[ESS DA GA] Connect Workday Skill

.github/copilot-instructions.md

@@ -21,6 +21,7 @@ For everything that isn't an attempt to use the kit (general questions, code exp
    - `/landing-page`
    - `/create`
    - `/connect`
+   - `/connect-workday`
    - `/delete`
    - `/evaluate`
    - `/run`

solutions/ess-maker-skills/.github/copilot-instructions.md

@@ -50,6 +50,14 @@ Respond with ONLY this exact message and nothing else:
   `flightCheckOnly: true`, proceed with `src/skills/flightcheck/SKILL.md`.
   This exception applies only to `/flightcheck`; every other command remains
   gated.
+- If the user typed `/connect`, allow the command after **local workspace
+  materialization**, even when runtime `connect_ready` is false. Require
+  `schema_version: 4`, resolve `.local/config.json` `activeAgent` to the
+  canonical agent whose `agent.workspace_slug` matches, and require canonical
+  workspace evidence plus `steps.SETUP-07.state: "done"`. Connector readiness
+  is intentionally not a prerequisite because `/connect` is the workflow that
+  resolves product-extension connection gaps. If materialization is incomplete,
+  show the setup message above and stop.
 
 **Except for the cases above, this gate applies to ALL user messages** —
 including "hello", "hi", "help",
@@ -79,8 +87,9 @@ After canonical DA setup is complete:
   available;
 - never run Dataverse push, publish, deletion, or server-backed validation
   instructions; explain that DA-GA deployment is not yet available;
-- `/connect` and integration troubleshooting require the corresponding DA-GA
-  product extension guidance, which is not yet available;
+- `/connect workday` uses the checked-in ESS DA HR Workday extension guidance;
+  unsupported products or agent verticals must stop at their explicit routing
+  boundary;
 - `/backup-template-configs` and `/restore-template-configs` are no longer
   supported because they belonged to the retired Dataverse-based agent model;
 - `/flightcheck` may run only its local-files scope.

solutions/ess-maker-skills/.github/prompts/connect-workday.prompt.md

@@ -0,0 +1,11 @@
+---
+mode: agent
+description: "Connect the active ESS HR agent to Workday"
+---
+
+# Connect Workday
+
+Follow the same setup-state check and execution rules as
+`.github/prompts/connect.prompt.md`, with `workday` supplied as the selected
+integration. Then read `src/skills/connect/SKILL.md` and continue without
+asking which system to connect.

solutions/ess-maker-skills/.github/prompts/connect.prompt.md

@@ -1,22 +1,22 @@
 ---
 mode: agent
-description: "Check DA-GA product extension setup availability"
+description: "Connect Workday or another supported integration"
 ---
 
 # Connect
 
-**Setup-state check.** Read `.local/setup/config.json` and `.local/config.json`. If canonical state does not have `schema_version: 4` and an `agents` entry matching the active workspace slug with `connect_ready: true`, show:
+**Setup-state check.** Read `.local/setup/config.json` and `.local/config.json`.
+Resolve `activeAgent` to the canonical agent whose `agent.workspace_slug`
+matches. Continue when canonical state has `schema_version: 4`, complete
+workspace evidence, and `steps.SETUP-07.state: "done"`. Do not require
+`connect_ready: true`; this command configures the product-extension
+connections that may currently block runtime readiness. If local workspace
+materialization is incomplete, show:
 
 > Welcome to the ESS Maker Kit. Before running `/connect`, type `/setup` to set up your environment.
 
 and STOP. Otherwise proceed.
 
-Show:
-
-> DA-GA connector setup requires the corresponding product extension. Extension setup is not yet available in this release.
-
-and STOP.
-
 You are a script executor. Read `src/skills/connect/SKILL.md` (a short
 router file) and follow it. It will tell you which step file to read next.
 Each step file contains pre-written messages between **Message:** and

solutions/ess-maker-skills/.github/prompts/menu.prompt.md

@@ -14,7 +14,8 @@ Here's what I can help you with:
 | Command | What it does |
 |---------|-------------|
 | `/landing-page` | Configure the branding and content employees see when they open the ESS agent |
-| `/connect` | Show the DA-GA product extension requirement |
+| `/connect-workday` | Connect the active ESS HR agent to Workday |
+| `/connect` | Choose an available integration |
 | `/create` | Create a topic, workflow, or evaluation test set locally |
 | `/update` | Update a topic, workflow, or evaluation test set locally |
 | `/delete` | Show DA-GA deletion availability |

solutions/ess-maker-skills/README.md

@@ -245,6 +245,9 @@ Connect your agent to ServiceNow for IT tickets, HR cases, and service catalog i
 
 Connect your agent to Workday for employee data, compensation, time off, and org lookups. Run `/connect workday` to start.
 
+For Declarative Agents, this release supports the **ESS HR Agent**. Workday
+integration with the ESS IT Agent is not supported in this release.
+
 **Two supported install paths** — the kit detects which one applies and routes automatically:
 
 - **Simplified** (Microsoft's default for new installs) — just one Workday connection (OAuthUser via Entra ID) plus Dataverse. No ISU service accounts, security groups, or custom reports. User context comes from the Workday REST `/workers/me` endpoint.
@@ -268,6 +271,27 @@ Connect your agent to Workday for employee data, compensation, time off, and org
 
 **Verify-first approach:** The kit runs API checks against your Workday tenant before asking you to configure anything. On the legacy path, if ISU accounts, auth policies, permissions, or the RaaS report are already set up (common on shared tenants), those tasks are automatically skipped.
 
+**Test and production deployment:** `/connect workday` is the development
+environment experience. After the ESS DA HR agent and Workday package are
+deployed to Test or Production, an administrator runs the post-deployment
+Dataverse authorization script for that target environment. See
+[`scripts/alm/README.md`](scripts/alm/README.md) for the required parameters,
+safe preview, execution, and verification procedure.
+
+For ESS DA HR in development, `/connect workday` also guides the maker through
+the OAuthUser and Dataverse references, shared connection parameters,
+stale-connection recovery, flow enablement, bot-to-flow authorization, V2
+employee context, topic selection, firewall readiness, and a signed-in
+end-to-end Workday scenario. Settings without a reliable DA-scoped API require
+explicit maker or administrator confirmation rather than being reported as
+automatically verified.
+
+At the beginning of the experience, the skill presents the complete setup plan
+and identifies when an Entra administrator, Workday administrator, Power
+Platform/Dataverse administrator, InfoSec administrator, or Workday test user
+is required. This lets the maker arrange the required participants before the
+setup reaches a permission-dependent step.
+
 **What you can build after connecting:**
 - Look up employee information, compensation, service anniversary, cost center
 - Check time off balances and request time off