flightcheck: re-point ESS-SOLN-001 to Declarative Agent GRS/ALM configure API

[Dawn Jeong (daeunJe0ng)]

Summary

Re-points ESS-SOLN-001 (AB#7852510) from the Dataverse solutions table to the Declarative Agent AgentBuilder GRS/ALM configure API.

This PR stacks on the shared reader in #326 and on #304, and keeps the check read-only. Merge order: #326 -> #304 -> this PR. It verifies ESS base package presence from the agent's ALM configure response by requiring both grsRepositoryId and commitSha.

What changed

• flightcheck/checks/solution.py
  • Reads runner.agentbuilder.get_realm_configuration(botId, realm) instead of querying Dataverse solutions.
  • Returns Passed when grsRepositoryId and commitSha are present.
  • Returns Failed when the configure response is missing either value.
  • Returns NotConfigured for AgentBuilder ALM error code 4003, with remediation to opt the agent into Application Lifecycle Management (ALM).
  • Returns Skipped when the AgentBuilder client or configured botId is unavailable.
  • Returns Warning for other configure read errors.
• flightcheck/registry.py
  • Updates ESS-SOLN-001 to require AGENTBUILDER.
  • Removes the Dataverse endpoint requirement and ENV-002 prerequisite.
• Tests
  • Replaces Dataverse solution-table tests with AgentBuilder configure tests using the validated tests/mocks/agentbuilder_connectivity.py mock.
  • Updates registry and single-checkpoint expectations for the DA read path.

Design rationale

• Reuses the same AgentBuilder ALM configure surface used by the ENV-004 GRS commit-pin work: /copilotstudio/minimalBots/alm/{agent_id}/configure.
• This branch does not use the ENV-004 GRS commit-pin helper, so ESS-SOLN-001 uses a small local realm/error helper around the existing AgentBuilderClient.get_realm_configuration method instead of duplicating a separate client.
• The external package identity and expected revision are still pending on Skantha / US 7792604. This PR intentionally checks package presence via grsRepositoryId + commitSha only. Exact identity or commit matching can be added later behind config, similar to ENV-004's opt-in expected commit setting.
• Error code 4003 is handled as a defined NotConfigured verdict so an ALM-not-opted-in agent does not crash FlightCheck.

Testing

From C:\Users\dawnjeong\worktrees\fc-pr-esssoln:

$env:PYTHONPATH="C:\Users\dawnjeong\worktrees\fc-pr-esssoln\solutions\ess-maker-skills\scripts"
python -m pytest tests\flightcheck -q
python -m ruff check solutions\ess-maker-skills\scripts

Results:

• 1121 passed in 7.36s
• All checks passed!

Live DA-environment validation (partially complete)

Live run 2026-09-22 against ESS GA env 258bd301 (prod ring): ESS-SOLN-001 -> PASSED; the ALM configure read returned both grsRepositoryId (01a6a43a...) and commitSha (95d7ea55...), so the base-package GRS state is present. Caveat: on the same run PUB-001 shows the configured agent (06ae0814) returns 4003 on ALM export (not opted into ALM), yet the configure GRS read still succeeded, so this PASS does not by itself prove full ALM opt-in. The 'ALM-opted-in agent' box below therefore stays unchecked. The missing-field FAIL, 4003 NOT_CONFIGURED, SKIP, and WARNING paths remain unconfirmed this run.

To be checked once a real Application Lifecycle Management (ALM) opted-in Declarative Agent is reachable. Blocked on a published DA agent enrolled in ALM; this is a read-only ALM configure call on the prod-audience AgentBuilder token, independent of the TIP2 (Test-In-Production ring 2) auth issue. Each box is marked when the scenario is confirmed on a live DA env.

• ESS-SOLN-001 against an ALM-opted-in DA agent whose configure response carries both grsRepositoryId and commitSha -> PASSED.
• ESS-SOLN-001 against a configure response missing either grsRepositoryId or commitSha -> FAILED.
• ESS-SOLN-001 against an agent not opted into ALM (error code 4003) -> NOT_CONFIGURED with opt-into-ALM remediation, no crash.
• No-AgentBuilder-client / no-active-botId -> SKIPPED, no crash.
• A configure read error other than 4003 -> WARNING (fail loudly, no false PASS).
• _alm_realm maps the config realm (Dev / Test / Prod) to the numeric realm the live ALM configure API expects, and Dev (0) is accepted.

Tracking

AB#7852510

---

Sync update (2026-09-24)

• Merged latest upstream/main into this branch (no rebase, no force-push). Clean auto-merge, no conflicts.
• Verified: ruff clean across scripts/flightcheck; full tests/flightcheck suite 1215 passed.
• Blocked only on required review.