Additive business-context and Open Work enhancements (preserve workflow mapping) #247

Goal

Enhance OWG; do not replace its core product. A user must still be able to install OWG and, with no business-system connectors or agents enabled, record work, discover recurring workflows, map processes, inspect raw traces, export context to an AI, use Discovery Mode, and identify automation opportunities. New capabilities are optional read-only/context layers using the same privacy-hardened evidence.

Product value

Agents should find missed/stalled business work, understand why it matters, retrieve relevant prior human/agent workflow evidence, act through their own authorized tools, and independently check business outcomes. We must demonstrate value beyond identical live-source API/log access; an agent could already answer unanswered emails without OWG.

Small milestones (separate reviewable PRs)

1 — Record and mapping correctness

• Close remaining record identity / interleaving / exact-source-ref correctness gaps. Fix old case retrieval without changing OWG workflow mapping #246 starts with exact-record history retrieval and cap handling.
• Do not equate captured clicks, source status or observed completion with customer/business outcome.
• Avoid expensive startup migrations; test 300k+ retained events and signed launcher startup.
• Regression-guard existing find_repeated_workflows, get_workflow_evidence, Activity, Discovery and export contracts.

2 — Open Work: opt-in read-only inventory

• Define an evidence-backed, tenant- and actor-scoped open-work candidate contract: work_item_ref, source, state, expected outcome, due/priority (only when declared), freshness, policy, evidence refs, unknowns.
• Start with one real independently authorized business-system inventory connector (helpdesk/ticketing or similar). Must discover unobserved outstanding cases, not only records already appearing in desktop history.
• Classify explicit pending/blocked states conservatively; unobserved reply or elapsed time alone is not an obligation.
• No default sync, no raw email bodies or customer names in OWG canonical traces, no new cloud sharing without consent, no autonomous writes.
• Source rate limits, pagination, TTL/freshness and revocation tested; no cross-tenant enumeration.

3 — Case graph + operational context

• Add durable case/goal/dependency/outcome edges with source-proven facts separate from derived correlations and owner-declared rules.
• Reuse existing record_graph, procedural memory, declared policy, task-context preflight and agent handoff; do not build new conflicting engines.
• One bounded get_case_context entry point for existing authorized agents. Include relevant historical traces, declared rules, current source state and explicit unknowns; no automatic permissions.
• Ensure case indexes vanish/lose authority on retention, deletion, disconnection and source revocation.

4 — Verified outcome + feedback

• Attach source-confirmed status receipts and corrections to case/context, not to raw observed actions as manufactured success.
• Return unknown on source outage/conflicts/partial history, and distinguish action completion vs provider state vs true customer outcome.
• Shadow/draft trials first; use the existing agent instrumentation and evaluators.
• No self-modifying policy from repeated observed behavior or unreviewed agent feedback.

5 — Prove commercial usefulness

• Run pre-registered, held-out A/B/C matched agent trials: same business tools, + audit/logs, + OWG, across discovery and verified completion; collect host-observed tool receipts.
• Include never-observed pending cases, interleaved work, rare exceptions, unknown outcomes, privacy revocation, and source outages.
• Report accuracy, independently verified completions, false-positive obligations, intervention and cost/latency; no claimed lift from synthetic-only CI.
• Add a simple optional business Open Work view alongside, not instead of, existing workflow mapping.

Hard compatibility / privacy requirements

• Keep existing MCP, REST, export and UI experiences functioning; additions are optional and default OFF until reviewed.
• Preserve local-first data collection, permission and redaction boundaries, employee consent and organization actor scope. Policy/authorization never follows from observed action history.
• Do not turn OWG into a general RPA/agent builder. Reuse existing connected agent runtimes.
• Every milestone has tests for old workflow mapping, unchanged capture, source isolation, data retention, no new default network writes, and privacy-sensitive exclusions.

Milestone gates

M1: an older real record can be retrieved correctly without weakening privacy.
M2: OWG finds true outstanding work that a screen-only observer could not have seen.
M3: agent consumes a self-contained, permitted case context.
M4: independent source confirms result rather than trusting agent status.
M5: adding OWG improves real held-out business outcomes compared with system APIs/logs alone.

Reference: existing issue #226 remains the source-joined record-evidence acceptance work; this issue coordinates the new additive product enhancement, not a claim #226 is complete.

Implementation progress — 2026-10-19 (reviewed in GitHub)

Merged, CI green

• Fix old case retrieval without changing OWG workflow mapping #246 — Exact-scoped historical record graph retrieval; correct older retained case lookups and fail-closed truncation while preserving existing workflow discovery/export. Merged.
• Add opt-in Open Work preview for unobserved Stripe invoice candidates #248 — Explicit default-OFF local Stripe open-invoice preview, including never-observed records. No writes, customer values or agent scan entitlement. Merged as an experimental feature; live provider account acceptance still pending.
• Add exact-source Open Work case context without replacing workflow maps #249 — Source-first case drilldown linking a selected current source record to exact, retained observed OWG evidence; case inspector in local dashboard; no agent execution authority. Merged.
• Add provider-neutral Open Work case graph and strict evidence semantics #250 — Provider-neutral read-only projection of a business-case graph with typed source facts and historical observations distinct from declared policy/agent authority. Merged. Not yet durable organization graph.

In review / staged separately

• Add second opt-in Open Work source via repository-scoped GitHub PR discovery #251 — Second source: dashboard-only, explicitly selected GitHub repository open PR candidates. Merged, CI green; real authenticated gh pilot acceptance pending.
• Add authorized local MCP get_case_context with existing history privacy guard #252 — Local MCP get_case_context for already observed exact records, with existing AI-access and saved-history checks, registered only through an explicit experimental tool flag. Merged, CI green.
• Add independently sourced operation receipts for known business cases #253 — Independently sourced operation receipts for GitHub/Jira/Stripe known cases. Merged after full cross-platform CI passed; this is not full customer-outcome verification.

Still required before declaring this issue fully complete

• Proper real-tenant app-owned OAuth connect/refresh/revoke for helpdesk/email/CRM/billing as applicable; per-org/actor authorization and customer-controlled grants. Stripe/GitHub local prototypes do not replace this.
• A durable, bounded business case/goal/dependency/outcome graph with tenant identity, consent, retention/deletion and connector revocation; on-demand source-derived graph views are not persistence.
• Explicitly declared, versioned business obligations and expected outcomes (not inferred from clicks or open status) with a usable review/approval UX.
• Opt-in recurring discovery/dispatch integration so external agents can act on unhandled work with separate action authority. Do not build a full agent framework.
• Independent source-verification receipt linked to agent attempts and final expected outcome, including unknown/stale/conflict handling and customer-vs-provider completion boundary.
• End-to-end testing with real signed clients and authorized test accounts, plus independently adjudicated held-out A/B/C agent evaluations comparing equal source data vs +OWG context. No claims of agent uplift until this is measured.
• Production pilot usability/performance tests for large retained history and source pagination, plus explicit regression checks for core workflow mapping/exports and multi-tenant privacy.

Status: important additive foundation is implemented, but this remains OPEN until the production/provider/evaluation gates pass. Preserve Activity, recording, workflow mapping, repeated-workflow discovery, Discovery Mode, exports and privacy defaults throughout.

Post-merge verification audit — October 19, 2026

• Confirmed Fix old case retrieval without changing OWG workflow mapping #246 and Add opt-in Open Work preview for unobserved Stripe invoice candidates #248–Add independently sourced operation receipts for known business cases #253 merged sequentially into main.
• On the merged main SHA before Add independently sourced operation receipts for known business cases #253: Linux (1,797 passed, 1 skipped, two repeats), macOS, Windows, browser JS, Gateway, plugin, packaging and launch smoke all passed.
• On Add independently sourced operation receipts for known business cases #253 prior to merge: Linux (1,814 passed, 1 skipped, two repeats), macOS, Windows, browser JS, Gateway, plugin, packaging and launch smoke passed.
• Live connected hosted OWG get_current_work_context, find_repeated_workflows, and get_workflow_evidence by returned execution IDs succeeded; hosted catalog remains separate from local experimental MCP tools.
• Post-Add independently sourced operation receipts for known business cases #253 merged-main push matrix running at time of audit.
• Post-merge regression: handle realistic Stripe invoice list pages safely #254: realistically sized Stripe invoice list regression with bounded 2 MiB cap, full cross-platform CI, packaging and launch smoke passed; merged.
• Real account provider acceptance (restricted Stripe key, local GitHub CLI) and independently adjudicated live agent A/B/C study remain unverified. Neither mock tests nor successful CI establishes real business outcomes.

Feedback fixes and next acceptance gates — October 19, 2026

• Already done: Fix lost application identities in manager and repeated-workflow views #245/Fix old case retrieval without changing OWG workflow mapping #246 are merged (not unmerged or superseded);
  Additive business-context and Open Work enhancements (preserve workflow mapping) #247 exists; Post-merge regression: handle realistic Stripe invoice list pages safely #254 fixed the 256 KB → 2 MiB Stripe inventory
  page issue with a bounded response cap and successful CI.
• Merged, full CI passed: Pin Stripe read API schema and stabilize Open Work IDs across key rotation #255 pins the source API version across
  Stripe account, single-record and list reads; derives opaque invoice
  work-item IDs from a local installation OWG secret rather than a rotating
  Stripe key. Real Stripe restricted-test-key validation still required.
• Merged, full CI passed: Show exact OWG observation status in Open Work previews; simplify Basic mode #256 adds one batched exact-record local OWG observation
  annotation per source invoice, distinguishing observed / no exact retained
  evidence / uncertain. It improves source error UI and moves Stripe/GitHub
  source previews to Advanced, preserving Basic workflow mapping.
  Absence of recorded evidence NEVER implies a human neglected a case.
• Merged, full CI passed: Add Advanced-only experimental Open Work MCP tool toggle with immediate revocation #257 adds a dashboard-session-only opt-in for the two
  experimental local MCP tools, preserving default tool catalogs and
  enforcing immediate read denial after toggle OFF. Includes a synthetic
  full-stack local dashboard → provider preview → retained OWG record →
  case graph → MCP setting test using actual SQLite/FastAPI.
• Next production acceptance: live restricted Stripe TEST account and
  native gh CLI tests on a real local installation, including pagination,
  account mismatch, token rotation, read revocation and throughput on 300k+
  historical events. These cannot be declared passing by mocked CI.
• Later issue Additive business-context and Open Work enhancements (preserve workflow mapping) #247 work remains OPEN: durable cross-provider
  case/goal/outcome graph with consent and retention, explicit approved
  business rules, separate execution authorization, and a preregistered
  held-out A/B/C study demonstrating real agent uplift beyond equally
  authorized source APIs/logs. Do not overclaim that an 'open' invoice
  itself establishes a follow-up obligation.

All three feedback PRs #255–#257 passed full CI and were merged in order. No changes remove
Activity, workflow mapping/discovery, Discovery Mode, exports or AI memory.

Local human-reviewed work queue — October 20, 2026

• Pin Stripe read API schema and stabilize Open Work IDs across key rotation #255–Add Advanced-only experimental Open Work MCP tool toggle with immediate revocation #257: feedback fixes merged in dependency order, original workflow mapping preserved.
• Add explicit, expiring local Open Work review queue without workflow regressions #258 (draft, CI running): voluntary local-only queue for source-reverified Stripe candidates, privileged dashboard-only explicit scan/save, typed human intent, no native IDs/customer data, maximum 50 items. Expiry at most 7 days and never longer than human history retention; session-only setting scrubs review intentions immediately; clear on source replacement/disconnect. Not a verified obligation or AI authority.
• Add explicit source recheck for locally reviewed Open Work cases #259 (draft, stacked on Add explicit, expiring local Open Work review queue without workflow regressions #258): user-confirmed fresh source recheck for saved cases; result differentiates still-open, missing from a complete open inventory, partial inventory and outage without claiming payment or business outcome. No automatic polling or persistence of source states.
• Real Stripe TEST account, local GitHub CLI, large-dataset latency and full signed client acceptance still required. Source-status verification does not prove agent benefit.
• Durable org/actor-scoped case graph, independently approved process rules, source-confirmed business outcomes and matched A/B/C agent evaluation remain OPEN.

The local review queue deliberately stays separate from Activity/workflow mapping; making manual selections is not required for any existing OWG workflow discovery.