Stop re-checking workflow run sources in run history and after a task saves

[Paul Lizer (paullizer)]

Summary

Layer 1 of 4 for #1621: content screening checks uploaded documents, and anything generated from them takes its access from the workflow, run or conversation it belongs to.

• Run history loads again. Run lists, run task items, the live run activity view and the last-run preview in the workflow list no longer re-check each run's source documents. Before, one run that used a document later deleted or re-uploaded turned the whole list into a 403: "Run history is unavailable because source access could not be confirmed."
• Tasks stop failing after saving output. The runner no longer reads each task's output back through the source check right after saving it, which failed the task with "Saved task output was withheld because its source access could not be confirmed." Reading a previous task's output as an input is unchanged.
• Container checks are unchanged. The workflow must still be in your scope, group routes still require membership, and a run from another workflow still answers 404.
• Approvals page. The content screening notice appears only while screening is enabled, with plain wording. Each screening request keeps its own Open content review link.

Still re-checked until layer 3: per-task previews inside run history (sanitize_workflow_analysis_history) and structured execution history.

Linked issue

Fixes #1613
Refs #1621

Related PRs and merge order

PR	What it does	Base
#1629	Layer 2: only user uploads and File Sync are screened	this branch
#1631	Layer 3a: saved workflow results take their access from the workflow and run	this branch
#1632	Layer 3b: saved chat, Analyze and orchestration results take their access from their container	this branch
#1630	Run as asks for approval only when someone else authored the revision or the connection changes	paullizer-react-v2-ui

1. Merge this PR first, with a merge commit rather than a squash. The three layer PRs contain this branch's commits, so after a squash their diffs would show these changes again.
2. Merge Limit content screening intake to uploads and apply metadata edits directly (layer 2 of 4) #1629, Stop re-checking saved workflow results against their source documents (screening layer 3a) #1631 and Saved chat, Analyze and orchestration results take their container's access (screening layer 3b) #1632 after it. Write access lapsed partway through, so they were opened from the paullizer/simplechat fork. GitHub stacks don't support fork heads, so they target this branch directly instead.
3. Ask for M365 Run as approval only when someone else authored the revision #1630 is independent and can merge at any point.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped to 0.261.229. The base branch took 0.261.228 for the V2 alert Open button (Lead the V2 workflow alert card with one Open button (0.261.228) #1625), which was merged in.
• deployers/version.txt not needed because deployers/ was not changed

Testing / validation

These commands ran in a session virtual environment layered on the global Python. The overlay adds cryptography 46.0.7 and the app's pinned Flask 3.1.3 / Werkzeug 3.1.6, because the global Flask 2.2.5 with Werkzeug 3.1.4, and cryptography 50 with pyOpenSSL 25.3, break test collection.

• New and updated tests: python -m pytest functional_tests/test_workflow_run_history_source_recheck_fix.py functional_tests/test_workflow_history_source_access.py -q passed (16 passed), both before and after merging the base branch. With the route, runner and template changes stashed, 8 of the 11 tests in the new file fail. The 3 that still pass are the version check and the container 404 checks.
• Regression comparison, before and after on the same 29 files: no new failures, and 2 previously failing tests fixed.
  • Files: workflow runner, result, route, provenance and analysis-publication test files, including test_workflow_task_sequence.py, test_workflow_structured_flow.py, test_workflow_result_routes.py, test_workflow_durable_routes.py and test_document_provenance_origin.py.
  • The remaining failures also fail on the base branch. Most come from stale harnesses: one patches the removed functions_workflow_context.resolve_model_token_limits, another can't import the new functions_workflow_chat_delivery. The rest need Azure configuration.
• Integration with the other layers: all five PRs were merged into a local, unpushed tree. That tree, this branch alone and the base branch (fd842e199) were compared across the functional suite (details on #1621).
  • In a normal run, this branch fails exactly the same tests as the base branch.
  • One test changes outcome here, but only once its out-of-date setup is filled in. test_native_source_revocation_blocks_saved_report_and_publication normally errors at setup on the base branch too.
  • With the setup filled in, a revoked source is now refused one step later, with "A required source is no longer available for this workflow run.", so the test's message pattern no longer matches. Stop re-checking saved workflow results against their source documents (screening layer 3a) #1631 inverts the test for the final design.
• Classic screening UI suite: python -m pytest ui_tests/test_content_screening_classic.py (local Chromium) gave 46 passed, 3 failed.
  • The new test_classic_approvals_screening_notice_follows_the_screening_setting[True/False] passes. After the merge, the approvals subset (-k approval) passed 11/11.
  • The 3 failures are test_classic_policy_prerequisites_fail_closed and test_classic_disable_new_scans_preserves_review_holds[True/False]. They fail identically on the base branch, because the configuration save payload now includes workspace_uploads_enabled.
  • The fixture now answers the Approvals page's /api/m365/requests and /api/msgraph/pending-actions calls. Without that, every approvals test in this suite errored at teardown on the base branch too.
• Route policy tests, all passed:
  • python functional_tests/route_tests/test_route_blueprint_policy_inventory.py (11/11)
  • python functional_tests/route_tests/test_route_unauthenticated_policy_contract.py (6/6)
  • python functional_tests/route_tests/test_route_policy_test_coverage.py (2/2)
• Docs:
  • python scripts/build_docs_inventory.py regenerated the inventory with no content change.
  • python functional_tests/test_docs_app_surface_coverage.py passed (7/7).
  • python functional_tests/test_docs_site_quality.py passed (6/6).
• PR guardrails, all passed:
  • python scripts/check_xss_sinks.py --base-sha <base> --head-sha <head> <changed files>
  • python scripts/check_broken_access_control.py --base-sha <base> --head-sha <head> <changed files>
  • python scripts/check_swagger_routes.py application/single_app/route_backend_workflows.py
• Whitespace: git diff --check is clean.

Documentation

• Release notes updated (v0.261.229: Bug Fixes and User Interface Enhancements)
• Feature documentation not needed for this layer; the screening framework docs are rewritten in layer 3
• Fix documentation updated (docs/explanation/fixes/WORKFLOW_RUN_HISTORY_SOURCE_RECHECK_FIX.md); docs/guides/review-approval-requests.md also notes the notice

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) (no new routes; existing decorators unchanged)
• Settings sent to non-admin frontends use sanitize_settings_for_user() (the Approvals page already renders sanitized settings, which keep enable_content_screening)
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS (no JavaScript changes)
• No secrets, keys, connection strings, or local-only artifacts are included