Add read-only workflow Flow inspection (M5A)

[Paul Lizer (paullizer)]

Summary

• Add read-only Flow for saved version-3 workflows, live unsaved List previews, and the exact frozen definition of a selected run. Version-1/version-2 authoring and history stay unchanged.
• Reuse the existing compiler, canonical/mixed-path identities, runtime, and shared execution/attempt/result/record/item/round/state inspectors. Projection and detail loading are bounded, source-authorized, and explicitly separate from execution and publication actions.
• Pin locally bundled React Flow 12.11.6 with dependency notices and SimpleChat-owned structured layout. Pan, zoom, collapse, and temporary positions do not alter executable definitions, revisions, approvals, or runs.
• Include accessible structure/diagram navigation, mobile behavior, regression coverage, documentation, and application version 0.261.121. Preserve the finite Repeat/For-each, global-budget, exact JSON export, and publication/readiness contracts.

Intended base: paullizer-react-v2-ui, not Development. M5B visual authoring and O1-O9 remain outside this PR. No merge, deployment, permission change, live workflow invocation, or live publication is authorized by this PR.

Linked issue

No new issue, per the owner's session-only tracking choice. Builds on merged #1504 (M4C-3), with #1496, #1498, #1499, and #1501 verified in the fetched integration ancestry. Integration baseline: 9660e22b3680c985556d5ddfe978c496e0e7cf98.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No — no card in this slice; the broader release/Latest Feature strategy remains an owner decision.
• Already added

Screenshot needed for the card?

• Yes
• No — no card is being added. Fictional offline screenshots remain local; no media uploaded.
• Attached

Release notes remain unchanged pending the owner's decision; feature documentation and published guides are updated.

Version bump

• application/single_app/config.py VERSION third segment bumped: 0.261.120 -> 0.261.121.
• deployers/version.txt bump not needed; deployers/ is unchanged.

Testing / validation

All application/browser validation was offline against fictional stores and closed API fixtures; it is not live acceptance.

• V2 typecheck and production build passed. Final browser bundle: index-D86iVPCp.js / index-DUL0AjJh.css.
• ui_tests/test_v2_workflow_flow_inspection.py: 52 passed, including same-node binding/status retention, exact mixed paths, root-instance evidence without extra reads, source/revision isolation, access-loss clearing, bounded loading, and keyboard/mobile behavior.
• Selected existing V2 compatibility checkpoint: 123 passed, with the named pre-existing O5 revoked-record refresh assertion excluded. A later affected control-flow rerun passed all 10 cases; these selections overlap and are not additive.
• Exact execution-client and Flow-semantic Node tests: 13 passed. Final projection/route/layout selection: 55 passed, with the expensive admitted lifetime-round-1001 case separately passed by the backend run.
• Existing compiler/revision/Repeat/collection, source-authorized history, structured edges, native publication, runtime/export, and publication-completion selections passed. The shared Flask/Werkzeug mismatch was resolved only in a session-local validation environment using manifest-pinned Flask 3.1.3 and Werkzeug 3.1.6; no global dependency change.
• Flow notices/local-assets checks: 8 passed plus 24 notice subtests. Documentation inventory/coverage: 7/7; site quality: 6/6. Inventory regeneration produced no content delta.
• Route policy, scoped access-control, Swagger, version-header, and whitespace checks passed. The XSS checker passed for the new Python helper; it does not classify TSX, so React rendering is covered by JSX inspection and browser tests rather than a claimed TSX scan.

Known separate follow-ups: O4 Office-export harness/import debt and O5's existing revoked-refresh assertion are not fixed by this change. No claim of a full repository-wide or live production test pass.

Documentation

• Release notes updated — deferred pending owner approval.
• Feature documentation: docs/explanation/features/WORKFLOW_FLOW_INSPECTION.md; structured-control-flow note and create/trigger guides updated.
• Separate fix documentation not needed; integration fixes and regression coverage belong to this new M5A feature.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) and retain existing scope/role/source checks.
• No raw settings are added to non-admin frontend responses; explicit inspection DTO allowlists exclude private snapshots, runner context, and storage locators.
• Browser JavaScript and styles are served from local SimpleChat static assets; no CDN, worker, remote companion asset, or CSP relaxation.
• No secrets, credentials, generated bundles, node_modules, session environments, screenshots, or other local-only artifacts are included.