[Mark Brown (markjbrown)]

Summary

Update CODA to v0.17.14 Preview, cumulative since published v0.17.12 Preview. v0.17.13 was not released.

• Bundle methodology for all 24 detectors and make explain_finding work without a source checkout, with explicit errors for unreadable resources belonging to known detectors.
• Add VS Code/Copilot, Codex, Cursor, and Claude Code setup guidance for the shared Python MCP server, plus on-demand guidance for a finding's Agent Kit rule.
• Exercise actual MCP catalog/explanation calls and compare their results with the built wheel.
• DX-011: Use a 1,000 RU/s autoscale maximum baseline (100 RU/s when idle) and calculate recoverable capacity as 10% of the reducible maximum for dedicated containers and shared databases. Preserve the manual-throughput 400 RU/s minimum and avoid no-op reduction recommendations.
• DX-016: Include known single-region Strong accounts at the existing Medium severity. Clarify the account's one default consistency level and the session-token round trip through the web tier and end-user cookie/client context. Session does not replace Strong's global guarantees.
• DX-020: Add conditional Agent Kit guidance for dominant 404/409 create-if-absent investigation and 412 ETag investigation. Explain that non-429 errors are not necessarily client bugs; these links do not establish request sequences or missing concurrency control.
• DX-023: Clarify that Low severity means a reservation-review advisory, not low throughput or small savings, without changing policy.

Preview scope

Detection thresholds and DX-002 policy are unchanged. DX-020 detection, counting, severity, and thresholds remain unchanged; only its guidance and conditional rule mapping change. Data sources, Azure permissions, and diagnose-only operation are unchanged. No hosted service, automatic remediation, or PyPI publication is introduced.

Autoscale targets remain analytical, require resource-specific service validation, and do not guarantee savings. Single-region Bounded Staleness policy is unchanged. Conditional-create guidance is SDK-specific; unconditional upsert is not create-if-absent.

Earlier native offline MCP checks covered Windows with VS Code 1.144.0 and Codex 0.165.0; they do not establish acceptance of a new v0.17.14 public artifact. Cursor and Claude Code native runtime acceptance, model-provider/GUI flows, and live Azure diagnostics remain unverified. Fresh all-detector live acceptance and signed-in Portal-link verification remain deferred.

Validation

Fresh governed Preview export validation, reproducibility, and repository-settings checks passed. The pushed public tree matches the validated payload.

Required public GitHub CI checks are pending and must pass before merge. Offline/package checks do not establish live detector correctness. Tagging and Preview release publication remain separate gated steps.