Five connected AI-first workflows

User outcome: contextual merchant assistance, resumable authorized multi-step work, complete app creation with actual private validation, shared graphical/agent edits, and actionable shop work suggestions. Website, handbook and README describe the actual delivered paths. Existing Rust operations, tasks, app packages, records, inference and release owners remain authoritative.

Global constraints: no duplicate queues, stores, commerce owners or app renderer. Current tenant/actor/domain/PII rights and CAS are enforced at every operation. Configuration work is private; operational writes remain native authorized work. External uncertain effects are never blindly retried. App source stays app-owned; source execution requires a real isolated build boundary. Generated examples and provider fixtures never count as real-model or hosted acceptance.

Task 1: Context and app discovery

Add a bounded typed workspace context to the existing conversation/run path, with stable scope fencing and shared catalogue/source intake. Replace alphabetical app sampling with permission-filtered query/cursor discovery and native read tools. Expected: a relevant app beyond the first eight is discoverable; denied app data and untrusted context never grant access; saved context survives safe continuation. Tests: targeted frontend context/chat regressions and native provider/run suites.

Task 2: Resumable authorized work

Extend the existing task owner with reviewed bounded operation plans and persisted per-step outcomes. Approval binds exact operations, arguments and scope. Recheck current authority before each step, preserve native idempotency/CAS and pause unknown outcomes. Use supported native operations and existing app gateway, not model SQL. Expected: approved multi-step work completes, reload/restart preserves progress, revocation/cancellation/stale plans cannot mutate, and no approval means no writes. Tests: actual HTTP/PostgreSQL tasks, interruption/replay, foreign and revoked actors.

Task 3: Complete app generation and preview validation

Join generation, canonical Manifest admission, immutable build, private installation, real preview and diagnostic repair into one explicit App Studio workflow. Preserve data/actions/settings/placements/events/rights as one version. Coding-agent changes use the same reviewed artifacts and tests. Do not claim source execution from export. Expected: a generated app writes actual private records, exposes declared surfaces, and keeps its complete contract during a repair; failed validation cannot publish. Tests: app generation native suite, builder UI and private preview acceptance.

Task 4: Shared graphical and language edits

Connect contextual requests to the existing grid, Flow and site/app editors via their native reviewed change owners and stable IDs. Apply accepted changes into the actual editable state with existing undo/history and late-response fences. Expected: accepted criteria change the real server grid; Flow/page proposals remain visually editable; cancelled/stale/cross-scope results do not overwrite manual work. Tests: grid/flow/designer integration and browser interactions.

Task 5: Actionable work and remembered guidance

Derive bounded current-right work suggestions from native product, order, app and integration data. Each opens the exact filtered view/editor or prepares a concrete agent request. Explicit merchant guidance reuses versioned private knowledge sources and actual planner retrieval; never auto-promote external text into instructions. Expected: genuine incomplete work has an actionable destination, resolved work disappears, restricted users receive no leaked counts, and saved guidance affects the next authorized task with source provenance. Tests: native own/foreign/right cases, UI actions, guidance retrieval and withdrawal.

Task 6: Documentation, website and full acceptance

Update owning guides, current status, README entrance, CHANGELOG and public website navigation/features. Generate every handbook page; verify actual HTML/links/assets. Run affected real native flows, frontend suite/build/localization, Rust lint/tests, formal and source-ownership gates. Review the complete branch independently, repair findings, preserve evidence and make changes reviewable through a pull request. Expected: documentation matches demonstrated behavior; pending external deployment is explicit and earlier hosted evidence is never relabelled.

Review focus

Context injection, foreign/private app discovery, scope changes, revoked authority, plan/argument substitution, duplicated effects after crashes, uncertain providers, partial generation contracts, private/live mixing and misleading completion UI.