Fix saved credential continuation and recovery state

[Paul Lizer (paullizer)]

Summary

• Fix the shared credential-continuation boundary behind the Yamcs failure: detached workers now reauthorize saved waits inside the existing isolated execution-identity bridge, without inheriting the browser request or bypassing current permissions.
• Finalize credential interactions from the selected step's acknowledged durable outcome, not HTTP 200, SSE content, or normal executor return. Preserve independent waits, renewed challenges, exact continuation claims, and no-replay guarantees.
• Distinguish confirmed credential saves from continuation failures in React V2. Require an authoritative request/run refresh before another attempt, use the latest revision, and suppress continuation for terminal or unconfirmed work.
• Add real-boundary regressions and secret-safe diagnostics, document recovery, and bump the application to 0.261.343. No deployment or live credential/run repair was performed; this does not establish that the supplied credentials are accepted by Yamcs.

Linked issue

N/A. No associated issue; the user previously chose to proceed without creating one.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.342 -> 0.261.343. No deployer files changed.

Testing / validation

• Focused results: all 79 tests across the four credential Python suites passed; 22 credential browser tests and 28 Cosmos response-contract tests passed. Frontend transport, TypeScript/build, route policies, documentation checks, and diff hygiene passed. Desktop light and mobile dark recovery states were inspected with the production styles.
• Known baseline failure: adding the broader orchestration continuation suite produced 120 passed, 1 failed. test_native_wait_reopens_original_handle_once_and_preserves_child_and_fingerprint reports result_producer_unavailable, then a missing compute wait. It fails identically in isolation with both execution modules loaded from unmodified HEAD source in memory. This unrelated native-compute baseline failure is documented, not changed here.

Tests used session-local Python compatibility overrides and restored frontend dependencies, with external service I/O doubled. Global packages were not changed. This is not a full pinned-environment CI result or a live Yamcs acceptance test. The production build emitted its existing large-chunk warning.

Exact validation commands and results

Python runs used this application import path:

$env:PYTHONPATH = "$PWD\application\single_app;$PWD\functional_tests"

120 passed, 1 known baseline failure (includes all 79 focused credential tests passing):

& 'C:\Users\paullizer\.copilot\session-state\309c97a0-d0db-4228-b1af-798fc43d8760\files\validation-venv\Scripts\python.exe' -m pytest functional_tests\test_action_credentials_orchestration_continuation.py functional_tests\test_action_credentials_bootstrap.py functional_tests\test_action_credentials_sk_continuation.py functional_tests\test_action_personal_credentials.py functional_tests\test_orchestration_continuation.py -q --disable-warnings --tb=short

22 passed:

& 'C:\Users\paullizer\.copilot\session-state\309c97a0-d0db-4228-b1af-798fc43d8760\files\validation-venv\Scripts\python.exe' -m pytest ui_tests\test_v2_action_credentials.py -q --disable-warnings --maxfail=1 --tb=short

28 passed:

& 'C:\Users\paullizer\.copilot\session-state\309c97a0-d0db-4228-b1af-798fc43d8760\files\validation-venv\Scripts\python.exe' -m pytest functional_tests\test_orchestration_cosmos_response_contract.py -q --disable-warnings --maxfail=1 --tb=short

62 passed (credential worker regressions plus all three route-policy files):

& 'C:\Users\paullizer\.copilot\session-state\309c97a0-d0db-4228-b1af-798fc43d8760\files\validation-venv\Scripts\python.exe' -m pytest functional_tests\test_action_credentials_orchestration_continuation.py functional_tests\route_tests\test_route_blueprint_policy_inventory.py functional_tests\route_tests\test_route_unauthenticated_policy_contract.py functional_tests\route_tests\test_route_policy_test_coverage.py -q --disable-warnings --maxfail=1 --tb=short

Passed:

npm --prefix application\v2_ui run typecheck
npm --prefix application\v2_ui run build
node functional_tests\test_v2_action_personal_credentials.mjs

Passed: 7/7 coverage checks and 6/6 site-quality checks:

& 'C:\Users\paullizer\.copilot\session-state\309c97a0-d0db-4228-b1af-798fc43d8760\files\validation-venv\Scripts\python.exe' functional_tests\test_docs_app_surface_coverage.py
& 'C:\Users\paullizer\.copilot\session-state\309c97a0-d0db-4228-b1af-798fc43d8760\files\validation-venv\Scripts\python.exe' functional_tests\test_docs_site_quality.py

Passed:

git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated docs/guides/personal-action-credentials.md and added docs/explanation/fixes/YAMCS_CREDENTIAL_CONTINUATION_FIX.md. The application-surface inventory remains current. Release notes were offered but left unchanged without approval.

Deploying this fix does not reset an already-terminal attempt. Preserve the saved identity/run and use only server-authorized recovery actions; do not automatically resend the question or replay uncertain external operations.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new routes or settings payloads were introduced. Authorization, credential fingerprints, ETags, leases, and checkpoints remain enforced. Diagnostics use static stages, exception types, and hashed identifiers, not credential values or provider exception text.