flightcheck: exclude per-agent DA connection refs from WD-PKG-001 fingerprint

solutions/ess-maker-skills/scripts/flightcheck/checks/workday.py

@@ -1188,8 +1188,20 @@ def _check_package_flavor(runner, *, wd_flows: list) -> list[CheckResult]:
     runtime_refs: list[dict] = []
     unknown_format_names: list[str] = []
     unknown_suffixes: set[str] = set()
+    agent_scoped_refs: list[dict] = []
     for r in workday_refs:
         logical = r.get("connectionreferencelogicalname")
+        # Per-agent Declarative Agent connection references have a
+        # `{schema}.{guid}.{connector}` logical name and bind the same
+        # shared_workdaysoap connector, but they are NOT the Microsoft-shipped
+        # solution refs whose stable `_<5hex>` role suffix defines the install
+        # flavor. Including them would land them in `unknown_format_names`
+        # (their name has no role suffix), forcing a valid Declarative Agent
+        # install to misclassify as "unknown" and un-gating every ISU/RaaS
+        # consumer check. Exclude them from the fingerprint. (AB#7852495)
+        if _AGENT_CONNECTION_REF_RE.search(str(logical or "")):
+            agent_scoped_refs.append(r)
+            continue
         if (
             str(logical or "").casefold()
             == WORKDAY_RUNTIME_REF_LOGICAL_NAME.casefold()
@@ -1344,6 +1356,11 @@ def _check_package_flavor(runner, *, wd_flows: list) -> list[CheckResult]:
             "rows with unexpected logical-name format: "
             + ", ".join(sorted(unknown_format_names))
         )
+    if agent_scoped_refs:
+        diagnostics.append(
+            f"per-agent Declarative Agent connection references "
+            f"(excluded from fingerprint): {len(agent_scoped_refs)}"
+        )
     results.append(CheckResult(roles=[Role.POWER_PLATFORM_ADMIN.value],
         checkpoint_id="WD-PKG-001", category="Workday",
         priority=Priority.HIGH.value, status=Status.WARNING.value,

tests/flightcheck/checks/test_workday_package.py

@@ -282,6 +282,88 @@ def test_connectorid_with_trailing_slash_and_casing_still_matches(
         assert r.status == "Passed"
         assert runner._workday_package_flavor == "simplified"
 
+    @responses.activate
+    def test_simplified_install_with_agent_ref_stays_simplified(
+        self, runner: _MinimalRunner, fake_dataverse_url: str
+    ) -> None:
+        """A Declarative Agent install adds a per-agent Workday connection
+        reference (`{schema}.{guid}.shared_workdaysoap`) alongside the
+        Microsoft-shipped solution ref. That agent ref carries no `_<5hex>`
+        role suffix, so before AB#7852495 it landed in
+        `unknown_format_names` and forced a valid simplified install to
+        misclassify as "unknown" (WARNING), un-gating every downstream
+        ISU/RaaS check. It must be excluded from the fingerprint."""
+        from flightcheck.checks.workday import _check_package_flavor
+
+        _register_connection_refs(
+            base_url=fake_dataverse_url,
+            refs=[
+                _non_workday_ref(),
+                *dv.workday_connection_refs_simplified(),
+                dv.workday_agent_scoped_connection_ref(),
+            ],
+        )
+
+        runner._workday_flows = [{"name": "Workday-WhateverFlow"}]
+        results = _check_package_flavor(runner, wd_flows=runner._workday_flows)
+
+        r = _result_by_id(results, "WD-PKG-001")
+        assert r.status == "Passed"
+        assert runner._workday_package_flavor == "simplified"
+        assert "simplified-install shape" in r.result
+        # The agent ref is still a Workday-SOAP row, so it remains in the
+        # cache WD-CONN-012 reads (2 rows), but it did NOT force "unknown".
+        assert len(runner._workday_connection_refs) == 2
+
+    @responses.activate
+    def test_full_install_with_agent_ref_stays_full(
+        self, runner: _MinimalRunner, fake_dataverse_url: str
+    ) -> None:
+        """Same agent-ref exclusion for a full / legacy 3-ref install."""
+        from flightcheck.checks.workday import _check_package_flavor
+
+        _register_connection_refs(
+            base_url=fake_dataverse_url,
+            refs=[
+                *dv.workday_connection_refs_full(),
+                dv.workday_agent_scoped_connection_ref(),
+            ],
+        )
+
+        runner._workday_flows = [{"name": "Workday-WhateverFlow"}]
+        results = _check_package_flavor(runner, wd_flows=runner._workday_flows)
+
+        r = _result_by_id(results, "WD-PKG-001")
+        assert r.status == "Passed"
+        assert runner._workday_package_flavor == "full"
+        assert "full / legacy" in r.result
+
+    @responses.activate
+    def test_only_agent_ref_is_unknown_with_agent_scoped_diagnostic(
+        self, runner: _MinimalRunner, fake_dataverse_url: str
+    ) -> None:
+        """Degenerate case: the ONLY Workday-SOAP row is a per-agent ref and
+        no Microsoft solution ref is present. There is nothing to fingerprint,
+        so the verdict is still WARNING/"unknown" — but the operator must be
+        told agent-scoped refs were seen and excluded, not left with an empty
+        diagnostic."""
+        from flightcheck.checks.workday import _check_package_flavor
+
+        _register_connection_refs(
+            base_url=fake_dataverse_url,
+            refs=[
+                _non_workday_ref(),
+                dv.workday_agent_scoped_connection_ref(),
+            ],
+        )
+
+        results = _check_package_flavor(runner, wd_flows=[])
+
+        r = _result_by_id(results, "WD-PKG-001")
+        assert r.status == "Warning"
+        assert runner._workday_package_flavor == "unknown"
+        assert "per-agent Declarative Agent connection references" in r.result
+
     def test_no_dv_token_returns_skipped(self, fake_dataverse_url: str) -> None:
         from flightcheck.checks.workday import _check_package_flavor
 

tests/mocks/dataverse.py

@@ -263,6 +263,38 @@ def workday_connection_refs_runtime() -> list[dict[str, Any]]:
     ]
 
 
+def workday_agent_scoped_connection_ref(
+    *,
+    schema_prefix: str = "msdyn_copilotforemployeeselfservicedahr",
+    guid: str = "3f2504e0-4f89-41d3-9a0c-0305e82c3301",
+    display_name: str = "Workday (agent connection)",
+    connection_id: str | None = "shared-workdaysoap-agent-0000-0000-000000002222",
+    statuscode: int = 1,
+    ref_id: str | None = "00000000-0000-0000-0000-000000008801",
+) -> dict[str, Any]:
+    """Build a per-agent Declarative Agent Workday connection reference.
+
+    Declarative Agent connection references use a `{schema}.{guid}.{connector}`
+    logical name (matched by `_AGENT_CONNECTION_REF_RE` in workday.py) and bind
+    the same `shared_workdaysoap` connector as the Microsoft-shipped solution
+    refs — but they carry no `_<5hex>` role fingerprint suffix. WD-PKG-001 must
+    exclude them from install-flavor detection (AB#7852495) so a valid
+    Declarative Agent install is not misclassified as "unknown".
+
+    Same Dataverse `connectionreferences` GET endpoint/shape as
+    `connection_ref` (only the logical-name value differs), so it is covered by
+    the existing connectionreferences cassette — no new capture needed.
+    """
+    return connection_ref(
+        ref_id=ref_id,
+        logical_name=f"{schema_prefix}.{guid}.shared_workdaysoap",
+        display_name=display_name,
+        connector_id=WORKDAY_SOAP_CONNECTOR_ID,
+        connection_id=connection_id,
+        statuscode=statuscode,
+    )
+
+
 def collection(
     records: Iterable[Mapping[str, Any]],
     *,