v2.9 — Workflow Studio

Agentic RAG v2.9 — Workflow Studio

v2.9 turns the v2.8 harness engine into something a domain expert can actually use: describe a workflow in plain English, bind it to your project's knowledge base and skills, and run it to produce a real, cited, integrity-checked deliverable. This release adds project-scoped retrieval governance the model cannot widen, workflow↔skill composition with locked version snapshots, ephemeral template upload with guaranteed-cited template-fill, a reusable validation-gate library topped by an LLM-judge output-quality hard wall, and a built Workflows page where natural-language authoring meets an 8-stage publish gauntlet — with project management shipped as the flagship demo, authored entirely on the generic primitives with zero hardcoded PM logic. The whole milestone is ~80-90% composition of shipped harness primitives, and Deep Mode stayed byte-identical across all nine phases.

Highlights

• Project = folder binding + server-side KB governance — a workflow binds to a project (a folder + its subtree); retrieval scope is resolved server-side from your RLS context at run start and bound to every retrieval call as a parameter the model cannot override or widen.
• Workflow ↔ skill composition with locked snapshots — a phase can reference a project skill; its instructions and files compose into the phase framing, and the skill version is snapshotted into the published definition so a later edit or delete can never change a published run.
• Ephemeral template upload + guaranteed-cited template-fill + integrity gates — hand a workflow a .docx/.pptx/.xlsx template for one run; the model is forced to emit a cited field-map that a deterministic, no-model-code driver renders into a real deliverable, then re-opens to verify integrity — a corrupt file can never reach you as "done."
• Reusable validation-gate library + LLM-judge output-quality hard wall — a closed registry of 9 validator kinds any phase can attach, plus an LLM-judge gate and a publish-time golden run that form a hard publish blocker: a lint-clean workflow that produces bad output cannot publish.
• Workflows page + natural-language authoring + read-only graph + 8-stage publish gauntlet — describe a workflow in natural language and get a valid, KB-grounded draft; view it as a read-only phase-spine graph; browse a project-filtered library; run it from a thread; publish it only by clearing an ordered server-side gauntlet ending in the judge wall.
• PM flagship content pack — charter, weekly-status-report, and risk-register templates plus two published workflow definitions and a synthetic project corpus, authored entirely on the generic primitives, with the headline single template-fill status-report demo green across a 7-model cross-provider sweep.

What's New in Detail

Project binding + server-side KB scope governance (098)

A workflow can now bind to a project via an additive-optional project_folder_id — old unbound workflows still validate and run with zero migration. A bound workflow defaults its retrieval to the project-folder subtree, with an optional per-phase folder_scope to narrow further; the scope comes from the binding, never from a prompt hint. At run start the scope is resolved server-side from the user's RLS context and bound to every retrieval call as a parameter the model cannot widen. Retrieved folder_ids are asserted to be a subset of scope (RLS as backstop), and any out-of-scope attempt is clipped and surfaced as an observable scope_violation run-log event. The subset assert is a None-gated no-op when scope is absent, so the shared search_documents path stays Deep byte-identical.

Workflow ↔ skill composition (099)

An llm_agent or llm_single phase can reference a project skill via optional skill_ref. The skill's instructions and attached files compose directly into the phase framing, with read_skill_file auto-whitelisted for that phase. Critically, the skill version is snapshotted into the locked definition (migration 067 sibling column + CAS) at first kickoff, so a later edit or delete can't break a published workflow. Composition was proven across 6+ providers, and snapshot immutability was proven live.

Ephemeral template upload + template-fill + integrity (100 / 101 / 101.1)

A user can hand a workflow a .docx/.pptx/.xlsx template for exactly one run — workspace-only (kind=template_input), TTL + cron-swept, RLS-scoped, and never KB-ingested, embedded, or searchable (which also closes the upload-injection vector). The shared guaranteed-structured-emission llm_emit layer then forces the model to emit a cited field-map against a strict Pydantic schema — each field nullable and carrying its source chunk/page — which a pinned, deterministic, no-model-code driver renders into a real deliverable using docxtpl/python-docx inside the sandbox (a Jinja SandboxedEnvironment with autoescape for SSTI containment). Citation policy (strict/flag/partial/draft) and an integrity policy enforce that uncited values are marked or blanked, never silently filled, and the filled file is re-opened with the same library to assert integrity before delivery. Capability-tiered forcing at the gateway boundary plus native narrated-JSON recovery make this reliable across the native-7.

Reusable validation-gate library + output-quality judge hard-wall (102)

A closed validator registry of 9 gate kinds — json_schema, regex_match, workspace_file_exists, programmatic, citations_required, freshness, structure_check, output_file_valid, and llm_judge_rubric — lets any phase attach validation that rides the existing gate + bounded-retry loop (on_failure: fail_run / retry / skip_to_phase / ask_user). Every gate's pass/fail is driven by a schema-bound boolean, never a regex over prose, so a narrated verdict can't game the gate. A workflow declares exactly one business_requirement, and an llm_judge_rubric gate plus a publish-time golden run form a hard publish blocker (QUAL-01): a structurally-lint-clean workflow that produces bad output cannot publish. The judge works cross-provider and grades both prose and template-fill.

Workflows page + authoring API + NL authoring + publish gauntlet (103)

POST /workflows/generate turns a plain-English description into one model_validate-clean, KB-grounded WorkflowDefinition draft via a single forced emit over the strict schema — grounded on the project folder tree, the tool/skill registry, and any uploaded template placeholders, with one retry against the validation error then an honest structured failure (never a partial draft). A built Workflows page hosts a project-filtered library, a Builder with a read-only vertical phase-spine graph (view, not drag-to-build — a deliberate anti-feature for the domain-expert buyer) plus side-panel forms, and the publish gauntlet. Publishing runs an ordered server-side gauntlet — owner-check, already-published, definition validation, business_requirement present, structural lint, interactive-phase pre-run block, a real golden run on the project KB (no mocks), structural gate, the judge verdict (hard blocker), then the flip — returning a structured verdict with the blocking stage and named failures, and writing publish_attempted/blocked/succeeded receipts. Run forks a new chat thread and kicks off a real server-side run; Deep is the resting default. The whole path is ~90% reuse of the shipped forced_emit substrate plus the 092.5 gateway force_tool_name.

PM flagship content pack (104)

The project-management flagship — charter / weekly-status-report / risk-register templates, two published workflow definitions, register schemas, and a synthetic "Project Meridian" corpus — was authored entirely on the generic primitives, domain-author-driven with zero PM-hardcoded engine logic. The headline demo runs green live: a single template-fill status report drawn from the project KB, cited and integrity-checked, across a 7-model cross-provider sweep with honesty on all 7.

Requirements shipped

• PROJ-01 — workflow bound to a project folder via optional project_folder_id; old unbound workflows still validate and run (zero-migration, additive). [098]
• PROJ-02 — bound workflow defaults retrieval to its project-folder subtree; optional per-phase folder_scope narrows it; scope comes from the binding, not a prompt hint. [098]
• GOV-01 — retrieval scope resolved server-side from the user's RLS context at run start, bound as a parameter the model cannot override; retrieved folder_ids asserted subset of scope; out-of-scope attempts clipped + observable. [098]
• WFSKILL-01 — llm_agent/llm_single phase references a skill via optional skill_ref; skill version snapshotted into the locked definition; Deep-mode chat byte-identical. [099]
• TMPL-01 — ephemeral template upload: .docx/.pptx/.xlsx into a thread for one run (workspace-only, kind=template_input, RLS-scoped), never ingested/embedded/searchable, expires via TTL + cron sweep. [100]
• TMPL-02 — fill that exact template from project-KB content via a cited Pydantic field-map (each field nullable, carrying source chunk/page), rendered deterministically by pinned sandbox code. [101 / 101.1]
• TMPL-03 — filled template re-opened with the same library to assert integrity before delivery; a corrupt/unopenable file is caught and never delivered; SSTI contained via SandboxedEnvironment. [101 / 101.1]
• GATE-01 — reusable library of validator kinds (citations_required, freshness, structure_check, output_file_valid, llm_judge_rubric) any phase can attach, riding the existing gate + bounded-retry loop. [102]
• QUAL-01 — workflow declares exactly one business_requirement; an LLM-judge output-quality gate + a publish-time golden run are a hard publish blocker — lint-clean-but-bad-output cannot publish. [102]
• WFAUTH-01 — create/edit a workflow as a draft (CRUD) on a new Workflows page, with publish-time structural lint (reachable, terminal, satisfiable inputs) blocking invalid publishes. [103]
• WFAUTH-02 — describe a workflow in natural language and receive a valid draft (one-shot structured generation over the strict WorkflowDefinition schema, grounded + auto-retrying against the validation error). [103]
• WFAUTH-03 — Workflows page renders a read-only live graph of a workflow's phases/edges (view, not drag-to-build). [103]
• WFAUTH-04 — published workflow browsable in a project-filtered library and runnable from a thread (thread enters workflow mode, Deep is the resting default); definitions immutable-on-publish + versioned. [103]
• PM-01 — PM flagship content pack (charter/weekly-status-report/risk-register templates + workflow defs + register schemas) authored entirely on the generic primitives; headline single template-fill demo runs end-to-end, cited + integrity-checked. [104]

By the numbers

• 9 CORE phases (097–104, including the inserted emission-layer phase 101.1)
• 57 plans (~6.3 plans/phase, ~7.1 plans/day)
• 418 commits (99 of them feat)
• 678 files changed — +88,561 / −514 lines
• 8 days — 2026-06-08 → 2026-06-15
• 14/14 CORE requirements shipped + validated; 5/5 STRETCH deferred

Deferred to backlog

The five STRETCH phases (105–109) were never started and roll forward to the next milestone:

• Phase 105 — Scheduled/Recurring Triggers + Budget Caps (SCHED-01) — carries a hard prerequisite: a gateway spend meter (no schedule without a budget).
• Phase 106 — Citation-Traceable Grid Renderer (GRID-01) — risk register / RTM / stakeholder matrix as a grid where every cell is agent-filled and source-cited.
• Phase 107 — Per-Run Provenance Receipt View (GOV-02) — surface the already-recorded provenance chain as an auditable, EU-AI-Act-Art-12-shaped receipt.
• Phase 108 — Plugin Contract Lock: phase_type + file_preview (PLUG-01) — lock the first two contract types on real flagship telemetry (closes the SEED-037 office-viewer gap).
• Phase 109 — Operator/Admin Role Tier (ROLE-01) — self-serve global workflow publish behind an operator role, only if global sharing becomes a headline.

In total, 40 deferred items were triaged at milestone close as zero CORE blockers (operator-approved). These include status-label lag on superseded/closed phases (101 → 101.1; 102/103 secured), 19 pre-GSD tracking slugs, 12 dormant forward seeds (with SEED-005 Enhanced Document Structure as the next-milestone candidate), and SEED-082 (emit-gate policy + model-fit routing) — where reasoning-model forced-emit reliability on DeepSeek/Gemini remains a provider-boundary rough edge that always honest-fails and never silently ships a bad file. Seven open surface:Agentic-RAG bug reports also roll forward into the next milestone's UAT blast radius; none was folded into a v2.9 CORE phase.

Quality & verification

There was no formal milestone-wide audit run this cycle — it was deliberately substituted by per-phase verify-work + secure-phase + live cross-provider UAT on every CORE phase. Selected results:

• Phase 102 — 34/34 threats closed (threats_open: 0) and 7/7 SC#10 cross-provider tests passing.
• Phase 103 — 32 threats reviewed, 0 open.
• Phase 104 — 15 threats reviewed, 0 open; Nyquist-compliant; live UAT 5/5.

The hard-won discipline of the milestone was "drive the real endpoint." Static def-shape tests and mocks repeatedly false-greened live failures: Phase 102's judge gate had never actually worked live (6 mock-masked blockers found and fixed only by driving the real publish endpoint on a real golden run), and Phase 104 — the first definition to attach the citations_required + output_file_valid gates to an llm_emit phase — surfaced 2 blocking double-gate engine bugs that static tests passed clean. The lesson extended even to auditors and validation maps: re-run and hand-spot-check, don't trust labels.

Throughout, the Deep Mode byte-identical red line held: the harness/workflow layer is layered strictly on top of the Deep agent loop and is inert unless a workflow is active (phase_whitelist / skill_snapshot / workflow_run_id on ToolContext default to None, so Deep dispatch stays byte-identical). Every engine addition was an additive seam — never a breaking change to the shared SSE/chunk path or the G-5 hot files — and provider-specific handling stayed confined to the gateway/service boundary.

Upgrade notes

• No breaking changes to Deep / Explorer (non-workflow) mode. All workflow features are additive and inert unless a workflow is active; Deep Mode behavior is byte-identical to v2.8.
• Additive-optional schema. WorkflowDefinition is a strict discriminated-union Pydantic model with additive-optional fields, so old JSONB rows stay model_validate-clean with zero migration. The new schema additions (migration 067 skill-snapshot sibling column, migration 068 template-input support, migration 069 harness_audit emit kinds, migration 070 validation-gate library + workflow_runs.is_golden_run) are all additive (ALTER / new column / CHECK widen).
• Migrations. Apply the four new v2.9 migrations (067–070) via the Supabase SQL editor (never db push / db reset against a live dev DB), then regenerate supabase/full-schema.sql with scripts/regenerate-full-schema.sh and commit both. The single-file full-schema.sql remains the greenfield deploy artifact.
• No env or provider-key changes are required to upgrade from v2.8; workflow features ride the existing provider gateway and the existing sandbox image.

Full changelog

Compare the full set of changes on GitHub: v2.8...v2.9 (the v2.9 tag is cut at 2026-06-15). For per-phase detail, see the phase artifacts under .planning/097-* through .planning/104-* (PLAN, VERIFICATION, and SECURITY documents).