[ESS DA GA] Connect Workday Skill

[Surendra Goutham (is-goutham)]

Description

Adds  /connect workday  support for ESS DA agents, including architecture-aware routing, Workday extension package installation for HR and IT, Entra and Workday tenant configuration guidance, resumable validation, and honest configuration status reporting.

Also introduces safer per-agent lifecycle handling for existing CEA Workday integrations, including scoped validation, explicit publish approval, and rollback support.

Related issue

• N/A

Type of change

• Bug fix (non-breaking change which fixes an issue)
✓ New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
✓ Documentation update
✓ Refactor / cleanup

Testing

• Focused Connect Workday and FlightCheck tests: 96 passed
• Full test suite: 2,344 passed, 14 skipped
• The remaining 11 installer-related failures are pre-existing and reproducible on  main .

Checklist

✓ My code follows the existing style
✓ I have added/updated tests where applicable
✓ I have updated documentation as needed

Static validation (samples/ only)

Validation
• YAML parse: N/A
• AdaptiveDialog kind: N/A
• XML parse: N/A
• Filename convention (new): N/A
• Folder convention (new, incl. README.md): N/A
• Diff scope (samples/ only): N/A
• Secrets / internal URLs: N/A

[Copilot]

🟡 Changes recommended

Lifecycle regression handling, routing, readiness persistence, and Dataverse authorization contain blocking correctness and security issues.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds architecture-aware /connect workday support for ESS Declarative Agents and safer per-agent CEA lifecycle handling.

Changes:

• Adds DA HR Workday setup, validation, installation, and authorization workflows.
• Introduces resumable CEA lifecycle state, scoped validation, rollback, and publishing approval.
• Expands FlightCheck and automated tests for DA packages and active-agent scoping.

File summaries

File	Description
tests/setup/test_setup_router.py	Tests architecture-aware routing.
tests/scripts/test_install_workday_da_extension.py	Tests DA package installation.
tests/scripts/test_checkpoint.py	Tests named scoped rollback.
tests/flightcheck/test_cli.py	Tests DA scope isolation.
tests/flightcheck/test_cli_single_checkpoint.py	Tests config overlays and agent scoping.
tests/flightcheck/checks/test_workday_extension.py	Tests active-agent validation.
tests/flightcheck/checks/test_workday_da.py	Tests DA package checks.
tests/flightcheck/checks/test_entra_app.py	Tests architecture-specific Entra hints.
solutions/ess-maker-skills/src/skills/setup/workday-da/verify-connection.md	Defines final runtime validation.
solutions/ess-maker-skills/src/skills/setup/workday-da/tasks.md	Defines the DA checklist.
solutions/ess-maker-skills/src/skills/setup/workday-da/SKILL.md	Orchestrates DA Workday setup.
solutions/ess-maker-skills/src/skills/setup/workday-da/shared/permission-gate.md	Defines shared role gates.
solutions/ess-maker-skills/src/skills/setup/workday-da/shared/connection-fields.md	Defines connection-field validation.
solutions/ess-maker-skills/src/skills/setup/workday-da/shared/config-schema.md	Documents DA state schema.
solutions/ess-maker-skills/src/skills/setup/workday-da/shared/checklist-updater.md	Persists checklist progress.
solutions/ess-maker-skills/src/skills/setup/workday-da/provision-entra-app.md	Guides Entra provisioning.
solutions/ess-maker-skills/src/skills/setup/workday-da/install-extension.md	Guides DA package installation.
solutions/ess-maker-skills/src/skills/setup/workday-da/configure-tenant.md	Guides Workday tenant setup.
solutions/ess-maker-skills/src/skills/setup/workday-da/configure-power-platform.md	Guides Power Platform integration.
solutions/ess-maker-skills/src/skills/connect/workday/SKILL.md	Starts installed CEA lifecycle.
solutions/ess-maker-skills/src/skills/connect/workday/contract.json	Defines Workday lifecycle phases.
solutions/ess-maker-skills/src/skills/connect/workday/actions/wire-user-context-redirect.md	Wires and publishes user context.
solutions/ess-maker-skills/src/skills/connect/steps.md	Documents architecture routing.
solutions/ess-maker-skills/src/skills/connect/step1.md	Implements integration routing.
solutions/ess-maker-skills/src/skills/connect/SKILL.md	Documents connect dispatch.
solutions/ess-maker-skills/src/skills/connect/shared/lifecycle-runner.md	Implements resumable lifecycles.
solutions/ess-maker-skills/src/skills/connect/shared/lifecycle-contract-schema.md	Documents lifecycle contracts.
solutions/ess-maker-skills/scripts/install_workday_da_extension.py	Installs the DA extension package.
solutions/ess-maker-skills/scripts/flightcheck/registry.py	Registers the DA checkpoint.
solutions/ess-maker-skills/scripts/flightcheck/cli.py	Adds config and agent arguments.
solutions/ess-maker-skills/scripts/flightcheck/checks/workday_tenant.py	Generalizes provider config messaging.
solutions/ess-maker-skills/scripts/flightcheck/checks/workday_extension.py	Scopes checks to one agent.
solutions/ess-maker-skills/scripts/flightcheck/checks/workday_da.py	Validates DA package presence.
solutions/ess-maker-skills/scripts/flightcheck/checks/_workday_app_assignment.py	Isolates explicit provider overlays.
solutions/ess-maker-skills/scripts/checkpoint.py	Adds named, path-scoped restoration.
solutions/ess-maker-skills/scripts/alm/README.md	Documents target-environment authorization.
solutions/ess-maker-skills/scripts/alm/Enable-CosmosDAFlowAuthorization.ps1	Provisions Dataverse flow authorization.
solutions/ess-maker-skills/README.md	Documents DA Workday support.

Review details

Suppressed comments (1)

solutions/ess-maker-skills/scripts/alm/Enable-CosmosDAFlowAuthorization.ps1:278

• When the lookup returns multiple teams, this prints [FAIL] but leaves $ok true. If the first team has the requested shares, the script exits 0 even though the documented success condition requires exactly one team and Flow-RP will choose ambiguously. Mark every count other than one as a failed verification.

} else {
    Write-Fail "GetTeamsForBotId returned $($teamCheck.Count) teams; Flow-RP takes the first and expects exactly one"
    if ($teamCheck.Count -eq 0) { $ok = $false }

• Files reviewed: 38/38 changed files
• Comments generated: 10
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Surendra Goutham (is-goutham)]

Kept the Microsoft PowerShell file unchanged; setup now blocks missing authorization/team creation until a corrected script is available.

[Surendra Goutham (is-goutham)]

Superseded by the focused replacement PR stack:

• Add named and scoped checkpoint restore #300 — checkpoint and rollback utility
• Add provider-scoped FlightCheck execution #301 — targeted FlightCheck execution
• Add resumable connect lifecycle framework #302 — generic connect lifecycle
• Add Workday DA package discovery #303 — Workday DA discovery and routing guards
• Add ring-aware Workday runtime installer #305 — ring-aware Workday runtime installer
• Add Dataverse flow authorization automation #306 — Dataverse flow authorization automation
• Add resumable Workday DA setup foundation #307 — resumable Workday setup foundation
• Add end-to-end Workday DA setup orchestration #308 — end-to-end Workday DA setup orchestration
• Expose Workday setup commands and maker guidance #309 — command discovery and maker documentation

The replacement stack was reconstructed from the validated final tree rather than cherry-picking the intertwined commits. It also adds fail-closed authorization cardinality checks, validates fallback Dataverse tokens, excludes unrelated telemetry/CLI cosmetic changes, and keeps the setup PR boundaries independently reviewable.

Validation: all focused Workday/setup suites pass; the repository-wide run completed with 2,579 passed and 15 skipped. The remaining 11 installer-launch failures reproduce on the current main-based branch and are unrelated to this Workday stack.

[nkemms]

Review: Request changes

The foundation-to-connect handoff is directionally correct: /connect can run after workspace materialization without requiring connect_ready: true, and the active agent is resolved from canonical setup state. Several state, routing, and mutation paths remain unsafe, however, and can report readiness for the wrong agent, direct administrators to configure the wrong identifier, or mutate ambiguous Dataverse authorization records.

1. DA Workday readiness is not scoped to the active agent

Files: src/skills/connect/step1.md, src/skills/setup/workday-da/shared/config-schema.md

DA Workday state is stored globally in .local/connect/workday-da/config.json, including status: "ready" and every DA* checklist row. The operations completing those rows—agent authorization, topic selection, and signed-in runtime validation—are performed for the active bot.

In a multi-agent workspace, completing Workday for agent A and then selecting agent B allows agent B to consume agent A’s readiness without having its own authorization, topic wiring, or runtime validation.

Required change: Separate environment-shared Workday configuration from per-agent progress and readiness. Store agent-specific state under a stable agent key such as .local/connect/workday-da/agents/{agentSlug}/..., bind it to the canonical bot identity, and resolve that identity on every run.

2. Workday’s SAML identifier is conflated with the OAuth App ID URI

Files: src/skills/setup/workday-da/configure-tenant.md, scripts/flightcheck/checks/workday_tenant.py, src/skills/setup/workday-da/shared/connection-fields.md

The connection reference correctly distinguishes:

• OAuth Application ID URI: api://{entraAppId}
• Workday SAML Service Provider/resource identifier: http://www.workday.com/{tenant}

The tenant guidance and WD-TENANT-001 nevertheless instruct administrators to match Workday’s SAML Service Provider ID to appIdUri. That can reject a valid federation or lead an administrator to configure the wrong identifier.

Required change: Persist and validate separate appIdUri and workdaySamlIdentifier values. Use the SAML identifier for Workday SP/resource configuration and the App ID URI only for the exposed OAuth scope.

3. The /connect prompt requires nonexistent state

File: .github/prompts/connect.prompt.md

The prompt says its first action after loading the router is to inspect .local/connect/steps.md and render a checklist from a “Fresh Start” section. Neither exists; the actual routing authority is src/skills/connect/SKILL.md followed by src/skills/connect/step1.md.

This can derail /connect before the real router executes.

Required change: Remove the stale paragraph and keep connect/SKILL.md plus connect/step1.md as the routing authority.

4. /connect-workday can be blocked by the global setup gate

Files: .github/copilot-instructions.md, .github/prompts/connect-workday.prompt.md

The mandatory global gate exempts exact /connect when workspace materialization is complete but connect_ready is false. It then states that the gate applies to all other messages.

A user invoking /connect-workday can therefore be redirected to /setup before connect-workday.prompt.md gets the opportunity to delegate to /connect. This is precisely the state in which Workday connection setup may be needed to make connect_ready true.

Required change: Register /connect-workday in the global gate as an exact alias of /connect workday, using the same schema-version, active-agent, workspace-evidence, and SETUP-07 requirements.

5. The authorization script mutates the first linked team before proving uniqueness

File: scripts/alm/Enable-CosmosDAFlowAuthorization.ps1

When multiple teams are linked to a bot, the script selects the first returned team and can grant it workflow access. Final verification prints [FAIL] for counts other than one, but only sets $ok = $false when the count is zero; multiple teams can therefore still produce exit code 0.

The guided playbook performs a protective preflight, but the script is also documented as an independently executable post-deployment tool.

Required change: Fail closed before mutation unless delegated authorization and the linked Access team are unambiguous. Treat every final team count other than one as failure and add behavioral coverage for zero, one, and multiple linked teams.

6. Failed FlightCheck startup can leave stale passing evidence

Files: scripts/flightcheck/cli.py, src/skills/setup/workday-da/install-extension.md, src/skills/setup/workday-da/shared/checklist-updater.md

Single-checkpoint execution can exit before save_results() on malformed configuration, interruption, or other startup failures. The previous shared workspace/flightcheck/results.json remains in place, while the Workday playbooks read that file as though it came from the command just executed.

A stale PASSED result can therefore advance a setup row after the current invocation failed.

Required change: Write checkpoint output to an invocation-specific location, or add an atomic result envelope containing a run ID, requested checkpoint, timestamp, and completion status. Consumers must verify that the result belongs to the current invocation before changing state.

Additional required corrections

• Bind sidecar identity more strongly. The installer correctly passes the selected Dataverse URL through PAC’s explicit --environment argument, so the target is not unconstrained. Persist the sidecar environment ID and tenant ID alongside the URL, however, and verify that identity before later PAC, Dataverse, connection, flow, or authorization operations.
• Normalize checklist gate metadata. The documented gate enum is prog | manual | attest | advisory, but checklist rows contain composite prose such as prog, else manual, prog instantiate..., and manual/attest. Keep the machine-readable field to one enum value and represent fallback behavior separately.
• Add bounded authorization operations. Dataverse HTTP calls and the az/Python authentication subprocesses need explicit timeouts. Retry only idempotent transient reads.
• Avoid emitting bearer tokens from the helper. The current caller captures and filters the marker, but direct helper execution writes the token to stdout. Keep token acquisition and Dataverse requests in one process or use a restricted transport.
• Reconcile the public support contract. The README says product-extension setup is unavailable and reference-only, while later sections advertise an executable DA Workday setup. It also describes legacy CEA setup as fully supported even though the router rejects fresh and full/legacy CEA setup.
• Add behavioral handoff coverage. Current routing tests largely assert Markdown phrases. Cover active-agent resolution, false connect_ready, malformed canonical state, multi-agent switching, and per-agent Workday readiness through a deterministic resolver or equivalent executable boundary.