feat!: refuse workflow-changing writes unless the call allows them; remove set_status; add reassign_action

[baraline]

Stacked on #6: this PR targets feat/content-conversion, and the two ship together as one breaking 0.4.0.

Why

A GLPI ↔ EasyVista synchroniser was ending every EasyVista ticket's initial workflow action ("A faire") the first time it touched the ticket. The cause was in this package. set_status sends the vendor's close request, PUT requests/{rfc} with {"closed": {...}}, under a name that presented it as a neutral status setter. The vendor's close page (rest-api-close-an-incident-request, tier 1) describes four steps, and none depends on the status sent:

• "1. The workflow of the ticket is interrupted."
• The status is set.
• The unfinished actions are deleted (or, by our reading of the end_date row, ended).
• "An anticipated closing action … is inserted."

The vendor's model is that a ticket's status follows its workflow ("Advancing through the steps of a workflow changes the status of a ticket." — references-tables). The vendor documents no status setter.

What changes

The guard. easyvista_python_client/workflow.py classifies each request from its method, path, body and override headers as INTERRUPTS, ADVANCES or UNKNOWN. Transport.send refuses a named effect before any I/O unless the call passes allow_workflow_effect=. What gets named:

• the closed, end_action, suspended and restarted bodies, on any path;
• status and catalog columns on requests/{rfc};
• end-date, type, parent, workflow-link and ticket-link columns on actions/{id};
• ticket sub-routes that are workflow commands, and non-numeric actions/<x> (the end-action route).

Paths with dot segments, encoded slashes or backslashes are refused. A request counts as a read only if every method it names (including override headers, config.extra_headers too) is a read. An allowed workflow write is sent once, never retried. The refusal is EasyvistaWorkflowEffectRefused(ValueError), deliberately not an EasyvistaError: nothing was sent, and retrying can never succeed.

Client changes:

• BREAKING: set_status and build_set_status are removed.
• BREAKING: close_ticket requires allow_workflow_effect= (keyword-only, no default).
• BREAKING: end_action reads the action first, projecting ACTION_ID and WORKFLOW_ID. Unless ADVANCES is allowed, it refuses a workflow step, a record without WORKFLOW_ID, or a read that returns a different id. end_all=True always needs ADVANCES. An explicit action_id must be a positive integer.
• BREAKING: update_action refuses an id that is not a positive integer, because an RFC number there addresses the end-action route.
• New: reassign_action(action_id, *, group_id=None, done_by_id=None). No REST reassignment route is documented; this is PUT actions/{id}, and its effect was measured live (below).
• update_ticket, update_action, create_action, create_task and send take allow_workflow_effect=(). What the typed models declare needs no opt-in.

Docs:

• docs/vendor-api-reference.md gains a "Ticket workflow" section: what each documented write does to the workflow, and exactly what the guard names. O-CLOSE-DEFAULT is closed at tier 1.
• The skills, user guide (new "Changing a ticket's status" section), README and CHANGELOG are rewritten.
• The skills contract test now fails a snippet that omits a required keyword-only parameter.

Evidence (tier 4: one instance, 2026-10-02, may not generalise)

• An action's item read names WORKFLOW_ID on a workflow step and on a non-workflow action. The end_action pre-read relies on this.
• PUT actions/{id} {"group_id": …} on the open workflow step, on two tickets:
  • the group stored;
  • the step stayed open;
  • status and END_DATE_UT did not move;
  • no new action row appeared.
  • Read on one of them: the ticket's OWNING_GROUP_ID did not follow.
• A title update left the workflow step open.

The live tests are in integration_tests/test_live_workflow_guard.py. The two read-only checks run normally. The write census runs only with EASYVISTA_TEST_RUN_WORKFLOW_CENSUS=1.

Test plan

• pytest -m "not integration": 2028 passed on Python 3.11, after merging the rebuilt base (6143c23; 2146 before, on the old converter's tests)
• ruff check ., unasync_build.py --check, mypy easyvista_python_client, sphinx -E -W; coverage 98.92% against the 95% floor
• CI green on 3.11–3.14 after the merge. The first run failed 20 content tests that were not this branch's. The old base's python-markdown converter broke under markdown 3.11, and the base failed the same way on its own run. The merge brings in the base's rebuilt converter and its Python 3.10 drop. Only CHANGELOG.md conflicted: the 0.4.0 intro now names all three changes, and the two ### Removed sections are one.
• Live read-only check: both pass
• Live census (approved): group reassignment and title write both pass; person reassignment not measured
• Per-task spec and quality reviews, plus a final whole-branch review; all findings fixed or recorded

Known follow-ups

• skills/easyvista-ticket-workflow/SKILL.md:87 says "the vendor documents no status write"; it should say "no status setter".
• integration_tests/conftest.py still claims the smoke test's rejected create leaves no ticket (pre-existing).
• Set the 0.4.0 date at tagging.
• Downstream synchronisers: remove both set_status calls in the same change that widens the pin past <0.4.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.92%. Comparing base (4292f16) to head (6143c23).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@                     Coverage Diff                     @@
##           feat/content-conversion       #7      +/-   ##
===========================================================
+ Coverage                    98.85%   98.92%   +0.06%     
===========================================================
  Files                           39       40       +1     
  Lines                         2449     2595     +146     
===========================================================
+ Hits                          2421     2567     +146     
  Misses                          28       28              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.