Fix Control Center action access in orchestration workers

[Paul Lizer (paullizer)]

Summary

• Fix Control Center actions that were offered during planning but rejected before execution with integration_unavailable. Application Insights and App Service console logs identified external_source_preflight / selection_not_in_catalog.
• Forward the authenticated external-source identity's roles to both action discovery and exact manifest resolution. Worker preflight, acquisition checks, result admission, and retained reads no longer depend on an absent Flask request session. Existing dashboard permissions, governance, exact scope, and unsigned-in refusal remain unchanged.
• Add 17 regression cases for allowed roles, independent exact resolution, stale catalogs, saved/ambient roles, and current-access revocation. Update related documentation and bump the application to 0.261.329.

Linked issue

No associated issue. The user declined issue creation and requested the code fix, commit, push, and PR only.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Release-note approval was requested but the user was unavailable. Optional release notes and issue creation were left out rather than expanding the requested scope.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.328 -> 0.261.329. No deployer files changed.

Testing / validation

• The new worker cases reproduced selection_not_in_catalog against the unfixed provider. The independent exact-resolution case reproduced integration_access_denied, proving discovery alone was not a complete fix.
• The combined command below passed: 533 tests and 276 subtests using an isolated session virtualenv's Python with repository-pinned Flask 3.1.3, Werkzeug 3.1.6, and Semantic Kernel 1.39.4. The initial system-Python attempt failed during collection because host pyOpenSSL 25.3.0 requires cryptography <47, but cryptography 50.0.0 was installed. The isolated environment used compatible cryptography 46.0.7; no shared packages or repository dependency manifests were changed.

python -m pytest -q .\functional_tests\test_control_center_orchestration_roles.py .\functional_tests\test_orchestration_action_catalog.py .\functional_tests\test_orchestration_external_sources.py .\functional_tests\test_orchestration_session_trusted_sources.py .\functional_tests\test_orchestration_seeded_agent_preference_fix.py .\functional_tests\test_orchestration_external_pre_effect.py .\functional_tests\test_orchestration_external_bootstrap.py .\functional_tests\test_orchestration_external_preflight_adapter.py .\functional_tests\test_v2_control_center_action.py .\functional_tests\test_orchestration_external_identity.py

• python .\functional_tests\test_docs_app_surface_coverage.py — passed, 7/7 checks; the generated surface inventory remains current.
• python .\functional_tests\test_docs_site_quality.py — passed, 6/6 checks.
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check — passed.
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --cached --check — passed.
• Azure investigation was read-only. No deployment, restart, configuration change, or live chat retry was performed. No routes or frontend assets changed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated CONTROL_CENTER_ACTION.md and ORCHESTRATION_EXTERNAL_SOURCE_ACCESS.md; added CONTROL_CENTER_ORCHESTRATION_ROLE_PROPAGATION_FIX.md with the root cause, authorization boundaries, before/after behavior, and validation results.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new routes, frontend settings responses, browser assets, or credentials. Roles come only from the authenticated external-source identity; saved plans, saved runs, and ambient request roles cannot substitute for it.