Skip to content

fix(workflows): authorize agent wake via workflow-owner tag - #5048

Open
joaoh82 wants to merge 2 commits into
block:mainfrom
joaoh82:agent/fix-workflow-agent-wake
Open

fix(workflows): authorize agent wake via workflow-owner tag#5048
joaoh82 wants to merge 2 commits into
block:mainfrom
joaoh82:agent/fix-workflow-agent-wake

Conversation

@joaoh82

@joaoh82 joaoh82 commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

  • emit a dedicated workflow-owner authority tag on relay-signed workflow send_message events
  • ACP evaluates that principal only when the event is kind-9, signed by NIP-11 self, and carries exactly one buzz:workflow=true marker plus one valid workflow-owner tag
  • keep mention p tags as routing only — they never grant author-gate authority
  • fail closed on missing, malformed, ambiguous, or forged provenance

Root cause

Scheduled workflow send_message publishes valid kind-9 events signed by the relay service. ACP's inbound author gate previously evaluated that raw relay signer, so default owner_only agents dropped the message before mention matching. Human-authored mentions worked because their raw signer already passed the policy.

An earlier draft of this PR tried to derive authority from the first p tag. That is wrong: live production events often carry only the mentioned agent as p (and for agent-owned workflows that is the agent itself). Authority must not be inferred from mention routing tags.

A live Anyone check appeared to falsify the author-gate diagnosis, but Desktop can fail to persist respond_to edits to the harness process (#2501). Independent reports show workflow messages do wake when the harness actually starts with respond_to=anyone. The production harness still runs stock code without this patch.

Tracked by #3858. Design aligns with the authority contract proposed in #2737 / #3638 (dedicated owner tag; p for mentions only).

Impact

Trusted scheduled workflows can wake the intended agent under normal owner_only policy without weakening the general inbound author gate or treating mention p tags as authority.

Deploy note

This is a two-component fix: the relay must emit workflow-owner, and ACP must accept it. Existing in-channel workflow events without the tag remain fail-closed until new events are published after relay deploy.

Validation

  • cargo test -p buzz-acp (697 unit + 9 integration) at 7653c00e23c598ea44177da5338ba99b6faaf80a
  • cargo test -p buzz-relay --lib workflow_sink (17 passed, 1 ignored postgres)
  • cargo clippy -p buzz-acp --all-targets -- -D warnings at the same commit

Security properties

  • relay identity must match the NIP-11 self pubkey
  • event signature must verify
  • event must carry exactly one buzz:workflow=true marker
  • event must carry exactly one valid workflow-owner pubkey
  • mention/p tags never grant authority
  • missing NIP-11 identity, failed discovery, invalid attribution, untrusted signers, and non-workflow relay events retain the raw author

@joaoh82
fix(acp): route trusted workflow prompts by owner
2453147 
Recognize relay-authored workflow events through the relay's NIP-11 identity, then apply the existing inbound author policy to their attributed owner. Keep malformed, forged, and non-workflow events fail-closed on the raw signer.

Co-authored-by: Joao Henrique Machado Silva <joaoh82@gmail.com>
Signed-off-by: Joao Henrique Machado Silva <joaoh82@gmail.com>
@joaoh82
joaoh82 marked this pull request as ready for review August 6, 2026 13:04
@joaoh82
joaoh82 requested a review from a team as a code owner August 6, 2026 13:04
@joaoh82
joaoh82 marked this pull request as draft August 6, 2026 14:14
@joaoh82

joaoh82 commented Aug 6, 2026

Copy link
Copy Markdown
Author

Live verification invalidated the root-cause assumption behind this patch. Setting the target agent access mode to Anyone did not allow relay-authored buzz:workflow=true events to start an ACP turn, while human-authored mentions in the same channel continued to work. That means the event is being lost before the ACP author-policy branch changed here. I have returned this PR to draft and will revise or replace the patch only after reproducing the actual live-delivery failure. Please do not merge the current head as the workflow wake-up fix.

@joaoh82
fix(workflows): authorize agent wake via workflow-owner tag
7653c00 
Relay-signed send_message events were dropped by ACP's owner-only author
gate because the raw signer is the relay, not the workflow owner. Live
events also only carry a mention `p` tag, so treating the first `p` as
authority is incorrect.

Emit a dedicated workflow-owner authority tag from the relay sink, and
have ACP accept that principal only for NIP-11 self-signed kind-9 events
with exactly one buzz:workflow=true marker. Mention `p` tags stay
routing-only and cannot grant authority.

Co-authored-by: Joao Henrique Machado Silva <joaoh82@gmail.com>
Signed-off-by: Joao Henrique Machado Silva <joaoh82@gmail.com>
@joaoh82 joaoh82 changed the title fix(acp): route trusted workflow prompts by owner fix(workflows): authorize agent wake via workflow-owner tag Aug 7, 2026
@joaoh82

joaoh82 commented Aug 7, 2026

Copy link
Copy Markdown
Author

Investigation update (2026-08-07)

Follow-up after the live falsification note on the previous head.

What was wrong with the previous patch

Head 2453147 treated the first p tag as the workflow principal. Production Marvin dispatcher events look like:

pubkey: <relay>
tags: [["p","<Lead>"],["h","<engineering>"],["buzz:workflow","true"]]

There is no separate owner p — only the mentioned agent. Inferring authority from that p is incorrect and conflicts with the mention-routing contract (#3638).

Why the live Anyone test looked like a deeper delivery bug

  • Production Desktop/ACP was not running this unmerged patch, so author-gate changes could not affect the live harness.
  • Desktop respond_to UI edits can fail to reach the running harness (#2501). A harness that still starts as owner-only will keep dropping relay-signed workflow events even when the UI shows Anyone.
  • Independent evidence on #2501 shows a workflow-engine message does wake an agent after a hand-edit that actually starts the harness with respond_to=anyone.

So the loss is still at the author gate for stock owner_only, not a mysterious pre-subscription drop. Feed visibility is expected: historical query is independent of ACP wake.

Revised head

7653c00e23c598ea44177da5338ba99b6faaf80a:

  1. Relay sink emits workflow-owner = workflow owner pubkey.
  2. ACP accepts that principal only for verified NIP-11 self + exact workflow marker + single valid owner tag.
  3. Mention p tags cannot grant authority.

Still requires relay and ACP deploy before re-enabling the scheduled Marvin dispatcher. Manual human-authored @Lead dispatch remains the operational path until then.

Please do not merge the previous head 2453147 as the fix.

@joaoh82
joaoh82 marked this pull request as ready for review August 7, 2026 21:31
@joaoh82 joaoh82 mentioned this pull request Aug 8, 2026
Open
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@joaoh82