v0.261.001 Latest Features: user and admin tiers, generated docs catalog, real screenshots

[Paul Lizer (paullizer)]

Summary

• Consolidates everything shipped after v0.250.001 into a single v0.261.001 Latest Features release, presented in two tiers: 30 user-facing cards and 18 admin-managed cards. The user tier grew from 20; the admin tier is new to the docs site.
• Captures 22 real 1280x720 screenshots so no current-release card ships with a placeholder, and publishes them to the docs site.
• Makes the docs site generated from the app via scripts/build_latest_release_docs.py, so the in-app catalog and the public guides cannot drift apart again. A new parity test enforces it.
• Fixes admin card shortcuts that silently landed on the wrong tab, and repairs three tests this branch had left failing.

Heads up for reviewers: this branch also carries a pre-existing SSRF fix in application/single_app/config.py — validate_azure_blob_endpoint(...) is now applied in build_enhanced_citations_blob_service_client. It was in-progress work in the working tree when this branch started and was deliberately included. It is the one security-relevant change in an otherwise docs-and-tests PR, so please review it on its own merits.

Linked issue

None. This work was not tracked by an issue and none was opened.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped — 0.260.028 -> 0.261.001
• deployers/version.txt bumped, or not needed because deployers/ was not changed

What changed

App

• support_menu_config.py: user catalog 20 -> 30 cards, admin catalog 16 -> 18; release tier relabelled to 0.261.001.
• New User-Facing Latest Features admin tab, split out of the Support Menu pane; the old tab is renamed Admin Latest Features. Submitted field names are unchanged.
• Admin card shortcuts repointed at the tab that actually holds each setting (see below).

Docs

• scripts/build_latest_release_docs.py projects both current catalogs onto the docs site: it writes docs/_data/latest_release_features.yml, creates pages for cards that lack one, refreshes generator-authored pages in place, relabels hand-authored pages, and publishes catalog screenshots.
• The latest-release index now renders the new Admin-Managed Latest Features group.
• Six release-260 pages had an identical boilerplate ## Admin Side paragraph; each now describes what an admin actually configures, verified against the settings panes.
• docs/admin/help.md documents the new admin tab, keeping app-surface coverage at 100%.

Three defects found while doing this

1. A page was silently dropping out of the Jekyll build. The first version of the generator wrote front matter with f-strings, and one card summary contains "that XML file" — the embedded quotes produced a YAML Exception and the page vanished from the site. Front matter is now dumped as real YAML and the parity test parses every page.

2. Admin shortcuts landed one tab away from the setting. admin_sidebar_nav.js has a deliberate LEGACY_TAB_REDIRECTS table, so these links worked — but an alias resolves to whichever tab inherited the old id:

   Target	Landed on	Setting actually on
   #general	Branding	Notices & Agreements (Terms of Use, Chat AI Notice)
   #search-extract	Web & Research	Document Extraction
   #scale	Redis & Caching	Cosmos (Document Access Index, Cosmos Maintenance)
   #governance	Feature Governance	Governance Policies / MCP Governance

   The MCP card now also links the dedicated Inbound MCP tab, which governs SimpleChat acting as an MCP server and was previously unreachable from the card. "Open Safety" now targets /admin/safety_violations, which is a page rather than a settings tab.

3. Inaccurate published guidance. The formula-extraction steps told users to look for LaTeX in the document details panel; that panel shows metadata only. Azure Blob File Sync listed SAS as a fourth authentication mode, but the selectable set is managed_identity / client_secret / connection_string — a SAS URL arrives via connection string and is then validated. Both corrected at the source.

Tests this branch had left failing

Three tests were already red before this PR's docs work, because earlier commits on the branch relabelled the tier and flipped cards to visible without updating them. Verified against a git worktree at f33f9388. All three now derive counts from the catalog instead of hard-coding them:

• test_support_menu_user_feature — pinned tier 0.260.001, exactly 20 cards, exactly 3 screenshots each
• test_latest_features_release_group_integrity — asserted cards ship hidden
• test_latest_release_docs_structure — froze the exact 20-slug current release list

Left alone: test_admin_send_feedback_tab is red, but it is equally red on origin/Development — it expects pre-rework nav markers (id="send-feedback-tab", data-tab="search-extract") that exist on neither branch. That is long-standing breakage from the information architecture rework, not this PR.

Testing / validation

python functional_tests\test_docs_latest_release_catalog_parity.py     6/6
python functional_tests\test_latest_feature_action_targets.py          4/4
python functional_tests\test_admin_latest_features_tab.py              8/8
python functional_tests\test_docs_app_surface_coverage.py              7/7
python functional_tests\test_docs_site_quality.py                      6/6
python functional_tests\test_latest_release_docs_structure.py         pass
python functional_tests\test_latest_features_release_group_integrity.py 7/7
python functional_tests\test_support_menu_user_feature.py              5/5
python functional_tests\test_support_menu_blueprint_endpoints.py      pass
python functional_tests\test_latest_features_action_links.py          pass
python functional_tests\test_admin_card_links.py                       4/4
python functional_tests\test_admin_settings_nav_map.py                 4/4
python functional_tests\test_admin_settings_field_contract.py          2/2
python functional_tests\test_admin_settings_sidebar_card_parity.py    pass
python functional_tests\test_admin_settings_template_composition.py   pass
node ui_tests\check_docs_links.js            377 pages, 0 broken targets
bundle exec jekyll build                     clean, no YAML exceptions

Note: test_docs_site_quality and the link checker read the built docs/_site. A stale build produced two false failures and 94 phantom broken links before a rebuild — run bundle exec jekyll build from docs/ first.

New tests added:

• functional_tests/test_docs_latest_release_catalog_parity.py — group membership, page and image resolution, front matter parseability, layout coverage, generator freshness.
• functional_tests/test_latest_feature_action_targets.py — resolves every card target through the alias table parsed from admin_sidebar_nav.js, checks that table for dangling and shadowed entries, and requires current-release cards to name their destination directly.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Release notes were deliberately skipped at the author's direction, and the version is intentionally locked at 0.261.001 rather than bumped further for the late fixes. Flagging it so the reviewer can override.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) — no new routes in this PR
• Settings sent to non-admin frontends use sanitize_settings_for_user() — no new frontend routes
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS — enforced by test_docs_site_quality::test_no_cdn_browser_assets
• No secrets, keys, connection strings, or local-only artifacts are included

The bundled SSRF fix noted at the top applies validate_azure_blob_endpoint(...) to the enhanced-citations blob endpoint before a BlobServiceClient is constructed.