Fix orchestration settings race and Microsoft 365 action steps

[Paul Lizer (paullizer)]

Summary

Fixes two V2 chat orchestration bugs found while investigating a "what are my latest emails" plan that showed every step completed but ended Partially completed.

• Finished plans no longer fail with "A required retained result is unavailable or changed" (0.261.237). Orchestration rechecks kept results against current settings and requires exactly a dict. Settings served from Redis were a dict, but settings served from Cosmos DB came back as the SDK's CosmosDict. Cosmos serves the read while any settings save is in flight (the Cosmos throughput autoscale saves often), when the cache is repaired, and on every read when Redis is off, so runs failed intermittently at finalization. app_settings_store now returns a plain dict from every read and write; the orchestration check is unchanged.
• Microsoft 365 actions now work in plan steps (0.261.238). Each action step runs in a fresh bridged request context, and orchestration never installed the M365ExecutionContext that chat and workflows create. Every Microsoft 365 call was refused with m365_context_required before reaching Microsoft Graph, the plugin returned the refusal as data, and the step reported completed. An action step now gets its own Microsoft 365 request as the signed-in user. It selects only that step's saved action and checks delegated sign-in before the model or Graph is called.
• Microsoft 365 refusals stop the step with a failure that says what to do (m365_sign_in_required, m365_approval_required, m365_unavailable, m365_shared_conversation, m365_read_only) instead of becoming findings. The V2 run details offer Connect Microsoft 365 (the existing Profile reconnect flow, in a pop-up), then Retry from failed step. Approval stops link to Approvals.
• Telemetry: [MS_GRAPH_PLUGIN] Microsoft 365 operation could not complete. now logs the refusal code and source as text instead of only the code's length. A stopped step logs [ORCHESTRATION_M365] A Microsoft 365 step stopped.

Deliberate limits worth a look in review:

• Plans only read Microsoft 365. send_mail, create_calendar_invite and mark_message_as_read are removed from a plan step even when the action enables them.
• Shared conversations are refused before any Microsoft 365 work, because their source-sharing approvals resume chat requests, not plan steps.
• The step's Microsoft 365 request ID is derived from the plan's first attempt and the step, so Retry from failed step reuses the request and any approval given after the stop. Deciding an approval doesn't resume a plan; the user retries.
• Sign-in is checked at the step, before any model or Graph call, not before the run starts.
• Ask an agent steps don't get Microsoft 365, because plans already refuse the local agents that load those actions. Classic Call agent delegation is unchanged: the same bridge runs inside workflows, which must use their Run as account.

Linked issue

N/A (no tracking issue)

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

VERSION is 0.261.238. The settings fix is recorded as 0.261.237 and the Microsoft 365 fix as 0.261.238, renumbered after #1636 and #1643 took 0.261.235 and 0.261.236.

Testing / validation

Functional tests ran from functional_tests with PYTHONPATH=application/single_app, one file per process:

• python -m pytest test_orchestration_m365_actions.py -q -p no:cacheprovider (new): 14 passed. It runs the real action runner, step scope, Microsoft 365 runtime, approval service and Email plugin through a real Flask bridge, with storage, tokens, Graph and the model doubled and network blocked. Each of 10 deliberate breaks of the fix fails at least one test.
• python -m pytest test_app_settings_store_plain_dict_reads.py -q -p no:cacheprovider (new): 21 passed. 17 of them fail without the fix.
• Same command for test_orchestration_action_runtime.py (50 passed), test_m365_runtime_adapters.py (14 passed), test_m365_execution_preflight.py (23 passed), test_m365_approvals_execution.py (42 passed) and test_m365_loader_preflight.py (29 passed).
• Regression sweep of 78 related files (m365_*, msgraph_*, orchestration action, adapter, dependency, external, executor and recovery suites, app_settings_*, agent_delegation_entrypoints), run before merging V2: Scroll the chat rail as one panel and pop workflow alerts from the bell #1643, which changed only VERSION in Python application code: 63 pass, 6 of them on a lower-parallelism rerun after timing out under machine load. The other 15 also fail on the base branch:
  • 14 fail with the same failing tests on both branches. Causes seen include missing Cosmos credentials in this environment, a copy_action_manifest NameError in test_agent_delegation_entrypoints.py, and an assert_group_role ImportError in test_m365_routes.py.
  • test_orchestration_dependency_imports.py: cold-import probes hit their 180 s timeout under heavy machine load on both branches.

Docs and logging, from the repo root:

• python .\functional_tests\test_docs_site_quality.py: 6/6 passed.
• python .\functional_tests\test_docs_app_surface_coverage.py: 7/7 passed.
• python .\functional_tests\test_logging_tag_standardization.py: fails on nonstandard tags that already exist in workflow modules this PR doesn't touch ([Workflows], [WorkflowResults], [WorkflowAssist], ...). The new [ORCHESTRATION_M365] tag is detected and documented.

V2 UI:

• npm --prefix .\application\v2_ui run build -- --outDir ..\..\ui_tests\artifacts\orchestration-plan-editor (includes tsc -b): passed.
• python -m pytest .\ui_tests\test_v2_orchestration_m365_recovery.py -q -p no:cacheprovider (new, Chromium): 6 passed. Removing the notice from the recovery view fails 5 of them, and dropping m365_sources when a failure is read fails the connect test.
• python -m pytest .\ui_tests\test_v2_orchestration_recovery.py -v -p no:cacheprovider (existing; its RecoveryApi failure is now configurable, with the same default): 32 passed.

Not run: a plan against a live Microsoft 365 tenant. The real sign-in pop-up and Microsoft Graph calls are doubled in these tests.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Fix docs: ORCHESTRATION_SETTINGS_DOCUMENT_TYPE_FIX.md and ORCHESTRATION_M365_ACTION_CONTEXT_FIX.md. Also updated: the admin orchestration page (Microsoft 365 actions in plans, troubleshooting rows), the Microsoft 365 data guide (Use Microsoft 365 in a plan) and the logging tag reference. No new feature doc.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No routes were added or changed. No settings are sent to the browser; step failures carry only allowlisted m365_sources. The connect pop-up navigates to the HTTPS sign-in URL issued by the existing connect route. Tests use placeholder keys.