Wire deployed ACA qualification CI

[Laveesh Rohra (larohra)]

Stack layer 4/5

Parent: #196

Summary

• Adds one nonblocking AcaQualification stage after Build in the E2E pipeline, with independent Python 3.13 and 3.14 matrix jobs.
• Runs automatically only for IndividualCI/BatchedCI on refs/heads/main; trusted operators may manually queue any branch. PR and Schedule reasons remain excluded.
• Uses ordinary/basic ACA variables configured directly on Azure DevOps pipeline 1777. It does not add or depend on an Azure DevOps variable group; existing YAML variable templates remain unrelated build-infrastructure imports.
• Keeps provisioning concurrency at 1 per runtime leg and aggregate concurrency at 2. The dedicated Sandbox Group must retain quota/headroom for both jobs plus retained sessions; the matrix is intentionally not serialized and does not depend on an unverifiable quota API.
• Preserves the lightweight in-package build marker. Sweep, post-run cleanup, and group-wide reclamation remain owned by layer 5.

Manual-run trust boundary

A manual run executes branch-controlled YAML and scripts under the deployment service connection. This is intentionally authorized through restricted pipeline queue permissions for trusted operators so feature branches can be validated before merge. Protected-branch or environment checks are not added because they would defeat that approved workflow.

Validation

• python -m pytest tests/test_aca_qualification_pipeline.py -q — 65 passed
• python -m ruff check src tests
• python -m mypy src — 98 source files
• git diff --check
• ADO preview compile: pipeline 1777 expands Python 3.13/3.14 with maxParallel: 2, no variable group, and no sweep
• ADO preview compile: pipeline 1733 remains without qualification, variable-group, or sweep wiring

This replaces the CI-trigger, deployment-identity, Python-matrix, and basic-variable-policy portion of draft #169 without modifying or closing it.

[Copilot]

🟡 Changes recommended

Qualification must stop after failed provenance verification, and the operational guide must list all required app settings.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds nonblocking deployed ACA qualification to the E2E pipeline for trusted manual runs and main-branch CI.

Changes:

• Adds parallel Python 3.13/3.14 deployment and qualification jobs.
• Documents pipeline configuration, prerequisites, and triage.
• Adds wiring contract tests and updates FRD/live-test documentation.

File summaries

File	Description
eng/ci/e2e-tests.yml	Adds the qualification stage and execution condition.
eng/templates/official/jobs/aca-qualify.yml	Defines deployment and qualification matrix jobs.
eng/ci/docs/aca-qualification.md	Adds the operational guide.
tests/test_aca_qualification_pipeline.py	Tests pipeline wiring and policy.
tests/live/README.md	Documents automated qualification coverage.
docs/frds/0008-aca-sandbox-session-runtime.md	Records the finalized CI policy.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Two existing operational guides still incorrectly state that deployed qualification has no pipeline wiring.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Balanced