Complete goal-first workflow authoring and bounded runtime action choice

[Paul Lizer (paullizer)]

Summary

• Ask AI now fills every supported known detail instead of stopping at metadata. The Tuesday summarization request authors instructions, Analyze, My workspace and Added in the last seven days, retaining an incomplete recurrence and asking only for the missing time. Save/run validation stays strict; the 64-operation bound and existing authoring token budgets are unchanged.
• Separate visible document action and source controls, replace large workspace checkbox lists with searchable Add/Remove discovery, and distinguish authoritative upload-time Added filtering from the backward-compatible added-or-updated default.
• Add opt-in Choose at run time: one closed document action per task/visit over bounded authorized inputs. Captures, decisions and refusals survive retry/resume without silent replanning; permission, source-proof, capability and integrity checks remain mandatory. Empty selection skips both model calls, ambiguous Merge requirements fail explicitly, and history shows safe summaries and separate selection-model usage.
• Preserve existing selected/recent, broad Search, all-files/Merge, loop, File Sync and frozen-plan replay behavior. Include regression coverage, renewed Cosmos SDK owner evidence and documentation in application version 0.261.333.

Review focus: incomplete authoring drafts must not become executable schedules, and runtime decisions must never broaden source scopes or document IDs. Runtime choice is not an unrestricted planner and cannot create tasks or invoke external tools.

Linked issue

N/A. The user explicitly chose to continue without a new issue. This is a follow-up to merged #1761, not an update to its branch.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Release notes remain unchanged: the coordinating parent is handling the optional release-note decision. Latest Feature card and card screenshot decisions are deferred; no card was added.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.332 -> 0.261.333. No deployer files changed.

Testing / validation

Python checks used the isolated validation environment with the repository-pinned Cosmos SDK 4.9.0.

• npm --prefix application\v2_ui run build - passed, including TypeScript compilation and production Vite build. The existing large-chunk advisory remains.
• python .\scripts\check_cosmos_response_boundaries.py --run-contracts - passed, exit 0: 1,051 owners, 395 doubles, zero review gaps; 718 tests and 231 subtests passed with sockets/DNS blocked by the checker. Explicitly renewed 29 unchanged owner bodies/calls and replaced 14 stale source-only exemptions with owner-runtime SDK evidence. No checker or compatibility baseline was weakened.
• python -m pytest functional_tests\test_docs_app_surface_coverage.py functional_tests\test_docs_site_quality.py -q --disable-warnings --tb=short - 13 passed; regenerated surface inventory has no semantic changes.
• git --no-pager diff --cached --check - passed before committing.

Previously completed focused regression runs passed 114 goal/task/structured checks, 139 authoring/action/File Sync checks, 285 result/selection/privacy/route checks plus 112 subtests, and 168 frozen-replay cases across isolated runs. The selected production-bundle browser runs passed 178 distinct cases, including actual 1280px desktop and 390px mobile workspace discovery. Bounded synthetic real-model evaluation passed 12/12 scenarios in 14 calls, with a largest output of 638 tokens; no production workflow was run.

The broader legacy matrix is not claimed to be fully green: obsolete source/version assertions, an old task-sequence golden, existing logging-tag inventory failures and one offline route_backend_agents.enabled_required bootstrap failure predate this change. Details and before/after evidence are recorded in the fix documentation; these checks were not weakened or rewritten.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated the workflow guide, AI assistant/document selection feature contracts and logging reference. Added versioned fix documentation covering the contract diagnosis, runtime boundaries, validation and known baseline limitations. Release-note approval remains with the coordinator.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new Flask routes or settings exposure paths were introduced. Source capture and resumed processing remain permission-fenced, and model-visible handles do not expose raw storage locators. Evaluation scripts, screenshots, logs and validation environments remain outside the repository.