Fix source identity for chat-linked workspace documents

[Paul Lizer (paullizer)]

Summary

• FED-04 exposed a shared retrieval bug: an upload conversation could replace a workspace document's scope ID, causing Compare to fail authorization after successful source analysis and skip dependent composition. Explicit Analyze manifest matching could reject the same mismatch.
• Select identity from the already authorized source scope. Preserve personal ownership, approved group access paths, public workspace identity, true chat-only attachment identity, and separate owning provenance. Authorization, screening, revision checks, provider-failure behavior, and UI acceptance criteria are unchanged.
• Add 28 runtime regressions covering retrieval, Analyze, Compare, retained-result composition, sharing, and source changes. Document the generalized fix and bump the application to 0.261.347. No migration or new configuration is required.

Linked issue

Fixes #1777

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Testing / validation

Commands used a session-local Python 3.12 environment with application-pinned dependencies restored. Application and functional-test directories were on PYTHONPATH; runtime tests blocked network access.

• python -m pytest -p test_support.cosmos_network_guard -p no:cacheprovider .\functional_tests\test_document_source_scope_identity.py -q --tb=short - 28 passed.
• python .\scripts\check_cosmos_response_boundaries.py --run-contracts - 1,079 passed and 244 subtests passed; 1,066 owners, 409 doubles, zero review gaps. Only two unchanged chat-upload owners' containing-module fingerprints changed in the reviewed inventory.
• python -m pytest -p no:cacheprovider .\functional_tests\test_docs_app_surface_coverage.py .\functional_tests\test_docs_site_quality.py -q --tb=short - 13 passed.
• git diff --check - passed.

Known baseline failures: python -m pytest -p test_support.cosmos_network_guard -p no:cacheprovider .\functional_tests\test_orchestration_source_authority_runtime.py -k 'saved_wait or recovery_preserves_typed' -q --tb=no reports 24 failures, 14 setup errors, 59 deselected. The same 38 recovery/wait cases reproduce with unchanged pre-fix retrieval code and without the new test module; source-free durable fixtures stop before adapter execution. These failures are documented, not counted as passing or hidden by changed expectations.

No deployment or live FED-04 rerun was performed. Deterministic model replies validate orchestration plumbing, not live model arithmetic or citation quality. The original UI attempt remains failed pending an authorized post-deployment rerun.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated ORCHESTRATION_GATHER_REASON_RENDER.md and added DOCUMENT_SOURCE_SCOPE_IDENTITY_FIX.md. Release notes remain unchanged pending separate approval.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No Flask routes, frontend settings responses, or browser assets were changed.