mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
3e3d80a27d
🤖 ## Summary Workflow messages still wake the managed agent named by their owner-signed definition, but the relay is now only a doorbell. It carries pointers to the exact workflow revision and cause; ACP independently verifies those signed artifacts, reconstructs trigger input, and renders the prompt locally. Relay-authored prose is never shown to the agent or treated as owner authority. Before this change, a compromised relay signing key could attach `workflow-owner` to chosen message content. After this change, ACP grants the workflow owner principal only when the doorbell, owner-signed kind `30620` definition, referenced step, channel, and cause all verify. Invalid workflow-shaped deliveries are dropped rather than falling through as ordinary relay messages. ### Doorbell behavior - Workflow rows retain the exact kind `30620` event ID that materialized them. Existing rows remain nullable and fail closed until the definition is saved again. - Relay events contain the definition event/step and one typed cause: signed event, signed manual command, deterministic schedule slot, or webhook cargo. - ACP refetches and verifies the owner-signed definition. It also refetches signed event/command causes, reconstructs their trigger context, rechecks that the signed trigger matches the definition, validates exact cron/interval slots, and renders `send_message` text itself. - Manual commands from an agent's cryptographically verified human owner remain authorized, but command JSON deliberately no longer populates arbitrary webhook fields. Unrelated channel members remain denied. If parameterized manual runs are added later, those parameters must return as explicitly untrusted cargo under the same boundary as webhooks rather than inheriting owner authority. - Prior workflow-step outputs cannot be independently reconstructed, so `send_message` templates and conditions that depend on them fail closed rather than treating unresolved placeholders as owner-authorized text. - Mention wake targets are resolved only from the owner-signed template. `@Name` text arriving through a signed source event or webhook field cannot steer a different agent. ### Webhooks and replay controls Webhooks have no signed source event. Their JSON therefore travels as explicitly untrusted external cargo, can fill only `{{trigger.*}}` slots declared by the owner-signed template, and is labelled as untrusted in the prompt. ACP applies a per-definition token bucket (five immediate turns, refilling at five per minute) and caps serialized cargo at 61,440 bytes. Signed event, command, and schedule causes are deduplicated by definition revision × semantic cause. Dedupe is intentionally process-lifetime/in-memory: an ACP restart can admit a replay again. Schedule causes must be exact authorized cron occurrences or interval boundaries; wall-clock freshness/skew policy is deferred. ### Rollout This is a coordinated protocol change. New ACP drops old relay workflow messages because they lack the `doorbell-v1` pointer shape. Old ACP does not recognize new doorbells as delegated owner messages, so owner-only policy rejects them. Existing database rows without a definition event ID do not fire a doorbell until the workflow is re-saved. ### Related issue Security correction stacked directly on #2737. The owner-trigger authorization in #5854 remains separate and will be restacked after this correction merges into #2737. ### Testing - `cargo test -p buzz-workflow` — 156 passed, 2 Postgres-gated ignored - `cargo test -p buzz-acp` — 783 unit + 9 lifecycle passed - `cargo test -p buzz-db migration --lib` — 10 passed, 6 Postgres-gated ignored - `cargo test -p buzz-relay --no-run` - `cargo test -p buzz-test-client --test e2e_workflow_agent_owner --no-run` - `cargo clippy -p buzz-acp -p buzz-workflow -p buzz-relay -p buzz-test-client --all-targets` - `cargo fmt --check` and `git diff --check` --------- Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>