[Paul Lizer (paullizer)]

Summary

• Integrate paullizer-react-v2-ui into Development through a history-preserving merge, carrying forward the React V2 interface and its orchestration, workspace, document, and administration capabilities without changing interface rollout defaults.
• Preserve Development's fixes through their newer V2 implementations. Resolve 69 conflicted files and reconcile automatic-merge duplicates, historical OneNote rollback coverage, and both release-note streams.
• Fix restored waiting-run composer ownership, enforce safe configured-navigation URLs at the browser boundary, and update regression fixtures for current guided-input, plan-revision, and quiet-progress contracts.
• Keep GitHub's default branch main, retain the React source branch, and leave Staging/main promotion outside this PR. Retarget the two pending React PRs only after this integration lands.

Integration commit: 783153c1af61b52cb7236a63066be1a422abd3de.
Its parents are React 34df8404ab9e20e51ffaf9d98ea40d75a18570e8 and Development f4e186401b58e284ee9b626aa84c903f69ea100b; both ancestry checks passed.

Linked issue

N/A - this integration PR is the tracking item, as requested.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

The integration preserves the source branch's feature catalog rather than adding a second promotion-only card.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.418 -> 0.261.419. The integrated deployer changes already carry 1.0.37 versus Development's 1.0.32; reconciliation adds no deployer changes relative to the React input.

Testing / validation

• Local validation used Python 3.12, OpenAI 1.109.1, and Cosmos 4.9.0. In the SDK-dependent commands below, $python was .\.test-artifacts\integration-venv\Scripts\python.exe; that task-local environment was removed after validation.
• The overlay environment inherited PyYAML 6.0.3 and test-only Uvicorn 0.52.0, rather than the declared 6.0.2 and 0.50.2. Clean pinned CI is required before merge. The shared host SDK was not changed.

Command	Result
npm --prefix .\application\v2_ui run build	Passed, including TypeScript; existing large-bundle advisory remains
npm --prefix .\application\v2_ui run build -- --outDir ..\..\ui_tests\artifacts\orchestration-plan-editor	Passed
python -m compileall -q .\application\single_app	Passed
node --check .\application\single_app\static\js\chat\chat-export.js	Passed
node --check .\application\single_app\static\js\chat\chat-inline-diagrams.js	Passed
python .\functional_tests\route_tests\test_route_blueprint_policy_inventory.py	15/15 passed
python .\functional_tests\route_tests\test_route_unauthenticated_policy_contract.py	10/10 passed
python .\functional_tests\route_tests\test_route_policy_test_coverage.py	3/3 passed
python .\scripts\build_docs_inventory.py	Passed; committed inventory is current
python .\functional_tests\test_docs_app_surface_coverage.py	7/7 passed
python .\functional_tests\test_docs_site_quality.py	6/6 passed
python .\scripts\build_release_notes_pages.py --check	Passed; 313 sections in 14 generated pages
& $python .\functional_tests\test_chat_inline_diagram_rendering.py	5/5 passed, including real local Chromium rendering
& $python .\functional_tests\test_export_mermaid_browser_rasterizer.py	3/3 passed
node .\functional_tests\test_v2_navigation_groups_logic.mjs	12/12 passed
git diff --check HEAD^1 HEAD	Passed

SDK, backend, and browser selections: exact commands and results

The SDK matrix ran with PYTHONPATH set to the application and functional-test directories, warmed tokenizer assets, and the repository's network guard:

& $python -u -c "import pathlib,runpy,tempfile; tempfile.tempdir=str(pathlib.Path('.test-artifacts').resolve()); runpy.run_path('scripts/check_cosmos_response_boundaries.py',run_name='__main__')" --run-contracts

Result: 2,005 passed; 431 subtests passed. Inventory: 1,094 owners, 425 doubles, zero review gaps.

& $python -m pytest -q functional_tests\test_guided_user_input.py functional_tests\test_guided_user_input_routes.py functional_tests\test_guided_user_input_orchestration.py functional_tests\test_orchestration_document_planning_recovery.py functional_tests\test_orchestration_planning_persistence.py functional_tests\test_task_completeness_engine.py functional_tests\test_task_completeness_runtime.py functional_tests\test_orchestration_available_information.py functional_tests\test_orchestration_attachment_native_evidence.py functional_tests\test_orchestration_native_citation_delivery.py functional_tests\test_saved_analysis_cleanup.py functional_tests\test_saved_analysis_cleanup_http.py --disable-warnings --tb=short --maxfail=3

Result: 262 passed.

& $python -m pytest -q functional_tests\test_react_v2_development_integration.py functional_tests\test_chat_retry_edit_model_endpoint_replay.py functional_tests\test_chat_retry_request_contract.py functional_tests\test_onenote_upload_dispatch.py functional_tests\test_onenote_workspace_ingestion.py functional_tests\test_onenote_extractor_runtime.py functional_tests\test_v2_onenote_uploads.py functional_tests\test_xss_guardrails_checker.py functional_tests\test_v2_bootstrap_branding_and_navigation.py functional_tests\test_document_provenance_origin.py --disable-warnings --tb=short --maxfail=3

Result: 175 passed; 57 subtests passed.

& $python -m pytest -q functional_tests\test_tabular_model_http_diagnostics.py functional_tests\test_tabular_tool_error_retry_and_thoughts.py functional_tests\test_workflow_instruction_drafting.py functional_tests\test_deployer_key_vault_secret_permissions.py functional_tests\test_v2_user_settings_audio_voice_retention.py functional_tests\test_app_settings_import_boundaries.py functional_tests\test_chat_retry_attempt_lifecycle.py --disable-warnings --tb=short --maxfail=3

Result: 77 passed; 33 subtests passed.

& $python -m pytest -q ui_tests\test_v2_chat_attachment_isolation.py ui_tests\test_v2_new_chat_reset.py ui_tests\test_v2_guided_user_input.py ui_tests\test_v2_orchestration_planning_persistence.py ui_tests\test_v2_orchestration_quiet_activity.py ui_tests\test_v2_orchestration_recovery.py ui_tests\test_task_completeness_ui.py ui_tests\test_v2_stream_citation_delivery.py ui_tests\test_v2_excel_citation_inspection.py ui_tests\test_v2_mobile_navigation.py --disable-warnings --tb=short

Result: 184 passed.

node --test .\functional_tests\test_native_workbook_citation_parser.mjs .\functional_tests\test_v2_chat_attachment_isolation.mjs .\functional_tests\test_v2_orchestration_progress_lane.mjs .\functional_tests\test_v2_orchestration_run_progress_status.mjs .\functional_tests\test_v2_stream_citation_delivery.mjs .\functional_tests\test_v2_web_iq_citations.mjs

Result: 43 passed.

Committed-head guardrail CLI commands

The actual committed head, not the pre-merge source head, was checked. The file arrays were generated from the complete application diff and converted to Windows paths:

$baseSha = git rev-parse origin/Development
$headSha = git rev-parse HEAD
$files = @(git diff --name-only --diff-filter=ACMR $baseSha $headSha -- application |
    ForEach-Object { $_.Replace('/', '\') })
$pythonFiles = @($files | Where-Object { $_ -like '*.py' -and (Test-Path -LiteralPath $_) })
$browserFiles = @($files | Where-Object {
    $_ -match '\.(js|html|py|ts|tsx|jsx|mjs)$' -and (Test-Path -LiteralPath $_)
})
function Invoke-Guardrail([string]$script, [string[]]$paths, [string[]]$options) {
    for ($offset = 0; $offset -lt $paths.Count; $offset += 64) {
        $batch = @($paths | Select-Object -Skip $offset -First 64)
        $output = & python $script @options @batch 2>&1
        if ($LASTEXITCODE -ne 0) { $output | Write-Output; throw "$script failed" }
    }
}
Invoke-Guardrail '.\scripts\check_swagger_routes.py' $pythonFiles @()
Invoke-Guardrail '.\scripts\check_broken_access_control.py' $pythonFiles @('--base-sha', $baseSha, '--head-sha', $headSha)
Invoke-Guardrail '.\scripts\check_xss_sinks.py' $browserFiles @('--base-sha', $baseSha, '--head-sha', $headSha)

Results: Swagger passed for 562 paths, access-control passed for 562 paths, and XSS passed for 1,460 paths, against base f4e186401b58e284ee9b626aa84c903f69ea100b and head 783153c1af61b52cb7236a63066be1a422abd3de.

Not run: a live authenticated Azure deployment smoke test, private/native OneNote executable fixtures, or a full native/container build. Local component/HTTP fixtures are not a claim of deployment validation. No resources were provisioned or independently deployed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

See docs/explanation/fixes/REACT_V2_DEVELOPMENT_INTEGRATION_FIX.md, the 0.261.419 release entry, chat-control and waiting-run guidance, and the preserved historical fix notes.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

The pinned classic Mermaid distribution uses the existing vendor boundary; first-party wrappers remain scanned. Narrow annotations document reviewed sanitizer, generated-blob, fixed-route, and intentionally hostile fixture boundaries rather than globally disabling first-party checks.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.