Wake agents from verified workflow mentions

[loganj]

🤖
I’m Larry.

Summary

Make workflow-authored agent mentions durable without letting trigger-controlled text acquire the workflow owner’s authority. The relay atomically stores the generated message and recipient-specific wake events, then broadcasts them. ACP verifies the signed captured definition, run, message, recipient and current access before applying its ordinary owner/sender policy. A visible mention alone cannot bypass these checks.

• Select wake recipients from mentions in the authored template, not mentions introduced only by rendered trigger values.
• Preserve the exact signed definition captured by a run through ordinary replacement and approval resume; explicit deletion (or unknown historical deletion) remains revoked. Legacy runs lacking a captured revision do not emit durable wake events. Approval suspension itself remains the existing WF-08 limitation.
• Keep durable-wake authentication and ordinary listener admission on the same connection-generation relay identity. Revision-labelled visible messages are not a fallback around wake verification.
• Recover temporary authority or identity-discovery failures through paced transport replay while continuing to deny unverified dispatch. Authoritative absence of a relay signing identity is terminal for that connection generation, not a no-progress resubscription loop. This is not a general exactly-once execution guarantee.

Related issue

Stacked on #6960, the exact-revision foundation. #6964 independently adds owner-authorized manual triggering on that same foundation; neither sibling requires the other. This replaces the relevant portion of retired #6963, which is closed and unmerged. No historical revision backfill is planned.

Database redesign and rollout

No wake-specific FTS migration or bootstrap exclusion. The old 0044 whole-history generated-expression rewrite is removed, without replacing it with permanent triggers, separate storage or a query exclusion. Ordinary signed events already provide persistence/replay. Existing unrelated private-kind storage exclusions remain intact.

Search returns candidates, not authorization: HTTP /query and WS NIP-50 refetch scoped events, match full filters and apply canonical wake/recipient/current-membership gates. Indexed empty wakes can match NOT-only queries but cannot bypass those checks. Authorized recipients may receive canonical wakes through explicit search just as through replay. Normal message-search kinds exclude wakes. Counts use per-event visibility rather than raw FTS totals; no raw snippets are exposed. Bounded pagination/timing is not a constant-time guarantee. The prior physical-NULL requirement was speculative, not a product contract.

• Foundation 0043 retained/changed: nullable captured-revision IDs and mixed-writer invalidation remain. Length checks use NOT VALID to avoid historical scans under ACCESS EXCLUSIVE while enforcing every subsequent INSERT/UPDATE. Legacy rows stay NULL; no backfill or deferred validation job. Fresh schema checks remain validated.
• Old 0044 removed: no events-tree FTS inspection/rewrite/index rebuild.
• Old 0045 retained as 0044: fast-default workflow_revision_superseded distinguishes positively identified replacement from explicit/unknown deletion. Existing deleted_at cannot express that invariant. No historical inference or heap/index rewrite, but ACCESS EXCLUSIVE parent/partition locks still apply.

All three PRs were open/unmerged, with main ending at 0042, when renumbering. Recreate disposable databases that applied the old draft checksums; if a draft was applied elsewhere, reconcile the ledger explicitly before upgrade. Runtime BUZZ_AUTO_MIGRATE remains opt-in, sets lock/statement timeouts to zero before its advisory lock, and applies each file transactionally. Neither retained migration adds a timeout. Metadata-only is not lock-free: waits/queued blocking remain unbounded. PostgreSQL 17 CI is retained because VISION/architecture/docker-compose already require it, not for the removed SET EXPRESSION. See rollout guide. No live DB operation, merge or deployment.

Validation

Current redesign head 15826a98fd03579dd9fc0ce59d453797ca8c26aa, on foundation 92f15c04. Earlier readiness is withdrawn pending independent review and exact-head CI.

Focused local redesign checks passed: populated revision-table no-rewrite/no-validation-scan and write-enforcement test; fast-default supersession partition/index test; actual HTTP+WS indexed-wake search regression (positive/NOT-only/normal kinds/known-ID/foreign recipient/malformed/removal/public-control cases); all 6 wake lifecycle/storage tests; search library plus 20 PostgreSQL FTS tests; 115 DB unit tests. Final affected-package broader validation is being tracked on this exact candidate.

Retained unchanged-authority evidence: ACP 925 passed with two test threads (default concurrency had two pre-existing timing assertions); prior affected all-target Clippy/fmt; prior sink 32 and DB 115; prior published 5c68804e had 33 successful checks / 4 skips, including 394 PostgreSQL archive tests. Removed FTS rewrite tests are no longer applicable. Previous independent reviews closed authority/identity/retry findings at 53e8b9a6; those reviews do not certify this new database design.

Combined sibling proof remains unchanged: real signed manual trigger → executor/sink/storage → outer ACP → four injected authority 503s → real endpoint → ordinary owner admission → one session/one prompt, with a two-second duplicate observation window. Not a general exactly-once or actual-reconnect guarantee. No unnecessary rerun or redesign of unchanged authority paths is claimed.