Limit content screening to uploads and stop re-checking generated results #1621

Summary

Content screening was meant to check documents when they enter a workspace. Its source-access checks now also run on everything generated from those documents. Workflow, orchestration and Analyze results are re-checked against every source document when they're saved and every time they're read. If any check fails, the result is blocked. This happens even with screening turned off and no screened documents. Symptoms:

• Run history is unavailable because source access could not be confirmed. The whole list returns 403 if any one of the last 50 runs fails the check (Workflow run history returns 403 after an attached document is deleted or re-uploaded #1613).
• Workflow tasks fail with Saved task output was withheld because its source access could not be confirmed. because the runner re-checks a task's output right after saving it.
• Saved Analyze results and orchestration files are withheld with similar messages.
• The Approvals page shows a content screening banner to everyone, even when screening is off.

This issue limits screening to uploads and removes the re-checks on generated results.

Agreed rules

1. Screening checks only documents that enter a workspace through a user upload (personal, group, public) or File Sync.
2. Generated content is never checked, neither when it's created nor when it's read. That covers model replies; workflow, orchestration and Analyze results; generated or merged files; files that agents or workflows save or publish into a workspace; and model-generated metadata. User edits to metadata don't trigger a rescan either.
3. Saved results get their access from their container (the workflow or run, the conversation, or the orchestration run), not from their source documents.
4. One input check stays: reading an uploaded document (search, document selection, file bytes, opening a citation, workflow document inputs) still requires that the reader has access and that the document isn't held.
5. Nothing is withdrawn after the fact. Results generated from a document that's later deleted or rejected stay.
6. Chat input/output checks are unchanged and stay off by default.
7. Microsoft 365 Run as asks for a new approval only when someone other than the Run as user edits the workflow, or when that user's M365 connection changes (a new connection ID or generation).

Scope

• Quick relief: remove the run-history re-check (personal and group run routes in route_backend_workflows.py) and the re-check right after a task saves its output (functions_workflow_runner.py, the "Saved task output was withheld" path). This resolves Workflow run history returns 403 after an attached document is deleted or re-uploaded #1613.
• Intake: mark generated documents with an origin marker and exempt them in document_requires_screening / prepare_document_upload. This covers the agent actions in functions_simplechat_operations.py (_upload_generated_document_for_current_user, queue_generated_document_processing), artifact publication, and the group/public generated-document routes. Remove the publication screening reservation (_consume_publication_reservation, consume_artifact_publication_screening_scan). Publication readiness should treat a destination with no screening marker as ready.
• Metadata: stop calling queue_metadata_rescan on metadata edits (functions_documents.py), drop the metadata_fingerprint comparison from _require_release_proof, and stop holding model-generated metadata.
• Workflows: remove the source re-checks from authorize_workflow_task_result_read / authorize_workflow_run_read, WorkflowLineageAuthorization, AuthorizedWorkflowRecordInput (source_snapshot_changed), execution/repeat/loop history, the flow runner, reporting, artifacts, generated artifact sources, the result reader, runtime, and sanitize_workflow_analysis_history. Keep the identity and integrity checks, and keep the checks on uploaded-document inputs (loop inputs, readiness, File Sync).
• Chat, Analyze, orchestration: remove authorize_analysis_sources from the save, read and retry paths for generated results (functions_saved_analysis.py, the saved-analysis routes in route_backend_chats.py, route_backend_analysis_results.py). Also remove authorize_orchestration_sources, OrchestrationResultAccess.authorize_sources, the output store's withholding, and the screening_sources checks on generated exports. AI replies and their saved citations stay visible in history. Keep the input checks on search, document selection, citations and file bytes. Narrow the model fence (the guard that blocks later model calls after a check fails) so that only input reads can trigger it.
• Run as: in ensure_workflow_binding / prepare_m365_workflow_binding, approve the new revision automatically when modified_by is the Run as user and the connection ID and generation haven't changed. Otherwise, request approval as today.
• UI: show the screening banner on the Approvals page only when enable_content_screening is on. Remove "source access could not be confirmed" messages that no longer apply, and the source_snapshot_changed handling in workflowExecutionHistory.ts.
• Tests: rewrite or retire the tests that assert re-checks (list below), and add coverage for the new behavior.
• Docs, version, release notes.

Acceptance Criteria

• Deleting, re-uploading or holding a source document doesn't hide saved workflow, orchestration or Analyze results, and run history always loads for anyone who can read the workflow.
• Workflow tasks no longer fail after saving output because of a source re-check.
• A held uploaded document still can't be used as an input (search, document selection, workflow input, file bytes, opening a citation).
• Generated or published documents never get a screening marker; user uploads and File Sync still do when screening is on.
• Editing metadata doesn't hold a cleared document.
• Container access is unchanged: group run results stay limited to group members, and someone else's run looks the same as a missing one.
• Run as: editing your own workflow doesn't ask for approval again; an edit by someone else or a change to the M365 connection does.
• The Approvals page shows the screening banner only when screening is on.
• Functional and UI tests are updated and pass; docs and release notes are updated; VERSION is bumped.

Notes

Related: this supersedes #1613 (run history 403), which can be closed when this lands. It narrows the scope of #1476 (content screening framework) and touches #1493 (M365 Run as) and #1509 (retained-result source checks in orchestration). The #1613 symptom was seen on a POC deployment running 0.261.221.

Assumptions to confirm

• A user's chat attachment saved into a workspace counts as an upload, so it is checked.
• The first run of a workflow you wrote yourself, running as you, doesn't ask for approval.
• Adding people to the conversation a workflow came from no longer asks for Run as approval again, because the separate M365 source-sharing approval covers publishing to them. This needs verifying.
• Group workflows can read only documents the whole group can see. If they can read the author's personal documents today, block that when the input is read.

Risks: the change touches a lot of code (about 18 workflow modules plus orchestration, Analyze and chat), and many tests are written around the old behavior. Held documents must still be blocked as inputs once the model fence is narrowed. Expect merge churn on paullizer-react-v2-ui.