Repository navigation
[API tests] Provision credentials and clean-tenant workflow infrastructure - #11891
Merged
Prangshuman Das (t-prda) merged 12 commits intoOct 5, 2026
Merged
Conversation
github-actions
Bot
added
Build: Automation
Prangshuman Das (t-prda)
added this pull request to stack #11893
September 25, 2026 08:47
github-actions
Bot
added
Ownership: Needs Review
This was referenced Sep 25, 2026
Contributor
|
Issue #11561 is not valid. Please make sure you link an issue that exists, is open and is approved. |
The historical workflow patch relocated the original core checks. Remove that duplicate while retaining the behavioral workflow tests and downstream AL adoption metadata assertions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Prangshuman Das (t-prda)
force-pushed
the
features/646383-api-test-workflow
branch
from
September 29, 2026 18:43
9269e3d to
6e1d8bb
Compare
pull Bot
pushed a commit
to CarstenMertes/BCApps
that referenced
this pull request
Sep 29, 2026
## Purpose [AB#646383](https://dynamicssmb2.visualstudio.com/Dynamics%20SMB/_workitems/edit/646383) Add opt-in authentication to `Library - Graph Mgt.` without API re-enablement or pipeline changes. ## Design - Default `None` preserves existing behavior. The public enum/interface and public `API Test Auth Context` retain external provider extensibility. - The Microsoft provider stays `Internal`; context `Apply` stays internal. Internal visibility is API encapsulation, not authorization. - Credential precedence remains container file, then existing Key Vault only if the file is absent. Invalid configured credentials fail; successful passwords remain instance-scoped `SecretText`. - File credentials now use a private file-mapping provider directly, without replacing or clearing the session-wide Azure Key Vault provider/cache. No extra AL plaintext copy is introduced. - `OnAfterInitializeWebRequestWithURL` remains last. The pre-existing empty Graph `OnRun` is restored. The trust boundary is admitted OnPrem test code and environment credential access, not `Internal` visibility or a destination-URL restriction. ## Tests and scope All six AL contracts remain: default None, event ordering, provider reuse, instance scoping, same-provider reselection and deselection. The dedicated recorder is removed. The non-SingleInstance internal mock publishes the **test-only** `OnAfterConfigureAuthentication` event; the same manually bound test-codeunit instance owns `Library - Variable Storage` for both recording and verification. Initialization clears that instance's queue after prior failures; each contract drains it and calls `AssertEmpty`. The six source-pattern PowerShell checks are removed, not replaced by other AL-text assertions. The real 401/200/401 HTTP scenario is owned by uptake microsoft#11860 after credential provisioning; core has no dependency on that future workflow. This is not a claim of a complete provider-branch matrix. No caller migration, URL repair, credential provisioning, scheduling, exclusion or work-date rollout belongs to this core. Native stack #11893: **microsoft#10085 auth core -> microsoft#11862 URL/fixture prerequisites -> microsoft#11891 workflow infrastructure -> microsoft#11860 AL uptake -> microsoft#11224–microsoft#11230 -> microsoft#11322 -> microsoft#11451–microsoft#11454**. ## Current checkpoint Head `4a76bb71851c158083dbe4d22e84bf40a0577842`, tree `12739039e502a3feeea9e98694fb360ea959c606`. Merged main baseline remains `0a602a2481c93ebfe7b1d27d6016fb9926c42111` (permission cleanup from PR 11561). No additional main merge or code changes were made during finalization. Old `b195c7a`/`4eef8ac` tree-equality claims remain obsolete after the intentional baseline/auth changes. [Verified AL compile/publish/test run 36131334134](https://github.com/microsoft/BCApps/actions/runs/36131334134) **succeeded, attempt 2**, at exact validation head `4a76bb71851c158083dbe4d22e84bf40a0577842`. **113/113 test jobs and 113/113 cleanup steps succeeded.** Core has no credential-file provisioning/removal step (expected). W1 artifacts verify all **6 auth contracts**. Local Pester at the applicable checkpoint: **28 passed, zero failed/skipped**. Core local Pester: **28 passed**; no unsupported claim about a separate root PowerShell workflow. ## Validation limits For uptake/full, CU139496 `MicrosoftAuthenticationRespectsServerAuthMode` is verified in the actual UserPassword fixture (**401/200/401**). The Windows **200/200/200** expectations are implemented but **Windows runtime remains unverified**; no foreign local NST was used. Successful GitHub runs do not establish universal native NAV coverage. Excluded PDF cases, country-specific absent/excluded cases and tolerated-native distinctions are not claimed passing. No PR has been merged or auto-merged; validation drafts remain Do Not Merge outside stack #11893. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
pull Bot
pushed a commit
to CarstenMertes/BCApps
that referenced
this pull request
Sep 29, 2026
## Scope [AB#646383](https://dynamicssmb2.visualstudio.com/Dynamics%20SMB/_workitems/edit/646383) Prerequisite layer above microsoft#10085. Move existing **non-authentication** repairs out of the auth-only base so reviewers can assess them separately. - Query-safe Graph URL path/query helpers and `CreateTargetURLWithTwoSubpages`, with five existing URL regressions. - Corresponding URL composition changes in API callers. - Existing APIV2 RapidStart fixture/polling, journal-handler and Foundation-setup corrections. - Existing Expense Activity/Policy API fixture and assertion corrections. - Existing Czech inventory-posting fixture corrections, also tracked by microsoft#11370. - Three existing fixture-variable relocations, retained without claiming separate product bugs. No provider-adoption calls, work-date rollout, `RequiredTestIsolation` changes, pipeline configuration or exclusion changes belong to this layer. The old Expense auth helper and bindings remain until uptake. ## Dependency and validation This PR remains the separate 18-file prerequisite above microsoft#10085; its owned patch is unchanged by the main refresh. The five URL tests remain alongside the six core contracts in CU139494 (11 methods). Workflow microsoft#11891 follows it without changing AL source; AL adoption remains microsoft#11860. No exclusions or pipeline files change here. The root core's queue/KV fixes are inherited, not duplicated. Standalone feature-base checks are distinct from main-targeted workflow/uptake/full validation; none of the previous successful cumulative runs is new-head proof. ## Current checkpoint Head `768a6395f186f4db4981631dbcacaa01677c5d40`, tree `0bea3b816388c79fb950a8ad22bb11ff0f2598be`. Merged main baseline remains `0a602a2481c93ebfe7b1d27d6016fb9926c42111` (permission cleanup from PR 11561). No additional main merge or code changes were made during finalization. Old `b195c7a`/`4eef8ac` tree-equality claims remain obsolete after the intentional baseline/auth changes. [Verified AL compile/publish/test run 36157073629](https://github.com/microsoft/BCApps/actions/runs/36157073629) **succeeded, attempt 1**, at exact validation head `9269e3df582704881a898e19029308e9296cbbf1`. **113/113 test jobs and 113/113 cleanup steps succeeded.** **113/113 credential-removal steps** also succeeded. W1 artifacts verify all **11 auth/URL methods**. Clean-codeunit activation remains absent/off; ordinary execution, Legacy and the Unit Disabled fallback are preserved. This prerequisite is validated as part of the successful workflow cumulative head, not by a claimed standalone prerequisite run. Local Pester at the applicable checkpoint: **28 passed, zero failed/skipped**. [PowerShell run 36157073348](https://github.com/microsoft/BCApps/actions/runs/36157073348) **succeeded, attempt 1**. ## Validation limits For uptake/full, CU139496 `MicrosoftAuthenticationRespectsServerAuthMode` is verified in the actual UserPassword fixture (**401/200/401**). The Windows **200/200/200** expectations are implemented but **Windows runtime remains unverified**; no foreign local NST was used. Successful GitHub runs do not establish universal native NAV coverage. Excluded PDF cases, country-specific absent/excluded cases and tolerated-native distinctions are not claimed passing. No PR has been merged or auto-merged; validation drafts remain Do Not Merge outside stack #11893. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Bardur Knudsen (BardurKnudsen)
previously approved these changes
Oct 1, 2026
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The overly broad transient-failure signature can retry and mask genuine intermittent API regressions.
Review effort: Balanced
Findings: 1
What changed in this PR
Adds workflow infrastructure for securely provisioning API test credentials and opt-in clean-tenant execution of Disabled-isolation codeunits.
Changes:
- Materializes and securely removes container credentials.
- Adds clean-tenant discovery, reset, scheduling, retry, and result aggregation.
- Adds extensive PowerShell and ACL coverage while leaving clean execution disabled by default.
| File | Description |
|---|---|
.github/AL-Go-Settings.json |
Enables Task Scheduler only for Uncategorized tests. |
.github/workflows/_BuildALGoProject.yaml |
Adds unconditional credential cleanup. |
build/scripts/ApiTestCredential.psm1 |
Securely creates the credential file. |
build/scripts/NewBcContainer.ps1 |
Provisions credentials for password-authenticated containers. |
build/scripts/ParallelTestExecution.psm1 |
Implements clean-tenant scheduling and retries. |
build/scripts/Remove-ApiTestPassword.ps1 |
Stops consumers and deletes credentials. |
build/scripts/RunTestsInBcContainer.ps1 |
Integrates clean execution and transient detection. |
build/scripts/tests/ApiTestCredential.Test.ps1 |
Tests credential materialization and ACLs. |
build/scripts/tests/ParallelTestExecution.Test.ps1 |
Tests scheduling, restoration, retries, and merging. |
build/scripts/tests/Remove-ApiTestPassword.Test.ps1 |
Tests credential cleanup and workflow lifetime. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Remove the wrapper generator and its generator-specific tests. Keep the shared finalizer and behavioral tests that execute every project wrapper. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Maria Zhelezova (mazhelez)
previously approved these changes
Oct 3, 2026
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
Maria Zhelezova (mazhelez)
approved these changes
Oct 4, 2026
Bardur Knudsen (BardurKnudsen)
approved these changes
Oct 5, 2026
melnikbo
pushed a commit
to melnikbo/BCApps
that referenced
this pull request
Oct 7, 2026
…microsoft#12325) ## Scope Related authentication and API enablement: [AB#646383](https://dynamicssmb2.visualstudio.com/Dynamics%20SMB/_workitems/edit/646383) (link only; this PR does not resolve the umbrella item). Fixes [AB#653119](https://dynamicssmb2.visualstudio.com/1fcb79e7-ab07-432a-a3c6-6cf5a88ba4a5/_workitems/edit/653119) Separate test defect: [653119 - Policy snapshot API URL composition and response isolation](https://dynamicssmb2.visualstudio.com/Dynamics%20SMB/_workitems/edit/653119). This tracks the policy-snapshot test corrections, not production access permissions or unrelated runtime failures. Expense-first adoption directly against main after the external squash merge of workflow microsoft#11891; remaining general APIs follow in microsoft#11860. - Migrate the 11 reviewed Expense API/helper paths to shared authentication and remove exactly 51 existing Expense API exclusions. Preserve exactly nine non-API Expense exclusions; all 19 previously retained API exclusions are now removed. - Enable the existing `enableCleanTestCodeunitExecution` boolean. Use existing DisabledTests selectors throughout discovery, ordinary execution and clean-codeunit execution/reruns. No app-name allowlist, new selection setting or runner implementation/test change. - Include the six-line license-safe WorkDate helper needed by PerDiem, five query-safe policy URL compositions, four independent response clears, and the existing unlimited-approval fixture. Preserve all nine Activity Log tests and upstream assertions. - Consolidate microsoft#11453's exact assigned-user filter (no cross-table range compression), true fallback fixture and regressions. Upstream wildcard quoting alone did not fix the range-gap case. - Consolidate microsoft#11451's unique denied-approval error/permission capture and microsoft#11454's existing repeated-delta, missing-header-permission, Released-status and real deletion-total regressions, including its internal test-only permission set. - Do not reintroduce upstream repairs from microsoft#11654 (three permission-role tests and posted zero-amount fixture), the obsolete date test removed by microsoft#12074, or the production indirect-Modify change already supplied by microsoft#11333. microsoft#11452's duplicate deletion helper is absent; existing callers use the upstream shared helper. - All seven artificial Expense exclusions introduced by the previous uptake are absent here and at every general checkpoint. This is not blanket re-enablement of Expense tests. This focused review diff has21 paths, using the two existing API exclusion manifests. No NAV selectors, local NST, BC-ExpenseAgent changes, unrelated new test scope or production permission changes. Exact head: `bd3bbc04e13965f967a26eef435bdbf0cbc09ad7`; tree: `2b8c47b138846f63bd49d47188f54ea7e86c1f24`. ## Expense-first sequencing using existing exclusions The same **193 method-specific temporary exclusions (135 APIV1 +58 APIV2 across12 codeunits)** now live in the existing `src/DisabledTests/_Exclude_APIV1__Tests/_Exclude_APIV1__Tests.DisabledTest.json` and `src/DisabledTests/_Exclude_APIV2__Tests/_Exclude_APIV2__Tests.DisabledTest.json`. No separate sequencing files remain. Original entries retain their order/style/content; no new duplicate or wildcard/codeunit-wide exclusion is introduced. Unrelated pre-existing APIV2 duplicates are preserved rather than mixed with this change. microsoft#11860 removes the temporary additions from these same existing manifests alongside its already-reviewed authentication uptake. All193 temporary stage entries are removed in microsoft#11860, but it makes **192/193 target methods eligible**: the independent `139739::TestDeleteInUse` exclusion remains until the VAT fixture correction in PR [microsoft#11224](microsoft#11224) removes it. From microsoft#11224 onward all193 are eligible; eligibility is not runtime success. All general/downstream cumulative trees are **exactly byte-identical** to the preceding checkpoint; the full checkpoint has none of these193 methods excluded. No app-name allowlist, selection setting, runner/authentication/test/production change or Logiq exclusion is added. **Why these methods started executing:** they already required Disabled isolation and were IntegrationTest codeunits. Ordinary typed selection in TestSuiteMgt332–352 selects None|Codeunit; the old extra Disabled pass in RunTestsInBcContainer was UnitTest-only. The clean-execution switch newly reaches Disabled IntegrationTest codeunits and still honors the existing JSON exclusions. These193 methods were not listed in those exclusions. This is a pre-existing selection gap, not a newly introduced product auth bug or proof they never ran in any historical configuration. A complete67-codeunit audit preserves existing UnitTest/Legacy behavior and the ten independently handled Logiq integration tests. Historical baseline run37215976231 at head69df41756d918a516a3c868ca66f45cbfd320428 independently corroborates this: zero of the exact193 methods appear across five inspected W1 result artifacts containing37,626 testcases (Integration, both Legacy buckets, default/unit and Uncategorized). This evidence is limited to that W1 baseline, not every country or historical run. The completed alternate-path audit found no other ordinary configured baseline BCApps lane: APIV1/APIV2 are outside Legacy buckets, Disabled-unit fallback retains UnitTest filtering, discovery skips test procedures, and ordinary PR/CI/CD/rerun routes do not bypass those constraints. Manual or explicitly untyped execution remains possible; no universal historical or NAV absence is claimed. **Expense scope is unchanged:**51 API reenables, nine non-API exclusions, baseline six cases and all consolidated regressions. The two legacy Spend Requests methods remain conditional on not CLEAN30. Focused microsoft#12325 review:21 files, including the two existing exclusion manifests. General microsoft#11860 review:159 files. The official NAV `Disable-NAVALTest` helper was inspected: it has no destination/app-file parameter, writes NAV's App/DisabledTests using per-codeunit filenames and sorts entries. It cannot safely preserve these BCApps files. A bounded JSON relocation preserved original prefixes/order and checked exact identities, then exercised the unchanged real loader. No new shared helper/framework or NAV selector change was made. ## Validation and presentation evidence **Pester117/117 passed independently at the new Expense/general/full heads.** Actual existing-loader checks confirm identical effective193-method selection after relocation and preserved51/9 Expense scope. All nine downstream Git tree hashes remain exactly unchanged. Fresh exact-head CI is pending; old-head successes are not substituted for current runtime evidence. Historical run37330893173 at head88881be reached193 general methods:171 genuine401 failures and22 nominal passes (17 bare-ASSERTERROR cases can accept the wrong error; five local fixtures). Separately, all51 Expense methods passed in13 inspected countries (663 results), and all63 touched API methods yielded819 results; Activity coverage was117/198 at that checkpoint. These are bounded historical results, not a full/current matrix pass. The preceding stage-fix runs hit50 hosted-runner acquisition cancellations; other jobs were active, so this was not a claimed global outage. New pushes schedule fresh CI, not an AL retry. The general SQL-pool NRE and missing warning-reference artifacts remain separate unresolved limitations. Durable session presentation notes: **api-test-enablement-presentation-notes.md**, with source-pinned selection proof, fix/coverage inventory, helper limitations and historical-vs-current evidence boundaries. Fresh runtime proof must still establish the51 Expense cases and actual193-case suppression at Expense stage. [AB#646383](https://dynamicssmb2.visualstudio.com/1fcb79e7-ab07-432a-a3c6-6cf5a88ba4a5/_workitems/edit/646383) (link only). Native stack #12327 remains microsoft#12325 → microsoft#11860 → microsoft#11224 → microsoft#11225 → microsoft#11226 → microsoft#11227 → microsoft#11228 → microsoft#11229 → microsoft#11230 → microsoft#11322. Protected merged microsoft#10085/microsoft#11862/microsoft#11891 and validation microsoft#11892 are untouched; validation-only microsoft#11861/microsoft#11455 remain Do Not Merge. No new main integration, native-group/base change, PR merge, queue operation, Actions cancellation or manual retry was made. All prior heads remain ancestors; source publication used backups and an atomic forward-only push with explicit leases. Exact current head: `bd3bbc04e13965f967a26eef435bdbf0cbc09ad7`; source tree: `2b8c47b138846f63bd49d47188f54ea7e86c1f24`. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3952f078-a881-4da8-ad96-13b727e48a91
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
AB#646383
Workflow-only prerequisite above #11862 and below #11860: 33
.github/buildfiles including the committed project finalizer wrappers.enableCleanTestCodeunitExecution. This infrastructure stage leaves it absent/off, preserving ordinary typed/Legacy execution and the existing Unit Disabled pass, including warmup and retries. Uptake [API tests] Adopt shared authentication for remaining general APIs #11860 activates it alongside AL authentication adoption.All AL source and exclusions equal the integrated main baseline
bb7111877ff786951b86a1a0f80d8b39b8f5dacd, including merged auth/prerequisites. No provider adoption or API re-enablement belongs here. The old Expense helper remains until uptake.The six relocated source-pattern auth checks are removed here too; the three additional uptake AL source-inspection assertions were also removed. No replacement auth source-pattern checks are added.
The previous workflow-only NZ Integration run newly dispatched API Disabled-isolation codeunits before authentication adoption: CU139700 has 22 failures in its JUnit, while unchanged-core NZ has no CU139700 suite and no failures. These are real runtime regressions, not infra failures or tolerated-native evidence. The default-off gate restores the stage boundary; enabled uptake/full behavior remains equivalent to the previous combined implementation. The earlier workflow run succeeded; that evidence is historical after this baseline refresh.
Native stack #11893: #10085 auth core -> #11862 URL/fixture prerequisites -> #11891 workflow infrastructure -> #11860 AL uptake -> #11224–#11230 -> #11322 -> #11451–#11454. Main-targeted draft #11892 stays outside grouping.
Validation limits
Historical uptake/full runs verified CU139496
MicrosoftAuthenticationRespectsServerAuthModein the actual UserPassword fixture (401/200/401). The Windows 200/200/200 expectations are implemented but Windows runtime remains unverified; no foreign local NST was used. Successful GitHub runs do not establish universal native NAV coverage. Excluded PDF cases, country-specific absent/excluded cases and tolerated-native distinctions are not claimed passing. No additional PR was merged or auto-merged during this refresh; validation drafts remain Do Not Merge outside stack #11893.Historical targeted country evidence
Final workflow NZ Integration artifact at
9269e3df582704881a898e19029308e9296cbbf1verifies 2,751 test cases, zero failures, and CU139700 absent. This confirms the default-off gate no longer prematurely runs the API Items codeunit that previously had 22 failures. Workflow run36157073629 succeeded with all113 test jobs.Current checkpoint
Head
69df41756d918a516a3c868ca66f45cbfd320428; captured maineaddd6b3c518414f372154ea6cedd6c12b287359.Validation BLOCKED; no whole-run or all-country green claim. Current exact-head AL runs: workflow, workflow validation, uptake, uptake validation, full. Remaining jobs are not cancelled.
Platform
30.0.55429.0reproducibly throwsAcquireSqlConnectionFromPoolNullReference on the first API GET after tenant reset: uptake IS Integration job111493435528 (CapabilitiesProjectsEnabledViaAPI) and full MX Default job111493443618 (TestGetCurrencyExchangeRates). Both occur56–64 seconds after tenant3 reset; later independent requests pass, but the failed methods do not recover. No scheduler reset/worker overlap was found. Async runtime/pool lifecycle coupling remains possible, unproven—not infrastructure-only. Exact implementation is unavailable in the exposed NAV tree; runtime-owner source/PDB analysis of pool lifetime across dismount/copy/remount is required. Separately, uptake-validation BE job111494278233 fails ordinary SLS installation with a duplicate datasearch sequence before clean execution. Runner/network outages are separate failures. No AL retries, arbitrary waits or classifier broadening will mask these failures.Verified partial evidence: direct uptake CU148343 passes 153/198 cases across17 countries, including all9 methods and the repaired policy snapshot method. CA/CZ/ES/NL/NO artifacts were missing at2026-10-04T19:58Z; absence is not failure or success. Original8 methods, all assertions, four response clears and five query-safe URLs are preserved alongside upstream's ninth method. Local Pester remains117/117 at workflow/uptake/full. All4 exact-head PowerShell runs passed; workflow-validation37215974877 required attempt2 after one analyzer-tool crash; the other3 passed attempt1. Uptake PowerShell provenance is validation37215973669 at the same uptake SHA, not a separate direct-branch run.
The supported finalizer ran after normal teardown in direct workflow BE Default job111495104917 at2026-10-04T19:30:13.2943924Z and direct uptake DE Integration job111493433096 at2026-10-04T19:37:30.6075547Z. These markers prove hook invocation, not explicit deletion when teardown already removed the file. The23 committed wrappers/shared finalizer and absent generator remain unchanged. Accepted limitation: explicit cleanup is success-only; failed/cancelled runs rely on normal container teardown, with no hard-runner-loss guarantee. Credential ACL protections remain; per-run disposable CI credentials limit risk, not eliminate it.
No CU139496 runtime evidence yet; Legacy1 remains unverified and W1 Default does not cover it. Windows authentication, excluded CompanyInfo (
TestGetCompanyAndEnvironmentDescriptions, PR11741), Travel, PDF/native coverage remain unverified/excluded as applicable. Existing review fixes/resolutions, native stack #11893, merged prefix, approval/queue/draft states and upstream exclusions remain unchanged. Permission cleanup from PR11561 is retained. No new source change, baseline update, push, merge or AL retry accompanies this checkpoint. Validation drafts remain Do Not Merge.