Automated Executive Reporting with Copilot or Rovo

Prerequisite check

1. 1

   Confirm licensing and policy

   Have the administrator verify premium Jira, HTTP and Azure Key Vault entitlement for the unattended cloud flow, plus capacity for Run a prompt. A Microsoft 365 Copilot license alone does not establish entitlement for those Power Automate actions. Confirm the environment and DLP policy with a small connector test flow. If using Process capacity, explicitly assign parent and child flows to the supported flow group; a parent's capacity does not automatically cover an unrelated child.

2. 2

   Create the solution and connections

   Power Automate → Solutions → New solution → TeamReporting. Create the flows below inside it with connection references for Outlook, SharePoint, Jira, Azure Key Vault and prompts. Add Approvals only for approval mode. Use approved unattended identities and document ownership/rotation.

3. 3

   Confirm product scope and access

   This baseline targets Jira Cloud, Confluence Cloud, SharePoint Online and Exchange Online. Test the actual flow identities' access to the project, mail folders, snapshot library and prior reports, plus page creation under the target parent. An administrator's browser access is not that test.

4. 4

   Record audience and exclusions

   Choose source exclusions once. Collector access to a private email does not authorize disclosing it to the report audience. Restrict raw evidence separately when needed. A link to a restricted source does not restrict the summary containing its facts.

State store and publisher setup

1. 1

   Create the evidence library

   Choose an approved SharePoint library. Add SourceInbox for persistent intake and Runs for packages. Use Runs/{ProgramKey}/{RunKey}/ for each run. Give the flow write access and reviewers the approved read access. Keep loops that append shared variables sequential.

2. 2

   Create ReportingRuns

   Create list ReportingRuns. Rename Title's display label to RunKey, retaining internal field Title; set Enforce unique values=Yes. Add text columns ProgramKey, Cadence, PublishedAt, RunId, OwnerRunId, PeriodStartUtc, PeriodEndUtc, PackageId, PackagePath, PageId, PageUrl, FailureCode; number columns Revision, RepairAttempts, PageVersion; and choice State: Collecting, Blocked, Drafting, NeedsRework, Ready, AwaitingApproval, Prepared, Posting, Published, Exception. Approval mode also needs text ApprovalId and ApprovedPackageId.

3. 3

   Create SourceInbox

   Create list SourceInbox with unique Title = IntakeKey; text columns SourceId, ProgramKey, ViewId, PeriodStartUtc, PeriodEndUtc, DataAsOfUtc, FileIdentifier, SourceUrl, Status; and date/time ReceivedAt. This manifest exists before any run folder. Intake never needs to guess the next run ID.

4. 4

   Establish destination permissions

   Create the Confluence reporting parent. Set its audience before the first POST. Parent view restrictions inherit; edit restrictions do not. Confluence Free does not offer content restrictions. Test an intended and an excluded reader. Stable past reports are not a tamper-proof retention system.

5. 5

   Record destination IDs and token route

   Copy the numeric parent page ID. Authenticate GET /wiki/api/v2/pages/{parentId} and record spaceId. Retrieve cloud ID from https://YOUR-SITE.atlassian.net/_edge/tenant_info. Create a scoped Confluence token with the endpoint's page read/write scopes and a rotation owner. Scoped/service-account tokens use ApiBase https://api.atlassian.com/ex/confluence/{cloudId}. An approved unscoped ordinary-user token may use the site origin instead; these routes are not interchangeable.

6. 6

   Bind a secret provider

   In an administrator-managed Azure Key Vault add secret weeklyexec-confluence-token and grant the Key Vault connection access. Add Azure Key Vault → Get secret, rename Get_Confluence_Token, and enter that name. Its value is body('Get_Confluence_Token')?['value']. Enable Secure inputs/outputs on it and HTTP actions. Those settings hide history data; they are not a secret store and cannot protect against someone authorized to redesign the flow.

Prepare Jira collection

1. 1

   Validate the connector and query

   Add Jira → Get list of issues, operation ListIssues. Set Jira instance to the site URL for an API Token connection. For OAuth call Get list of Resources and use the matching resource's cloud ID, not URL. Set jql to the generated bounded query. Saved filters/dashboards can help readers; subscription emails are not the required collector.

2. 2

   Freeze boundaries and query semantics

   At runtime substitute MainCore's local dates formatted in the Jira account's time zone. Start is inclusive; end exclusive. Store actual JQL in evidence. updated >= start AND updated < end is a last-updated slice: an issue edited again after the cutoff can disappear. It is not all changes or completed throughput. Collect current release/backlog scope separately. Exact historical reporting needs stored snapshots or a complete history design.

3. 3

   Build terminal pagination

   Initialize arrays JiraIssues and SeenTokens, string NextToken empty, Boolean JiraComplete=false. Add Do until JiraComplete. Call ListIssues with the same jql and nextPageToken (blank/omitted first). Append each returned issues item. If isLast=true, set JiraComplete. Otherwise require a nonempty unseen nextPageToken, append it to SeenTokens and repeat. Missing/repeated tokens, failed pages or exhausted loop limits mark error/truncated. An editorial top-N limit is never a total count.

4. 4

   Normalize complete results

   Use Select to map {id,url,observedAt,content,facts}. IDs can be jira:PHX-42; URLs use the approved host/key. For current issue state observedAt is the query snapshot time; keep issue.updated in content. Deduplicate by issue ID across queries. Count distinct items only after terminal pages. Store flow-computed counts in synthetic item jira:scope-counts with facts like {key:"openCount",value:"12",unit:"issues"}.

Prepare Tableau and Outlook

1. 1

   Configure the Tableau view

   Apply exact program/release filters and save a custom view. Use the previous completed period. Tableau Last relative-date ranges can include the current unit; Previous week may match your report. Show metric definitions, filters, period and data-as-of metadata. Subscribe after the relevant refresh with a delivery buffer. Verify Download Image/PDF and subscription permissions. Include visible metadata labels with a fixed period label, view name and filter summary, plus a data-as-of timestamp in canonical UTC format, for example 2026-09-28T05:00:00Z. If the dashboard cannot expose this, use an approved structured metadata source; email receipt is not a substitute. The label format is fixed, but its dates must roll forward automatically from the view's relative-period calculations: previous completed week for weekly cadence, previous completed day for daily. Do not type new dates into the dashboard each run. MainCore computes the expected label from PeriodStartLocal/PeriodEndLocal, for example 2026-09-21 / 2026-09-28 (end exclusive), and compares the extracted label.

2. 2

   Choose a readable numeric source

   Prefer approved structured numeric data where available. For subscriptions use tested PNG/JPG/PDF. Tableau Cloud subscription attachments have a documented 2 MB limit, with different behavior for configured SMTP. Pulse/Trusted Extensions can cause blank PDFs; Bridge refresh subscriptions have limitations. Test your exact view and format. Saving an image does not extract or verify its numbers.

3. 3

   Create real mail folders

   Create approved real Outlook folders such as Reporting/Project and Reporting/Tableau. Route mail using server-side delivery rules. Do not depend on a later manual move behaving like new delivery. Configure sender/subject/program exclusions once. For a shared mailbox use its corresponding trigger/actions and grant mailbox access.

4. 4

   Build Reporting-Intake

   Inside the solution use When a new email arrives (V3) in the Tableau folder. Check sender/subject against configured subscriptions. Retrieve selected attachments with Get attachment (V2), passing Message Id and Attachment Id. Inline PNGs can have isInline=true; don't discard all inline images. Save bytes using SharePoint Create file and write SourceInbox. Use a unique intake key from mailbox identity + internetMessageId + attachment ID, or an approved stable equivalent. Subject alone is not unique.

5. 5

   Reconcile delayed/missed intake

   Dynamic Delivery can generate an initial event without attachments and a later one with them. Mark pending, refetch with bounded delay, deduplicate the later event. Add daily Reporting-ReconcileIntake with Recurrence and Get emails (V3) over the approved folders to fill missing manifest entries. Top defaults to 10 and maxes at 1000; some separate filters search only the first 250 items. Use Search Query and bounded subwindows. A limit-sized response may be truncated, not complete. Inspect actual output fields before mapping message identifiers.

6. 6

   Validate metadata before admission

   Intake writes Status=pending and records approved routing plus received time. MainCore runs KPI extraction on the actual file. Its observedMetadata returns the visible viewName, periodLabel, filterSummary and dataAsOfLabel. Compare the first three to configured expected labels, require dataAsOfLabel to be a valid canonical UTC timestamp, and assign that exact value to observedAt/DataAsOfUtc. Set SourceInbox ready only after these checks and metric validation. Unknown/absent/ambiguous metadata stays unverified; never derive freshness from received time.

Set up Reporting-MeetingIntake once

1. 1

   Choose the delivery profile

   Record the provider, a tested parser/calendar mapping for that provider’s actual delivery, approved organizer/program scope, intended recipient, real Outlook folder Reporting/MeetingNotes, source hosts and maximum delivery delay. For Webex or Zoom, configure provider summary generation and sharing for that recipient. Configure an Outlook server-side delivery rule. Use the shared-mailbox trigger/actions when applicable. Require administrator-approved anti-spoofing controls; an allowed From address alone does not prove authenticity.

2. 2

   Choose the reporting basis

   For reporting meetings held during a period, use the actual MeetingHeldAtUtc from a tested provider/calendar mapping. Preserve ReceivedAtUtc separately. Do not substitute the email arrival time for the meeting time. If the scope is instead “summaries received this week,” explicitly configure ReceivedAt and label that limitation. Fix the program and organizer mapping in trusted configuration; email text cannot redefine it.

3. 3

   Extend the intake manifest

   In SourceInbox add text fields Provider, OrganizerIdentity, ProviderTenant, MailboxIdentity, InternetMessageId, ProviderMeetingId, OccurrenceKey, SegmentId, NoteVersion, NotesOrigin, ReviewState, AcquisitionRoute and SupersedesIntakeKey; add date/time fields MeetingHeldAtUtc, ReceivedAtUtc and NoteUpdatedAtUtc. Reuse ProgramKey, FileIdentifier, SourceUrl and Status. Use NotesOrigin=provider-ai and ReviewState=unverified for generated summaries. These are proposed internal columns, not guaranteed provider email headers. Leave absent version/update metadata explicitly unknown; provenance is not a model-controlled approval flag.

4. 4

   Create the meeting intake flow

   Inside TeamReporting create Reporting-MeetingIntake with the appropriate new-email trigger in the meeting-notes folder. Add Outlook Get email (V2) with the trigger Message Id, and set Original Mailbox Address for a shared mailbox. Inspect the test output and use the actual Body dynamic value. Preserve the original body and message metadata in SourceInbox files. For HTML normalization, Microsoft lists Content Conversion (Preview) → Html to text; obtain policy approval before choosing that preview connector. It is unavailable for new GCC/GCC High implementations and has a 5 MB content limit and 70-level HTML depth limit. It can change formatting and links. Keep the original alongside normalized text, and use original source metadata for citations. If the connector is prohibited or unsuitable, configure and test an approved converter or a provider plain-text delivery route before enabling this source; do not promise conversion by stripping HTML with an untested expression. A snippet or body preview cannot replace the full note.

5. 5

   Resolve protected content only through an approved reader

   For a link-only delivery, call the preconfigured provider reader using the connection with access to those notes. Allow only approved hosts and redirects. Store the returned note text and platform identity before marking it readable. Do not fetch arbitrary email URLs or pass notification links to a prompt as if it read them. A missing reader, denied access, deleted note or empty response leaves Status=unavailable; if those notes are required, stop the report. Full-body email intake does not need this adapter.

6. 6

   Deduplicate and retain corrections

   Use mailbox identity + internetMessageId as the unique delivery key, with a tested stable equivalent only when the field is absent. Record provider + tenant/organizer + meeting ID + occurrence + segment + provider note version as content identity. A recurring series ID alone is insufficient. Map identity from documented provider metadata or an approved calendar mapping, never an invented model value. Quarantine unresolved occurrences. Distinct recording segments are separate content and must not replace one another. Retain reissued summaries as separate versions; set SupersedesIntakeKey only for documented supersession. Where no source revision exists, compare the preserved normalized content to detect change; this cannot prove which version supersedes another. Quarantine ambiguous changes instead of choosing the last arrival. Never overwrite evidence in a frozen run.

7. 7

   Reconcile delivery automatically

   Extend Reporting-ReconcileIntake to scan the approved meeting-notes folder with bounded Search Query windows and the same deduplication/admission logic. Scan a delivery window from PeriodStartUtc through EvaluationTime, extended by the configured delivery grace and replay overlap; enforce complete results and exact matching after retrieval. This window finds notifications; admission uses the configured meeting/receipt basis. For meeting-time reports, query SourceInbox by MeetingHeldAtUtc within the closed report interval. Late delivery still belongs to the meeting period. Do not apply the project-mail ReceivedAt filter to this source path.

8. 8

   Define what completeness means

   If every expected meeting summary is required, provide an approved meeting inventory keyed by occurrence, plus its generation/sharing expectations and delivery deadline. Compare expected occurrences with admitted notes. Schedule MainCore after the configured delivery deadline. If a run starts earlier, its original owner may use a bounded Delay until and re-read before freezing, or stop as an exception. A later scheduled duplicate cannot take over that owner’s row. After the deadline, record missing evidence and notify the owner. Without that inventory the flow can prove a complete mailbox scan, but cannot prove that every meeting produced notes. State the scope as received/admitted summaries. Never treat no email as proof that no meeting occurred.

9. 9

   Admit notes to the Outlook evidence record

   After content, scope, identity, permission and completeness checks, save Status=ready. MainCore reads actual stored text and provenance. Merge admitted meeting items with normal project-mail items into exactly one outlook source record. Use unique item IDs such as outlook:meeting:{IntakeKey} and url to the approved stored evidence. Set observedAt to the documented note update timestamp when supplied; otherwise use ReceivedAtUtc and state that source update time is unknown. The separate held/receipt basis controls period selection. Include provider, occurrence/segment/version, origin, review state and both event/delivery timestamps as a labeled prefix in content. Leave facts empty unless a separate authorized structured source supplies verified numeric facts. The canonical item schema stays unchanged.

10. 10

    Test the boundary before enabling delivery

    Run one real meeting with a known note body, then test a link-only message without access, a duplicate delivery, an edited summary, a late email for the prior week and a meeting exactly at PeriodEndUtc. Require one admitted version per occurrence and segment under the saved selection policy, no admitted link-only text and end-exclusive matching. Test the intended report audience against the stored evidence and linked platform permissions; exclude notes whose disclosure is not approved for that audience. Include multiple recording segments and an edited portal summary with no replacement email; the latter must not be claimed as captured automatically.

Save and test prompt actions

1. 1

   Create named inputs

   In the prompt builder save WeeklyExec-DRAFT with Text inputs configJson and evidenceJson, inserted as input objects in the instructions. QA adds draftJson; REPAIR adds qaJson. KPI extraction uses Image or document input snapshotFile and Text metadataJson. A typed input name in prose is not a binding.

2. 2

   Set Text output and test the shape

   Paste the workbench instructions; choose Text output. Instruct one JSON object without Markdown fences. DRAFT/REPAIR return {runId,revision,claims}; QA returns {runId,revision,status,findings}. Test representative records including all claim kinds. Save the prompt. Missing facts produce failure, never fabricated owners, dates or zero values.

3. 3

   Map and parse each response

   Add Run a prompt and choose the saved prompt. Map configJson to string(outputs('Report_config')), evidenceJson to string(outputs('Validated_evidence')), and the other named inputs to validated stage outputs. Feed the Text response dynamic value into Parse JSON; inspect a test run to find the actual response property. Do not parse the entire action envelope or transcript. Use the appropriate stage property schema from the contract builder. Conditions enforce values and bounds beyond parsing.

4. 4

   Map actual snapshot bytes

   Use SharePoint Get file content and map its File Content dynamic value to snapshotFile, not a URL. metadataJson contains runId/revision, sourceId, expected view/filters/period and allowed metric keys. Supported input limits include PNG/JPG/PDF under 25 MB and under 50 pages, with a 100-second processing limit. Calling a prompt directly as an agent tool has separate image/document restrictions; this recipe uses a flow.

5. 5

   Validate extraction before adding facts

   Parse the KPI shape; require ready status, zero findings, matching runId/revision/sourceId, exact configured metric keys, numeric strings, matching units and locator fields. Compare expected period/filter metadata to visible evidence. Duplicates, absent values or unreadable/stale data block admission. Benchmark extraction against underlying data during acceptance; schema and AI QA alone cannot prove OCR accuracy. Require observedMetadata viewName/periodLabel/filterSummary to equal the expected display labels. Require dataAsOfLabel in the agreed UTC ISO format, validate it with the workflow date functions, and store the exact timestamp rather than asking the model to convert a timezone. If labels or metadata feed are unavailable, block that required source.

Initialize and freeze a new run

1. 1

   Save configuration and initialize variables

   Compose Report_config with planner settings plus ProgramKey, BusinessTimeZone, ExceptionOwner, allowed source hosts and required KPI keys/units. Initialize EvidenceSources, EvidenceItems and Errors as arrays; GateFailed=false; RepairAttempts=0; ReportHtml and NextToken as empty strings. Keep variable-mutating loops sequential. Use exact action names below or update all references. Initialize Object variables CurrentDraft={} and CurrentQA={}; arrays SourceErrors=[] and DraftErrors=[]; and Booleans SourcesPass=false, ClaimsPass=false, NumericPass=false, ContentPass=false. CurrentDraft/CurrentQA can be replaced after repair; Compose outputs cannot be reassigned.

2. 2

   Compute closed-period boundaries

   Compose EvaluationTime=utcNow() once. Add the expressions below in order. Paste only the expression following each action name. Convert local start and end separately to UTC; a DST week is not necessarily 168 hours. Resumed runs load their stored boundaries and never recompute them.

Claim, collect and freeze

1. 1

   Atomically claim a run

   For a new computed key use SharePoint Create item in ReportingRuns with unique Title=RunKey, OwnerRunId=workflow().run.name, State Collecting, Revision 1, stored boundaries and PackageId=guid() generated once. Only the execution that successfully creates that unique row may collect/draft/publish. Put creation in its own Scope. On unique conflict, Get items with Title eq 'PHX-weekly-2026-09-21-r1' (example), Top Count 2, and return existing status or read-only reconciliation. Other errors are failures, not evidence that another owner exists. Never allow a caller merely finding an existing Prepared row to become its writer. Initialize OwnsRun=false. Set OwnsRun=true only after a confirmed successful Create item response, then assign OwnerRunId/PackageId from that row and Set Integer ReportingRunItemId to its ID. Read-only callers may inspect the existing row ID for status only; it never grants writer ownership. An ambiguous creation response enters read-only lookup/reconciliation, never writes.

2. 2

   Create the package folder

   The owner persists PackagePath and creates Runs/{ProgramKey}/{RunKey}/. Store its row ID for Update item. The unique key uses restricted ProgramKey, cadence, local start date and revision, so apostrophes cannot enter the filter. Existing callers use the stored PackageId; they never generate a replacement.

3. 3

   Handle existing runs before sources

   Published: verify and return the stored page. Posting/uncertain: read-only reconciliation. Active: return in-progress, never run a parallel collector or writer. A crashed pre-write owner remains an exception requiring an explicit operator-controlled recovery/revision; do not automatically take over its row. This conservative policy trades unattended exception recovery for clear duplicate prevention. Normal new-period runs remain automatic.

4. 4

   Collect configured sources

   Run terminal Jira pagination. Read approved project mail with Get emails (V3), Search Query and bounded period subwindows; preserve message identifiers, timestamps and approved plain content. Collect prior report context using the lookup recipe immediately below. Query SourceInbox by trusted ProgramKey/ViewId and a configured delivery window, including pending rows whose period is not known yet. A starting window is PeriodEndUtc minus 48 hours through EvaluationTime; tune it once to subscription timing. Get file content, extract/validate observed metadata, then admit only the expected period. Persist canonical PeriodStartUtc/PeriodEndUtc and DataAsOfUtc after that match. If multiple validated snapshots match, choose the newest data-as-of under a fixed policy, not latest arrival. Require an expected file type/view mapping to exclude logos and unrelated attachments. Do not select only by latest arrival time. Bound all loops and mark a partial scan truncated. If meeting intake is enabled, select admitted SourceInbox meeting occurrences by the saved reporting basis and EvaluationTime, read the actual files, and merge them into the same Outlook source record. Apply the registered occurrence/deadline policy before declaring that record complete.

5. 5

   Compose the evidence envelope

   Build Validated_evidence with runId, revision and source records. Record ready, verified empty, missing, stale, truncated or error for every required source. Preserve content, IDs and exact numeric fact strings. Keep prior reports as historical context. Freeze files and the normalized bundle before Draft. A URL is a citation, not proof that a prompt read its target. After source admission, loop sequentially over EvidenceSources, then each source.items, and Append to array variable EvidenceItems. Resolve all draft references against this flattened ledger. Save EvidenceItems with the bundle.

6. 6

   Apply the source gate

   Parse the stage schema. Loop over required source IDs; require exactly one record each. Reject duplicate item IDs (append to SeenIds only after checking contains=false), failed terminal pagination, ready records without items, and disallowed/unverified empty results. Check source-specific data freshness and period/context. Append violations to Errors and set GateFailed. On failure save Blocked, notify and return; do not call Draft. Append source violations to SourceErrors. Set SourcesPass=true only after the entire source loop succeeds and SourceErrors is empty; otherwise keep it false.

Collect project mail with explicit boundaries

1. 1

   Scan bounded calendar days

   In Get emails (V3), select the configured real folder, Fetch Only Unread=false, Top=1000, and leave separate Subject/From filters empty. For each calendar date covering the UTC window (include an adjacent day on both sides), use Search Query such as received:09/21/2026; this is Microsoft Graph's documented received-date syntax. Add the approved scope terms only after testing their matches. Deduplicate using mailbox identity + internetMessageId. A result at the configured cap, or any truncated response, blocks completeness. High-volume folders need an administrator-provided paginated source path, not a silently incomplete scan.

2. 2

   Filter the exact UTC interval

   Use Filter array over body('Read_Project_Mail')?['value']. The current V3 Graph output uses receivedDateTime. Apply the expression below. Keep only approved/exclusion-compliant messages, use source ID outlook:{stable ledger ID}, observedAt=receivedDateTime, plain approved body text and a URL to the stored evidence file. The stored file link remains useful if a message moves. Test inclusion at the start and exclusion at the end with known boundary messages. A successful zero query can be empty only after the complete scan.

Bootstrap and collect prior Confluence context

1. 1

   Find the prior published run

   SharePoint Get items on ReportingRuns: filter ProgramKey and Cadence to this configuration, State='Published', and PeriodEndUtc no later than this run's PeriodStartUtc. Order by PeriodEndUtc desc, Revision desc; Top Count 1. Store ProgramKey/Cadence when creating a row, and PublishedAt when verifying publication. Example Filter Query: ProgramKey eq 'PHX' and Cadence eq 'weekly' and State eq 'Published' and PeriodEndUtc le '2026-09-21T00:00:00Z'. All boundaries use the same canonical UTC text format.

2. 2

   Fetch the actual body

   If found, add Confluence Get page content and metadata named Read_Prior_Report. Select the website/space and supply the stored PageId. Its response contains value[], not a single top-level page body. Filter for the expected id and require exactly one result; use that entry's body.storage.value as content. Set id='confluence:'+pageId, a trusted page-ID URL and observedAt=the stored PublishedAt. This is historical context verified at publication, never current delivery evidence. If a later edit must be detected, use the authenticated REST GET and compare the stored version to the returned version.

3. 3

   Handle the first report

   If the successful prior-run lookup is empty, use a configured seed page if provided, or record confluence status empty, emptyVerified=true, items=[] only when that source policy allows bootstrap emptiness. Read a seed through the same action; capture its actual timestamp with the REST page version metadata when needed. A failed lookup or denied page read is error, never verified empty.

Draft, verify, review and repair

1. 1

   Draft from frozen evidence

   Set State Drafting. Call DRAFT with Report_config and Validated_evidence. Parse into Parse_Draft; Set variable CurrentDraft to body('Parse_Draft'). Require exact runId/revision and unique claim IDs; reject unknown kinds/fields. Keep output as plain text. The model cannot set evidence status, approval or publication state. Don't create the final Validated_draft Compose until repair/QA selection is complete.

2. 2

   Validate each claim

   Resolve every sourceIds entry against EvidenceItems with Filter array and require exactly one match. Risk claims require owner/impact/mitigation; actions and decisions require owner/dueDate. Parse/validate date values; blanks or placeholders fail. For each kpis mapping require exactly one referenced fact and identical value/unit. Reject duplicate mappings and unapproved URLs. Numeric KPI cells come from these structured mappings. QA must flag unsupported narrative figures; issue keys and dates are not KPIs. Validate CurrentDraft. Keep separate structural/reference errors and numeric errors in DraftErrors. Set ClaimsPass/NumericPass/ContentPass true only after every corresponding check finishes successfully. Require at least one claim, all kinds allowed, nonblank bounded text, known references and valid typed fields. Test schema keyword enforcement and add Conditions where needed.

3. 3

   Run independent QA

   Call QA with string(outputs('Validated_evidence')) and string(variables('CurrentDraft')) as draftJson. Parse Parse_QA; Set CurrentQA=body('Parse_QA'). Require matching identity, status passed and zero findings. QA checks factual support and omissions; deterministic reference/value checks remain required.

4. 4

   Repair once

   For a parseable draft with failed claim checks or QA, set NeedsRework and RepairAttempts=1. Call REPAIR with original evidence, CurrentDraft and CurrentQA (including deterministic validation findings). Parse into a separately named Parse_Repaired_Draft and replace CurrentDraft. Reset DraftErrors and ClaimsPass/NumericPass/ContentPass to false; preserve SourceErrors/SourcesPass. Repeat all draft checks, call QA again, parse into Parse_Repaired_QA and replace CurrentQA. Keep the revision unchanged. A second failure or malformed output saves Exception and notifies. Once checks pass, Compose Validated_draft=variables('CurrentDraft') and Validated_QA=variables('CurrentQA') for the renderer/final gate. Corrections to a published report need a new revision/package.

5. 5

   Freeze the passing package

   Save evidence.json, draft.json and qa.json plus rendered HTML. Persist State Ready then Prepared and restrict package edits. Automatic mode continues; approval mode reviews these exact bytes/PackageId. An altered package invalidates approval.

Render the package

1. 1

   Create the section renderer

   Use the builder's Filter array actions for summary/progress/risk/decision/action, each reading Validated_draft.claims. Use Select in text mode for escaped rows, then Compose Render_storage to join fixed headings/tables. Keep KPI loops sequential. Empty sections do not prove no risks; source completeness and QA establish that interpretation.

2. 2

   Append trusted source references

   Append Sources using EvidenceItems. Before rendering, require https and exact membership in the configured host allowlist using uriScheme/uriHost. Escape ampersands first, then angle brackets and double quotes in attributes. Escape visible text. Malformed/unknown links fail validation; models cannot generate destination/source URLs.

3. 3

   Append the package marker

   Set PageTitle to concat('Executive Report - ',variables('RunKey')). Confirm the renderer emitted Report key: {RunKey}; Package: {PackageId} using persisted values; append it only for an alternative renderer. Save complete ReportHtml in PackagePath. Retry/reconciliation reuses this title, marker and frozen content.

4. 4

   Add approval only when configured

   For PublicationMode=approval add Start and wait for an approval after rendering/gates. Assign the configured approver and include RunKey/PackageId/package link. Store ApprovalId; require Approve for the unchanged package and persist ApprovedPackageId. Rejection/timeout stops. Choose escalation shorter than cloud-flow duration limits. Automatic mode skips this branch entirely.

Publisher scope inside MainCore

1. 1

   Recheck owner and gate

   Reload the run row. Require OwnerRunId=workflow().run.name, correct PackageId/identity, no prior write, SourcesPass/ClaimsPass/NumericPass/ContentPass true, QA passed with zero findings, and exact package approval only if enabled. Set these Booleans through the checks in Phase 5. False saves Blocked and returns. Do not trust a prompt's canPublish property.

2. 2

   Read before creating

   HTTP Find_Report_Page: GET the URI below; Basic authentication, configured account email as Username, body('Get_Confluence_Token')?['value'] as Password, Accept application/json, Secure inputs/outputs on. Filter results for exact title and spaceId, then verify parent and storage marker. Complete pagination within the approved API base or stop with an exception. Partial absence is not permission to create.

3. 3

   Handle existing pages

   One exact matching page with correct parent/package marker is a recovered success: GET with body-format=storage and persist ID. Wrong package/parent or multiple matches is a conflict. A Posting/uncertain row performs read-only recovery. Empty recovery results never prove an earlier POST had no side effect.

4. 4

   Persist Posting before POST

   Only the confirmed original owner of Prepared can create. Update State Posting successfully first. HTTP Create_Report_Page: Method POST, URI concat(variables('ApiBase'),'/wiki/api/v2/pages'), Retry policy None. A failed state update stops the write. Do not deploy a second writer or take over an existing Prepared row automatically.

5. 5

   Send the object body

   Use the JSON object below with dynamic values. The serializer escapes embedded HTML. Do not concatenate JSON from model text. status=current publishes within previously configured permissions. No subsequent editor click is needed. Set ReportHtml to the final renderer output plus any appended trusted source list; HTTP must use ReportHtml, not an earlier Render_storage value.

6. 6

   Verify and store success

   The documented create success is HTTP 200. Require numeric body.id and persist it immediately. GET the ID with body-format=storage, verify status/title/space/parent/marker and record version.number. Construct PageUrl from SiteOrigin and ID; do not assume a top-level url property. Update Published before notification. Failed notification retries only the notification. Set PublishedAt to the verified publication timestamp and persist ProgramKey/Cadence with the row.

Enable unattended operation

1. 1

   Record test evidence

   Save configuration version, actual flow run IDs, page ID, source snapshots, expected KPI comparisons and acceptance outcomes. Record owner/admin sign-off. Readiness is self-attestation until these artifacts exist.

2. 2

   Enable the schedule

   Turn on Intake and ReconcileIntake first, then ScheduleEntry. Verify a scheduled run, followed by the next period, completes without manual initiation and produces one page. A manual demonstration does not prove recurrence.

3. 3

   Maintain ownership

   Assign backups for connections, prompts, source policies, subscriptions and token rotation. Alert on missed scheduled completion. Review permissions and model/source changes. Normal reporting has no repetitive user steps; maintaining the integration and resolving exceptions still needs owners.

1. Approve and prepare the bridge

1. 1

   Confirm entitlements and policy

   Confirm Rovo and Automation access, Power Automate premium HTTP/Request entitlements for MainCore and the callback, and permission to send the scoped evidence to Atlassian. Account for polling actions, Automation capacity and Rovo credits. Set ReasoningProvider=rovo once in Report_config. No recurring approval is added unless PublicationMode already requires it.

2. 2

   Approve the callback authentication

   This recipe uses Power Automate When an HTTP request is received → Who can trigger the flow? → Anyone, its current signed URL, and an independently checked secret header. The full URL is a bearer credential; the header is an additional application check. If organizational policy prohibits this mode, the Rovo route is blocked until an approved authentication adapter is implemented and tested. Selecting tenant-only and sending a static header does not satisfy Entra authentication.

3. 3

   Separate identities and secrets

   Use approved unattended connections. Store the three incoming-webhook tokens and RovoCallbackToken in Azure Key Vault; keep each stage URL in restricted configuration. Restrict rule editors and outbound domains. Give the callback connection read access to ReportingRuns/RovoJobs and create/read access to RovoResults, with no Edit/Delete permission there. MainCore creates/reads jobs and reads results. Keep the existing publisher identity separate.

3. Create Draft, QA and Repair agents

1. 1

   Create the agents

   Open app switcher → Studio → Agents → Create → Rovo agent → Skip to manual setup. Create Reporting Draft, Reporting QA and Reporting Repair. Use the default subagent only. Add no tools or knowledge sources: all required context is supplied in the invocation.

2. 2

   Set identity

   Open Studio → Agents → agent settings → Access and identity → See details → Select this account for the approved agent account with minimal app access. Administrators may need to grant that access. Requesting-user mode uses the automating user’s permissions, so document and test that dependency if selected. No reporting-space write permission is needed for reasoning.

3. 3

   Save the instructions

   Paste the shared behavior below into each agent’s Behavior field. Put its stage instructions and the matching output schema from Phase 4 into the default subagent. Repair receives the full Draft instructions/schema plus its repair instructions; do not leave a reference asking it to consult another agent. Test each agent and Activate it.

Configure each rule in order

1. 1

   Reject a wrong envelope

   Add {{smart values}} condition checks: {{webhookData.schemaVersion}} equals 1; {{webhookData.stage}} equals the rule’s literal draft, qa or repair; {{webhookData.stageRequestId}} and {{webhookData.evidenceJson}} are not empty. The callback and MainCore still perform full validation.

2. 2

   Invoke the fixed agent

   Add Use agent, connect Rovo if prompted and choose the fixed stage agent. Keep Let this agent take actions off. Current Rovo automation can perform writes when enabled; disabling them is this design’s deliberate boundary. Paste the invocation template below, with the stage-specific substitutions.

3. 3

   Capture text

   Immediately add Create variable, name resultText, value {{agentResponse.asString}}. The default response is Markdown; this documented accessor supplies text. MainCore must still parse it as JSON.

4. 4

   Configure the callback

   Add Send web request with POST, the fixed complete callback URL from step 5, Content-Type: application/json, and header X-Reporting-Callback-Token containing the independent callback secret. Mark the header value Hidden. Select Custom format and use the body below. Enable Delay execution of subsequent rule actions until we have received a response for this web request. Never use a callback URL from evidence or model output.

5. 5

   Save the incoming credentials

   Enable the worker rule for a controlled setup test, reopen Incoming webhook and copy its generated URL and secret. Keep ScheduleEntry disabled during setup. MainCore sends the secret as X-Automation-Webhook-Token. Finish the callback and round-trip tests before enabling scheduled reporting. If you duplicate or import a rule, re-enter hidden values; Atlassian does not preserve them in those operations.

Persist and acknowledge the result

1. 1

   Create once

   If the active-state Condition fails, return 409 and terminate. Otherwise Create item in RovoResults with Retry Policy None. Map Title, RunId, Revision, PackageId, OwnerRunId and Stage from Expected_job; ResultText comes from Parse_callback. Confirmed creation returns Response 201 with {"accepted":true}. Do not return evidence or secrets.

2. 2

   Reconcile an uncertain create

   In a Scope configured to run after failed/timed-out creation, Get items RovoResults with the same escaped Title filter and Top Count=2. Exactly one row with identical run/revision/package/owner/stage and exact ResultText returns 200, without mutation. Conflicting content returns 409 and records an exception. No row or uncertain read returns 503; do not create again in that callback execution. A redelivery may try the same create-only operation; the unique column prevents replacement.

3. 3

   Keep the receiver short

   Return within the inbound HTTP response window. Do not wait for an agent or MainCore. A timeout may occur after the row committed, which is why read-only reconciliation exists. The signed URL and hidden header do not protect against a rule editor changing the destination: restrict editors and outbound domains.

8. Complete Draft, QA, optional Repair and publication

1. 1

   Draft

   Parse the draft and replace CurrentDraft. A malformed response is terminal. For a parseable draft with deterministic claim failures, create CurrentQA with matching runId/revision, status=failed and every finding in findings; this can enter the existing single-repair branch. Passing deterministic checks proceed to QA.

2. 2

   QA

   Allocate a fresh StageRequestId and job, using the same frozen evidence and exact CurrentDraft. Parse into CurrentQA. Require matching identity, status=passed and findings empty. Keep Drafting during this first QA.

3. 3

   Repair once

   For a permitted deterministic or QA failure, persist NeedsRework and RepairAttempts=1. Allocate a new repair request with original evidence, CurrentDraft and CurrentQA, preserving revision. Parse and replace CurrentDraft; reset the draft-check flags/errors and repeat every deterministic check. Request QA again with another fresh stage ID; replace CurrentQA. A remaining failure stops. No old-stage callback satisfies a new stage ID.

4. 4

   Publish through the existing flow

   Create Validated_draft and Validated_QA from the final passing variables. Freeze the package, render escaped HTML and apply the unchanged Phase 6 gate. Automatic mode publishes without a person; approval mode reviews that exact package only if configured. The original owner performs the same title/marker preflight, POST, read-back verification and receipt persistence. The callback and model cannot set canPublish, approval, destination or publication state.