[Paul Lizer (paullizer)]

Summary

• Give admins a self-service support ZIP workflow in the classic and V2 interfaces, filtering retained Azure Monitor/Cosmos diagnostics by user, conversation and time instead of requiring developer-operated log collection.
• Scrub credentials and deterministic PII before an optional isolated default-model privacy pass. Whole personal-conversation snapshots require explicit owner consent; shared/group transcripts remain unavailable.
• Use resource-scoped Azure queries, private staging, leased/idempotent jobs, checksum-bound snapshots, cancellation/revocation and authenticated expiring downloads. No logs are enabled or sent to support automatically.
• Update documentation, generated inventories, SDK-boundary evidence and regression coverage; bump the application to v0.261.428.

Review focus: owner-only consent and snapshot authorization, fresh AI destination binding, and worker fencing/cleanup. Limits are seven days, 20 conversations, 100,000 records, 50 MiB uncompressed and at most 24 hours of ZIP availability.

Linked issue

Closes #1916

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Owners receive consent requests; export tooling itself remains admin-only.

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Pending maintainer publication decision. The documentation feature catalog is updated; an application Latest Feature card is not included.

Screenshot needed for the card?

• Yes
• No
• Attached

N/A until the card publication decision. No media or local-only verification artifacts are included.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.427 -> 0.261.428 after merging the latest Development base. No deployer changes.

Testing / validation

Implementation-session validation (before the latest base merge):

Command	Result
python .\scripts\check_cosmos_response_boundaries.py --run-contracts	Passed: 2,025 tests, 431 subtests; zero review gaps across 1,102 owners and 427 doubles.
python -m pytest .\ui_tests\test_admin_support_export.py .\ui_tests\test_v2_admin_support_export.py .\ui_tests\test_support_export_consent.py -q --disable-warnings --tb=short	Passed: 9 browser workflows, including actual ZIP downloads, owner approval/revocation, desktop/mobile and light/dark coverage.
python -m pytest .\functional_tests\test_admin_support_export_startup.py .\functional_tests\test_admin_support_export_model_budget.py -q --disable-warnings --tb=short	Passed: 8 cases, including real normal/optimized web/scheduler imports with external I/O blocked and current-registry/model-binding checks.
npm --prefix .\application\v2_ui run typecheck	Passed.
npm --prefix .\application\v2_ui run build	Passed; existing large-chunk warning remains.
node .\functional_tests\test_v2_admin_support_export_logic.mjs	Passed: request, path, state and DST contracts.
node --check .\application\single_app\static\js\support-exports.js	Passed.
python .\functional_tests\route_tests\test_route_blueprint_policy_inventory.py	Passed: 15 checks.
python .\functional_tests\route_tests\test_route_unauthenticated_policy_contract.py	Passed: 10 checks.
python .\functional_tests\route_tests\test_route_policy_test_coverage.py	Passed: 3 checks.
python .\functional_tests\test_docs_app_surface_coverage.py	Passed: 7 checks.
python .\functional_tests\test_docs_site_quality.py	Passed: 6 checks.
git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check	Passed.

The combined targeted support-export/logging selection also passed 68 tests. Feature-specific access-control checks, full new-file XSS checks, actual worktree-added-line integration checks and the final UI detector passed.

Post-merge validation against origin/Development at 5f2390160, with the application version resolved to 0.261.428:

Command	Result
python -m pytest .\functional_tests\test_admin_support_export_filters.py .\functional_tests\test_admin_support_export_privacy.py .\functional_tests\test_admin_support_export_jobs.py .\functional_tests\test_admin_support_export_sources.py .\functional_tests\test_admin_support_export_api.py .\functional_tests\test_admin_support_export_logging.py .\functional_tests\test_admin_support_export_model_budget.py .\functional_tests\test_admin_support_export_startup.py .\functional_tests\test_unified_logging_entrypoint.py .\functional_tests\test_log_credential_key_redaction.py -q --disable-warnings --tb=short	Passed: 72 tests.
$env:PYTHONPATH = '.\application\single_app;.\functional_tests'; python -m pytest .\functional_tests\test_native_audit_answer_delivery.py .\functional_tests\test_native_audit_reliability.py .\functional_tests\test_native_document_fidelity.py .\functional_tests\test_native_document_fidelity_http.py .\functional_tests\test_native_document_fidelity_pipeline.py .\functional_tests\test_native_inspection_request_contract.py .\functional_tests\test_orchestration_document_action_end_to_end.py .\functional_tests\test_document_accessibility_report_action.py .\functional_tests\test_excel_inventory_persistence.py -q --disable-warnings --tb=short	Passed: 168 tests.
python -m pytest .\functional_tests\test_workflow_authoring_sdk_boundaries.py::test_search_upload_owners_consume_real_sdk_point_documents -q --disable-warnings --tb=short	Passed: 1 SDK-boundary test.
python -m pytest .\ui_tests\test_admin_support_export.py .\ui_tests\test_v2_admin_support_export.py .\ui_tests\test_support_export_consent.py -q --disable-warnings --tb=short	Passed: 9 browser workflows.
npm --prefix .\application\v2_ui run typecheck	Passed.
npm --prefix .\application\v2_ui run build	Passed; existing large-chunk warning remains.
node --check .\application\single_app\static\js\support-exports.js && node .\functional_tests\test_v2_admin_support_export_logic.mjs	Passed: syntax, request, path, state and DST contracts.
python .\scripts\check_cosmos_response_boundaries.py	Passed: 1,102 owners, 427 doubles, zero review gaps. The full runtime contract suite above was run before this base merge.
python .\functional_tests\test_docs_app_surface_coverage.py	Passed: 7 checks; generated inventory is current.
python .\functional_tests\test_docs_site_quality.py	Passed: 6 checks.
git diff --cached --check	Passed before the merge commit.

Known baseline limitation: python -m pytest .\functional_tests\test_content_screening_model.py -q --disable-warnings failed during setup because its unchanged AST adapter fixture requests endpoint_uses_openai_style_protocol as a local definition, although the current client imports it. New real-engine tests cover the changed budget/binding behavior without that stale fixture, and the reviewed Cosmos contract runner passed.

Live Azure deployment permissions, retention and ingestion were not exercised. Deployment must configure monitoring read permissions, resource-context workspace access and private application Blob storage; the admin workflow provides Test source access. No cloud roles or diagnostic settings are changed by this PR.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

A feature release-note entry was offered separately and is not included without confirmation. Incoming Development release notes are preserved. Added the feature technical notes and support-export guide; updated Operations, owner approvals, logging tags, the feature catalog and generated surface inventory/stub. Separate fix documentation is not needed for this new capability.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No raw settings payload is added to a non-admin frontend. Owner-facing endpoints emit allowlisted consent data and scrubbed previews, with subject-level authorization independent of admin roles. Test credentials and identities are synthetic.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.