orchestrator-core 4.7.0rc1__py3-none-any.whl → 4.7.0rc2__py3-none-any.whl

orchestrator/__init__.py

@@ -13,7 +13,7 @@
 
 """This is the orchestrator workflow engine."""
 
-__version__ = "4.7.0rc1"
+__version__ = "4.7.0rc2"
 
 
 from structlog import get_logger

orchestrator/app.py

@@ -57,7 +57,8 @@ from orchestrator.graphql.types import ScalarOverrideType, StrawberryModelType
 from orchestrator.log_config import LOGGER_OVERRIDES
 from orchestrator.metrics import ORCHESTRATOR_METRICS_REGISTRY, initialize_default_metrics
 from orchestrator.services.process_broadcast_thread import ProcessDataBroadcastThread
-from orchestrator.settings import AppSettings, ExecutorType, app_settings
+from orchestrator.settings import AppSettings, ExecutorType, app_settings, get_authorizers
+from orchestrator.utils.auth import Authorizer
 from orchestrator.version import GIT_COMMIT_HASH
 from orchestrator.websocket import init_websocket_manager
 from pydantic_forms.exception_handlers.fastapi import form_error_handler
@@ -311,6 +312,38 @@ class OrchestratorCore(FastAPI):
         """
         self.auth_manager.graphql_authorization = graphql_authorization_instance
 
+    def register_internal_authorize_callback(self, callback: Authorizer) -> None:
+        """Registers the authorize_callback for WFO's internal workflows and tasks.
+
+        Since RBAC policies are applied to workflows via decorator, this enables registration of callbacks
+        for workflows defined in orchestrator-core itself.
+        However, this assignment MUST be made before any workflows are run.
+
+        Args:
+            callback (Authorizer): The async Authorizer to run for the `authorize_callback` argument of internal workflows.
+
+        Returns:
+            None
+        """
+        authorizers = get_authorizers()
+        authorizers.internal_authorize_callback = callback
+
+    def register_internal_retry_auth_callback(self, callback: Authorizer) -> None:
+        """Registers the retry_auth_callback for WFO's internal workflows and tasks.
+
+        Since RBAC policies are applied to workflows via decorator, this enables registration of callbacks
+        for workflows defined in orchestrator-core itself.
+        However, this assignment MUST be made before any workflows are run.
+
+        Args:
+            callback (Authorizer): The async Authorizer to run for the `retry_auth_callback` argument of internal workflows.
+
+        Returns:
+            None
+        """
+        authorizers = get_authorizers()
+        authorizers.internal_retry_auth_callback = callback
+
 
 main_typer_app = typer.Typer()
 main_typer_app.add_typer(cli_app, name="orchestrator", help="The orchestrator CLI commands")

orchestrator/cli/scheduler.py

@@ -36,7 +36,13 @@ app: typer.Typer = typer.Typer()
 
 @app.command()
 def run() -> None:
-    """Start scheduler and loop eternally to keep thread alive."""
+    """Starts the scheduler in the foreground.
+
+    While running, this process will:
+
+      * Periodically wake up when the next schedule is due for execution, and run it
+      * Process schedule changes made through the schedule API
+    """
 
     def _get_scheduled_task_item_from_queue(redis_conn: Redis) -> tuple[str, bytes] | None:
         """Get an item from the Redis Queue for scheduler tasks."""
@@ -63,17 +69,45 @@ def run() -> None:
 
 @app.command()
 def show_schedule() -> None:
-    """Show the currently configured schedule.
+    """The `show-schedule` command shows an overview of the scheduled jobs."""
+    from rich.console import Console
+    from rich.table import Table
 
-    in cli underscore is replaced by a dash `show-schedule`
-    """
-    for task in get_all_scheduler_tasks():
-        typer.echo(f"[{task.id}] Next run: {task.next_run_time} | Trigger: {task.trigger}")
+    from orchestrator.schedules.service import get_linker_entries_by_schedule_ids
+
+    console = Console()
+
+    table = Table(title="Scheduled Tasks")
+    table.add_column("id", no_wrap=True)
+    table.add_column("name")
+    table.add_column("source")
+    table.add_column("next run time")
+    table.add_column("trigger")
+
+    scheduled_tasks = get_all_scheduler_tasks()
+    _schedule_ids = [task.id for task in scheduled_tasks]
+    api_managed = {str(i.schedule_id) for i in get_linker_entries_by_schedule_ids(_schedule_ids)}
+
+    for task in scheduled_tasks:
+        source = "API" if task.id in api_managed else "decorator"
+        run_time = str(task.next_run_time.replace(microsecond=0))
+        table.add_row(task.id, task.name, source, str(run_time), str(task.trigger))
+
+    console.print(table)
 
 
 @app.command()
 def force(task_id: str) -> None:
-    """Force the execution of (a) scheduler(s) based on a task_id."""
+    """Force the execution of (a) scheduler(s) based on a schedule ID.
+
+    Use the `show-schedule` command to determine the ID of the schedule to execute.
+
+    CLI Arguments:
+        ```sh
+        Arguments:
+            SCHEDULE_ID  ID of the schedule to execute
+        ```
+    """
     task = get_scheduler_task(task_id)
 
     if not task:
@@ -91,7 +125,18 @@ def force(task_id: str) -> None:
 
 @app.command()
 def load_initial_schedule() -> None:
-    """Load the initial schedule into the scheduler."""
+    """The `load-initial-schedule` command loads the initial schedule using the scheduler API.
+
+    The initial schedules are:
+      - Task Resume Workflows
+      - Task Clean Up Tasks
+      - Task Validate Subscriptions
+
+    !!! Warning
+        This command is not idempotent.
+
+        Please run `show-schedule` first to determine if the schedules already exist.
+    """
     initial_schedules = [
         {
             "name": "Task Resume Workflows",

orchestrator/graphql/schemas/process.py

@@ -89,8 +89,8 @@ class ProcessType:
         auth_resume, auth_retry = get_auth_callbacks(get_steps_to_evaluate_for_rbac(process), workflow)
 
         return FormUserPermissionsType(
-            retryAllowed=bool(auth_retry and auth_retry(oidc_user)),
-            resumeAllowed=bool(auth_resume and auth_resume(oidc_user)),
+            retryAllowed=bool(auth_retry and await auth_retry(oidc_user)),
+            resumeAllowed=bool(auth_resume and await auth_resume(oidc_user)),
         )
 
     @authenticated_field(description="Returns list of subscriptions of the process")  # type: ignore

orchestrator/llm_settings.py

@@ -34,7 +34,6 @@ EMBEDDING_DIMENSION_FIELD = Annotated[
 
 
 class LLMSettings(BaseSettings):
-
     # Feature flags for LLM functionality
     SEARCH_ENABLED: bool = False  # Enable search/indexing with embeddings
     AGENT_ENABLED: bool = False  # Enable agentic functionality

orchestrator/migrations/versions/schema/2020-10-19_a76b9185b334_add_generic_workflows_to_core.py

@@ -17,6 +17,7 @@ down_revision = "c112305b07d3"
 branch_labels = None
 depends_on = None
 
+# NOTE: this migration forgot to insert these workflows with is_task=true. Make sure to correct that if you copy this.
 workflows = [
     {"name": "modify_note", "description": "Modify Note", "workflow_id": uuid4(), "target": "MODIFY"},
     {"name": "task_clean_up_tasks", "description": "Clean up old tasks", "workflow_id": uuid4(), "target": "SYSTEM"},

orchestrator/migrations/versions/schema/2021-04-06_3c8b9185c221_add_validate_products_task.py

@@ -17,6 +17,7 @@ down_revision = "3323bcb934e7"
 branch_labels = None
 depends_on = None
 
+# NOTE: this migration forgot to insert these workflows with is_task=true. Make sure to correct that if you copy this.
 workflows = [
     {"name": "task_validate_products", "description": "Validate products", "workflow_id": uuid4(), "target": "SYSTEM"},
 ]

orchestrator/migrations/versions/schema/2025-11-18_961eddbd4c13_create_linker_table_workflow_apscheduler.py

@@ -17,7 +17,7 @@ down_revision = "850dccac3b02"
 branch_labels = None
 depends_on = None
 
-
+# NOTE: this migration forgot to insert these workflows with is_task=true. Make sure to correct that if you copy this.
 workflows = [
     {
         "name": "task_validate_subscriptions",

orchestrator/migrations/versions/schema/2025-12-10_9736496e3eba_set_is_task_true_on_certain_tasks.py

@@ -0,0 +1,40 @@
+"""Set is_task=true on certain tasks.
+
+This is required to make them appear in the completed tasks in the UI, and for the cleanup task to be able to
+remove them.
+
+Revision ID: 9736496e3eba
+Revises: 961eddbd4c13
+Create Date: 2025-12-10 16:42:29.060382
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "9736496e3eba"
+down_revision = "961eddbd4c13"
+branch_labels = None
+depends_on = None
+
+task_names = [
+    # Added in a76b9185b334
+    "task_clean_up_tasks",
+    "task_resume_workflows",
+    # Added in 3c8b9185c221
+    "task_validate_products",
+    # Added in 961eddbd4c13
+    "task_validate_subscriptions",
+]
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    query = sa.text("UPDATE workflows SET is_task=true WHERE name = :task_name and is_task=false")
+    for task_name in task_names:
+        conn.execute(query, parameters={"task_name": task_name})
+
+
+def downgrade() -> None:
+    pass  # Does not make sense to downgrade back to a 'bad' state.

orchestrator/schedules/__init__.py

@@ -15,7 +15,9 @@ import warnings
 from orchestrator.schedules.validate_products import validate_products
 
 warnings.warn(
-    "ALL_SCHEDULERS is deprecated; scheduling is now handled entirely through the scheduler API.",
+    "ALL_SCHEDULERS is deprecated and will be removed in 5.0.0. "
+    "Scheduling tasks can now be handled entirely through the API. "
+    "For more details, please consult https://workfloworchestrator.org/orchestrator-core/guides/upgrading/4.7/",
     DeprecationWarning,
     stacklevel=2,
 )

orchestrator/schedules/scheduling.py

@@ -23,7 +23,11 @@ F = TypeVar("F", bound=Callable[..., object])
 
 
 @deprecated(
-    reason="We changed from scheduler to apscheduler which has its own decoractor, use `@scheduler.scheduled_job()` from `from orchestrator.scheduling.scheduler import scheduler`"
+    reason=(
+        "Scheduling tasks with a decorator is deprecated in favor of using the API. "
+        "This decorator will be removed in 5.0.0. "
+        "For more details, please consult https://workfloworchestrator.org/orchestrator-core/guides/upgrading/4.7/"
+    )
 )
 def scheduler(
     name: str,

orchestrator/search/agent/prompts.py

@@ -26,7 +26,7 @@ logger = structlog.get_logger(__name__)
 
 async def get_base_instructions() -> str:
     return dedent(
-        """
+        f"""
         You are an expert assistant designed to find relevant information by building and running database queries.
 
         ---
@@ -50,17 +50,21 @@ async def get_base_instructions() -> str:
 
         Follow these steps:
 
-        1.  **Set Context**: Call `start_new_search` with appropriate entity_type and action
+        1.  **Set Context**: Call `start_new_search` with appropriate entity_type and action:
+            - `action={ActionType.SELECT.value}` for finding/searching entities
+            - `action={ActionType.COUNT.value}` for counting (e.g., "how many", "count by status", "monthly growth")
+            - `action={ActionType.AGGREGATE.value}` for numeric operations (SUM, AVG, MIN, MAX of specific fields)
         2.  **Set Filters** (if needed): Discover paths, build FilterTree, call `set_filter_tree`
             - IMPORTANT: Temporal constraints like "in 2025", "in January", "between X and Y" require filters on datetime fields
             - Filters restrict WHICH records to include; grouping controls HOW to aggregate them
-        3.  **Set Grouping/Aggregations** (for COUNT/AGGREGATE):
+        3.  **Set Grouping/Aggregations** (for {ActionType.COUNT.value}/{ActionType.AGGREGATE.value}):
             - For temporal grouping (per month, per year, per day, etc.): Use `set_temporal_grouping`
             - For regular grouping (by status, by name, etc.): Use `set_grouping`
-            - For aggregations: Use `set_aggregations`
+            - For {ActionType.AGGREGATE.value} action ONLY: Use `set_aggregations` to specify what to compute (SUM, AVG, etc.)
+            - For {ActionType.COUNT.value} action: Do NOT call `set_aggregations` (counting is automatic)
         4.  **Execute**:
-            - For SELECT action: Call `run_search()`
-            - For COUNT/AGGREGATE actions: Call `run_aggregation()`
+            - For {ActionType.SELECT.value} action: Call `run_search()`
+            - For {ActionType.COUNT.value}/{ActionType.AGGREGATE.value} actions: Call `run_aggregation()`
 
         After search execution, follow the dynamic instructions based on the current state.
 

orchestrator/search/agent/tools.py

@@ -16,6 +16,7 @@ from typing import Any, cast
 
 import structlog
 from ag_ui.core import EventType, StateSnapshotEvent
+from pydantic import ValidationError
 from pydantic_ai import RunContext
 from pydantic_ai.ag_ui import StateDeps
 from pydantic_ai.exceptions import ModelRetry
@@ -39,13 +40,15 @@ from orchestrator.search.filters import FilterTree
 from orchestrator.search.query import engine
 from orchestrator.search.query.exceptions import PathNotFoundError, QueryValidationError
 from orchestrator.search.query.export import fetch_export_data
+from orchestrator.search.query.mixins import OrderBy
 from orchestrator.search.query.queries import AggregateQuery, CountQuery, Query, SelectQuery
 from orchestrator.search.query.results import AggregationResponse, AggregationResult, ExportData, VisualizationType
 from orchestrator.search.query.state import QueryState
 from orchestrator.search.query.validation import (
     validate_aggregation_field,
-    validate_filter_path,
     validate_filter_tree,
+    validate_grouping_fields,
+    validate_order_by_fields,
     validate_temporal_grouping_field,
 )
 from orchestrator.settings import app_settings
@@ -404,20 +407,30 @@ async def prepare_export(
 async def set_grouping(
     ctx: RunContext[StateDeps[SearchState]],
     group_by_paths: list[str],
+    order_by: list[OrderBy] | None = None,
 ) -> StateSnapshotEvent:
     """Set which field paths to group results by for aggregation.
 
     Only used with COUNT or AGGREGATE actions. Paths must exist in the schema; use discover_filter_paths to verify.
+    Optionally specify ordering for the grouped results.
+
+    For order_by: You can order by grouping field paths OR aggregation aliases (e.g., 'count').
+    Grouping field paths will be validated; aggregation aliases cannot be validated until execution.
     """
-    for path in group_by_paths:
-        field_type = validate_filter_path(path)
-        if field_type is None:
-            raise ModelRetry(
-                f"Path '{path}' not found in database schema. "
-                f"Use discover_filter_paths(['{path.split('.')[-1]}']) to find valid paths."
-            )
+    try:
+        validate_grouping_fields(group_by_paths)
+        validate_order_by_fields(order_by)
+    except PathNotFoundError as e:
+        raise ModelRetry(f"{str(e)} Use discover_filter_paths to find valid paths.")
 
-    ctx.deps.state.query = cast(Query, ctx.deps.state.query).model_copy(update={"group_by": group_by_paths})
+    update_dict: dict[str, Any] = {"group_by": group_by_paths}
+    if order_by is not None:
+        update_dict["order_by"] = order_by
+
+    try:
+        ctx.deps.state.query = cast(Query, ctx.deps.state.query).model_copy(update=update_dict)
+    except ValidationError as e:
+        raise ModelRetry(str(e))
 
     return StateSnapshotEvent(
         type=EventType.STATE_SNAPSHOT,
@@ -434,16 +447,26 @@ async def set_aggregations(
     """Define what aggregations to compute over the matching records.
 
     Only used with AGGREGATE action. See Aggregation model (CountAggregation, FieldAggregation) for structure and field requirements.
+
     """
     # Validate field paths for FieldAggregations
     try:
         for agg in aggregations:
             if isinstance(agg, FieldAggregation):
                 validate_aggregation_field(agg.type, agg.field)
-    except ValueError as e:
-        raise ModelRetry(f"{str(e)} Use discover_filter_paths to find valid paths.")
+    except PathNotFoundError as e:
+        raise ModelRetry(
+            f"{str(e)} "
+            f"You MUST call discover_filter_paths first to find valid fields. "
+            f"If the field truly doesn't exist, inform the user that this data is not available."
+        )
+    except QueryValidationError as e:
+        raise ModelRetry(f"{str(e)}")
 
-    ctx.deps.state.query = cast(Query, ctx.deps.state.query).model_copy(update={"aggregations": aggregations})
+    try:
+        ctx.deps.state.query = cast(Query, ctx.deps.state.query).model_copy(update={"aggregations": aggregations})
+    except ValidationError as e:
+        raise ModelRetry(str(e))
 
     return StateSnapshotEvent(
         type=EventType.STATE_SNAPSHOT,
@@ -456,19 +479,36 @@ async def set_aggregations(
 async def set_temporal_grouping(
     ctx: RunContext[StateDeps[SearchState]],
     temporal_groups: list[TemporalGrouping],
+    cumulative: bool = False,
+    order_by: list[OrderBy] | None = None,
 ) -> StateSnapshotEvent:
     """Set temporal grouping to group datetime fields by time periods.
 
     Only used with COUNT or AGGREGATE actions. See TemporalGrouping model for structure, periods, and examples.
+    Optionally enable cumulative aggregations (running totals) and specify ordering.
+
+    For order_by: You can order by temporal field paths OR aggregation aliases (e.g., 'count').
+    Temporal field paths will be validated; aggregation aliases cannot be validated until execution.
     """
-    # Validate that fields exist and are datetime types
     try:
         for tg in temporal_groups:
             validate_temporal_grouping_field(tg.field)
-    except ValueError as e:
+        validate_order_by_fields(order_by)
+    except PathNotFoundError as e:
+        raise ModelRetry(f"{str(e)} Use discover_filter_paths to find valid paths.")
+    except QueryValidationError as e:
         raise ModelRetry(f"{str(e)} Use discover_filter_paths to find datetime fields.")
 
-    ctx.deps.state.query = cast(Query, ctx.deps.state.query).model_copy(update={"temporal_group_by": temporal_groups})
+    update_dict: dict[str, Any] = {"temporal_group_by": temporal_groups}
+    if cumulative:
+        update_dict["cumulative"] = cumulative
+    if order_by is not None:
+        update_dict["order_by"] = order_by
+
+    try:
+        ctx.deps.state.query = cast(Query, ctx.deps.state.query).model_copy(update=update_dict)
+    except ValidationError as e:
+        raise ModelRetry(str(e))
 
     return StateSnapshotEvent(
         type=EventType.STATE_SNAPSHOT,

orchestrator/search/aggregations/base.py

@@ -61,6 +61,11 @@ class TemporalGrouping(BaseModel):
         },
     )
 
+    @property
+    def alias(self) -> str:
+        """Return the SQL-friendly alias for this temporal grouping."""
+        return f"{BaseAggregation.field_to_alias(self.field)}_{self.period.value}"
+
     def get_pivot_fields(self) -> list[str]:
         """Return fields that need to be pivoted for this temporal grouping."""
         return [self.field]
@@ -83,8 +88,7 @@ class TemporalGrouping(BaseModel):
         col = getattr(pivot_cte_columns, field_alias)
         truncated_col = func.date_trunc(self.period.value, cast(col, TIMESTAMP(timezone=True)))
 
-        # Column name without prefix
-        col_name = f"{field_alias}_{self.period.value}"
+        col_name = self.alias
         select_col = truncated_col.label(col_name)
         return select_col, truncated_col, col_name
 

orchestrator/search/query/builder.py

@@ -25,6 +25,7 @@ from orchestrator.db.models import AiSearchIndex
 from orchestrator.search.aggregations import AggregationType, BaseAggregation, CountAggregation
 from orchestrator.search.core.types import EntityType, FieldType, FilterOp, UIType
 from orchestrator.search.filters import LtreeFilter
+from orchestrator.search.query.mixins import OrderDirection
 from orchestrator.search.query.queries import AggregateQuery, CountQuery, Query
 
 
@@ -181,7 +182,8 @@ def _build_pivot_cte(base_query: Select, pivot_fields: list[str]) -> CTE:
 
 
 def _build_grouping_columns(
-    query: CountQuery | AggregateQuery, pivot_cte: CTE
+    query: CountQuery | AggregateQuery,
+    pivot_cte: CTE,
 ) -> tuple[list[Any], list[Any], list[str]]:
     """Build GROUP BY columns and their SELECT columns.
 
@@ -244,6 +246,76 @@ def _build_aggregation_columns(query: CountQuery | AggregateQuery, pivot_cte: CT
     return [count_agg.to_expression(pivot_cte.c.entity_id)]
 
 
+def _apply_cumulative_aggregations(
+    stmt: Select,
+    query: CountQuery | AggregateQuery,
+    group_column_names: list[str],
+    aggregation_columns: list[Label],
+) -> Select:
+    """Add cumulative aggregation columns."""
+
+    # At this point, cumulative validation has already happened at query build time
+    # in GroupingMixin.validate_grouping_constraints, so we know:
+    # temporal_group_by exists and has exactly 1 element when cumulative=True
+    if not query.cumulative or not aggregation_columns or not query.temporal_group_by:
+        return stmt
+
+    temporal_alias = query.temporal_group_by[0].alias
+
+    base_subquery = stmt.subquery()
+    partition_cols = [base_subquery.c[name] for name in group_column_names if name != temporal_alias]
+    order_col = base_subquery.c[temporal_alias]
+
+    base_columns = [base_subquery.c[col] for col in base_subquery.c.keys()]
+
+    cumulative_columns = []
+    for agg_col in aggregation_columns:
+        cumulative_alias = f"{agg_col.key}_cumulative"
+        over_kwargs: dict[str, Any] = {"order_by": order_col}
+        if partition_cols:
+            over_kwargs["partition_by"] = partition_cols
+        cumulative_expr = func.sum(base_subquery.c[agg_col.key]).over(**over_kwargs).label(cumulative_alias)
+        cumulative_columns.append(cumulative_expr)
+
+    return select(*(base_columns + cumulative_columns)).select_from(base_subquery)
+
+
+def _apply_ordering(
+    stmt: Select,
+    query: CountQuery | AggregateQuery,
+    group_column_names: list[str],
+) -> Select:
+    """Apply ordering instructions to the SELECT statement."""
+    columns_by_key = {col.key: col for col in stmt.selected_columns}
+
+    if query.order_by:
+        order_expressions = []
+        for instruction in query.order_by:
+            # 1) exact match
+            col = columns_by_key.get(instruction.field)
+            if col is None:
+                # 2) temporal alias,
+                for tg in query.temporal_group_by or []:
+                    if instruction.field == tg.field or instruction.field == tg.alias:
+                        col = columns_by_key.get(tg.alias)
+                        if col is not None:
+                            break
+                if col is None:
+                    # 3) normalized field path
+                    col = columns_by_key.get(BaseAggregation.field_to_alias(instruction.field))
+            if col is None:
+                raise ValueError(f"Cannot order by '{instruction.field}'; column not found.")
+            order_expressions.append(col.desc() if instruction.direction == OrderDirection.DESC else col.asc())
+        return stmt.order_by(*order_expressions)
+
+    if query.temporal_group_by:
+        # Default ordering by all grouping columns (ascending)
+        order_expressions = [columns_by_key[col_name].asc() for col_name in group_column_names]
+        return stmt.order_by(*order_expressions)
+
+    return stmt
+
+
 def build_simple_count_query(base_query: Select) -> Select:
     """Build a simple count query without grouping.
 
@@ -282,7 +354,7 @@ def build_aggregation_query(query: CountQuery | AggregateQuery, base_query: Sele
     if group_cols:
         stmt = stmt.group_by(*group_cols)
 
-    if query.temporal_group_by:
-        stmt = stmt.order_by(*group_cols)
+    stmt = _apply_cumulative_aggregations(stmt, query, group_col_names, agg_cols)
+    stmt = _apply_ordering(stmt, query, group_col_names)
 
     return stmt, group_col_names

orchestrator/search/query/mixins.py

@@ -1,6 +1,8 @@
 import uuid
+from enum import Enum
+from typing import Self
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, model_validator
 
 from orchestrator.search.aggregations import Aggregation, TemporalGrouping
 
@@ -8,9 +10,28 @@ __all__ = [
     "SearchMixin",
     "GroupingMixin",
     "AggregationMixin",
+    "OrderBy",
+    "OrderDirection",
 ]
 
 
+class OrderDirection(str, Enum):
+    """Sorting direction for aggregation results."""
+
+    ASC = "asc"
+    DESC = "desc"
+
+
+class OrderBy(BaseModel):
+    """Ordering descriptor for aggregation responses."""
+
+    field: str = Field(description="Grouping or aggregation field/alias to order by.")
+    direction: OrderDirection = Field(
+        default=OrderDirection.ASC,
+        description="Sorting direction (asc or desc).",
+    )
+
+
 class SearchMixin(BaseModel):
     """Mixin providing text search capability.
 
@@ -59,6 +80,37 @@ class GroupingMixin(BaseModel):
         default=None,
         description="Temporal grouping specifications (group by month, year, etc.)",
     )
+    cumulative: bool = Field(
+        default=False,
+        description="Enable cumulative aggregations when temporal grouping is present.",
+    )
+    order_by: list[OrderBy] | None = Field(
+        default=None,
+        description="Ordering instructions for grouped aggregation results.",
+    )
+
+    @model_validator(mode="after")
+    def validate_grouping_constraints(self) -> Self:
+        """Validate cross-field constraints for grouping features."""
+        if self.order_by and not self.group_by and not self.temporal_group_by:
+            raise ValueError(
+                "order_by requires at least one grouping field (group_by or temporal_group_by). "
+                "Ordering only applies to grouped aggregation results."
+            )
+
+        if self.cumulative:
+            if not self.temporal_group_by:
+                raise ValueError(
+                    "cumulative requires at least one temporal grouping (temporal_group_by). "
+                    "Cumulative aggregations compute running totals over time."
+                )
+            if len(self.temporal_group_by) > 1:
+                raise ValueError(
+                    "cumulative currently supports only a single temporal grouping. "
+                    "Multiple temporal dimensions with running totals are not yet supported."
+                )
+
+        return self
 
     def get_pivot_fields(self) -> list[str]:
         """Get all fields needed for EAV pivot from grouping.
@@ -82,7 +134,10 @@ class AggregationMixin(BaseModel):
     Used by AGGREGATE queries to define what statistics to compute.
     """
 
-    aggregations: list[Aggregation] = Field(description="Aggregations to compute (SUM, AVG, MIN, MAX, COUNT)")
+    aggregations: list[Aggregation] = Field(
+        description="Aggregations to compute (SUM, AVG, MIN, MAX, COUNT)",
+        min_length=1,
+    )
 
     def get_aggregation_pivot_fields(self) -> list[str]:
         """Get fields needed for EAV pivot from aggregations.

orchestrator/search/query/queries.py

@@ -13,7 +13,7 @@
 
 from typing import Annotated, Any, ClassVar, Literal, Self, Union
 
-from pydantic import BaseModel, ConfigDict, Discriminator, Field
+from pydantic import BaseModel, ConfigDict, Discriminator, Field, model_validator
 
 from orchestrator.search.core.types import ActionType, EntityType
 from orchestrator.search.filters import FilterTree
@@ -112,6 +112,20 @@ class AggregateQuery(BaseQuery, GroupingMixin, AggregationMixin):
     query_type: Literal["aggregate"] = "aggregate"
     _action: ClassVar[ActionType] = ActionType.AGGREGATE
 
+    @model_validator(mode="after")
+    def validate_cumulative_aggregation_types(self) -> Self:
+        """Validate that cumulative is only used with COUNT and SUM aggregations."""
+        if self.cumulative:
+            from orchestrator.search.aggregations import AggregationType
+
+            for agg in self.aggregations:
+                if agg.type in (AggregationType.AVG, AggregationType.MIN, AggregationType.MAX):
+                    raise ValueError(
+                        f"Cumulative aggregations are not supported for {agg.type.value.upper()} aggregations. "
+                        f"Cumulative only works with COUNT and SUM."
+                    )
+        return self
+
     def get_pivot_fields(self) -> list[str]:
         """Get all fields needed for EAV pivot including aggregation fields."""
         # Get grouping fields from GroupingMixin

orchestrator/search/query/validation.py

@@ -31,6 +31,7 @@ from orchestrator.search.query.exceptions import (
     InvalidLtreePatternError,
     PathNotFoundError,
 )
+from orchestrator.search.query.mixins import OrderBy
 
 
 def is_filter_compatible_with_field_type(filter_condition: FilterCondition, field_type: FieldType) -> bool:
@@ -207,3 +208,45 @@ def validate_temporal_grouping_field(field_path: str) -> None:
     # Validate field type is datetime
     if field_type_str != FieldType.DATETIME.value:
         raise IncompatibleTemporalGroupingTypeError(field_path, field_type_str)
+
+
+def validate_grouping_fields(group_by_paths: list[str]) -> None:
+    """Validate that all grouping field paths exist in the database.
+
+    Args:
+        group_by_paths: List of field paths to group by
+
+    Raises:
+        PathNotFoundError: If any path doesn't exist in the database
+    """
+    for path in group_by_paths:
+        field_type = validate_filter_path(path)
+        if field_type is None:
+            raise PathNotFoundError(path)
+
+
+def validate_order_by_fields(order_by: list[OrderBy] | None) -> None:
+    """Validate that order_by field paths exist in the database.
+
+    Args:
+        order_by: List of ordering instructions, or None
+
+    Raises:
+        PathNotFoundError: If a field path doesn't exist in the database
+
+    Note:
+        Only validates fields that appear to be paths (contain dots).
+        Aggregation aliases (no dots, like 'count') are skipped as they
+        cannot be validated until query execution time.
+    """
+    if order_by is None:
+        return
+
+    for order_instr in order_by:
+        # Skip aggregation aliases (no dots, e.g., 'count', 'revenue')
+        if "." not in order_instr.field:
+            continue
+
+        field_type = validate_filter_path(order_instr.field)
+        if field_type is None:
+            raise PathNotFoundError(order_instr.field)

orchestrator/settings.py

@@ -17,10 +17,13 @@ from pathlib import Path
 from typing import Literal
 
 from pydantic import Field, NonNegativeInt, PostgresDsn, RedisDsn
+from pydantic.main import BaseModel
 from pydantic_settings import BaseSettings
 
+from oauth2_lib.fastapi import OIDCUserModel
 from oauth2_lib.settings import oauth2lib_settings
 from orchestrator.services.settings_env_variables import expose_settings
+from orchestrator.utils.auth import Authorizer
 from orchestrator.utils.expose_settings import SecretStr as OrchSecretStr
 from pydantic_forms.types import strEnum
 
@@ -111,3 +114,48 @@ if app_settings.EXPOSE_SETTINGS:
     expose_settings("app_settings", app_settings)  # type: ignore
 if app_settings.EXPOSE_OAUTH_SETTINGS:
     expose_settings("oauth2lib_settings", oauth2lib_settings)  # type: ignore
+
+
+class Authorizers(BaseModel):
+    # Callbacks specifically for orchestrator-core callbacks.
+    # Separate from defaults for user-defined workflows and steps.
+    internal_authorize_callback: Authorizer | None = None
+    internal_retry_auth_callback: Authorizer | None = None
+
+    async def authorize_callback(self, user: OIDCUserModel | None) -> bool:
+        """This is the authorize_callback to be registered for workflows defined within orchestrator-core.
+
+        If Authorizers.internal_authorize_callback is None, this function will return True.
+        i.e. any user will be authorized to start internal workflows.
+        """
+        if self.internal_authorize_callback is None:
+            return True
+        return await self.internal_authorize_callback(user)
+
+    async def retry_auth_callback(self, user: OIDCUserModel | None) -> bool:
+        """This is the retry_auth_callback to be registered for workflows defined within orchestrator-core.
+
+        If Authorizers.internal_retry_auth_callback is None, this function will return True.
+        i.e. any user will be authorized to retry internal workflows on failure.
+        """
+        if self.internal_retry_auth_callback is None:
+            return True
+        return await self.internal_retry_auth_callback(user)
+
+
+_authorizers = Authorizers()
+
+
+def get_authorizers() -> Authorizers:
+    """Acquire singleton of app authorizers to assign these callbacks at app setup.
+
+    Ensures downstream users can acquire singleton without being tempted to do
+    from orchestrator.settings import authorizers
+    authorizers = my_authorizers
+    or
+    from orchestrator import settings
+    settings.authorizers = my_authorizers
+
+    ...each of which goes wrong in its own way.
+    """
+    return _authorizers

orchestrator/workflows/modify_note.py

@@ -13,6 +13,7 @@
 from orchestrator.db import db
 from orchestrator.forms import SubmitFormPage
 from orchestrator.services import subscriptions
+from orchestrator.settings import get_authorizers
 from orchestrator.targets import Target
 from orchestrator.utils.json import to_serializable
 from orchestrator.workflow import StepList, done, init, step, workflow
@@ -21,6 +22,8 @@ from orchestrator.workflows.utils import wrap_modify_initial_input_form
 from pydantic_forms.types import FormGenerator, State, UUIDstr
 from pydantic_forms.validators import LongText
 
+authorizers = get_authorizers()
+
 
 def initial_input_form(subscription_id: UUIDstr) -> FormGenerator:
     subscription = subscriptions.get_subscription(subscription_id)
@@ -51,6 +54,12 @@ def store_subscription_note(subscription_id: UUIDstr, note: str) -> State:
     }
 
 
-@workflow("Modify Note", initial_input_form=wrap_modify_initial_input_form(initial_input_form), target=Target.MODIFY)
+@workflow(
+    "Modify Note",
+    initial_input_form=wrap_modify_initial_input_form(initial_input_form),
+    target=Target.MODIFY,
+    authorize_callback=authorizers.authorize_callback,
+    retry_auth_callback=authorizers.retry_auth_callback,
+)
 def modify_note() -> StepList:
     return init >> store_process_subscription() >> store_subscription_note >> done

orchestrator/workflows/removed_workflow.py

@@ -12,11 +12,18 @@
 # limitations under the License.
 
 
+from orchestrator.settings import get_authorizers
 from orchestrator.workflow import StepList, workflow
 
+authorizers = get_authorizers()
+
 
 # This workflow has been made to create the initial import process for a SN7 subscription
 # it does not do anything but is needed for the correct showing in the GUI.
-@workflow("Dummy workflow to replace removed workflows")
+@workflow(
+    "Dummy workflow to replace removed workflows",
+    authorize_callback=authorizers.authorize_callback,
+    retry_auth_callback=authorizers.retry_auth_callback,
+)
 def removed_workflow() -> StepList:
     return StepList()

orchestrator/workflows/tasks/cleanup_tasks_log.py

@@ -17,12 +17,14 @@ from datetime import timedelta
 from sqlalchemy import select
 
 from orchestrator.db import ProcessTable, db
-from orchestrator.settings import app_settings
+from orchestrator.settings import app_settings, get_authorizers
 from orchestrator.targets import Target
 from orchestrator.utils.datetime import nowtz
 from orchestrator.workflow import ProcessStatus, StepList, done, init, step, workflow
 from pydantic_forms.types import State
 
+authorizers = get_authorizers()
+
 
 @step("Clean up completed tasks older than TASK_LOG_RETENTION_DAYS")
 def remove_tasks() -> State:
@@ -41,6 +43,11 @@ def remove_tasks() -> State:
     return {"tasks_removed": count}
 
 
-@workflow("Clean up old tasks", target=Target.SYSTEM)
+@workflow(
+    "Clean up old tasks",
+    target=Target.SYSTEM,
+    authorize_callback=authorizers.authorize_callback,
+    retry_auth_callback=authorizers.retry_auth_callback,
+)
 def task_clean_up_tasks() -> StepList:
     return init >> remove_tasks >> done

orchestrator/workflows/tasks/resume_workflows.py

@@ -17,10 +17,12 @@ from sqlalchemy import select
 
 from orchestrator.db import ProcessTable, db
 from orchestrator.services import processes
+from orchestrator.settings import get_authorizers
 from orchestrator.targets import Target
 from orchestrator.workflow import ProcessStatus, StepList, done, init, step, workflow
 from pydantic_forms.types import State, UUIDstr
 
+authorizers = get_authorizers()
 logger = structlog.get_logger(__name__)
 
 
@@ -110,6 +112,8 @@ def restart_created_workflows(created_state_process_ids: list[UUIDstr]) -> State
 @workflow(
     "Resume all workflows that are stuck on tasks with the status 'waiting', 'created' or 'resumed'",
     target=Target.SYSTEM,
+    authorize_callback=authorizers.authorize_callback,
+    retry_auth_callback=authorizers.retry_auth_callback,
 )
 def task_resume_workflows() -> StepList:
     return init >> find_waiting_workflows >> resume_found_workflows >> restart_created_workflows >> done

orchestrator/workflows/tasks/validate_product_type.py

@@ -25,10 +25,12 @@ from orchestrator.services.workflows import (
     get_validation_product_workflows_for_subscription,
     start_validation_workflow_for_workflows,
 )
+from orchestrator.settings import get_authorizers
 from orchestrator.targets import Target
 from orchestrator.workflow import StepList, done, init, step, workflow
 from pydantic_forms.types import FormGenerator, State
 
+authorizers = get_authorizers()
 logger = structlog.get_logger(__name__)
 
 
@@ -86,7 +88,11 @@ def validate_product_type(product_type: str) -> State:
 
 
 @workflow(
-    "Validate all subscriptions of Product Type", target=Target.SYSTEM, initial_input_form=initial_input_form_generator
+    "Validate all subscriptions of Product Type",
+    target=Target.SYSTEM,
+    initial_input_form=initial_input_form_generator,
+    authorize_callback=authorizers.authorize_callback,
+    retry_auth_callback=authorizers.retry_auth_callback,
 )
 def task_validate_product_type() -> StepList:
     return init >> validate_product_type >> done

orchestrator/workflows/tasks/validate_products.py

@@ -26,12 +26,15 @@ from orchestrator.services import products
 from orchestrator.services.products import get_products
 from orchestrator.services.translations import generate_translations
 from orchestrator.services.workflows import get_workflow_by_name, get_workflows
+from orchestrator.settings import get_authorizers
 from orchestrator.targets import Target
 from orchestrator.utils.errors import ProcessFailureError
 from orchestrator.utils.fixed_inputs import fixed_input_configuration as fi_configuration
 from orchestrator.workflow import StepList, done, init, step, workflow
 from pydantic_forms.types import State
 
+authorizers = get_authorizers()
+
 # Since these errors are probably programming failures we should not throw AssertionErrors
 
 
@@ -187,7 +190,12 @@ def check_subscription_models() -> State:
     return {"check_subscription_models": True}
 
 
-@workflow("Validate products", target=Target.SYSTEM)
+@workflow(
+    "Validate products",
+    target=Target.SYSTEM,
+    authorize_callback=authorizers.authorize_callback,
+    retry_auth_callback=authorizers.retry_auth_callback,
+)
 def task_validate_products() -> StepList:
     return (
         init

orchestrator/workflows/tasks/validate_subscriptions.py

@@ -24,7 +24,7 @@ from orchestrator.services.workflows import (
     get_validation_product_workflows_for_subscription,
     start_validation_workflow_for_workflows,
 )
-from orchestrator.settings import app_settings
+from orchestrator.settings import app_settings, get_authorizers
 from orchestrator.targets import Target
 from orchestrator.workflow import StepList, init, step, workflow
 
@@ -33,6 +33,8 @@ logger = structlog.get_logger(__name__)
 
 task_semaphore = BoundedSemaphore(value=2)
 
+authorizers = get_authorizers()
+
 
 @step("Validate subscriptions")
 def validate_subscriptions() -> None:
@@ -56,6 +58,11 @@ def validate_subscriptions() -> None:
         start_validation_workflow_for_workflows(subscription=subscription, workflows=validation_product_workflows)
 
 
-@workflow("Validate subscriptions", target=Target.SYSTEM)
+@workflow(
+    "Validate subscriptions",
+    target=Target.SYSTEM,
+    authorize_callback=authorizers.authorize_callback,
+    retry_auth_callback=authorizers.retry_auth_callback,
+)
 def task_validate_subscriptions() -> StepList:
     return init >> validate_subscriptions

{orchestrator_core-4.7.0rc1.dist-info → orchestrator_core-4.7.0rc2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orchestrator-core
-Version: 4.7.0rc1
+Version: 4.7.0rc2
 Summary: This is the orchestrator workflow engine.
 Author-email: SURF <automation-beheer@surf.nl>
 Requires-Python: >=3.11,<3.15
@@ -57,8 +57,8 @@ Requires-Dist: pytz==2025.2
 Requires-Dist: redis==7.1.0
 Requires-Dist: semver==3.0.4
 Requires-Dist: sentry-sdk[fastapi]>=2.29.1
-Requires-Dist: sqlalchemy==2.0.44
-Requires-Dist: sqlalchemy-utils==0.42.0
+Requires-Dist: sqlalchemy==2.0.45
+Requires-Dist: sqlalchemy-utils==0.42.1
 Requires-Dist: strawberry-graphql>=0.281.0,<0.285.0
 Requires-Dist: structlog>=25.4.0
 Requires-Dist: tabulate==0.9.0

{orchestrator_core-4.7.0rc1.dist-info → orchestrator_core-4.7.0rc2.dist-info}/RECORD

@@ -1,12 +1,12 @@
-orchestrator/__init__.py,sha256=HWuhzwoxPlAnuAGVtn9GBpZS5X185yqB_j-WnUzXnVE,1457
+orchestrator/__init__.py,sha256=g60P7OYq7nfuo0jdDTrWSn_bkOtIRZqRdU_opGAR1aQ,1457
 orchestrator/agentic_app.py,sha256=ouiyyZiS4uS6Lox2DtbGGRnb2njJBMSHpSAGe-T5rX0,3028
-orchestrator/app.py,sha256=w8ubXaaogwjmwLM0TXqZaLkAhmaOTWzVlwiYbi5mHeE,13203
+orchestrator/app.py,sha256=5ITGSN_KeRi2qTvfwBXhjOGNyWNy-rdtzfOLEk76ZtY,14661
 orchestrator/exception_handlers.py,sha256=UsW3dw8q0QQlNLcV359bIotah8DYjMsj2Ts1LfX4ClY,1268
-orchestrator/llm_settings.py,sha256=giqxZmwO8sXyNF5Zc7-O9JYd7PLN065pKQYpJYOpXcE,2816
+orchestrator/llm_settings.py,sha256=Rk5yBTmMAhyTcBVucQwzV2qBGTs-zZss76687cHy8tA,2815
 orchestrator/log_config.py,sha256=aCbIzKzDnVwF0zVoQ9TlvuHxn0uhJWRjNL72Hc5pcss,2031
 orchestrator/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 orchestrator/security.py,sha256=iXFxGxab54aav7oHEKLAVkTgrQMJGHy6IYLojEnD7gI,2422
-orchestrator/settings.py,sha256=mvs1VhBYth6Zp55HsNroML4DU1jiq5SkVM47_BLgcIo,4662
+orchestrator/settings.py,sha256=Xn9SC8omh3rHhp-1bIyYHhwbu-rpvbqauBFPTLGhYic,6562
 orchestrator/targets.py,sha256=d7Fyh_mWIWPivA_E7DTNFpZID3xFW_K0JlZ5nksVX7k,830
 orchestrator/types.py,sha256=qzs7xx5AYRmKbpYRyJJP3wuDb0W0bcAzefCN0RWLAco,15459
 orchestrator/version.py,sha256=b58e08lxs47wUNXv0jXFO_ykpksmytuzEXD4La4W-NQ,1366
@@ -41,7 +41,7 @@ orchestrator/cli/migrate_domain_models.py,sha256=WRXy_1OnziQwpsCFZXvjB30nDJtjj0i
 orchestrator/cli/migrate_tasks.py,sha256=bju8XColjSZD0v3rS4kl-24dLr8En_H4-6enBmqd494,7255
 orchestrator/cli/migrate_workflows.py,sha256=nxUpx0vgEIc_8aJrjAyrw3E9Dt8JmaamTts8oiQ4vHY,8923
 orchestrator/cli/migration_helpers.py,sha256=C5tpkP5WEBr7G9S-1k1hgSI8ili6xd9Z5ygc9notaK0,4110
-orchestrator/cli/scheduler.py,sha256=U-YLa_SkwGVAf7jQ8EQugtwTuycw3DtXhmCxlMpiQqQ,4396
+orchestrator/cli/scheduler.py,sha256=kCHKAXnVWDgmzgIaIBYHop0vE2Isi22KFH3W7d8Yyi4,5805
 orchestrator/cli/domain_gen_helpers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 orchestrator/cli/domain_gen_helpers/fixed_input_helpers.py,sha256=uzpwsaau81hHSxNMOS9-o7kF-9_78R0f_UE0AvWooZQ,6775
 orchestrator/cli/domain_gen_helpers/helpers.py,sha256=tIPxn8ezED_xYZxH7ZAtQLwkDc6RNmLZVxWAoJ3a9lw,4203
@@ -196,7 +196,7 @@ orchestrator/graphql/schemas/customer_description.py,sha256=fize71IMpkvk_rTzcqCY
 orchestrator/graphql/schemas/errors.py,sha256=VRl-Zd1FHMnscyozhfxzqeEUZ0ERAWum_Y8YwjGxwmA,203
 orchestrator/graphql/schemas/fixed_input.py,sha256=1yqYHADQRgHz8OIP7ObYsPFS-gmzfkCvEO0a-KKf7zI,513
 orchestrator/graphql/schemas/helpers.py,sha256=Kpj4kIbmoKKN35bdgUSwQvGUIbeg7VJAVMEq65YS_ik,346
-orchestrator/graphql/schemas/process.py,sha256=APARniusSdqHkXann2oHp72PBE-nslQcLTQQaFFLiG4,4912
+orchestrator/graphql/schemas/process.py,sha256=2TJq5MTrHW3NtlImuTiIJZm8GTTzS8msWgB_k_-rPhc,4924
 orchestrator/graphql/schemas/product.py,sha256=vUCqcjrKBJj-VKSrMYPKzjmmxLMXL7alKTJ8UdUkhTg,4342
 orchestrator/graphql/schemas/product_block.py,sha256=Qk9cbA6vm7ZPrhdgPHatKRuy6TytBmxSr97McEOxAu8,2860
 orchestrator/graphql/schemas/resource_type.py,sha256=s5d_FwQXL2-Sc-IDUxTJun5qFQ4zOP4-XcHF9ql-t1g,898
@@ -230,9 +230,9 @@ orchestrator/migrations/templates/alembic.ini.j2,sha256=8v7UbKvOiWEbEKQa-Au3uONK
 orchestrator/migrations/templates/env.py.j2,sha256=LIt0ildZTZvNEx3imhy4GNzfFi_rPZg-8H7rGgrBOP8,2717
 orchestrator/migrations/templates/helpers.py.j2,sha256=3MWNMICGrcQFObyBQefL-FPjoVKUgP0QIlbk4TdMZds,98
 orchestrator/migrations/versions/schema/2020-10-19_3323bcb934e7_fix_tsv_triggers.py,sha256=ufe6OFUELNpx6N2663bvdwgB4lP-v71fuMuJtx9CmJc,2698
-orchestrator/migrations/versions/schema/2020-10-19_a76b9185b334_add_generic_workflows_to_core.py,sha256=EHj87IXucruyB8KuxEWcc7JK1NIizZ5Jzmj-bzY0t1Y,1265
+orchestrator/migrations/versions/schema/2020-10-19_a76b9185b334_add_generic_workflows_to_core.py,sha256=3MP7cY_znFbC-dTdf8us7Dn8Fn7g1D_ROCrxrlRzfx0,1384
 orchestrator/migrations/versions/schema/2020-10-19_c112305b07d3_initial_schema_migration.py,sha256=-_dEwEXbl1E2HQpdcigMsSsq6H98eRcmaE8g5NR36iE,39291
-orchestrator/migrations/versions/schema/2021-04-06_3c8b9185c221_add_validate_products_task.py,sha256=rLuEl8WuQHcwmOBZdADbgCBqzJ5EZ4KWXrTVwXrRyx4,950
+orchestrator/migrations/versions/schema/2021-04-06_3c8b9185c221_add_validate_products_task.py,sha256=BVPkhxz8E_eEM4T1toujSdVWhmR_klZEqN3DUpQDaus,1069
 orchestrator/migrations/versions/schema/2021-07-01_6896a54e9483_add_product_block_relations.py,sha256=xw01x5YTNDDxZiMUCeBPuzp0LKsKeMMR4YWF2aWI9ZI,1214
 orchestrator/migrations/versions/schema/2021-11-17_19cdd3ab86f6_fix_parse_websearch.py,sha256=FUWxAPpi32SgowU_WdZiC903BbLUA5zktBICOi4ecpQ,1603
 orchestrator/migrations/versions/schema/2022-02-16_bed6bc0b197a_rename_parent_and_child_block_relations.py,sha256=2hiV8aFwlcgRQ7EFVvGhV13j2j-p7cMLadyUfXezIF8,5106
@@ -258,10 +258,11 @@ orchestrator/migrations/versions/schema/2025-05-08_161918133bec_add_is_task_to_w
 orchestrator/migrations/versions/schema/2025-07-01_93fc5834c7e5_changed_timestamping_fields_in_process_steps.py,sha256=Oezd8b2qaI1Kyq-sZFVFmdzd4d9NjXrf6HtJGk11fy0,1914
 orchestrator/migrations/versions/schema/2025-07-04_4b58e336d1bf_deprecating_workflow_target_in_.py,sha256=xnD6w-97R4ClS7rbmXQEXc36K3fdcXKhCy7ZZNy_FX4,742
 orchestrator/migrations/versions/schema/2025-07-28_850dccac3b02_update_description_of_resume_workflows_.py,sha256=R6Qoga83DJ1IL0WYPu0u5u2ZvAmqGlDmUMv_KtJyOhQ,812
-orchestrator/migrations/versions/schema/2025-11-18_961eddbd4c13_create_linker_table_workflow_apscheduler.py,sha256=wJ01G2fpph9gYq0haeYRoSD21cTLOdn41axCSMyWV8o,3109
-orchestrator/schedules/__init__.py,sha256=WNjy4D4QdOKJh6ZEHJ119tXL1xJ3L7kMPuJWYnayjtE,868
+orchestrator/migrations/versions/schema/2025-11-18_961eddbd4c13_create_linker_table_workflow_apscheduler.py,sha256=Vy2qA8wb_lQWExhF0PX_IFwCr_vafe9uaT1pXvCwbGI,3227
+orchestrator/migrations/versions/schema/2025-12-10_9736496e3eba_set_is_task_true_on_certain_tasks.py,sha256=2DOERJ7QF83o-goxJPtz0FUC3xZAt5ms8miadFGVFcw,1007
+orchestrator/schedules/__init__.py,sha256=i8sT88A3v_5KIfwbKZxe3rS2rMakOuqfAis0DRmBleU,1017
 orchestrator/schedules/scheduler.py,sha256=8o7DoVs9Q1Q231FVMpv3tXtKbaydeNkYQ1h6kl7U1X4,7198
-orchestrator/schedules/scheduling.py,sha256=_mbpHMhijey8Y56ebtJ4wVkrp_kPVRm8hoByzlQF4SE,2821
+orchestrator/schedules/scheduling.py,sha256=1lSeAhKRGhZNOtFiB-FPMeo3bEIDpt9OdJKBkk7QknI,2914
 orchestrator/schedules/service.py,sha256=CYWb_gB5Dw57AIiQtSVcLW4sEE69zNoWGuSe2WEIj_8,8940
 orchestrator/schedules/validate_products.py,sha256=_ucUG9HecskG2eN3tcDSiMzJK9gN3kZB1dXjrtxcApY,1324
 orchestrator/schemas/__init__.py,sha256=YDyZ0YBvzB4ML9oDBCBPGnBvf680zFFgUzg7X0tYBRY,2326
@@ -285,12 +286,12 @@ orchestrator/search/agent/__init__.py,sha256=_O4DN0MSTUtr4olhyE0-2hsb7x3f_KURMCY
 orchestrator/search/agent/agent.py,sha256=iWa4_achqh5zRIfcJvjmY3hmDuFVGpV_PxjgttLdokU,2075
 orchestrator/search/agent/handlers.py,sha256=z1KqeUUn7cYNBW39femwYnZOqRiYm1885Cx4TWVNyCY,4476
 orchestrator/search/agent/json_patch.py,sha256=_Z5ULhLyeuOuy-Gr_DJR4eA-wo9F78qySKUt5F_SQvQ,1892
-orchestrator/search/agent/prompts.py,sha256=aNxdJz7M1RPg_Py5v3Wvc2Kzo_tshkfHqNlF6S7YQv4,6975
+orchestrator/search/agent/prompts.py,sha256=3Bo1Pc2iasGvifwpmvmd3S-kE07fTO4uZ6wp7VmoLM8,7562
 orchestrator/search/agent/state.py,sha256=YBrpHb8ok2RPwoLwBUWHYaGms_uj6nz51le2vbDjJwA,1113
-orchestrator/search/agent/tools.py,sha256=hMovAKJ03EKsmGbdS363kbx1-BX4YJB6MsQUzZkEA38,17144
+orchestrator/search/agent/tools.py,sha256=WwJVvl_P4BM5Bf0niS1H0lvlojdSoSb1AbIWBbtBZRY,18727
 orchestrator/search/agent/validation.py,sha256=-U7g9Tgw6wH_tli0X0wrVKmiP9Id08sISq3kRrJjFNQ,2926
 orchestrator/search/aggregations/__init__.py,sha256=Re5XDxvbRCT5DUFTQbHeDCyync1RL7yHh-D3Bm28CXg,921
-orchestrator/search/aggregations/base.py,sha256=8zIdZx9cLxgFg6PePHzUNdMhHejPpb-hKL6lirDJlyQ,6916
+orchestrator/search/aggregations/base.py,sha256=jC06rzecurlzIxh7RCctFgsaPxU1sGCamgM7u6pzhJw,7051
 orchestrator/search/core/__init__.py,sha256=q5G0z3nKjIHKFs1PkEG3nvTUy3Wp4kCyBtCbqUITj3A,579
 orchestrator/search/core/embedding.py,sha256=n16H5fZRlfn91wI8PfZPa1R39HwQd8T1nwlDOzcOUBU,2823
 orchestrator/search/core/exceptions.py,sha256=S_ZMEhrqsQBVqJ559FQ5J6tZU6BYLiU65AGWgSvgv_k,1159
@@ -310,15 +311,15 @@ orchestrator/search/indexing/registry.py,sha256=V6Q4aRXHON1gSE6wsavEIfwHwCPicSzF
 orchestrator/search/indexing/tasks.py,sha256=0p68RNwJnHSGZQjfdpyFsS2Ma5Gr2PpZROZgal_R1wI,3064
 orchestrator/search/indexing/traverse.py,sha256=JLut9t4LoPCWhJ_63VgYhRKfjwyxRv-mTbQLC8mA_mU,15158
 orchestrator/search/query/__init__.py,sha256=nCjvK_n2WQdV_ACrncFXEfnvLcHtuI__J7KLlFIaQvo,2437
-orchestrator/search/query/builder.py,sha256=ob92J0jQ_bn86Dhl_3k0_cOL7C5PmcXdmpOKeqw4Pz4,10228
+orchestrator/search/query/builder.py,sha256=EfDSSOQKUBNtUESDBsKaPY6hZ_iDXAwc3qcNR4AGAEg,13261
 orchestrator/search/query/engine.py,sha256=TFdV_sSoSXCSDSpyhVA2S6YaJysDSW2WtPj7duAyomk,5745
 orchestrator/search/query/exceptions.py,sha256=DrkNzXVbQAOi28FTHKimf_eTrXmhYwXrH986QhfQLPU,4941
 orchestrator/search/query/export.py,sha256=_0ncVpTqN6AoQfW3WX0fWnDQX3hBz6ZGC31Beu4PVwQ,6678
-orchestrator/search/query/mixins.py,sha256=BdVDzCOFDXT6N9LI_WrbVzGrk61UNplX-UZPvD0rEV0,3019
-orchestrator/search/query/queries.py,sha256=j1uKSQgF_ifVaDJaxjs4h2z48KqGVEIKCXOoJ7Ur9Mk,3805
+orchestrator/search/query/mixins.py,sha256=IUtN8QEowTNntk_MiiaaRxJS_QNxOXYmfiiOwzWuYZA,4939
+orchestrator/search/query/queries.py,sha256=0jF97cU2Z98-oWm1Iyqf3xIgrmc7FcWAPTb51tUG4MA,4506
 orchestrator/search/query/results.py,sha256=5OgAs39oncDIBdpB3NJltPr-UvLvLlxTWw9sn-lyfQA,10989
 orchestrator/search/query/state.py,sha256=fMSBJs39kZTkpDE2T4h4x0x-51GqUvzAuePg2YUbO6I,3220
-orchestrator/search/query/validation.py,sha256=m0xJ71A0Qa5hm8b71zKRjSVpPrnkG7LbqPu4lv_GboI,8260
+orchestrator/search/query/validation.py,sha256=Pprv40yvpynL1-MCFE1YuouguYW6lfh1PZKsVei2i6w,9622
 orchestrator/search/retrieval/__init__.py,sha256=q5G0z3nKjIHKFs1PkEG3nvTUy3Wp4kCyBtCbqUITj3A,579
 orchestrator/search/retrieval/pagination.py,sha256=kcUzq1QQk4GrZq02M4hsKwAelUo1qDeCqsXImLUK6DA,3006
 orchestrator/search/retrieval/retrievers/__init__.py,sha256=dJlN6a0oHSquzjE5POYxrMGOXMx4Bx2khbJI-rA_qwg,971
@@ -371,18 +372,18 @@ orchestrator/websocket/websocket_manager.py,sha256=hwlG9FDXcNU42jDNNsPMQLIyrvEpG
 orchestrator/websocket/managers/broadcast_websocket_manager.py,sha256=fwoSgTjkHJ2GmsLTU9dqQpAA9i8b1McPu7gLNzxtfG4,5401
 orchestrator/websocket/managers/memory_websocket_manager.py,sha256=lF5EEx1iFMCGEkTbItTDr88NENMSaSeG1QrJ7teoPkY,3324
 orchestrator/workflows/__init__.py,sha256=FbwcAYJh8oSi0QFjXXXomdl9c8whCa_qSt_vPXcwasE,4216
-orchestrator/workflows/modify_note.py,sha256=eXt5KQvrkOXf-3YEXCn2XbBLP9N-n1pUYRW2t8Odupo,2150
-orchestrator/workflows/removed_workflow.py,sha256=V0Da5TEdfLdZZKD38ig-MTp3_IuE7VGqzHHzvPYQmLI,909
+orchestrator/workflows/modify_note.py,sha256=WFK3rA3Cmpk2_kOUP3xDfe9OI5LuQGv09tRAoTVKaR4,2360
+orchestrator/workflows/removed_workflow.py,sha256=fwi1-aC1KQvb08hq8St-_lWOLM_tjTcQMLJ_Fjdn2M8,1111
 orchestrator/workflows/steps.py,sha256=VVLRK9_7KzrBlnK7L8eSmRMNVOO7VJBh5OSjHQHM9fU,7019
 orchestrator/workflows/utils.py,sha256=VUCDoIl5XAKtIeAJpVpyW2pCIg3PoVWfwGn28BYlYhA,15424
 orchestrator/workflows/tasks/__init__.py,sha256=GyHNfEFCGKQwRiN6rQmvSRH2iYX7npjMZn97n8XzmLU,571
-orchestrator/workflows/tasks/cleanup_tasks_log.py,sha256=BfWYbPXhnLAHUJ0mlODDnjZnQQAvKCZJDVTwbwOWI04,1624
-orchestrator/workflows/tasks/resume_workflows.py,sha256=T3iobSJjVgiupe0rClD34kUZ7KF4pL5yK2AVeRLZog8,4313
-orchestrator/workflows/tasks/validate_product_type.py,sha256=lo2TX_MZOfcOmYFjLyD82FrJ5AAN3HOsE6BhDVFuy9Q,3210
-orchestrator/workflows/tasks/validate_products.py,sha256=GZJBoFF-WMphS7ghMs2-gqvV2iL1F0POhk0uSNt93n0,8510
-orchestrator/workflows/tasks/validate_subscriptions.py,sha256=OZtqO6aJR4KwEFvBioV2gWAjmyLiWxe9Wlps3YmFh9w,2200
+orchestrator/workflows/tasks/cleanup_tasks_log.py,sha256=FOcYfyH-dsNAilmW8ynEpz5zaKzlHNYJfDtIUqfrztQ,1797
+orchestrator/workflows/tasks/resume_workflows.py,sha256=OvYFY-Nun885ZAzcFp6hphvYtRy3VkdUgiGIU5TapZ0,4507
+orchestrator/workflows/tasks/validate_product_type.py,sha256=KoDMqROGVQ0ZPu69jMFO7cto8j0xi11h0_IeBOcV94A,3413
+orchestrator/workflows/tasks/validate_products.py,sha256=lCAXmCVhohgrdgJn7-d7fIxPj4MVOX0J8KezcvwIK3k,8716
+orchestrator/workflows/tasks/validate_subscriptions.py,sha256=lMAwaEVhZ1FD91Sw2eIjTc4hmGxQX3DgbJPYdJ1_dmw,2373
 orchestrator/workflows/translations/en-GB.json,sha256=ObBlH9XILJ9uNaGcJexi3IB0e6P8CKFKRgu29luIEM8,973
-orchestrator_core-4.7.0rc1.dist-info/licenses/LICENSE,sha256=b-aA5OZQuuBATmLKo_mln8CQrDPPhg3ghLzjPjLn4Tg,11409
-orchestrator_core-4.7.0rc1.dist-info/WHEEL,sha256=G2gURzTEtmeR8nrdXUJfNiB3VYVxigPQ-bEQujpNiNs,82
-orchestrator_core-4.7.0rc1.dist-info/METADATA,sha256=usMBg-ktGcbAy1WVADeof9gd_oBI4OQg2fPJfOhv60A,6421
-orchestrator_core-4.7.0rc1.dist-info/RECORD,,
+orchestrator_core-4.7.0rc2.dist-info/licenses/LICENSE,sha256=b-aA5OZQuuBATmLKo_mln8CQrDPPhg3ghLzjPjLn4Tg,11409
+orchestrator_core-4.7.0rc2.dist-info/WHEEL,sha256=G2gURzTEtmeR8nrdXUJfNiB3VYVxigPQ-bEQujpNiNs,82
+orchestrator_core-4.7.0rc2.dist-info/METADATA,sha256=t5QOCqYRtJbaUgsAdnnxJ-9Eqh0TkICB5oAlmswWDHs,6421
+orchestrator_core-4.7.0rc2.dist-info/RECORD,,