Dry-run under-counted every phase downstream of a fresh create: a phase
that would create a parent recorded no target id, so dependent phases saw
an empty remap and no-op'd (tool_instance/endpoint/pipeline/api_deployment
showed 0 on a fresh target). Dry-run also counted would-creates as
`skipped`, so totals didn't match the real run it's meant to predict.

Fix centrally with a "reads run, writes stub" contract:
- RemapTable.record_planned() mints a deterministic synthetic target id so
  dependent phases resolve the FK and plan-count without writing;
  is_planned() flags them; snapshot(hide_planned=) masks them in the report.
- Every create-capable phase's dry-run branch now counts in the bucket a
  real run would (created/adopted) and records a planned remap.
- custom_tool runs its source-side validations (frictionless check, source
  registry lookup) in dry-run so the plan reflects real create-vs-skip.
- Phases doing live target lookups (tool_instance, workflow_endpoint, files)
  guard on is_planned to avoid querying a synthetic parent id.
- Report shows a DRY RUN banner; synthetic ids never reach the wire.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ja9H1rnSXmPUgQtHm8TNS

Address review: _create_fresh recorded the planned remap and _clone_one
re-recorded the same value, while the adopt path only recorded in
_clone_one. Drop the generic record in _clone_one; each sub-path
(adopt / fresh / fresh-dry-run) now records once, since only it knows
whether the target id is real or a planned synthetic.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ja9H1rnSXmPUgQtHm8TNS

[FIX] correct dry-run counts via planned-remap chaining

…dio)

Extend the org clone with cloud-only (enterprise) entity support, gated so OSS
runs are unchanged.

Foundation:
- Capability probe (PlatformClient.probe + ctx.feature_present cache) and a
  Phase.probe_path gate. The orchestrator probes source/target before a cloud
  phase: absent on source -> skip silently (OSS looks like today); present on
  source but absent on target -> warn + skip + continue. report.warnings added.
- custom_tool now records a src->tgt prompt-id remap (matched by prompt_key,
  real + dry-run planned) so prompt-scoped cloud config can rewrite its FKs.

Phases (each create-or-adopt-by-name, FK remap, dry-run aware, probe-gated):
- lookups: definition + draft template/adapters + reference-file blobs +
  draft-pinned assignments (prompt + lookup + variable_mappings remap).
  v1 defers published-version replay (logged, non-fatal).
- manual_review: workflow-scoped RuleEngine (+ confidence filters) and
  HITLSettings rebased onto the cloned workflow, org-level AutoApprovalSettings,
  ReviewApiKey recreated (secret re-minted -> operator re-wire warning).
- agentic_studio: project (4 adapter FKs remapped) + prompt-versions
  (parent-before-child) + schemas + settings, registry republished via export.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

…story

Make the cloned cloud entities match the source, including user-group sharing.

Sharing (sharing.py): extract the user/group axis mapping into reusable helpers
and add replicate_share(), generic over the write mechanism (POST /share/ or a
detail PATCH). Existing /share/-POST phases are unchanged (thin wrapper).
- lookups + agentic projects now replicate shared_to_org + shared_users
  (mapped by email) via their detail PATCH; lookups have no group axis, agentic
  group sharing is polymorphic/read-only and is warned, not dropped silently.

Lookups published-version replay: reproduce each source published version
(stage template + remapped adapters + that version's reference files onto the
draft, then publish in version_number order, recording a lookup_version remap),
then restore the draft to the source's current draft. Assignments now resolve
published-pinned versions via the version remap instead of being skipped.
Residual: assignment_values_snapshot is backend-derived at publish time (best
effort). Fixes list_lookup_versions to unwrap the {"versions": [...]} envelope.

Manual review: auto_approved_users remapped by email (was carried verbatim);
auto_approved_document_classes carried with a verify-on-target warning. MR rows
have no share fields (inherit workflow/org visibility).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

…ns + MR api keys

- lookups: adopt existing target published versions by name instead of
  re-publishing (fixes spurious failures / duplicate version history on
  re-runs and adopted definitions)
- lookups: guard draft_cache so a failed fetch can't clobber a peer's
  valid draft id (TOCTOU)
- manual_review: adopt ReviewApiKey by (class_name, description) so
  re-runs don't create duplicate keys; only warn for keys actually minted
- tests for both adopt paths

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

Drop persona-mode markers and conversational phrasing from comments.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

Share axes are read-only on AgenticProjectSerializer, so a detail PATCH
silently no-ops. Route share replication through the dedicated share
action (POST agentic/projects/{id}/share/), which also handles the
polymorphic group axis — so agentic group shares now replicate like every
other shared resource. Drops the now-dead update_agentic_project_share
client method and the include_groups=False special-case.

Found while prepping live staging test scenarios for the clone tool.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

Dry-run records planned group remaps as synthetic uuids; the share-payload
builder int()-cast them and crashed the whole run. Cast only real (digit)
pks, keep planned uuids as-is (never POSTed in dry-run).

Caught running a live dry-run against staging.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

AgenticSetting.key is globally unique across orgs, so a create can collide
with a row owned by another org that isn't in this org's listing (surfaces
as a 500). That isn't data loss the clone can resolve — downgrade from a
hard failure to a warned skip.

Surfaced verifying a live staging clone.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

CustomToolPhase failed the whole tool on three recoverable conditions,
turning pre-existing source-config gaps into clone failures the operator
would blame on the clone. Mirror the tool unconfigured instead:

- No default profile on source: import with an empty adapter set. The
  backend auto-creates an unconfigured default profile and flags
  needs_adapter_config rather than rejecting the import.
- Missing target adapter remap: _resolve_target_adapter_ids is now
  best-effort — it resolves the adapters that map and omits the rest,
  so a partial set still imports (flagged needs_adapter_config).
- Registry republish 500 (stale/empty source registry): warn instead
  of fail. The tool itself cloned; only its registry entry is missing,
  so downstream tool_instances cascade-skip until re-published.

In every case the operator wires the adapters on target and re-runs the
(idempotent) clone to complete downstream. Frictionless-bound tools are
unchanged — still hard-skipped + cascaded, since the adapter is
cloud-only with no target equivalent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: 4f5ab436-eabb-4464-9a96-f024724bc818

…ntic re-run idempotency

- client.get_review_settings: only suppress the backend's DoesNotExist
  (500); re-raise 401/403/429 so an auth error can't silently drop a
  configured HITLSettings row.
- lookups._replay_one_version: return after a template/adapter staging
  failure instead of publishing a version with stale content.
- agentic _clone_prompt_versions / _clone_schemas: adopt children already
  on target (keyed by version) so a re-run against the same pair doesn't
  re-create duplicates — mirrors the lookups version-replay guard.

Tests added for each. The draft_cache TOCTOU (P2) is already mitigated:
the `is None` write guard guarantees a valid draft id is never overwritten
by a peer's failure; only a benign extra GET can occur.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: 4f5ab436-eabb-4464-9a96-f024724bc818

…ion_type on unmapped connector

Clone faithfully mirrors a source pipeline's disabled state instead of
letting the backend's force-activate leave it running on the target
scheduler. Endpoint patch now sets connection_type even when a source
connector has no remap, so runs fail with a clear 'connector not
configured' instead of an invalid empty connection type.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

…mments

- README: document `unstract clone` compatibility (capability-probed,
  match builds, pin client >= 1.4.0).
- Trim comments/docstrings that disclosed cloud-backend internals
  (model/serializer/method names, cross-org invariants, queryset
  semantics); WHY preserved, public API surface unchanged.
- Drop dead service-account email-suffix fallback; rely on the
  `is_service_account` flag the members API returns.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

[FEAT] Support clone of cloud related entities - agentic PS, lookups and manual review