[Validation only - do not merge] API workflow infrastructure before AL uptake

[Prangshuman Das (t-prda)]

Validation only - do not merge

AB#646383

Validate the exact workflow-only intermediate, before AL uptake at review #11891. The tree matches that review branch; a forward-only validation merge preserves its historical ancestry, so commit heads differ; there are no validation-only code changes. This main-targeted draft remains outside native stack #11893 and must not be merged or auto-merged.

Review order: #10085 auth core -> #11862 URL/fixture prerequisites -> #11891 workflow infrastructure -> #11860 AL uptake -> #11224–#11230 -> #11322 -> #11451–#11454.

Main-target validation preserves warning-baseline policy. Previously observed missing feature-base baselines and the later stale-main AS0059 findings are different failures; neither is suppressed.

All AL source/exclusions equal integrated main df3ab2d79eb97aed4bef8db42748bc7fa3331a65; the 11 auth/URL methods are inherited. The real HTTP test belongs to subsequent uptake, not this workflow-only stage.

Clean-codeunit activation is absent/off at this stage. Ordinary execution, Legacy and the Unit Disabled fallback remain; newly discovered API Disabled-isolation lanes are activated only by uptake with authentication adoption.

Validation limits

Historical uptake/full runs verified CU139496 MicrosoftAuthenticationRespectsServerAuthMode in the actual UserPassword fixture (401/200/401). The Windows 200/200/200 expectations are implemented but Windows runtime remains unverified; no foreign local NST was used. Successful GitHub runs do not establish universal native NAV coverage. Excluded PDF cases, country-specific absent/excluded cases and tolerated-native distinctions are not claimed passing. No additional PR was merged or auto-merged during this refresh; validation drafts remain Do Not Merge outside stack #11893.

Historical targeted country evidence

Final workflow NZ Integration artifact at 9269e3df582704881a898e19029308e9296cbbf1 verifies 2,751 test cases, zero failures, and CU139700 absent. This confirms the default-off gate no longer prematurely runs the API Items codeunit that previously had 22 failures. Workflow run36157073629 succeeded with all113 test jobs.

Current checkpoint

Head 391e30817a2ed21c79665a5e8b5aede68fc1108d; captured main eaddd6b3c518414f372154ea6cedd6c12b287359.

Validation BLOCKED; no whole-run or all-country green claim. Current exact-head AL runs: workflow, workflow validation, uptake, uptake validation, full. Remaining jobs are not cancelled.

Platform 30.0.55429.0 reproducibly throws AcquireSqlConnectionFromPool NullReference on the first API GET after tenant reset: uptake IS Integration job111493435528 (CapabilitiesProjectsEnabledViaAPI) and full MX Default job111493443618 (TestGetCurrencyExchangeRates). Both occur56–64 seconds after tenant3 reset; later independent requests pass, but the failed methods do not recover. No scheduler reset/worker overlap was found. Async runtime/pool lifecycle coupling remains possible, unproven—not infrastructure-only. Exact implementation is unavailable in the exposed NAV tree; runtime-owner source/PDB analysis of pool lifetime across dismount/copy/remount is required. Separately, uptake-validation BE job111494278233 fails ordinary SLS installation with a duplicate datasearch sequence before clean execution. Runner/network outages are separate failures. No AL retries, arbitrary waits or classifier broadening will mask these failures.

Verified partial evidence: direct uptake CU148343 passes 153/198 cases across17 countries, including all9 methods and the repaired policy snapshot method. CA/CZ/ES/NL/NO artifacts were missing at2026-10-04T19:58Z; absence is not failure or success. Original8 methods, all assertions, four response clears and five query-safe URLs are preserved alongside upstream's ninth method. Local Pester remains117/117 at workflow/uptake/full. All4 exact-head PowerShell runs passed; workflow-validation37215974877 required attempt2 after one analyzer-tool crash; the other3 passed attempt1. Uptake PowerShell provenance is validation37215973669 at the same uptake SHA, not a separate direct-branch run.

The supported finalizer ran after normal teardown in direct workflow BE Default job111495104917 at2026-10-04T19:30:13.2943924Z and direct uptake DE Integration job111493433096 at2026-10-04T19:37:30.6075547Z. These markers prove hook invocation, not explicit deletion when teardown already removed the file. The23 committed wrappers/shared finalizer and absent generator remain unchanged. Accepted limitation: explicit cleanup is success-only; failed/cancelled runs rely on normal container teardown, with no hard-runner-loss guarantee. Credential ACL protections remain; per-run disposable CI credentials limit risk, not eliminate it.

No CU139496 runtime evidence yet; Legacy1 remains unverified and W1 Default does not cover it. Windows authentication, excluded CompanyInfo (TestGetCompanyAndEnvironmentDescriptions, PR11741), Travel, PDF/native coverage remain unverified/excluded as applicable. Existing review fixes/resolutions, native stack #11893, merged prefix, approval/queue/draft states and upstream exclusions remain unchanged. Permission cleanup from PR11561 is retained. No new source change, baseline update, push, merge or AL retry accompanies this checkpoint. Validation drafts remain Do Not Merge.

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.