilder withMtlsProofOfPossession() {


There is currently no way to ask whether mTLS PoP is actually available before calling. A credential chain like Azure Identity's ManagedIdentityCredential needs to decide up front whether to attempt the mTLS path or fall back, and today the only signal is to call and catch. Consider a lightweight capability probe (for example a static isMtlsPopSupported() or a getManagedIdentityCapabilities() view) that reflects platform, provider presence via ServiceLoader, and the IMDS v2 source, so consumers can branch without triggering a full token attempt.

Added getManagedIdentityCapabilities() with IMDS v2/provider/KeyGuard discovery, NONE/SOFTWARE/KEY_GUARD strength reporting, retryable failed probes, and a minimum-strength request floor for credential chains.

Vinay Gera (g2vinay) · 2026-08-26T18:09:23Z

+ */
+public interface IMtlsBindingContext {
+
+    SSLContext sslContext();


Consider also exposing the underlying KeyManager (or a KeyManagerFactory / X509ExtendedKeyManager) here, not just a fully built SSLContext. Most Azure SDK data-plane clients on Java run on Netty (reactor-netty), Vert.x, or the JDK HttpClient, and those stacks want to build their own SslContext from a KeyManager rather than consume a prebuilt JSSE SSLContext. KeyGuardMtlsBindingContext already constructs a CngX509ExtendedKeyManager internally, so surfacing it would let non-JSSE transports wire the binding without reflection or rebuilding. Keeping sslContext() is still useful for the JSSE / HttpsURLConnection path.

Exposed the CNG-backed X509ExtendedKeyManager alongside SSLContext so Netty, JDK HttpClient, and other transports can build their own TLS context.

Vinay Gera (g2vinay) · 2026-08-26T18:09:24Z

    private final AuthenticationResultMetadata metadata;
    private final Boolean isPopAuthorization;
+    private final String tokenType;
+    private final transient IMtlsBindingContext mtlsBindingContext;


Marking the binding context transient is correct since it is process-local and non-serializable. Worth confirming the persisted-cache path explicitly: when an mtls_pop entry is written to a persistent cache and later deserialized, this field comes back null. Please confirm that path fails closed, that is, the SDK never hands back an mtls_pop token without a live binding context (which would look like a usable token but cannot complete the mTLS handshake). Including key_id in the cache key hash is a good guard; a short test around deserialize-then-use would lock the behavior in.

Added fail-closed deserialization so an mtls_pop result cannot be restored or returned without its live process-local binding context, with coverage for the persisted-result path.

Vinay Gera (g2vinay) · 2026-08-26T18:09:24Z

+
+    static Path extractBundledLibrary() throws MtlsMsiException {
+        String architecture = System.getProperty("os.arch", "");
+        if (!"amd64".equalsIgnoreCase(architecture)


The clear typed failure for non-x64 is good and much better than a confusing link error. Since Windows on ARM is increasingly common for Azure VMs, it would help to note the arm64 roadmap here (bundle a second native or document the intended timeline) so consumers know whether they need to design a fallback for that platform today.

Documented Windows ARM64 as unsupported in this release; adding it requires an upstream ARM64 AttestationClientLib native artifact, so callers should retain a platform fallback for now.

Vinay Gera (g2vinay) · 2026-08-26T18:09:24Z

+            }
+
+            String actualHash = toHex(digest.digest());
+            if (!SHA256.equals(actualHash)) {


Good that the extracted DLL is integrity-checked. One gap: a pinned SHA-256 constant that ships in the same JAR as the DLL only proves the bytes match what this build embedded. If the JAR is repackaged, both the DLL and this constant move together, so the check still passes for a substituted binary. For a native library that performs attestation, consider also verifying the Authenticode signature (WinVerifyTrust) so the loaded DLL is proven Microsoft-signed independent of JAR integrity.

Added fail-closed WinVerifyTrust Authenticode validation before Native.load in addition to the pinned SHA-256 check, and locally confirmed the bundled DLL signer is Microsoft Corporation.

Vinay Gera (g2vinay) · 2026-08-26T18:09:24Z

+                                " native library is missing from the extension JAR.");
+            }
+
+            directory = Files.createTempDirectory("msal4j-keyguard-attestation-");


Extracting the native library to a temp directory and loading it by absolute path is the right approach and avoids PATH-based planting of the DLL itself. The residual Windows risk is dependency sideloading: when AttestationClientLib.dll loads, its own dependency DLLs can still be resolved from the load directory (this temp folder) under the default search order. Consider restricting the extraction directory ACLs to the current user and/or using the safe DLL search directory APIs, so a co-located planted dependency cannot be picked up.

Restricted the extraction directory ACL to the current Windows user and now fail closed when Windows ACL support is unavailable, while continuing to load the verified DLL by absolute path.

Vinay Gera (g2vinay) · 2026-08-26T18:09:24Z

+        } catch (RuntimeException e) {
+            MsalClientException wrapped = new MsalClientException(
+                    "The managed identity mTLS provider failed.",
+                    MsalError.MANAGED_IDENTITY_MTLS_REQUEST_FAILED);


Several very different conditions all collapse into MsalClientException with MANAGED_IDENTITY_MTLS_REQUEST_FAILED: permanent setup or config errors (wrong MI source, unsupported selector, a custom client missing the marker) and potentially transient runtime failures (the provider or attestation call failing here). A consumer that wants to fall back in a credential chain cannot distinguish "this will never work, stop" from "this failed once, maybe retry or move on" without string matching. Consider mapping permanent errors to a distinct code from transient ones (you already have MANAGED_IDENTITY_MTLS_PROVIDER_UNAVAILABLE, so extending that taxonomy would help) and preserving the underlying MtlsMsiException as the cause so the specific reason is not lost.

Added distinct permanent error codes for unsupported source/selector and custom HTTP clients, a dedicated minimum-strength error, retryable capability discovery, and preserved provider failures as the cause.

Vinay Gera (g2vinay) · 2026-08-26T18:09:24Z

+ * <p>Implementations must use {@link HttpRequest#sslSocketFactory()} when it is present
+ * and must not automatically follow redirects for that credential-bound request.</p>
+ */
+public interface IMtlsCapableHttpClient extends IHttpClient {


This marker means any existing custom IHttpClient fails closed for mTLS PoP until it is changed to implement IMtlsCapableHttpClient. That is a reasonable safety default, but it is a real friction point for consumers like Azure Identity, whose HttpPipelineAdapter implements IHttpClient and would otherwise silently lose mTLS support. Two asks: (1) call this out clearly in the changelog and migration notes as a required opt-in for custom clients, and (2) consider shipping a small default decorator that wraps a plain IHttpClient and applies HttpRequest.sslSocketFactory(), so integrators do not each reimplement the same socket-factory plumbing.

Documented the required IMtlsCapableHttpClient opt-in and migration path; I did not add a universal decorator because it cannot safely retrofit request-specific TLS into arbitrary Netty, OkHttp, or JDK transports.

Vinay Gera (g2vinay) · 2026-08-26T18:09:24Z

+    /**
+     * Returns a request-specific JSSE socket factory, when the request requires mTLS.
+     */
+    public SSLSocketFactory sslSocketFactory() {


SSLSocketFactory is a blocking, java.net.Socket-shaped abstraction. Custom IHttpClient implementations built on async or SSLEngine-based stacks (Netty, the JDK HttpClient, OkHttp) cannot consume an SSLSocketFactory directly, so this contract effectively limits request-scoped mTLS to blocking JSSE clients. Consider carrying the binding as an SSLContext (or the KeyManager) on the request so an async client can derive its own engine, or clearly document that mTLS PoP requires a JSSE-based IHttpClient.

HttpRequest now carries the request-specific SSLContext as well as the legacy SSLSocketFactory, and the binding exposes its X509ExtendedKeyManager for SSLEngine-based transports.

Add binding capability discovery and strength enforcement, expose transport-neutral TLS material, harden native loading, and expand local mTLS coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 30714a3c-b1e6-4578-8223-e07611e44e1d

Gladwin Johnson (gladjohn) requested a balanced review from Copilot August 16, 2026 01:00

Gladwin Johnson (gladjohn) requested a review from a team as a code owner August 16, 2026 01:00

Copilot started reviewing on behalf of Gladwin Johnson (gladjohn) August 16, 2026 01:00 View session

Copilot AI reviewed Aug 16, 2026

View reviewed changes

Gladwin Johnson (gladjohn) changed the title ~~Gladjohn/java msi v2 mtls binding context local~~ Add Managed Identity v2 KeyGuard mTLS PoP support Aug 16, 2026

Gladwin Johnson (gladjohn) force-pushed the gladjohn/java-msi-v2-mtls-binding-context-local branch 2 times, most recently from a5eec14 to e2b03ec Compare August 16, 2026 02:29

Add Managed Identity v2 KeyGuard mTLS PoP

a0b0785

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 30714a3c-b1e6-4578-8223-e07611e44e1d

Gladwin Johnson (gladjohn) force-pushed the gladjohn/java-msi-v2-mtls-binding-context-local branch from e2b03ec to a0b0785 Compare August 16, 2026 15:09

This was referenced Aug 21, 2026

Add SN/I certificate support over mTLS Proof-of-Possession (PoP) #1040

Draft

Add FIC Leg 2 over mTLS Proof-of-Possession (stacked on #1040) #1041

Draft

Vinay Gera (g2vinay) reviewed Aug 26, 2026

View reviewed changes

Uh oh!

Conversation

Gladwin Johnson (gladjohn) commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Architecture

Changes

Validation

Security properties

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Gladwin Johnson (gladjohn) commented Aug 16, 2026 •

edited

Loading