Feat v0.7.9 workflow independence (#63)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

ROADMAP.md

@@ -1,6 +1,6 @@
 # Armature — Roadmap
 
-## Current: v0.7.7 — API Tokens + Extension Permissions
+## Current: v0.7.9 — Workflow Independence Audit
 
 Self-hosted extensible platform kernel. Auth, identity, packages, Starlark
 sandbox, storage, realtime, and ops are kernel primitives. Everything else
@@ -223,10 +223,10 @@ a test coverage gap in the store layer. Fix before v0.8.x kernel expansion.
 
 | Step | Status | Description |
 |------|--------|-------------|
-| store/ unit tests | | Deferred to v0.7.8. Direct tests for PG + SQLite store implementations. Requires live DB. Target: ≥30% SLOC ratio. |
+| store/ unit tests | done | Moved to v0.7.9. 17 SQLite store tests: workflow CRUD, stages, instances, lifecycle, tokens, users, groups. |
 | workflow/ routing unit tests | done | 82 tests: ResolveNextStage, ResolveStageByName, ParseStageConfig, evaluateCondition (all operators). |
 | middleware/ unit tests | done | 10 tests: RequirePermission, RequireAdmin, permission caching, RateLimiter (allow/deny/fail-open). |
-| InstallPackage decomposition | | Deferred to v0.7.8. 224 cognitive complexity. Split into: validate → create → DDL → permissions → triggers. |
+| InstallPackage decomposition | done | Moved to v0.7.9. Split into 7 phases: receiveUpload, parseAndValidateArchive, extractPackageAssets, registerPackage, applySchemaAndPermissions, resolveDependencies, checkCapabilities. |
 
 **Bug Fixes**
 
@@ -285,16 +285,59 @@ Workflows must work end-to-end without chat or any 3rd-party package
 dependency. Chat, notifications, and other packages should *enhance*
 workflows but never be required for core operation.
 
+**RenderWorkflow Fix (critical)**
+
 | Step | Status | Description |
 |------|--------|-------------|
-| Public entry flow | | Verify workflow start → instance creation → stage progression works without chat package installed. Landing page → form → completion. |
-| Stage mode degradation | | All stage modes (`form_only`, `form_chat`, `review`) degrade gracefully when optional packages missing. `form_chat` without chat falls back to form-only. |
-| Instance lifecycle | | Create, advance, complete, cancel — full lifecycle without chat dependency. Engine doesn't error when chat unavailable. |
-| Admin/team-admin UI | | All CRUD, monitoring, and stage builder work without optional packages. No broken references. |
-| E2E without chat | | Landing page → instance → stage progression → completion tested with chat package disabled. |
-| Deferred test coverage | | store/ unit tests (PG + SQLite), InstallPackage decomposition, workflow/ engine integration tests. Carried from v0.7.6. |
+| Fix RenderWorkflow() handler | done | Was a stub (always `stageMode = "custom"`, no data loaded). Now loads instance by token/ID, resolves current stage, populates all template data. |
+| Rename WorkflowPageData fields | done | `ChannelID` → `EntryToken`, `ChannelTitle` → `WorkflowTitle`, `ChannelDescription` → `WorkflowDescription`. Vestigial chat-era names removed. |
+| Align stage mode values | done | Template now uses Go constants (`form`, `review`, `delegated`, `automated`) instead of legacy names (`form_only`, `form_chat`). |
+| Remove dead chat UI | done | Chat CSS, split layout, `sendMessage()` function, and fallback chat branch all removed from `workflow.html`. Replaced with clean form/review/unsupported modes. |
+| Fix landing page mode mapping | done | `workflow-landing.html` conditionals updated to match Go stage mode constants. |
+| Update OpenAPI spec | done | `stage_mode` enum changed from `[custom, form_only, form_chat, review]` to `[form, review, delegated, automated]`. |
 
-### v0.7.10 — Query & HTTP Ergonomics
+**Verification & Testing**
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Admin/team-admin UI audit | done | All workflow CRUD, monitoring, stage builder verified clean — zero chat/chat-core references. |
+| E2E workflow test | done | `ci/e2e-workflow-nochat.sh` — creates workflow via API, adds form+review stages, starts instance via public entry, verifies landing + execution pages. |
+| Store unit tests (SQLite) | done | 17 tests: workflow CRUD, stages, instances, lifecycle (advance/complete/cancel/stale), team scope, API tokens, users, groups. Carried from v0.7.6. |
+| InstallPackage decomposition | done | Split 400-line handler into 7 private methods: `receiveUpload`, `parseAndValidateArchive`, `extractPackageAssets`, `registerPackage`, `applySchemaAndPermissions`, `resolveDependencies`, `checkCapabilities`. Carried from v0.7.6. |
+
+**Bug Fixes (found during verification)**
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Entry token resolution | done | `RenderWorkflow()` passed route param (instance ID) as entry token. JS then sent instance ID to the advance API which expects entry token. Fixed: resolve actual token from `inst.EntryToken` + check `?token=` query param. |
+| Fieldset submit guard | done | `submitForm()` checked `FORM_TPL.fields` but not `.fieldsets` — progressive forms silently no-op'd on submit. Fixed: accept either. |
+| Stage advance status check | done | Template JS checked `result.status === 'advanced'` but API returns instance status (`active`/`completed`). Fixed: on 200 OK with `active` status, reload to render next stage. |
+
+**Discovered issues (deferred)**
+
+The audit uncovered deeper workflow UX gaps that are out of scope for v0.7.9:
+
+1. **Public→authenticated stage handoff** — After a public visitor completes their stages, the workflow advances to an authenticated stage (e.g. "classify"). The visitor sees the next stage's form + an auth error instead of a "thank you, we'll take it from here" message. The page should detect audience mismatch and show a completion/waiting screen.
+2. **Team member pickup UI** — No surface exists for team members to see workflow instances assigned to their team and claim/work on them. Currently only visible in team-admin monitoring.
+3. **Assignment flow** — No mechanism for team admins to assign a specific instance to a specific team member. The `workflow_assignments` table exists but has no admin UI for manual assignment.
+
+These will be addressed in a future version (see v0.7.10 below).
+
+### v0.7.10 — Workflow Handoff + Assignment UI
+
+Addresses the three UX gaps found during the v0.7.9 independence audit.
+The workflow engine and data model already support these flows — the
+missing pieces are page-level audience detection and team-facing UI.
+
+| Step | Status | Description |
+|------|--------|-------------|
+| Public stage completion screen | | When `RenderWorkflow()` detects the current stage's audience is `team`/`system` but the visitor is unauthenticated, render a "Submitted — your request is being reviewed" screen instead of the stage form. |
+| Team workflow inbox | | New section in team-admin (or dedicated surface): list active instances assigned to this team, with claim/unclaim actions. Uses existing `ListAssignmentsByTeam` store method. |
+| Manual assignment UI | | Team admin can assign an unclaimed instance to a specific team member. Uses existing `CreateAssignment` store method. |
+| Assignment notifications | | When an instance is assigned (auto or manual), notify the assignee via the notification system. |
+| E2E multi-stage test | | Full lifecycle: public form → team pickup → review → complete. Verified with both authenticated and unauthenticated users. |
+
+### v0.7.11 — Query & HTTP Ergonomics (was v0.7.10)
 
 Four additions to existing sandbox modules. No new files beyond tests,
 no schema changes. Motivated by real-world extension porting feedback:
@@ -309,7 +352,7 @@ remaining friction points for extensions migrating from native Go/Python.
 | `http.batch()` | | `http.batch(requests)` → list of response dicts (ordered). Each request dict: `method`, `url`, `body`, `headers`. Concurrent dispatch via goroutines capped at 10, `sync.WaitGroup` collection. Reuses existing `httpDo` plumbing (SSRF checks, domain allowlist, body cap, timeout). Individual failures return error response dicts, don't abort batch. Permission: `api.http`. ~80 lines in `http_module.go`. |
 | Tests | | Unit tests for all four builtins. `db.count`/`db.aggregate` test empty table, filtered, type coercion. `db.query_batch` test mixed specs, empty list. `http.batch` test concurrent execution, partial failure, ordering. PG + SQLite for db tests. |
 
-### v0.7.11 — Concurrent Execution Primitive
+### v0.7.12 — Concurrent Execution Primitive (was v0.7.11)
 
 New `batch` sandbox module. Enables extensions to parallelize arbitrary
 Starlark callables — including library function calls via `lib.require()`.