Add resumable Workday DA setup foundation

[Surendra Goutham (is-goutham)]

Summary

• define durable Workday DA setup state and a readable 21-row checklist
• centralize manual/attestation completion rules, role gates, and connection-field validation
• add guarded Entra provisioning with tenant pinning and exact app matching
• add ordered Workday tenant guidance with explicit administrator attestations
• keep the foundation unrouted until the orchestration PR lands

Validation

• python -m pytest tests/setup -q (51 passed)
• git diff --check

Stacked on #305. The independent flow-authorization dependency is in #306 and will be integrated by the orchestration branch.

[nkemms]

Review summary

• Adds a resumable Workday DA setup foundation, but the authorization and persisted-state contracts are internally inconsistent.
• Verdict: do not merge — 4 MAJOR findings.
• Minimum fixes: make role verification fail closed and role-object-specific, require explicit selection when tenant identity is unknown, align checklist gate metadata with updater calls, and align DA3.2 completion with its declared checkpoint.

[nkemms]

Updated review findings — state-contract blockers remain

• Major — acknowledgement can override a failed checkpoint. shared/checklist-updater.md maps manual/attest plus ACK=true to done without first rejecting CHECKPOINT_RESULT=FAILED. Callers can therefore persist completion for a known failed security or tenant-alignment check. Preserve checkpoint outcome and acknowledgement as separate facts; a failed checkpoint must not become done through acknowledgement.
• Major — permission evidence has no schema-compatible durable representation. shared/permission-gate.md produces GATE_EVIDENCE with verifiedBy and note and instructs callers to persist it, but checklist-updater.md and config-schema.md define only a verifiedBy string. Define and merge a stable evidence object (including outcome and provenance) rather than dropping the note or storing an object where a string is declared.
• Consistency: configure-tenant.md still maps DA3.2 to WD-TENANT-001 while the canonical checklist and execution path use WD-API-CLIENT-001; the config-schema example also retains the obsolete DA2.1 attest gate. Align these references with the corrected contract.

[nkemms]

Re-reviewed the current head (9384559) against its stacked base. The setup state contract remains unsafe to consume:

• Acknowledgement can override a known failed checkpoint — solutions/ess-maker-skills/src/skills/setup/workday-da/shared/checklist-updater.md:179-209: a manual/attest row with ACK=true becomes done without first giving FAILED precedence. Acknowledgement must not convert known failure into completion; failed checks must remain blocked.
• Gate evidence has no schema-compatible durable representation — shared/permission-gate.md:25-30 defines { verifiedBy, note } and instructs callers to persist it under setupStatus[STEP_ID].verifiedBy, while shared/config-schema.md:72-95 and shared/checklist-updater.md:253-261 define verifiedBy as a scalar. Use one shape consistently or add a separate durable evidence field.
• DA3.2 maps to conflicting checkpoints — configure-tenant.md:25-32 assigns DA3.2 to WD-TENANT-001, while the detailed DA3.1/DA3.2 execution section uses WD-API-CLIENT-001. The summary, execution path, and stored checkpoint identity must agree.
• reviewed cannot round-trip through the updater contract — shared/config-schema.md:90-95 permits verifiedBy: reviewed, but shared/checklist-updater.md:253-261 only documents programmatic | attested | null. Define the state vocabulary once and support every allowed value at the writer boundary.

These are completion and evidence-integrity issues, not retry/recovery concerns, and they block merge.

[Surendra Goutham (is-goutham)]

Addressed the latest blockers in f7b3803: Failed/Error now override acknowledgement, verifiedBy remains a scalar with separate structured row/gate evidence, reviewed is supported, and DA3.2 consistently maps to WD-API-CLIENT-001. Validation: 850 targeted tests passed.

[nkemms]

Re-reviewed the latest head (f7b3803). The failure-precedence, structured gate-evidence, DA3.2 checkpoint mapping, and verifiedBy: reviewed contract issues are fixed.

I found no remaining critical issue in this PR's own changes. Good to merge into its stacked base. The overall stack remains held at PR 305 until its PAC ring handling is corrected.

[Surendra Goutham (is-goutham)]

Upstream PR #305 PAC-ring correction propagated cleanly through this branch. Final #309 stack validation after propagation: 943 tests passed; Enable-CosmosDAFlowAuthorization.ps1 parsed successfully.

The merge-base changed after approval.

[Surendra Goutham (is-goutham)]

GitHub stack rebase completed after #302 merged. This branch was rebased linearly onto the updated branch below it and force-pushed with lease. Final rebased #309 validation: 960 relevant tests passed; the 3 excluded router assertions reproduce unchanged on current main; PowerShell parser passed.