Fix Workflow Ask AI authoring and add guided per-task document filters

[Paul Lizer (paullizer)]

Summary

• Workflow Ask AI previously returned successful explanation/question responses without editing a new draft or generating requested names. Explicit authoring context and closed operations now produce goal-based workflow/task metadata and apply clear edits while asking focused questions about missing execution details. No keyword-based intent heuristics were added.
• Add independent rolling document selectors for Analyze, Search, Compare, and Merge tasks: new or updated documents within 1 minute to 365 days, filename/prefix/regex, tags, file type, classification, author, and keywords with nested AND/OR groups. Guided labels, examples, searchable choices, Match case, summaries, and advisory previews explain each filter's purpose.
• Preview and execution share authorized current-document paging. Workspace/time boundaries remain outside Boolean groups; filters precede document limits. Task retries/resumes preserve snapshots and recheck access/source proofs. Empty selections can report without document-processing calls; incomplete or oversized selections fail explicitly. Search is ranked retrieval, not exhaustive analysis. Ask AI authors Analyze/Search/Compare selectors; Merge selectors use manual guided controls.
• Add safe diagnostics with closed codes, numeric counts, durations, and hashed correlation, plus regression coverage and documentation. Prompts, replies, filter literals, document content, and raw user/submission IDs are not logged. No deployment or production workflow changes were made.

Linked issue

N/A. The user chose no associated issue for now.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

The existing workflow administration and logging references were updated; no new admin setting was added.

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.328 -> 0.261.329. No deployer changes.

Testing / validation

Python checks used an isolated validation environment with repository-pinned Flask, regex, and Cosmos SDK dependencies. Browser checks used the production bundle and closed offline API fixtures with PLAYWRIGHT_SERVICE_URL='' and application/test fixture directories in PYTHONPATH.

• npm --prefix .\application\v2_ui run typecheck - passed.
• npm --prefix .\application\v2_ui run build - passed; existing large-bundle warning remains.
• python -m pytest .\ui_tests\test_v2_workflow_document_selection.py .\ui_tests\test_v2_workflow_ask_ai.py .\ui_tests\test_v2_workflow_editor.py .\ui_tests\test_v2_workflow_merge_task.py -q --tb=short - 55 passed, including mobile/desktop layout, exact saves, clarification/undo, malformed selector recovery, and unavailable-workspace removal.
• python -m pytest .\functional_tests\test_workflow_document_selection.py .\functional_tests\test_workflow_loop_inputs.py .\functional_tests\test_workflow_merge_task.py .\functional_tests\test_workflow_authoring_telemetry.py .\functional_tests\route_tests\test_workflow_document_selection_policy.py -q --tb=short - 161 passed, 6 subtests passed. Includes normal/optimized cold imports, bounded regex, frozen Merge source reads, and actual logging-sink/console privacy checks.
• python .\scripts\check_cosmos_response_boundaries.py --run-contracts - 703 passed, 231 subtests passed; 1,051 owners and 394 doubles with zero review gaps. Changed module fingerprints retain reviewed contracts with representative real-owner SDK evidence.
• python -m pytest .\functional_tests\test_workflow_per_document_analysis_mode.py .\functional_tests\test_workflow_loop_inputs.py .\functional_tests\test_workflow_document_selection.py .\functional_tests\route_tests\test_workflow_document_selection_policy.py .\functional_tests\route_tests\test_workflow_assist_policy.py -q --tb=short -k 'not test_the_v2_bootstrap_reports_the_assistant_flag_from_the_gate' - 163 passed, 6 subtests passed, 1 deselected. The deselected baseline AST assertion expects a direct gate call; unchanged bootstrap code already wraps it in measure(...).
• python .\functional_tests\route_tests\test_route_blueprint_policy_inventory.py - 15/15 passed.
• python .\functional_tests\route_tests\test_route_unauthenticated_policy_contract.py - 10/10 passed.
• python .\functional_tests\route_tests\test_route_policy_test_coverage.py - 3/3 passed.
• python .\functional_tests\test_log_event_call_contract.py - passed.
• node --check .\application\single_app\static\js\workspace\workspace_workflows.js - passed.
• python .\scripts\build_docs_inventory.py - regenerated; no application-surface delta.
• python .\functional_tests\test_docs_app_surface_coverage.py - 7/7 passed.
• python .\functional_tests\test_docs_site_quality.py - 6/6 passed.
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol --no-pager diff --check - passed before commit.
• Bounded synthetic GPT-4o evaluation - four authoring/filter scenarios passed without touching production workflows or documents. Full repository suite and production deployment were not run.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Release notes were offered but left unchanged pending user approval. Added WORKFLOW_DOCUMENT_SELECTION.md and WORKFLOW_ASK_AI_AUTHORING_FIX.md; updated the workflow guide, workflow admin reference, and logging tags.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

New preview responses expose explicit safe document descriptors, not settings or storage locators. Authorization is rechecked at capture/resume/native reads; source binding is an additional actor-scoped restriction, not cached permission.