[Experiment] Web service key authentication against existing PR2 API suites

[Prangshuman Das (t-prda)]

Draft experiment — web-service-key provider on inherited PR2 API suites

AB#646383

Originally based on live PR2 #11860, captured head c4953dceffe02a017adad34973e1955017bf5d20, with a provider-only implementation commit 4a8355406d6d3e3bbd0ee912194218ca506300a8. Original PR2, the native stack, draft #12441 and SQL pilot #12447 remain unchanged. Do not merge this experimental draft.

Target and inherited scope

• Targets repository default main because the feature-base run 37578205057 had no successful non-PR warning baseline. Its baseline ID was 0; warning comparison failed before downstream test execution. That deterministic failure was not retried or treated as authentication evidence.
• Experiment-only merge 70fded9af7b71517f4acc2512f88adce9b649617 incorporates main cbbfcab9f389db1db06f17ecb8e1f719568beee1, preserving PR2 ancestry.
• Follow-up dd37840896a95440608dbb10f7358e40e3ab8fda removes one duplicate RequiredTestIsolation property introduced by Git's automatic Company Information merge. Run 37582528418 exposed deterministic AL0317 in the RU build; no unchanged-head retry was used. Main's commented declaration and PR2 provider setup remain. The provider and exclusion manifests are unchanged.
• Both API exclusion conflicts were reconciled by exact selector sets: preserve inherited PR2 uptake, remove only its intended historical cohort exclusions, keep 139739/TestDeleteInUse, and preserve unrelated main exclusions including 139806/TestGetCompanyAndEnvironmentDescriptions.
• The historical cohort has 193 methods, 192 eligible and one retained exclusion. Eligibility is not an execution or pass count.
• The displayed main-target diff includes inherited PR2 uptake, not just the provider. Of 179 ancestry-difference paths, 19 are already equivalent to main; the effective 160 paths comprise 158 unchanged inherited PR2 files, one automatic Company Information test integration, and the unchanged provider experiment. No workflow or pipeline changes are introduced by this merge.

Provider

• Only new authentication implementation is MicrosoftTestAuthProvider.Codeunit.al; its blob remains identical to the implementation preserved in [Prototype] Use web service keys in Microsoft test authentication #12441.
• OnPrem NavUserPassword uses public Identity Management web-service-key APIs, checks fresh last-error state, preserves valid existing keys and creates a missing key with a 24-hour expiry.
• Windows/SaaS guards and public provider contracts remain unchanged.
• No explicit Commit, key rotation, file/Key Vault fallback, new custom test codeunits or source-pattern tests.
• Existing pipeline password provisioning is intentionally retained; the selected provider no longer reads it.

Evidence and limits

• After main reconciliation: existing targeted Pester 117 passed, 0 failed, 0 skipped, using an owned project-local TestDrive. Exact manifest preservation, 192-method eligibility, unchanged provider blob, both parent ancestries and effective diff checks passed.
• After the one-line compiler correction: the same 117 checks passed again. Runtime proof remains pending; the failed compile run is not counted as an authentication test.
• Current PR CI run 37588964135, attempt 1, checked out merge 6b3b69d4b0cfc1eea146af2167a2ec089ca61771 containing exact head dd37840896a95440608dbb10f7358e40e3ab8fda and main cbbfcab9f389db1db06f17ecb8e1f719568beee1. Successful main CI/CD baseline 37535399988 was selected. At 2026-10-07T08:04Z country compilation was running; no TestResults artifacts or runtime authentication outcomes yet. No manual CI retry or cancellation.
• Primary end-to-end proof is the existing PR2 API suites and inherited CU139496 OData control in disposable PR CI. Both provider and consumer test packages must compile/publish before runtime results count.
• Runtime validation pending. Not merge-ready; no production-readiness claim.
• Missing-key transaction visibility, concurrent lifecycle guarantees and rollback behavior remain unproven. Lifecycle tests remain preserved separately in [Prototype] Use web service keys in Microsoft test authentication #12441 and are deferred, not counted as passing.
• Original [Prototype] Use web service keys in Microsoft test authentication #12441 SOAP fixture requests were blocked before authentication by native HttpClient Anti-SSRF; this is distinct from genuine Integration HTTP401 observations.

Retry discipline

Preserve first-attempt evidence. Only demonstrated unstable or unrelated recoverable failures may receive narrow terminal failed-job reruns after current/bot-attempt checks, bounded to two manual rounds. Deterministic authentication401, fixture defects and unclassified errors are not retry candidates. No full-workflow rerun when job selection is possible.