flightcheck: add Workday DA profile + versioned result contract

[Dawn Jeong (daeunJe0ng)]

Summary

Adds the Workday Declarative Agent (DA) validation contract layer that the re-point PRs (#304, #314, #315, #316, #317, #318) plug into. Where those PRs re-point individual checks onto the DA components/ALM APIs, this PR gives Connect a callable profile + versioned, stable result contract so it can run a scoped set of checkpoints and consume the outcome without scraping the HTML report.

Tracks user story AB#7865450 (tasks AB#7865455 profile + result contract, AB#7865460 fixtures + contract tests).

Why this is needed

The re-point PRs make each check talk to the DA components/ALM APIs, but Connect still had no supported way to:

• ask FlightCheck for just the checkpoints relevant to one Workday DA stage (setup, dataverse, post-runtime, etc.), or
• read results as a stable machine contract instead of parsing report HTML, or
• distinguish "an essential platform capability was unavailable" (a release gate) from a benign "not applicable" skip.

What changed

• runner.py — new Status.BLOCKED (distinct from Skipped): an unavailable essential capability now buckets into Action required and forces overall = NOT_READY, so it can never render as a success-shaped no-op (AC3). Added stable per-result contract fields (severity, automation_type, remediation_id, non-secret evidence) with backward-compatible defaults, and a versioned flightcheck.result.v1 payload (versioned_run_result_to_dict) nested in results.json alongside the existing snake_case keys.
• registry.py — the eight callable profiles from the story (workday-da:setup-readiness, :dataverse-ready, :external-prerequisites, :post-runtime, :post-connection, :post-agent-wiring, :final, workday-legacy:diagnostic) plus profile resolution/planning helpers. WD-CONN-013 (agent connection OBO parameter sharing) resolves through the WD-CONN checkpoint group to the already-implemented check in checks/workday.py — no placeholder stub. profile_requirements now raises RegistryError on a profile that declares no checkpoints (instead of an IndexError).
• cli.py — --profile and --validation-realm flags that run a profile and emit the versioned contract. ValidationContext.realm is required so a Dev run can't be mistaken for Test/Prod readiness; --validation-realm help + the runtime error hint now state the realm can also come from a "realm" key in .local/config.json.
• tests/flightcheck/contract/ — seven non-secret connection-state fixtures (absent, partial, legacy, healthy, degraded, invoker, embedded) + contract tests covering versioned JSON, blocked bucketing, profile resolution, WD-CONN-013 resolving to the real check, fixture coverage, and empty-profile rejection.

Design notes / scope

• Skipped behavior is intentionally unchanged; only newly essential-unavailable rows use Blocked. Existing report UX and tests stay valid.
• The versioned contract is additive: legacy consumers keep the snake_case fields; Connect gets the camelCase contract block with a schemaVersion to negotiate future additive changes.
• Out of scope (follow-up): the WD-REST/WD-ENV/WD-WF-CAT/WD-REF re-points (flightcheck: fail loud on malformed DA connection-ref payloads (reader hardening) #304, flightcheck: re-point ENV-004 to Declarative Agent components API #314, flightcheck: re-point PUB-001 + PUB-002 to Declarative Agent ALM export/import API #315, flightcheck: re-point ESS-SOLN-001 to Declarative Agent GRS/ALM configure API #316, flightcheck: re-point WD-REST-001 + WD-ENV-001 to Declarative Agent components API #317, flightcheck: re-point WD-WF-CAT-001 + WD-REF-001 to Declarative Agent components API #318), the WD-PKG-001 fingerprint fix (flightcheck: exclude per-agent DA connection refs from WD-PKG-001 fingerprint #328), and the additional checkpoint-group work under AB#7865456 / AB#7865457 / AB#7865458.

Testing

• Full suite after changes: pytest tests/flightcheck -q = 1232 passed.
• Contract tests: pytest tests/flightcheck/contract/test_workday_da_profiles.py -q passes (incl. the new test_profile_requirements_rejects_empty_profile).
• ruff check on touched files = passed.
• Pre-existing failures in tests/scripts (installer) and tests/setup/test_da_setup_router.py reproduce on a clean upstream/main, so they are unrelated to this PR.

Live E2E validation (read-only)

Ran the workday-da:post-connection profile end to end against the real flow-based Workday DA environment (WD-Validate, orgba4e06cd, env 59e5511c, realm=prod), which carries a correctly configured Workday connection.

• The versioned flightcheck.result.v1 contract emitted correctly: profile, profileCheckpoints, validationContext (non-secret identifiers only), camelCase counts, and per-row severity/automationType/remediationId/evidence.
• The Dataverse-read Workday checks PASS on a correctly configured env: WD-PKG-001 (package fingerprint), WD-CONN-012, WD-CONN-013 (agent connection OBO parameter sharing), and DV-CONN-001.
• Result: 4 passed / 1 fail / 1 manual / 1 not-configured. The non-passes reflect env/local-config state, not code defects: WD-REST-001 (Workday REST base URL not yet captured), WD-CONN-AUTH-001 (manual portal confirm of Entra SSO vs basic auth), and WD-REST-002 (reads the local .local/agents/ topic folder, which is bound to the local checkout's agent config).

This exercises the full profile path (auth → scoped checkpoints → bucketing → versioned results.json + report.html) against live Workday connection data.

Stacking note

Branched off the foundation reader PR (#326, now merged). This PR's net delta over main is the profile + versioned contract layer across cli.py/registry.py/runner.py plus the contract tests.

---

Sync 2026-09-25: Merged latest upstream/main (merge a0ddbf1f). One conflict in flightcheck/cli.py (both sides added a helper at the same spot): kept BOTH _validation_context_from_args (this PR) and _resolve_environment_ring (main). Follow-up commit 15039c0c addresses review nits (empty-profile guard + --validation-realm help/error text) with a regression test. tests/flightcheck = 1232 passed; ruff clean. #327 is MERGEABLE (only the review gate remains).