Fix credential-clear intent in OpenAPI and MCP action tests

[Paul Lizer (paullizer)]

Summary

• Fix new no-auth OpenAPI drafts failing connection-test preparation before any connector call. The shared producer also serves MCP testing/discovery and personal, group, and global editors, so the correction is not specific to FED-12/FED-13.
• Derive transient auth clears only from the original action's owned secret paths, canonicalize no-auth before resolving masks, and prevent MCP discovery from restoring inactive stored credentials. Preserve strict backend authorization/clear validation and independent custom-header behavior.
• Return safe, specific preparation diagnostics and render existing MCP discovery feedback. No automatic save, retry, tool invocation, or external-write replay is introduced.
• Add actual TypeScript-producer-to-Flask contracts, responsive built-SPA regressions, and runtime evidence for unchanged Cosmos owners. Base integration preserves both the saved-memory and SQL-diagnostics fixes; overlapping inventory entries retain both branches' runtime evidence. Application version is 0.261.354.

Linked issue

N/A. The user explicitly requested no GitHub issue.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

The shared fix includes global action authoring; it adds no admin setting or governance change.

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.353 -> 0.261.354. The branch initially used 0.261.349, then 0.261.351 after saved-memory base integration. The latest merge preserves base version 0.261.353's SQL diagnostics and reconciles the version conflict at 0.261.354. Related connector test/documentation headers were aligned. No deployer files changed.

Testing / validation

Python commands below used $python, the session-only validation virtual environment's executable. Restored repository-pinned Flask, Werkzeug, Semantic Kernel, YAMCS client, and Cosmos SDK plus PyOpenSSL-compatible cryptography; the shared installation and dependency manifests were not changed. PYTEST_ADDOPTS=-p no:dash excluded an unrelated inherited Dash plugin. Backend contract selections blocked external sockets/DNS.

Current SQL-base integration, version 0.261.354:

• & $python .\scripts\check_cosmos_response_boundaries.py - passed: 1,067 owners, 412 doubles, 0 review gaps. The three conflicting plugin-route reviews use the combined module fingerprint and retain both runtime evidence suites; no baseline exemption was added or gate weakened.
• & $python -m pytest -p test_support.cosmos_network_guard .\functional_tests\test_action_connection_payload_contract.py .\functional_tests\test_action_route_cosmos_response_contract.py .\functional_tests\test_action_test_connection_endpoints.py .\functional_tests\test_action_connection_test_secret_redaction.py .\functional_tests\test_group_action_named_group_test_resolution.py .\functional_tests\test_group_action_saved_test_role_policy.py .\functional_tests\test_cosmos_document_boundaries.py .\functional_tests\test_plugin_routes_cosmos_contract.py .\functional_tests\test_sql_connection_diagnostics.py .\functional_tests\test_sql_connection_diagnostics_runtime.py .\functional_tests\test_docs_app_surface_coverage.py .\functional_tests\test_docs_site_quality.py -q --tb=short --disable-warnings - passed: 275 tests, covering the connector fix, pinned SDK, both Cosmos owner suites, incoming SQL diagnostics, and documentation.
• node .\functional_tests\test_v2_workspace_action_connectors_logic.mjs - passed again: 37 checks.
• & $python -m pytest .\ui_tests\test_v2_workspace_authoring.py -k 'no_auth_connector or connector_preparation' -q --tb=short --disable-warnings - passed again: 26 cases, including desktop/mobile and light/dark coverage against the production assets.
• & $python -m pytest .\functional_tests\test_docs_app_surface_coverage.py .\functional_tests\test_docs_site_quality.py -q --tb=short --disable-warnings - passed after final documentation updates: 13 checks.
• git diff --cached --check - passed before committing the resolved merge.

Earlier validation, not a claim of full-suite execution on the new merge commit:

• & $python .\scripts\check_cosmos_response_boundaries.py --run-contracts - passed before base integration: 1,126 tests and 244 subtests, with zero inventory gaps and external network blocked. The full gate was not repeated locally after the base merges.
• The saved-memory base integration passed 219 Python tests and 5 subtests, including connector/SDK contracts, incoming memory-resolution behavior, real bootstrap, and documentation.
• npm --prefix .\application\v2_ui run typecheck and npm --prefix .\application\v2_ui run build - passed before base integration; existing bundle-size advisory remains. Base integration did not change production frontend sources or dependencies.
• All reported GitHub checks passed on the preceding PR head 7623793fc. The new merge commit requires its own CI results.

Known baseline failures (pre-merge comparison): broader workspace-backend and MCP route-security suites were not green. Fresh-process runs produced identical sets of 86 failed reports, including the failed subtest, with current and untouched HEAD route source. The unrelated native-authoring Cosmos draft assertion and older UI expectation gaps are documented; this PR does not claim every repository suite passes or repair unrelated behavior.

Live boundary: Azure telemetry corroborated successful spec uploads followed by fast HTTP 400 preparation failures, with no recorded connector HTTP dependency. The exact deployed payload/revision was not captured. No deployment or live FED-12/FED-13 rerun was performed; downstream tool-call acceptance remains unqualified.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated ACTION_TEST_CONNECTION.md, OpenAPI/MCP references, and ACTION_CONNECTION_TEST_CLEAR_INTENT_FIX.md. Release notes remain unchanged because the optional update was not approved. A separate harness handoff was delivered outside the repository; no external federal harness files were changed.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new routes or settings responses. Existing route authentication, ownership, group/Admin policy, strict clear-path checks, and MCP destination validation remain intact. Regression tests cover response/log redaction and absence of storage mutation.