Feat v0.7.10 workflow handoff + assignment UI

Public→team stage handoff with audience mismatch detection, enriched
assignment API responses (workflow_name, stage_name, sla_breached),
team inbox with claim/assign actions, assignment notifications, team
middleware system-admin bypass fix, and SDK gap closure.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/pages/pages.go

@@ -646,6 +646,7 @@ type WorkflowPageData struct {
 	BrandingJSON         string
 	InstanceID           string // workflow instance ID (used for API calls)
 	Status               string // pending | active | completed | cancelled | stale
+	AudienceMismatch     bool   // true when current stage audience is team/system but visitor is unauthenticated
 }
 
 // WorkflowLandingPageData is passed to workflow-landing.html.
@@ -745,6 +746,22 @@ func (e *Engine) RenderWorkflow() gin.HandlerFunc {
 			entryToken = *inst.EntryToken
 		}
 
+		// Detect audience mismatch: stage requires team/system but visitor is
+		// unauthenticated. Show a "submitted" screen instead of the stage form.
+		audienceMismatch := false
+		userID := c.GetString("user_id")
+		if userID == "" {
+			// Visitor is unauthenticated — check the current stage audience
+			for _, s := range stages {
+				if s.ID == inst.CurrentStage || s.Name == inst.CurrentStage {
+					if s.Audience == models.AudienceTeam || s.Audience == models.AudienceSystem {
+						audienceMismatch = true
+					}
+					break
+				}
+			}
+		}
+
 		e.Render(c, "workflow.html", PageData{
 			Surface:      "workflow",
 			InstanceName: instanceName,
@@ -763,6 +780,7 @@ func (e *Engine) RenderWorkflow() gin.HandlerFunc {
 				BrandingJSON:        brandingJSON,
 				InstanceID:          inst.ID,
 				Status:              inst.Status,
+				AudienceMismatch:    audienceMismatch,
 			},
 		})
 	}

server/pages/templates/workflow.html

@@ -104,6 +104,26 @@
             padding: 24px; text-align: center; color: var(--text-2);
         }
 
+        /* ── Submitted / handoff screen ── */
+        .wf-submitted {
+            flex: 1; display: flex; align-items: center; justify-content: center;
+            padding: 40px 24px; text-align: center;
+        }
+        .wf-submitted-inner { max-width: 420px; }
+        .wf-submitted-icon {
+            width: 56px; height: 56px; border-radius: 50%;
+            background: var(--accent); color: #fff;
+            display: inline-flex; align-items: center; justify-content: center;
+            font-size: 28px; margin-bottom: 16px;
+        }
+        .wf-submitted h3 { font-size: 20px; font-weight: 600; margin-bottom: 8px; }
+        .wf-submitted p { color: var(--text-2); font-size: 14px; line-height: 1.5; }
+        .wf-submitted .ref-id {
+            margin-top: 16px; padding: 8px 16px; background: var(--bg-surface);
+            border: 1px solid var(--border); border-radius: 6px;
+            font-size: 12px; color: var(--text-3); display: inline-block;
+        }
+
         /* ── Branding ────────────────────── */
         .wf-branding-logo { max-height: 32px; margin-bottom: 4px; }
         .wf-branding-tagline { font-size: 13px; color: var(--text-2); margin-top: 2px; }
@@ -160,7 +180,18 @@
 
     <!-- Stage surface: form, review, delegated (custom surface), or automated -->
 
-    {{if .Data.SurfacePkgID}}
+    {{if .Data.AudienceMismatch}}
+    <div class="wf-submitted">
+        <div class="wf-submitted-inner">
+            <div class="wf-submitted-icon">&#10003;</div>
+            <h3>Submitted Successfully</h3>
+            <p>Your submission has been received and is now being reviewed by our team. You can safely close this page.</p>
+            {{if .Data.EntryToken}}
+            <div class="ref-id">Reference: {{.Data.EntryToken}}</div>
+            {{end}}
+        </div>
+    </div>
+    {{else if .Data.SurfacePkgID}}
     <div id="customSurfaceMount" style="flex:1;overflow-y:auto"></div>
     {{else if eq .Data.StageMode "form"}}
     <div class="wf-form" id="formArea"></div>