Add an AI workflow assistant to the V2 workflow editor #1548

Summary

Part of #1543 (Phase 3). An Ask AI side channel in the V2 workflow editor, modeled on Score's assisted editing. The assistant edits the unsaved draft, every AI change is highlighted with its previous value, each AI turn can be undone, and saving AI changes asks for confirmation.

User Value

Workflow definitions have many fields: triggers, tasks, runners, references, alerts and Run as. An assistant lets a user say what they want ("run this at 7 AM on weekdays and only alert me when something is urgent") and see exactly what changed, instead of hunting through the editor. Highlights and per-turn undo keep the user in control, which matters because a workflow keeps running long after the edit.

Proposed Behavior

• 3a: change tracking in the editor, useful even without AI. Built on WorkflowAuthoringSession:
  • stable-ID descriptors and a diff against the opened baseline
  • attribution, so AI changes and your own edits are highlighted differently (manual changes show as "Edited")
  • WorkflowChangedField highlights, Removed · Restore rows, a Changes tab, and Revert
• 3b: assist endpoint, POST /api/user/workflows/assist:
  • allowlisted operations only (roadmap §5). The server applies them, dry-run validates through the Phase 2 service, and allows one correction round.
  • 409 when the editor's base is stale
  • # references go through the A2 authorizer as request-local handles, placed according to the wording of the request
  • never writes. The route has @swagger_route(security=get_auth_security()), login_required, user_required, enabled_required('allow_user_workflows') and workflow_user_required.
  • 1 request in flight and about 20 per 10 minutes per user, with content-free telemetry through log_event
• 3c: Ask AI tab, built on the A1 assist thread:
  • a change card per turn with Jump to and Undo this change
  • focus on one task, quick actions, and Draft with AI on an empty task
  • the editor is locked while a turn runs, with Cancel
  • save confirmation for AI changes, including the Run-as re-approval warning when it applies
• The transcript is session-only in v1, so there's no new container. The saved workflow stays the permanent record.
• Ask AI is hidden for group workflows until Phase 8.

Acceptance Criteria

• "Run this at 7 AM on weekdays and only alert me when something is urgent" changes the schedule and alert fields, highlights each with its previous value, and can be undone as one turn or reverted field by field.
• Saving AI changes goes through the normal save path after a confirmation that includes the Run-as re-approval warning when it applies.
• "Compare every new document against #checklist" adds it as a shared reference the review task uses, "investigate #incident-report" binds it to one task, and an ambiguous request gets a question instead of a change.
• Escalation attempts (forbidden fields, documents the user didn't reference) are rejected.
• Functional tests (change-set validation, escalation rejection, re-approval warnings), route policy tests, and Playwright coverage.
• Admin setting documented (docs/admin/*, docs/_data/features.yml, regenerated inventory), a guide under docs/guides/, feature doc, release notes and config.py version.

Notes

• Roadmap: §5 (assistant design) and §6, Phase 3. Related gotchas in §8: 14, 15, 25 (return the un-normalized candidate so defaults don't show as AI changes), 26 (extend WorkflowAuthoringSession instead of adding a second undo stack), 27 (keep the server deadline around 150 s against App Service's 230 s), 28 (model-supplied document IDs), 29 (hide Ask AI for group workflows), 30 (wrong placement).
• Open decisions (§9), with recommendations: default the setting on when allow_user_workflows is on; keep the transcript ephemeral in v1; start with a small local word-diff helper.
• Depends on: Phase 2 (Add a workflow draft service: dry-run build, blueprint builder and provenance #1545), A1 (Show AI-assist messages immediately, with Cancel and Retry, in a shared assist thread #1552) and A2 (Support # document references in the plan editor's Ask AI #1556).