Guide AI configuration and share durable context between steps

CHANGELOG.md

@@ -18,6 +18,20 @@ SPDX-License-Identifier: Apache-2.0
 
 # Changelog
 
+## 0.1.0a11
+
+- Guide AI provider connections, Lumi settings, and workflow AI profiles through
+  focused steps with review before creation or application. Keep unfinished
+  profile changes local and apply the profile and connection slot atomically.
+- Let authors explicitly pass available earlier AI results as structured context
+  within one workflow execution, using existing compiler-checked expressions.
+- Document the verified alpha10 Azure application-token, AI workflow, Lumi, and
+  HTTP acceptance separately from unverified interactive Entra sign-in.
+- Correct browser selection tests to wait for the insertion reveal before
+  checking pointer reachability.
+- Publish worker packages 0.1.3 pinned to core 0.1.0a11. No server behavior or
+  database migration changes; the schema remains `0028_files`.
+
 ## 0.1.0a10
 
 - Expose Lumi configuration through the paired Studio host and clarify the

README.md

@@ -53,13 +53,14 @@ maps service tasks, user tasks, gateways, and timers to Weave steps.
 
 ## What you get
 
-The **v0.1.0a10 alpha** release provides the **API, CLI, Python SDK, and Studio**
+The **v0.1.0a11 alpha** release provides the **API, CLI, Python SDK, and Studio**
 visual workspace, with human-task inboxes, email conversations, execution
 management, and administration of people and access. Run Weave as a standalone
 service or embed it in another product.
 
-**New in 0.1.0a9:** configure AI provider connections from Studio settings, select
-Lumi's connection by name, and run Agentic workers with renewable OAuth2 credentials.
+**New in 0.1.0a11:** configure AI provider connections, Lumi, and workflow AI
+profiles through guided setup with review before saving. Explicitly select
+earlier AI results as [shared context within one execution](docs/guides/shared-ai-context.md).
 See the illustrated [AI workflow guide](docs/guides/ai-workers.md) and
 [Lumi guide](docs/guides/lumi.md).
 
@@ -80,7 +81,7 @@ See the illustrated [AI workflow guide](docs/guides/ai-workers.md) and
 Read the [capability matrix](docs/capabilities.md) for tested boundaries and
 live-provider checks that remain environment-specific.
 
-Studio runs in your browser from the [installed CLI](docs/guides/studio.md#install-the-alpha10-browser-application)
+Studio runs in your browser from the [installed CLI](docs/guides/studio.md#install-the-alpha11-browser-application)
 or as a [desktop app](docs/guides/desktop.md). The macOS desktop bundles
 are ad-hoc signed, not Developer ID signed or notarized, so macOS may ask you to
 approve them; do not use the alpha5 macOS installers, which were damaged. The
@@ -118,20 +119,20 @@ integration code. Each has its own guide, so you can stop at the result you need
 ## Install and discover the CLI
 
 On macOS, Linux, or WSL, install **Python 3.12 or newer** with `venv` support,
-then run this block in Bash or Zsh. It installs the pinned **v0.1.0a10 alpha**
+then run this block in Bash or Zsh. It installs the pinned **v0.1.0a11 alpha**
 into your user account without `sudo`, Git, or Docker:
 
 ```sh
 (
   # Stop if downloading the installer fails.
   set -o pipefail
   curl --proto '=https' --tlsv1.2 -fsSL \
-    https://github.com/fireflyframework/firefly-weave/releases/download/v0.1.0a10/install.sh \
-    | sh -s -- --version v0.1.0a10
+    https://github.com/fireflyframework/firefly-weave/releases/download/v0.1.0a11/install.sh \
+    | sh -s -- --version v0.1.0a11
 )
 ```
 
-Expected: `Installed Firefly Weave 0.1.0a10:` followed by the command's path. Then
+Expected: `Installed Firefly Weave 0.1.0a11:` followed by the command's path. Then
 make the default command directory available in this terminal and look around:
 
 ```sh
@@ -145,7 +146,7 @@ weave help workflow
 weave docs platform
 ```
 
-Expected: `Firefly Weave 0.1.0a10`, the command overview, the `workflow`
+Expected: `Firefly Weave 0.1.0a11`, the command overview, the `workflow`
 commands, and the address of the platform guide. You do not need to learn every
 command first: help explains each family and its next steps. The
 [installation guide](docs/installation.md) covers choosing Python, a permanent
@@ -178,7 +179,7 @@ Compose files and setup helpers. Clone the tag that matches the CLI:
 
 ```sh
 # Keep the platform files at the same version as the CLI.
-git clone --branch v0.1.0a10 --single-branch https://github.com/fireflyframework/firefly-weave.git
+git clone --branch v0.1.0a11 --single-branch https://github.com/fireflyframework/firefly-weave.git
 cd firefly-weave
 
 # Check prerequisites, then prepare private settings and dependencies once.
@@ -264,7 +265,7 @@ path, and the detailed diagrams.
 
 ## Current release and limits
 
-The recommended installation is **v0.1.0a10**, an **alpha** release. Download
+The recommended installation is **v0.1.0a11**, an **alpha** release. Download
 packages and checksums from
 [GitHub Releases](https://github.com/fireflyframework/firefly-weave/releases).
 The documentation on a branch describes the source on that branch; a release tag
@@ -280,12 +281,18 @@ setup and delivery still need validation in your environment. Sign-in from the
 CLI, and from Studio in an opt-in browser test, has been verified end to end only
 against the local platform's Keycloak 26.7.4, and sign-in with a code from a
 locally built macOS desktop app against the same platform; browser sign-in from
-the desktop app and the DMG have not been verified. Microsoft Entra ID and other
-OIDC providers have configuration guidance, not verification: the built-in token
-verifier accepts Entra's signing keys, which omit `alg`, but only unit tests
-cover them, and no Entra token has been verified yet. Credential storage on
+the desktop app and the DMG have not been verified. Credential storage on
 Windows and Linux is not verified.
 
+Azure preproduction checks on alpha10 verified Microsoft Entra ID application
+tokens for a host application and an independent Agentic worker. An Azure OpenAI
+workflow completed through that worker with consistent replay, and Lumi returned
+a response through its separate gateway. An HTTP workflow also completed after
+the alpha10 deployment, and five existing run states were unchanged. These checks
+do not verify Entra browser or device-code sign-in for people, other identity providers, or general
+provider availability. See the [capability matrix](docs/capabilities.md) for the
+verified scope.
+
 ## Meet Lumi
 
 ![Lumi, the Firefly Weave guide, with translucent mint wings and an amber lantern](assets/lumi.png)

desktop/RELEASE.md

@@ -17,16 +17,16 @@ SPDX-License-Identifier: Apache-2.0
 -->
 # Desktop release versions
 
-The alpha10 product version is `0.1.0-alpha.10` in npm, Cargo and Tauri. It corresponds
-to Python `0.1.0a10` and the repository prerelease tag `v0.1.0a10`.
+The alpha11 product version is `0.1.0-alpha.11` in npm, Cargo and Tauri. It corresponds
+to Python `0.1.0a11` and the repository prerelease tag `v0.1.0a11`.
 
-Windows MSI uses the explicit numeric version `0.1.10`. Tauri's pinned bundler rejects
+Windows MSI uses the explicit numeric version `0.1.11`. Tauri's pinned bundler rejects
 nonnumeric prerelease identifiers when deriving MSI versions; its `windows.wix.version`
 override supplies the valid numeric installer version while filenames retain the product
 version. MSI compares only the first three fields. Future desktop alpha and stable
 releases must advance this numeric installer counter: the stable product `0.1.0`
 must not reset the MSI counter to `0.1.0`. The macOS internal bundle version also uses
-numeric `0.1.10`; its displayed product version remains the alpha product version.
+numeric `0.1.11`; its displayed product version remains the alpha product version.
 
 The Desktop installers workflow builds on four native runners and is dispatchable by
 an exact branch/tag ref. Versioned, target-specific unsigned artifacts contain only

desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firefly-weave/desktop",
-  "version": "0.1.0-alpha.10",
+  "version": "0.1.0-alpha.11",
   "private": true,
   "license": "Apache-2.0",
   "scripts": {

desktop/src-tauri/Cargo.toml

@@ -16,7 +16,7 @@
 
 [package]
 name = "firefly-weave-studio"
-version = "0.1.0-alpha.10"
+version = "0.1.0-alpha.11"
 description = "Firefly Weave Studio desktop"
 authors = ["Firefly Software Foundation"]
 license = "Apache-2.0"

desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Firefly Weave Studio",
-  "version": "0.1.0-alpha.10",
+  "version": "0.1.0-alpha.11",
   "identifier": "io.getfirefly.weave.studio",
   "build": {
     "frontendDist": "../bootstrap"
@@ -52,7 +52,7 @@
           "y": 160
         }
       },
-      "bundleVersion": "0.1.10",
+      "bundleVersion": "0.1.11",
       "signingIdentity": "-",
       "entitlements": "entitlements.plist"
     },
@@ -61,7 +61,7 @@
         "type": "downloadBootstrapper"
       },
       "wix": {
-        "version": "0.1.10"
+        "version": "0.1.11"
       }
     },
     "icon": [

docs/README.md

@@ -47,7 +47,7 @@ gives the steps and what you finish with.
 | An administrator | Install the platform, configure sign-in, and give people access | [Start a local platform](guides/local-platform.md) | [Identity and secrets](operations/identity-and-secrets.md), [remote deployment](operations/remote-deployment.md), [people and access](guides/people-and-access.md), and [configuration](operations/configuration.md) |
 | An operator | Keep runs healthy, fix incidents, upgrade, and back up | [Connect the CLI](guides/connect-to-api.md), then [manage runs](guides/execution-management.md) | [Incidents](reference/incident-operations.md), [troubleshooting](operations/troubleshooting.md), [observability](operations/observability.md), [upgrades](operations/upgrades.md), [backup](operations/backup-restore.md), and [debug-session retention](operations/retention.md) |
 
-Start each path by [installing the CLI](installation.md) from the v0.1.0a10
+Start each path by [installing the CLI](installation.md) from the v0.1.0a11
 release.
 
 [Who does what](guides/roles-and-lifecycle.md) explains these roles with an
@@ -104,7 +104,7 @@ Run one command block, check its **Expected** result, then continue. Comments
 inside code blocks explain why each command is there. When a terminal shows
 server logs, keep it open and use a second terminal for client commands.
 
-The guides pin the **v0.1.0a10 alpha** release, a preview, which includes every
+The guides pin the **v0.1.0a11 alpha** release, a preview, which includes every
 feature they describe, such as saved platforms, REST calls without code, and the
 Studio editor. When a guide shows how to work with an alpha6 or earlier client
 or server, it says so.

docs/architecture.md

@@ -233,9 +233,10 @@ health probes, signed webhooks and provider ingress endpoints (which verify the
 sender by their own rules), and the interactive API documentation when it is
 enabled. Services enforce scoped authorization even when they are called without
 HTTP. The local platform uses Keycloak; a deployment can trust another OIDC
-provider through `WEAVE_OIDC_PROVIDERS`. Only the local Keycloak setup has been
-verified against a real provider, and the built-in verifier has a
-[known limitation with Microsoft Entra ID](operations/identity-and-secrets.md#microsoft-entra-id-not-verified).
+provider through `WEAVE_OIDC_PROVIDERS`. Real-provider checks cover local
+Keycloak sign-in and Microsoft Entra ID application tokens in Azure
+preproduction. Entra browser and device-code sign-in for people remain
+[unverified](operations/identity-and-secrets.md#microsoft-entra-id-human-sign-in-not-verified).
 
 **Persistence.** The [unit of work](../src/firefly_weave/persistence/uow.py) binds
 the tenant context inside a PostgreSQL transaction. Repositories use that