feat(bpmn): author Integration Service activities from discovered contracts

[DevMomo]

Summary

This layer teaches uipath-maestro-bpmn how to turn an exactly resolved Integration Service connection into source-complete Intsvc.ActivityExecution tasks under the current V1 contract.

It adds one provider-neutral, read-only eval that builds:

Start
  → SubmitArtifact — curated POST/Create activity
  → ListAllRecords — generic GET/List activity over ledger_entries
  → End

The synthetic connector exercises both Integration Service authoring paths without encoding provider-specific Jira, Slack, Google Drive, tenant, or environment behavior.

Why

Resolving a connection is not enough to author a connector activity. The author must preserve several distinct identities:

• catalog activity Name → BPMN operation;
• generic catalog CRUD Operation → resource and schema discovery;
• selected object and schema operation → BPMN objectName, method, and path;
• described request and response fields → activity inputs and response schema.

This layer documents and tests that complete chain.

Authoring workflow

For one named profile and connection, the skill now:

1. Reads the registry-owned Intsvc.ActivityExecution template.
2. Resolves the exact enabled connection across accessible folders.
3. Lists the connector activity catalog.
4. Resolves a curated activity by its concrete object and HTTP method, including a parent-dependent schema field.
5. Resolves a generic activity by its CRUD operation, concrete object, and independently verified available operation.
6. Confirms both object identities through enriched registry lookups.
7. Authors and locally preflights the BPMN without invoking either connector operation.

Current source contract

Each activity preserves the registry-owned shape:

• typed string context for activityConfigurationVersion, connectorKey, connection, operation, objectName, method, and path, plus folderKey when the selected connection supplies one;
• JSON metadata;
• separate root Connection bindings for ConnectionId and a discovered folderKey, sharing the appropriate source resource key;
• no context-level resourceKey;
• operation-specific request inputs directly under uipath:activity, after the closed context, with exact path, query, body, or file targets; and
• one response output with type="jsonSchema" and source="=response".

The eval preserves a supplied solution resource key for one activity and exercises the deterministic connection-ID fallback for standalone source in the other. The same connection can therefore require distinct binding pairs when the source resource keys differ.

If registry output does not expose the supported shape, the skill does not invent a replacement contract or claim the node is runnable.

What the eval asserts

The deterministic checker verifies both the authored BPMN and its discovery trace:

• a Process Orchestration project with one start event, two ordered bpmn:sendTask activities, one end event, three sequence flows, and complete diagram data;
• exact BPMN, BPMNDI, DI, DC, and UiPath namespaces;
• named-profile verification before tenant-dependent discovery, with the same profile and --output json on every parsed tenant command;
• exhaustive connection lookup, exact catalog identities, generic object resolution, and available → selected-operation → parent-dependent schema ordering;
• exact contexts, connection/folder bindings, resource ownership, request names/types/targets/values, response variables, and nested response schemas;
• no leaked enrichment data or stale grouped-input/output fields; and
• no connector execution, connection mutation, packaging, publishing, deployment, or direct mock-fixture inspection.

The synthetic fixture deliberately does not fake a successful product validation result. It reports validation as unavailable; the task checker proves the authored source and trace. Product-side structural validation is supplied by the CLI dependency below, and only an authorized live run can prove external business behavior.

Stack and dependencies

• Skills stack: #2371, immediately above #2370.
• UiPath/cli#3327 provides paged, all-folder connection discovery.
• UiPath/cli#3353 provides the current V1 registry template and matching structural validation.

This PR does not generate package metadata or execute a connector. Packaging, live accounts, debug execution, business assertions, and cleanup remain in the upper live-eval layer.

Verification

• Current-head smoke suite: 12/12 passed; 100% pass rate.
• Final clean coder-eval: 7/7 criteria, weighted score 1.000, Claude Sonnet 5, one iteration, 282.5 s.
• Checker output: OK: curated + generic activities preserve registry, binding, request, response, and read-only current V1 contracts.
• Focused BPMN contract tests: 6/6.
• All three mocked registry templates byte-match CLI #3353 at e10fd5e.
• Wrong-namespace and alternate mock-inspection negative probes: rejected.
• Task planning, Python compilation, JSON/YAML parsing, CLI-verb lint, and git diff --check: passed.

Iteration timings

Contract	Task time	Result	What it exposed
Superseded grouped-input contract	346.4 s, 293.7 s, 308.6 s interrupted, 248.7 s, 364.2 s	Not current proof	Retained only as benchmark history for the earlier CLI shape.
Current CLI #3353, run 1	349.9 s	6/7	Trace guard treated a redundant read-only default-profile status check as selected context.
Current CLI #3353, run 2	422.1 s	6/7	Operation inputs were placed inside uipath:context.
Current CLI #3353, run 3	332.4 s	5/7	Folder binding used the wrong resource type and generic available-operation discovery was skipped.
Hardened checker	520.6 s	6/7	Folder ownership was incorrectly described as activity-owned instead of coming from the selected connection row.
Final head	282.5 s	7/7, 1.000	All artifact, discovery, identity, binding, request/response, and safety criteria passed.

Only the final-head run is used as pass evidence.

[github-actions]

Claude finished @DevMomo's task in 2m 45s —— View job

---

Coder-eval task lint (advisory)

1 task YAML changed; verdicts: 0 Critical, 0 High, 0 Medium, 0 Low, 1 OK.

Rubric: .claude/commands/lint-task.md. This check is advisory and never blocks merge.

Evidence of passing run

✅ Author confirms passing run: "Final clean coder-eval: 7/7 criteria, weighted score 1.000, Claude Sonnet 5, one iteration, 282.5 s."

Per-task lint

tests/tasks/uipath-maestro-bpmn/connector/activity_authoring/activity_authoring.yaml — verdict: OK

The 795-line Python checker (check_activity_authoring.py) validates BPMN structure, namespaces, typed context fields, binding pairs with resource ownership, operation-specific request inputs/targets, nested response schemas, and the full CLI discovery call trace ordering — all against deterministic side effects from the mock harness call log. The command_executed criteria verify four distinct discovery phases (is activities list, is resources list, is resources describe, maestro bpmn registry get), all of which map to verbs present in the current CLI catalog. Two command_not_executed criteria enforce the read-only boundary. No self-report anti-pattern, no prompt over-specification (prompt states the goal and constraints without prescribing CLI flags or step-by-step procedure), no near-duplicate among connector siblings (registry_discovery, integration_service_boundary), no sandbox env_packages issues, and run_limits fields are correctly at the top level.

Within-PR duplicates

No duplicate clusters detected (only one task YAML added).

Conclusion

✅ All changed tasks pass the rubric. Evidence of passing run confirmed.

[github-actions]

Claude finished @DevMomo's task in 3m 47s —— View job

---

PR Review: feat(bpmn): author runnable Integration Service activities

• Read review criteria and project conventions
• Read existing PR conversation
• Analyze PR diff against base branch
• Read all changed files in full
• Run skill-specific checks (tests, CODEOWNERS, links, cross-skill refs, secrets)
• Post review findings

---

Summary

Adds a new reference guide (integration-service-activity-authoring-guide.md) teaching the BPMN skill how to author runnable Intsvc.ActivityExecution tasks from a resolved Integration Service connection. Includes a provider-neutral integration-tier eval task with a 795-line deterministic Python checker and 16 mock response fixtures. Updates SKILL.md, cli-conventions.md, and registry-workflow.md to integrate the new guide.

Change-by-Change Review

1. skills/uipath-maestro-bpmn/SKILL.md (+10/-2)

Severity: OK

Three well-scoped changes: (1) a bridge paragraph after the named-profile context section pointing to the new activity-authoring guide, (2) an expanded Intsvc.ActivityExecution note in the discover/get workflow that correctly describes the new boundary, and (3) a new row in the reference navigation table. All relative links resolve. The bridge paragraph joins the preceding paragraph via soft newline — consistent with this file's existing style.

2. skills/uipath-maestro-bpmn/references/cli-conventions.md (+3/-0)

Severity: OK

Adds three new CLI command rows for uip is activities list, uip is resources list, and uip is resources describe. All include --output json, correct flag descriptions, and clear guidance on when to use each (curated vs. generic). Consistent with the existing table format and column style.

3. skills/uipath-maestro-bpmn/references/integration-service-activity-authoring-guide.md (+230/-0)

Severity: OK

New 230-line guide covering the full activity-authoring workflow (registry template → catalog selection → schema resolution → template filling → request inputs → response contract). Prescriptive numbered sections with copy-paste CLI commands and --output json throughout. Opens with a bridge to live-resource-resolution-guide.md (exists). No content duplication with that guide — it picks up where connection resolution ends. No cross-skill references. Follows kebab-case -guide.md naming. Decision trees are explicit (curated vs. generic row shapes, stop conditions). File is appropriately self-contained.

4. skills/uipath-maestro-bpmn/references/registry-workflow.md (+9/-7)

Severity: OK

Replaces the old connector activity description (which referenced live-resource-resolution-guide.md#5-preserve-the-binding-boundary) with a pointer to the new guide. The new text is a bridge-only description — no duplicated mechanism detail. The generated package metadata prohibition is preserved.

5. tests/tasks/uipath-maestro-bpmn/connector/activity_authoring/activity_authoring.yaml (+97/-0)

Severity: OK

Task YAML follows conventions:

• task_id skill-bpmn-is-activity-authoring: matches skill-<domain>-<capability> ✓
• tags [uipath-maestro-bpmn, integration, "mode:build", "lifecycle:generate", "shape:multi-node", connector, "feature:registry", "feature:connections", "feature:activities"]: all in closed vocabulary, skill tag first, required dimensions present ✓
• Sandbox: uses template_sources and mock_path_dirs — no env_packages for @uipath/cli ✓
• Prompt: goal-oriented, specifies what to build but not the exact steps ✓
• Success criteria: mix of run_command (primary checker, weight 7.0), command_executed (catalog/resource/schema discovery patterns), and command_not_executed (mutation/mock-inspection guards). Weights follow convention (7.0 primary, 1.0–3.0 supporting) ✓
• No --output json gating check per test-writing rules ✓

6. tests/tasks/uipath-maestro-bpmn/connector/activity_authoring/check_activity_authoring.py (+795/-0)

Severity: OK

Thorough deterministic checker covering:

• BPMN structure (start → curated → generic → end, 3 sequence flows, diagram completeness)
• Namespace enforcement (only BPMN, BPMNDI, DI, DC, UiPath)
• Context field validation (exact names, types, values for both activities)
• Binding pair validation (connection + folder, distinct ids/names, correct resource/propertyAttribute/default, resource key preservation)
• Request input validation (exact names, types, targets, values; inputs are siblings of context, not inside it)
• Response schema validation (jsonSchema variables, nested property reconstruction, leaf type matching)
• Discovery trace ordering (login → registry → connection → catalog → resource → schema → validation)
• Safety boundary (no resources run, no connection mutations, no pack/publish/deploy/debug)
• Trap fields (ISEnrichment, RequestCurated, titleLookup, responseOnlyTrap, resourceKey, pathParameters, queryParameters leaked into BPMN)

Uses from __future__ import annotations for forward references. Well-structured with focused assertion helpers.

7. Mock fixtures (16 JSON files)

Severity: OK

Complete mock fixture set:

• manifest.json: rule-based mock dispatch with version 2, longest-match-first ordering, exit code 1 for validation, unmocked default returns failure
• Connection fixtures include enabled/disabled entries and multiple folders (exercises exact-match selection)
• Activity catalog includes curated distractors (SubmitArtifactPreview) and generic distractors (CreateRecord)
• Resource descriptions include parent-dependent schema enrichment (-f tenant.scope=finance)
• Enrichment traps (RequestCurated, responseOnlyTrap, titleLookup) designed to test that the agent doesn't leak authoring-only metadata into the BPMN
• All synthetic data — no provider-specific content, no secrets, no personal paths

What's Missing

Nothing identified. The PR is scoped to an existing skill with existing smoke and e2e coverage. The new integration-tier task adds connector/activity-authoring coverage that didn't exist before. CODEOWNERS already covers both the skill path and test path. No new skill folder was added.

Area Ratings

Area	Status	Notes
Frontmatter	OK	No frontmatter changes; existing SKILL.md frontmatter remains valid
E2E Tests	OK	New integration-tier task with comprehensive checker; skill already has smoke + e2e coverage
Skill Body	OK	Minimal, well-scoped SKILL.md changes with correct bridge references
References & Assets	OK	New guide follows conventions; no duplication with existing references; all links resolve
Repo Hygiene	OK	CODEOWNERS present, no secrets, no cross-skill dependencies, changes scoped to one skill

Issues for Manual Review

• CLI command accuracy: The three new uip is commands in cli-conventions.md (activities list, resources list, resources describe) and the mock fixtures assume specific CLI response shapes from UiPath/cli#3327 and UiPath/cli#3353. Verify those CLI PRs are merged or on track before this layer ships.
• V1 template shape: The guide's section 1 describes the current V1 XmlTemplate shape (separate inputs, no context-level resourceKey, two binding placeholders). If CLI #3353 changes the template shape before merge, the guide and checker would need to be updated.
• Mock dispatch ordering: manifest.json relies on longest-match-first rule ordering. Confirm that coder_eval's mock framework evaluates rules top-to-bottom and returns the first match (the parent-dependent -f tenant.scope=finance rule must match before the generic --operation Create rule).

Conclusion

Clean, well-structured PR. The new activity-authoring guide is prescriptive and self-contained, the reference pointer discipline is followed (bridge-only text at each link point), and the integration test is thorough with good trap/distractor coverage. No issues found that would block merge — the manual review items are dependency-timing verifications, not code defects. Approve.