Promote v0.260.028 from Development to Staging - #1335
Merged
Conversation
…ut-contract-phase-1-contract Phase 1: Add analyze deliverable contract baseline
…ut-contract-phase-2-intent Phase 2: unify Analyze deliverable intent
…ut-contract-phase-3-schema Phase 3: separate public schema from tabular lineage
…ut-contract-phase-4-correctness Phase 4: Add tabular transformation contract
…ut-contract-phase-5-lifecycle Phase 5: Add durable artifact-set lifecycle
…ut-contract-phase-6-ui Phase 6: Render plural artifact sets
…ut-contract-phase-7-integration Phase 7: Add rollout rollback controls
…e-artifact-output-contract # Conflicts: # application/single_app/config.py
…ut-contract-phase-7a-stabilization Phase 7A: stabilize Analyze artifact closure baseline
Merge Phase 7B correctness slice for #1233.
Merge Phase 7C publication slice for #1233.
Merge final Phase 7D validation documentation for #1233.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…ut-contract Complete Analyze artifact output contract
- Default tabular Analyze/Search durable-preflight parity to active (tabular_request_planner_mode, enable_tabular_search_shared_preflight, enable_tabular_analyze_durable_preflight); previously off-by-default with no admin UI toggle, so exhaustive row-by-row requests silently fell back to bounded foreground synthesis and truncated. Add SIMPLECHAT_DISABLE_TABULAR_PARITY_DURABLE_PREFLIGHT env var as the emergency rollback path instead of a UI toggle. - Add scheduler tick/skip visibility logging (debug_print) to the tabular generated-output, file sync, and data management scheduler loops, and stop suppressing the tabular scheduler scan-result log on empty scans, to diagnose stuck background exports. - Fix queue_tabular_generated_output_run locking output_schema to the lineage-only internal checkpoint schema before batch 1 runs whenever no public output schema is known yet (e.g. combined Analyze requests with prose-described columns). This made every batch, including batch 1, fail schema validation against a schema with none of the model's real output columns. Now defers to batch-1 discovery when public_output_schema is empty, matching the working Search/structured_export behavior. - Add regression tests: settings defaults + env kill switch, a real (unmocked) deliverable-contract reproduction of the bug precondition, and a full end-to-end AST-extracted invocation of queue_tabular_generated_output_run itself. Fixes truncated exhaustive tabular Analyze answers and stuck/failing combined CSV exports reported in production.
…lities
Rebased onto Development at v0.260.019. The only application surface change was
Admin Settings: capabilities, actions, chat controls, app pages, and feature
surfaces are all unchanged, which scoped the work precisely.
Admin Settings moved from 18 flat tabs to a grouped architecture of 14 groups,
44 tabs, and 93 sections, now declared in a new admin_settings_nav.py.
- Rewrite the inventory extractor to read that definition. It had scraped tab
markup out of admin_settings.html, which shrank from 12,492 lines to 620 when
the template was split into per-tab partials, so scraping returned a single
literal '{{ admin_tab.id }}' and admin coverage silently collapsed to one
bogus tab. Removed the now-dead HTML tab parser.
- Rebuild the 19 admin pages as 14 group pages, each tab reachable by its own
anchor. All 18 retired tab URLs still resolve, 13 by redirect and 5 because
the old tab id is now a group id. Inbound links and the feature catalog's
admin_tab values were repointed.
- Update the coverage test for the grouped structure: every group needs a page
and every tab id must appear as an anchor on its group page.
- Add a guide for collaborating in a conversation, covering the shared file
approvals and '@' mention Tab completion shipped in v0.260.005 and v0.260.006,
and document the Blob Storage action's managed identity and account key
options.
Two generator bugs surfaced and were fixed:
- Release notes pages failed the site build outright. Release notes quote
template syntax when describing template work, and an unescaped Jinja 'block'
tag was parsed as Liquid. Quoted syntax is now escaped and renders literally.
- Some release note entries linked to the unpublished engineering note trees.
Verified: 100 browser checks across five viewports, 32,483 internal links with
zero broken, 7/7 coverage checks, 6/6 site quality checks, the latest-release
structure test, and all three generators in sync.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
CodeQL flagged js/xss-through-dom in the documentation site's click-to-enlarge screenshot viewer. It assigned an image URL read from a data attribute in the rendered page, so page content flowed directly into a URL sink. The viewer now resolves the value against the document and requires a same-origin http or https URL whose path ends in an image extension. That rejects scheme-based payloads such as javascript: and data: URLs and any off-site source. All documentation media is local, so no legitimate image is affected, and the enlarge behavior is unchanged. Adds ui_tests/test_docs_media_lightbox_source_validation.js, which executes the real validation function against hostile and legitimate inputs so the guard cannot be quietly removed or weakened. It covers javascript: and data: URLs, off-site and protocol-relative sources, same-origin non-image paths, and non-string input, alongside the local image paths that must keep working. Verified in a browser as well as in isolation: legitimate screenshots still open in the viewer, and a javascript: URL leaves it closed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The media lightbox regression test asserted an accepted URL by checking result.startsWith(ORIGIN). CodeQL correctly flagged that as js/incomplete-url-substring-sanitization: a prefix check is weak URL matching, because a host such as microsoft.github.io.example.com shares the prefix without sharing the origin. The assertion now parses the result and compares the origin field. The test still passes all 17 checks, so the guard it protects is unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Documentation site redesign: search, navigation, mobile support, and complete capability coverage
…t context Running SimpleChat directly (python app.py) initializes Semantic Kernel at module scope, outside any Flask request context. Loading an agent with actions assigned called get_current_user_id() unguarded, which reads the Flask session proxy and raised "RuntimeError: Working outside of request context", aborting startup. Gunicorn deployments were unaffected because initialization happens in a before_request hook. Add get_current_user_id_or_none(), which returns None when there is no request context, and route the five identity lookups in semantic_kernel_loader.py through it. get_current_user_id() is left unchanged so authorization callers keep failing loudly rather than silently degrading to no identity. The group scope and personal endpoint lookups also short-circuit rather than forwarding an unresolved identity, since require_active_group() and get_user_settings() perform Cosmos reads keyed on the user id. Fixes #1327 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
… other Selecting an agent with actions and enabling a workspace produced answers that never invoked any action and reported numbers absent from the cited spreadsheet. Three independent defects combined to cause this. The retrieval augmentation prompt instructed the model to base its answer only on the retrieved excerpts. Agent actions were attached and available -- agents are built with FunctionChoiceBehavior.Auto() and nothing disables tools when documents are in scope -- but the model was told not to reach for them. Excerpts are now framed as starting evidence, and the model is directed to call an available action when they lack what the question needs, then reason over both. The no-fabrication rule is preserved and strengthened. should_run_tabular_evidence() suppressed computation whenever any narrative source was in scope, and treated topic words such as "report" and "policy" as evidence-type signals. Because only a truncated three-row preview of a spreadsheet is indexed for search, skipping computation left the model deriving totals from those preview rows. Tabular sources in scope are now computed unless the question unambiguously names a narrative artifact, restoring parity with the legacy path used when mixed-source search is disabled. A skipped tabular source previously reported that processing "was not needed", implying irrelevance. It now states the full table was never read, that indexed excerpts are a truncated preview, and that the tabular analysis action should be called if values are required. No new setting is introduced; these are correctness fixes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…context-guard Guard Semantic Kernel startup identity lookups against missing request context
Inline galleries were built from the full retrieved citation arrays, so every workspace or web media file returned by search became a tile inside the message bubble even when the response never referenced it. That presented unrelated media as though it supported the answer, consumed the five-item gallery cap with retrieval noise, and issued enhanced-citation fetches for documents that were never cited. Issue #1249 already persists the exact cited subsets on each assistant message and delivers them to the browser on every path, but no frontend module read them. Add chat-citation-tracking.js as the browser mirror of _message_has_citation_tracking, and feed the cited subsets to both gallery renderers from appendMessage. The Sources disclosure keeps the complete retrieved set. Agent and tool galleries stay ungated because they are executed results, and legacy messages without tracking keep prior behavior rather than being parsed at read time. Fixes #1329 Refs #1249 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…on-gating Gate inline image and video galleries to cited media only
Development shipped v0.260.023 (semantic kernel startup request context) and v0.260.024 (inline media cited-only gating) while this branch was open, so both the version constant and the release notes collided. Resolution: - config.py takes 0.260.025, since 0.260.023 and 0.260.024 are both taken. - release_notes.md keeps Development's v0.260.024 and v0.260.023 sections and moves this branch's three entries into a new v0.260.025 section at the top. - Renumbered the version references in the fix documentation and in the two affected functional test headers. - Registered the fix page in docs/explanation/fixes/index.md, which Development added while this branch was open. - Regenerated docs/explanation/release-notes/ with scripts/build_release_notes_pages.py, since those pages are generated from release_notes.md. Refs #1332 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…agement admin screenshots
…rkspace-search Run agent actions and workspace search together instead of one or the other
…creenshots for v0.260.001
… drop uncapturable admin screenshots
…-screenshots Capture real v0.260.001 Latest Features screenshots and publish the cards
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
24 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DevelopmentintoStaging, advancing the application from v0.250.001 to v0.260.028.Release highlights
Upgrade notes
requirements.txtso the newyamcs-clientdependency is available where Yamcs actions are used.Critical merge instruction
Use Create a merge commit /
gh pr merge --mergefor this PR.Do not squash or rebase merge. Preserving
Developmentancestry keeps future Staging promotions incremental and avoids replaying this 708-commit range.Validation
git merge-base --is-ancestor origin/Staging origin/Developmentsucceeded.origin/Developmentandorigin/Stagingrefs.azd deployfor Development completed successfully, and the Development deployment was manually exercised before this promotion request.Known merge gate