Slice 4: azurex adapters + jotsmith doctor (read-only)

[MaxAnderson95]

What to build

Stand up internal/azurex — thin adapters over the Azure SDK for the read paths every subsequent slice will need — and ship jotsmith doctor in its read-only form (no --repair, no --json yet). This is the first slice that actually talks to Azure, so it earns its keep by exercising credential resolution, control-plane reads, data-plane blob reads, and Key Vault reads in one go.

Read-only by design: no Azure writes happen in this slice. Repair and JSON output are deferred to a later slice so this one can ship without committing to repair semantics.

Acceptance criteria

• internal/azurex exposes adapters for:
  • DefaultAzureCredential resolution (with diagnostic detail on which chain step matched)
  • Subscription Get (ARM)
  • Storage Account Get (ARM) and static-website status read
  • Blob Get for $web/<discovery_path> and $web/<jwks_path>
  • Key Vault control-plane Get (to check RBAC mode)
  • Key Vault data-plane GetKey
• Adapter functions take a context.Context and return typed errors that wrap underlying SDK errors with the Azure resource identity being operated on
• jotsmith doctor runs every check from PRD §6.6, printing [PASS] / [WARN] / [FAIL] + a brief reason to stderr per check
• Refuses to proceed against a KV in legacy access-policy mode with a clear FAIL message
• Detects mismatch between SA PrimaryEndpoints.Web and config issuer — FAIL with both URLs in the message
• Reports missing blobs (e.g. discovery doc not yet uploaded) as FAIL, not a crash
• End-to-end mint+verify check from PRD §6.6 is included but marked optional (off by default in this slice)
• Exit 0 if every check is PASS or WARN; exit 1 if any FAIL
• Code review confirms no Create* / Upload* / Set* / Update* SDK calls
• Integration test behind //go:build integration documents required env vars and minimum RBAC in the package doc comment

Blocked by

• Slice 2: config package + jotsmith config show #2 — config package and config show

Originally created in OpenCode session ID: ses_17ca8efd8ffexLcFSysAMDVNBQ

[MaxAnderson95]

Implemented and merged in #14.

Originally created in OpenCode session ID: ses_17c986ef9ffeHc0S3r1wQcmLDT