microsoft
diff --git a/‎CHANGELOG.md‎
Lines changed: 4 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎docs/src/content/docs/reference/lockfile-spec.md‎
Lines changed: 5 additions & 0 deletions b/‎docs/src/content/docs/reference/lockfile-spec.md‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎scripts/lint-architecture-boundaries.sh‎
Lines changed: 12 additions & 0 deletions b/‎scripts/lint-architecture-boundaries.sh‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎src/apm_cli/deps/git_semver_resolver.py‎
Lines changed: 7 additions & 1 deletion b/‎src/apm_cli/deps/git_semver_resolver.py‎
Lines changed: 7 additions & 1 deletion
diff --git a/‎src/apm_cli/deps/lockfile.py‎
Lines changed: 7 additions & 2 deletions b/‎src/apm_cli/deps/lockfile.py‎
Lines changed: 7 additions & 2 deletions
diff --git a/‎src/apm_cli/install/helpers/ref_reuse.py‎
Lines changed: 5 additions & 0 deletions b/‎src/apm_cli/install/helpers/ref_reuse.py‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎src/apm_cli/marketplace/ref_resolver.py‎
Lines changed: 114 additions & 25 deletions b/‎src/apm_cli/marketplace/ref_resolver.py‎
Lines changed: 114 additions & 25 deletions
@@ -20,6 +20,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Azure DevOps dependencies now report real latest versions in `apm outdated`
+  and resolve correctly during bounded `apm update`, deriving transport
+  coordinates from generic `host` and `repo_url` identity without
+  provider-specific lock fields. (closes #2197; #2226)
 - Govern policy cache freshness now honors the effective policy's `cache.ttl`;
   bounded property coverage protects all 39 enforceable fields, cold/warm parity,
   canonical serialization, and last-good bytes after malformed refreshes. (#2235)
 
@@ -182,6 +182,11 @@ Each item in `dependencies` describes one resolved package.
 Fields are emitted only when set. A minimal entry is just `repo_url` plus
 `resolved_commit`.
 
+Azure DevOps uses the same generic `host` and `repo_url` fields as every other
+Git provider. APM derives its transient organization, project, and repository
+coordinates when reconstructing the dependency reference; no ADO-specific
+fields are persisted.
+
 ## Lockfile identity keys
 
 Lockfile dependency keys keep `github.com` implicit for migration stability:
 
@@ -562,6 +562,18 @@ if ! grep -q 'transport_plan = transport_selector.select(' "$semver_transport_ro
     violations=$((violations + 1))
 fi
 
+echo "[*] AC14: ADO lock-coordinate authority"
+if ! grep -q 'with_derived_provider_coordinates' \
+    src/apm_cli/deps/lockfile.py \
+    || grep -Eq 'ado_(organization|project|repo)' src/apm_cli/deps/lockfile.py \
+    || ! grep -q 'DependencyReference.canonical_ado_coordinates' \
+        src/apm_cli/marketplace/ref_resolver.py \
+    || grep -Eq '(self\.)?repo_url\.split\(' src/apm_cli/deps/lockfile.py \
+    || grep -Eq 'owner_repo\.split\(' src/apm_cli/marketplace/ref_resolver.py; then
+    echo "[x] ADO coordinates must be derived by DependencyReference, never persisted"
+    violations=$((violations + 1))
+fi
+
 if [ "$violations" -gt 0 ]; then
     echo "[x] $violations architecture boundary rule(s) failed"
     exit 1
 
@@ -219,6 +219,7 @@ def resolve(
         owner_repo: str,
         package_name: str,
         constraint: str,
+        remote_url: str | None = None,
         tag_patterns: Sequence[str] = DEFAULT_TAG_PATTERNS,
         now_iso: str | None = None,
     ) -> GitSemverResolution:
@@ -235,6 +236,8 @@ def resolve(
         constraint:
             Semver range (e.g. ``"^1.2.0"``, ``"~2.1"``, ``">=1.0 <2.0"``)
             or exact version (``"1.2.3"``).
+        remote_url:
+            Canonical ADO URL supplied by ``DependencyReference``.
         tag_patterns:
             Ordered tag patterns to try.  Defaults to
             :data:`DEFAULT_TAG_PATTERNS`.  A bare-version fallback
@@ -256,7 +259,10 @@ def resolve(
             When no tag on the remote satisfies the constraint after
             trying the default patterns and the bare-version fallback.
         """
-        refs = self._ref_resolver.list_remote_refs(owner_repo)
+        if remote_url is None:
+            refs = self._ref_resolver.list_remote_refs(owner_repo)
+        else:
+            refs = self._ref_resolver.list_remote_refs(owner_repo, remote_url=remote_url)
         primary_patterns = tuple(tag_patterns)
         # Two-pass: try the author-supplied patterns first; only if they
         # find zero candidates do we widen to the bare-version fallback.
 
@@ -403,7 +403,11 @@ def from_dict(cls, data: dict[str, Any]) -> LockedDependency:
             # legacy migration key handled above
             "deployed_skills",
         }
-        unknown_fields = {k: v for k, v in data.items() if k not in _known_keys}
+        unknown_fields = {
+            k: v
+            for k, v in data.items()
+            if k not in _known_keys and not DependencyReference.is_transient_provider_field(k)
+        }
 
         return cls(
             repo_url=data["repo_url"],
@@ -532,6 +536,7 @@ def from_dependency_ref(
         else:
             resolved_ref_val = dep_ref.reference
 
+        dep_ref.validate_provider_coordinates()
         if registry_resolution is not None:
             version_value = registry_resolution.version
         elif git_semver_resolution is not None:
@@ -617,7 +622,7 @@ def to_dependency_ref(self) -> DependencyReference:
             source=self.source,
             skill_subset=sorted(self.skill_subset) if self.skill_subset else None,
             target_subset=sorted(self.target_subset) if self.target_subset else None,
-        )
+        ).with_derived_provider_coordinates()
 
 
 @dataclass
 
@@ -148,6 +148,11 @@ def maybe_resolve_git_semver(
         owner_repo=owner_repo,
         package_name=package_name,
         constraint=constraint,
+        remote_url=(
+            dep_ref.to_github_url()
+            if transport_scheme == "https" and dep_ref.is_azure_devops()
+            else None
+        ),
     )
 
 
 
@@ -21,6 +21,7 @@
 import subprocess
 import threading
 import time
+import urllib.parse
 from dataclasses import dataclass
 
 from ..utils.github_host import (
@@ -50,6 +51,49 @@
 _SHA_RE = re.compile(r"^[0-9a-f]{40}$")
 
 
+# Local import below avoids a dependency-model import cycle at module load time.
+def _ado_coordinates_from_owner_repo(
+    *,
+    host: str,
+    owner_repo: str,
+) -> tuple[str, str, str]:
+    """Return validated ADO coordinates from the canonical dependency owner."""
+    from apm_cli.models.dependency.reference import DependencyReference
+
+    try:
+        return DependencyReference.canonical_ado_coordinates(host, owner_repo)
+    except ValueError as exc:
+        if "/_git/" in owner_repo:
+            try:
+                dep_ref = DependencyReference.parse(f"https://{host}/{owner_repo}")
+                return DependencyReference.canonical_ado_coordinates(
+                    dep_ref.host,
+                    dep_ref.repo_url,
+                )
+            except ValueError:
+                pass
+        raise GitLsRemoteError(
+            package=owner_repo,
+            summary="Azure DevOps resolution requires org/project/repo coordinates.",
+            hint=(
+                "Re-add the dependency with the original Azure DevOps URL "
+                "to regenerate the lock entry."
+            ),
+        ) from exc
+
+
+def _ado_remote_path_for_coordinates(
+    organization: str,
+    project: str,
+    repo: str,
+) -> str:
+    """Return the canonical HTTPS path for ADO coordinates."""
+    quoted_org = urllib.parse.quote(organization, safe="")
+    quoted_project = urllib.parse.quote(project, safe="")
+    quoted_repo = urllib.parse.quote(repo, safe="")
+    return f"/{quoted_org}/{quoted_project}/_git/{quoted_repo}"
+
+
 @dataclass(frozen=True)
 class RemoteRef:
     """A single ref returned by ``git ls-remote``."""
@@ -72,7 +116,7 @@ class _CacheEntry:
 
 
 class RefCache:
-    """In-memory cache keyed on ``owner/repo``.
+    """In-memory cache keyed on the effective remote identity.
 
     TTL defaults to 5 minutes.  Not thread-safe on its own; callers
     should use external synchronisation (``RefResolver`` does this via
@@ -201,7 +245,12 @@ def _remote_lock(self, owner_repo: str) -> threading.Lock:
                 self._remote_locks[owner_repo] = threading.Lock()
             return self._remote_locks[owner_repo]
 
-    def _git_url_and_env(self, owner_repo: str) -> tuple[str, dict[str, str]]:
+    def _git_url_and_env(
+        self,
+        owner_repo: str,
+        *,
+        remote_url: str | None = None,
+    ) -> tuple[str, dict[str, str]]:
         """Build the remote URL and auth environment for one git operation."""
         use_ssh = self._transport_scheme == "ssh"
         requested_bearer = self._auth_scheme == "bearer"
@@ -215,20 +264,10 @@ def _git_url_and_env(self, owner_repo: str) -> tuple[str, dict[str, str]]:
         bearer = requested_bearer and ado_host and not use_ssh
         url_token = None if requested_bearer or use_ssh else self._token
         if use_ssh and ado_host:
-            parts = owner_repo.split("/")
-            if len(parts) == 4 and parts[2] == "_git":
-                org, project, repo = parts[0], parts[1], parts[3]
-            elif len(parts) == 3:
-                org, project, repo = parts
-            else:
-                raise GitLsRemoteError(
-                    package=owner_repo,
-                    summary=(
-                        "Azure DevOps SSH resolution requires org/project/repo "
-                        f"coordinates; got '{owner_repo}'."
-                    ),
-                    hint="Use a standard Azure DevOps dependency URL.",
-                )
+            org, project, repo = _ado_coordinates_from_owner_repo(
+                host=self._host,
+                owner_repo=owner_repo,
+            )
             ssh_host = "ssh.dev.azure.com" if self._host == "dev.azure.com" else self._host
             url = build_ado_ssh_url(org, project, repo, host=ssh_host)
         elif use_ssh:
@@ -238,6 +277,40 @@ def _git_url_and_env(self, owner_repo: str) -> tuple[str, dict[str, str]]:
                 port=self._port,
                 user=self._ssh_user,
             )
+        elif remote_url is not None:
+            parsed_remote = urllib.parse.urlparse(remote_url)
+            expected_ado_path = (
+                _ado_remote_path_for_coordinates(
+                    *_ado_coordinates_from_owner_repo(host=self._host, owner_repo=owner_repo)
+                )
+                if ado_host
+                else None
+            )
+            # urlparse lowercases hostname per RFC 3986 3.2.2; normalize both sides.
+            if (
+                not ado_host
+                or parsed_remote.scheme != "https"
+                or parsed_remote.hostname != self._host.lower()
+                or parsed_remote.path != expected_ado_path
+                or parsed_remote.username is not None
+                or parsed_remote.password is not None
+                or parsed_remote.query
+                or parsed_remote.fragment
+            ):
+                raise GitLsRemoteError(
+                    package=owner_repo,
+                    summary=(
+                        "The canonical remote URL does not match the configured host "
+                        "or Azure DevOps dependency coordinates."
+                    ),
+                    hint=(
+                        "Re-add the dependency with the original Azure DevOps URL "
+                        "to regenerate the lock entry."
+                    ),
+                )
+            # ADO HTTPS intentionally keeps credentials out of the URL; auth
+            # is injected below through git http.extraheader.
+            url = remote_url
         elif ado_host:
             url = f"https://{self._host}/{owner_repo}"
         else:
@@ -274,7 +347,12 @@ def _git_url_and_env(self, owner_repo: str) -> tuple[str, dict[str, str]]:
             env.update(build_authorization_header_git_env("Basic", credential))
         return url, env
 
-    def list_remote_refs(self, owner_repo: str) -> list[RemoteRef]:
+    def list_remote_refs(
+        self,
+        owner_repo: str,
+        *,
+        remote_url: str | None = None,
+    ) -> list[RemoteRef]:
         """Fetch all tags and heads from the configured Git host.
 
         Results are cached; subsequent calls for the same remote return
@@ -284,6 +362,10 @@ def list_remote_refs(self, owner_repo: str) -> list[RemoteRef]:
         ----------
         owner_repo:
             ``"owner/repo"`` string (no host, no ``.git`` suffix).
+        remote_url:
+            Canonical ADO URL from ``DependencyReference.to_github_url``.
+            Pass consistently for the same logical remote within one
+            ``RefResolver`` lifetime so cache identity stays aligned.
 
         Returns
         -------
@@ -297,17 +379,18 @@ def list_remote_refs(self, owner_repo: str) -> list[RemoteRef]:
         GitLsRemoteError
             When the ``git ls-remote`` subprocess fails.
         """
-        lock = self._remote_lock(owner_repo)
+        cache_key = remote_url or owner_repo
+        lock = self._remote_lock(cache_key)
         with lock:
             # Check cache first
-            cached = self._cache.get(owner_repo)
+            cached = self._cache.get(cache_key)
             if cached is not None:
                 return cached
 
             if self._offline:
-                raise OfflineMissError(package="", remote=owner_repo)
+                raise OfflineMissError(package="", remote=cache_key)
 
-            url, env = self._git_url_and_env(owner_repo)
+            url, env = self._git_url_and_env(owner_repo, remote_url=remote_url)
             try:
                 result = subprocess.run(
                     ["git", "ls-remote", "--tags", "--heads", url],
@@ -329,9 +412,13 @@ def list_remote_refs(self, owner_repo: str) -> list[RemoteRef]:
                     hint=f"Ensure git is installed and on PATH. Error: {exc}",
                 )
 
-            fallback_refs = self._retry_rejected_ado_pat(result, owner_repo)
+            fallback_refs = self._retry_rejected_ado_pat(
+                result,
+                owner_repo,
+                remote_url=remote_url,
+            )
             if fallback_refs is not None:
-                self._cache.put(owner_repo, fallback_refs)
+                self._cache.put(cache_key, fallback_refs)
                 return fallback_refs
 
             if result.returncode != 0:
@@ -355,13 +442,15 @@ def list_remote_refs(self, owner_repo: str) -> list[RemoteRef]:
                 )
 
             refs = _parse_ls_remote_output(result.stdout)
-            self._cache.put(owner_repo, refs)
+            self._cache.put(cache_key, refs)
             return refs
 
     def _retry_rejected_ado_pat(
         self,
         result: subprocess.CompletedProcess,
         owner_repo: str,
+        *,
+        remote_url: str | None = None,
     ) -> list[RemoteRef] | None:
         """Retry one rejected ADO basic credential with an Azure CLI bearer."""
         eligible = (
@@ -396,7 +485,7 @@ def _bearer_op(bearer: str) -> list[RemoteRef]:
                 git_env=bearer_env,
             )
             try:
-                return resolver.list_remote_refs(owner_repo)
+                return resolver.list_remote_refs(owner_repo, remote_url=remote_url)
             finally:
                 resolver.close()