Reorder workspace section tabs into a consistent order of operations

[paullizer]

Summary

Workspace section tabs are ordered inconsistently across surfaces, and the current order doesn't communicate any order of operations. Users and admins tell us they don't understand that Identities feed both Sync and Actions, that Actions belong to Agents, or that Workflows consume Agents.

Current state

Surface	Order
Personal tabs (workspace.html)	Documents, Sync, Identities, Prompts, Agents, Actions, Workflows, Endpoints
Personal Section dropdown	Documents, Sync, Identities, Prompts, Agents, Actions, Workflows, Endpoints
Personal sidebar submenu	Documents, Prompts, Workflows, Agents, Actions, Endpoints, Sync, Identities
Group tabs (group_workspaces.html)	Documents, Sync, Identities, Prompts, Workflows, Agents, Actions, Endpoints
Group Section dropdown	Documents, Sync, Identities, Prompts, Workflows, Agents, Actions, Endpoints
Group sidebar submenu	Documents, Prompts, Agents, Actions, Endpoints, Sync, Identities (no Workflows link at all)
Public browse (public_workspaces.html)	Documents, Prompts

Proposed canonical order

Adopt one build-up order everywhere a workspace section list is rendered. Sections still only appear when their existing feature gates are enabled — this is a pure reorder.

1. Documents — the knowledge you bring in
2. Prompts — the instructions you reuse
3. Identities — the credentials Sync and Actions both resolve against
4. Sync — uses Identities to pull Documents in
5. Endpoints — the models Agents and Workflows run on
6. Actions — governed tools, using Identities and Endpoints
7. Agents — assemble Documents, Prompts, Actions, Endpoints
8. Workflows — run Agents on a schedule or trigger

Applies to all three section-listing surfaces: the top nav-tabs bar, the collapsed/mobile Section <select>, and the left-hand sidebar submenus, for personal, group, and public workspaces.

Sidebar gating bugs found while scoping

These are fixed as part of this change, because otherwise the "only enabled sections show up, in this order" rule doesn't actually hold:

Item	Today	Should be
Personal "Your Agents"	per_user_semantic_kernel and enable_semantic_kernel	+ allow_user_agents
Personal "Your Actions"	per_user_semantic_kernel and enable_semantic_kernel	+ allow_user_agents and allow_user_plugins
Personal "Identities"	file_sync_enabled or enable_semantic_kernel or enable_multi_model_endpoints	file_sync_enabled or enable_semantic_kernel (match tab gate)
Group "Group Agents"	allow_group_agents and enable_semantic_kernel	+ per_user_semantic_kernel
Group "Group Actions"	allow_group_agents and enable_semantic_kernel	+ per_user_semantic_kernel and allow_group_plugins
Group "Identities"	file_sync_enabled or enable_semantic_kernel or enable_multi_model_endpoints	file_sync_enabled or enable_semantic_kernel (match tab gate)
Group "Workflows"	missing entirely	add link, gated by allow_group_workflows

Each mismatch means a sidebar link can point at a tab that was never rendered.

Scope decisions

• Tab panes are not reordered. Bootstrap resolves panes by id / data-bs-target and inactive panes are hidden, so DOM order has no visual or accessibility effect. Leaving them keeps the diff reviewable (the group template is ~389 KB).
• Documents stays first, so class="nav-link active" and the "first sidebar link is active" logic in workspace_sidebar_nav.js keep working unchanged.
• Public workspaces already conform — the browse page is Documents then Prompts, and manage_public_workspace.html already lists Identities before Sync. Audit only.
• Guided tutorial is out of scope — it still walks Documents → Prompts → Agents → Actions. Its selectors are id-based, so nothing breaks.

Files affected

• application/single_app/templates/workspace.html
• application/single_app/templates/group_workspaces.html
• application/single_app/templates/_sidebar_nav.html
• application/single_app/config.py (version bump)
• functional_tests/test_endpoints_tab_order_visibility.py (updated)
• functional_tests/test_workspace_section_order.py (new)
• docs/explanation/features/v0.250.209/WORKSPACE_SECTION_ORDER.md (new)
• docs/explanation/release_notes.md

Follow-ups (not in this change)

• Visual grouping of sections. Reordering is the groundwork; a further pass could add dividers or group labels (e.g. Content / Connections / Automation) so the relationships read as cohesive rather than just sequential.
• Orphan tab pane. group_workspaces.html contains a #group-settings-tab pane with no corresponding nav button anywhere in the codebase — dead markup that should be removed or wired up.

[paullizer]

Implemented on paullizer-workspace-tab-ordering (commit 5ecf1c1f).

What changed

All six workspace section lists now render the canonical order — Documents, Prompts, Identities, Sync, Endpoints, Actions, Agents, Workflows:

• #workspaceTab and #workspace-section-select in workspace.html
• #groupWorkspaceTab and #group-workspace-section-select in group_workspaces.html
• #personal-workspace-submenu and #group-workspace-submenu in _sidebar_nav.html

Sidebar gating fixes landed alongside it: the missing Group Workflows link was added, personal Agents/Actions now respect allow_user_agents/allow_user_plugins, group Agents/Actions now respect per_user_semantic_kernel/allow_group_plugins, and both Identities links now match their tab's conditions.

Public workspaces were audited and needed no changes. Tab panes were intentionally left in place — Bootstrap resolves them by id and hides inactive ones, so DOM order has no effect.

Validation

• New functional_tests/test_workspace_section_order.py renders each section list with Jinja and asserts the canonical order, that disabled features only remove sections, and that all three surfaces stay in gating lockstep across every combination of the eight relevant feature flags per scope (512 renders). Confirmed it fails against the pre-change templates, so it isn't vacuous.
• test_endpoints_tab_order_visibility.py updated for the new Endpoints → Actions → Agents order.
• All 74 functional tests referencing the edited templates produce an identical failure set to the merge-base baseline — no regressions. The 50 failures in that set are pre-existing and unrelated (stale assertions in test_file_sync_capability.py, test_personal_workflows_feature.py, test_profile_workspace_tabs.py, and others).
• route_tests/ passes 12/12; all 50 templates parse cleanly through Jinja.

Version bumped to 0.250.209, with docs/explanation/features/v0.250.209/WORKSPACE_SECTION_ORDER.md and release notes added.

Still open from this issue

Both follow-ups listed above are untouched and remain valid: visual grouping of sections, and the orphan #group-settings-tab pane in group_workspaces.html.

[paullizer]

Correction on the version: Development claimed 0.250.209 (#1259) and then 0.250.210 (#1260) while this work was in flight, so the branch was rebased twice and this ships as 0.250.211. The feature doc moved to docs/explanation/features/v0.250.211/WORKSPACE_SECTION_ORDER.md and the release notes entry now sits under ### **(v0.250.211)**, above both upstream sections.

Submitted as #1262. All 12 CI checks pass and the PR is mergeable.

One extra fix in the PR: CodeQL flagged py/jinja2/autoescape-false (high) on the new test's Jinja environment. It was test-only and not exploitable, but it was a new alert introduced by this branch, so it was fixed with autoescape=True rather than suppressed. The test still passes 6/6 — autoescaping only affects {{ }} output, while the assertions match literal id= and data-tab= attributes.

[paullizer]

Shipped in v0.250.211 via #1262.

Release note entries:

• v0.250.211: Consistent Workspace Section Order
• v0.250.211: Group Workflows Missing From Sidebar Navigation
• v0.250.211: Sidebar Links Pointing At Unrendered Workspace Tabs

Full notes: https://microsoft.github.io/simplechat/explanation/release_notes/

Closing as completed. This issue stayed open after the fix merged because pull requests target Development while the repository default branch is main, so GitHub never applied the Fixes # keyword automatically.