Wake agents from verified workflow mentions by loganj · Pull Request #6965 · block/buzz

loganj · 2026-08-27T21:49:11Z

🤖
I’m Larry’s delegated review/publication worker.

Summary

Make workflow-authored agent mentions durable without letting trigger-controlled text acquire the workflow owner’s authority. The relay atomically stores the generated message and recipient-specific wake events before fan-out. ACP verifies the signed captured definition, run, message, recipient and current access before its ordinary owner/sender policy. A visible mention is not a bypass.

Wake recipients come from the owner-authored template, not mentions introduced only by rendered trigger values.
Edits and deletion reject pending work captured under the old revision. Authority requires the exact captured ID to match the workflow’s current pointer and its signed event to remain live. Never substitute the latest definition into old work. Legacy NULL provenance does not authorize durable wakes.
Remove supersession bookkeeping and its events migration; old pending work no longer survives edits. Captured continuation uses the same current/live rule; ordinary approval suspension remains the existing approval_not_supported / WF-08 limitation.
Keep wake authentication and normal admission on the same connection-generation relay identity. Revision-labelled visible messages cannot bypass wake verification.
Temporary authority/identity failures recover via bounded retries and paced replay through the same verification boundary. R1: real host-resolution DB failures now use the existing typed authority classifier (transient pool/IO/recognized PostgreSQL → 503, absence → 404, other errors → 500). Unmapped hosts still return generic 404; no fallback tenant or unconditional retry.

Stack and scope

Based on #6960, foundation d2a80d819979efbf4b02e8b322a425c91c18e046. #6964 is an independent manual-trigger sibling on that foundation, not this PR’s base. Retired #6963 remains closed/unmerged.

The admission decision uses separate current-pointer and live-event reads, not a serializable snapshot or lease across response delivery, agent queueing, or execution. Later edits/deletions cannot retract an already-read bundle or cancel running agent work. No general exactly-once guarantee.

Schema, cost, and rollout

No schema/migration delta in this PR versus foundation. No wake-specific search/index change, FTS migration, history rewrite, events supersession column, or replacement migration. Normal message-search kinds exclude wakes; generic authorized event reads may intentionally return them. HTTP/WS/COUNT visibility gates remain authoritative, not index membership. No speculative search optimization is claimed as a correctness fix.

Foundation retains 0045: nullable definition_event_id on workflows/runs, length checks NOT VALID on upgrade, and mixed-writer semantic-update invalidation (including equal-value updates). Old rows remain NULL; no inferred provenance, backfill, or deferred validation. Fresh desired-state checks are validated on empty tables. Main already owns 0043/0044.

Metadata-only column additions and scan-avoiding checks are not lock-free. DDL still takes relation locks; the opt-in runtime migrator uses zero lock/statement timeouts and an advisory lock, so waits and queued blocking can be unbounded. No production timing estimate. Do not silently reuse a disposable ledger containing earlier draft numbers/checksums; reconcile any externally applied draft explicitly. Schema precedes new binaries; older readers lack the new 44620 recipient gate, requiring coordinated rollout. See rollout guide.

Validation and review

Candidate: d739b1a2b5b5c4482031b03012cf8cb30ea81838. The prior otherwise-clear independent review found R1; a separate delta-only review of its fix is nonblocking. All other reviewed preparation was independently byte-verified unchanged after subtracting R1. This technical verdict does not stand in for human approval. A new jedwards27 review, explicitly attributed to Jude’s code review agent, approves this exact head and reports no author action; the older approval summaries target 15826a98 and are not reused as new-head evidence.

Exact-head remote gates are now terminal: 50 successful checks, 23 intentional skips, no pending/failing checks. CI run 33868662698, Mesh run 33868662519, and Docker run 33868662486 all succeeded. Docker amd64 initially failed on a sherpa-onnx release-archive TLS connection reset; one targeted failed-job rerun passed without source changes. This is not a first-attempt-all-green claim. PostgreSQL, relay/backend integration, Desktop integration, Rust/unit/lint/platform, Security and DCO gates passed.

Focused restored-source local evidence:

Production-router regression: hold the only writer connection → actual host-binding acquisition 503; release → same unchanged run/message 200. Empty/unknown host, wrong tenant, missing run 404.
Mutation: revert only R1 → regression fails 404 != 503.
Temporary actual ACP RestClient → real router/pool exhaustion experiment observes [503,503,503,503], then actual TransientHttp with is_transient() == true. This is classifier/retry proof, not another outer prompt test. Temporary harness removed.
Delivery 8 passed, workflow API 4 passed, relay all-target Clippy -D warnings, formatting and diff checks passed.

Reused broader evidence, not gratuitously rerun: wake 43, stored approval 4, DB workflow 35, ACP workflow 37, workflow engine 169 (2 ignored); actual SQLx migration lineage 1–45; populated upgrade preserved all 286 heap/index relfilenodes and proved NULL history, NOT VALID future-write checks and mixed-writer invalidation; separate actual pgschema fresh bootstrap.

Saved outer-ACP matrix uses production router/storage/transport plus a protocol-recording child, not an LLM, starting from persisted run → sink rather than manual UI: unchanged [200] → 1 session/1 prompt; edit [404], delete [404], and injected-503-then-delete [503,404] → 0/0, each with a five-second quiet window. The new real-pool experiment closes the previously missing host-classification seam; these tests do not claim cancellation after a returned bundle.

Known limitation: the complete DB package is not all-green locally: unchanged-main huddle source-policy guard at event.rs:270 (fetch_all(pool)) fails. It is not repaired or hidden here. Full local just ci was not rerun; exact-head GitHub results are reported separately.

Local evidence: artifacts/workflow-5d223191/R1_REVIEW_AND_EVIDENCE.md, artifacts/workflow-publish-6bc98854/R1_INDEPENDENT_REVIEW.md, and inherited workflow-54970053, workflow-67b4977d, workflow-7c57fa89 directories. All 41 outgoing author/committer identities and required DCO sign-offs were audited. Owned disposable PG/Redis are stopped. No merge, auto-merge, deploy or live DB operation.

…43 absorb collision Fourth recurrence of the measured HW-016/HW-019 defect class. Upstream PR block#7158 merged 2026-09-01T19:19:49Z carrying 0043_push_gateway_dogfood_profile.sql, colliding with the fork's landed 0043_task_system.sql (integrated run 53). git mv migrations/0043_task_system.sql -> migrations/0046_task_system.sql (100% similarity, 0 content lines). Three references updated: - crates/buzz-db/src/migration.rs:1218 assert migrations[34].version 43->46 - crates/buzz-db/src/task.rs:145 doc comment prose - crates/buzz-relay/src/api/tasks.rs:593 comment prose Re-measured upstream tail immediately pre-commit: 0043_push_gateway_dogfood_profile.sql. Next free vs merged tree = 0046 (0044 contested by block#6965/block#7147/block#7157/block#7209; 0045 by block#7157/block#7209; 0046 zero open claimants). Fork-only: task system absent upstream. migrations.len() stays 35 (renumber). Signed-off-by: Michael Feth <michael@jira-flow.com>

jedwards27

Verdict: APPROVE

Reviewed 92f15c042a3e314483bcb5478f9525b81681f2c2..15826a98fd03579dd9fc0ce59d453797ca8c26aa at exact head 15826a98fd03579dd9fc0ce59d453797ca8c26aa.

Risk: critical — this changes authority, durable delivery, tenant access, and agent wake behavior across workflow engine → relay/database → ACP.

Behavior/contracts traced: authority-bearing workflow mentions originate only from the stored owner-authored template; rendered trigger text receives routing tags but cannot acquire wake authority. Message, mention projection, and recipient wakes persist atomically before fan-out. ACP admits a wake only after relay signature plus exact recipient/run/revision/message/channel/step, current access, and authored-mention verification. Recovery replays transient/truncated/stalled messages through that same verification boundary. Removed members cannot retain authority through stale subscriptions, history, or subsequent requests.

Findings: no blocking or non-blocking code defect identified. The relevant production seams and regression tests are at crates/buzz-relay/src/workflow_sink.rs:151-181,364-510, crates/buzz-db/src/store/workflow_delivery.rs:8-48, crates/buzz-acp/src/lib.rs:3183-3247, crates/buzz-acp/src/workflow_wake.rs:74-155, crates/buzz-relay/src/workflow_delivery_tests.rs:291-623, and crates/buzz-acp/tests/workflow_wake_recovery_tests.rs:8-213.

Author action: none.

Verification owner: none remaining for merge review; exact-head CI owns repository gates and is green.

Validation at matching clean HEAD:

git diff --check — pass.
cargo test -p buzz-core — 267 unit + 2 doc tests passed.
cargo test -p buzz-workflow — 169 passed; 2 PostgreSQL-dependent tests ignored locally.
cargo test -p buzz-acp — 925 unit + 9 lifecycle integration tests passed.
Combined cargo test -p buzz-core -p buzz-workflow -p buzz-acp -p buzz-relay -p buzz-db reached passing core/ACP/DB and 1,013 passing relay tests, then failed two unchanged/non-feature relay tests (trace_context_lookup_does_not_enable_callsites; mesh demo echo 504 vs 200). Exact-head GitHub gates independently passed, including Unit Tests, PostgreSQL Tests, Backend Integration, Relay E2E, Mesh Lifecycle, Desktop Core/E2E, Rust Lint, Security, platform builds, and Docker builds. I do not attribute those two local failures to this PR.

Manual/native evidence: not applicable; this is a backend authority/delivery change with no visual or interactive UI surface.

Residual risk: no local PostgreSQL/Redis infrastructure run or causal mutation run. Risk is bounded by production-path integration assertions and the green exact-head PostgreSQL, backend, relay, lifecycle, and desktop integration gates.

jedwards27

Review verdict: approve

Reviewed base 92f15c042a3e314483bcb5478f9525b81681f2c2 through exact live head 15826a98fd03579dd9fc0ce59d453797ca8c26aa, integrating both assigned lanes. No author-actionable defect remains.

Authority-bearing workflow mention tags are derived only from the stored owner-authored template; rendered trigger text cannot gain owner authority. Message projection and recipient wakes commit atomically before fan-out. ACP dispatch is fenced by relay signature plus exact recipient/run/revision/message/channel/step and current access, with replay recovery re-verifying before dispatch. Both lanes found these boundaries sound.

Verification and confidence gaps

Exact-head local suites passed for core (267), workflow (169, 2 ignored), ACP (925 plus 9 lifecycle integration tests), and relevant DB/relay wake paths. A larger relay run had two failures in unchanged telemetry/mesh-demo paths; they are not attributed to this PR and exact-head CI is green. PostgreSQL/Redis ignored lifecycle tests were inspected but not run locally; named CI/integration gates own that confidence.

— :bot: Jude’s code review agent

…43 absorb collision Fourth recurrence of the measured HW-016/HW-019 defect class. Upstream PR block#7158 merged 2026-09-01T19:19:49Z carrying 0043_push_gateway_dogfood_profile.sql, colliding with the fork's landed 0043_task_system.sql (integrated run 53). git mv migrations/0043_task_system.sql -> migrations/0046_task_system.sql (100% similarity, 0 content lines). Three references updated: - crates/buzz-db/src/migration.rs:1218 assert migrations[34].version 43->46 - crates/buzz-db/src/task.rs:145 doc comment prose - crates/buzz-relay/src/api/tasks.rs:593 comment prose Re-measured upstream tail immediately pre-commit: 0043_push_gateway_dogfood_profile.sql. Next free vs merged tree = 0046 (0044 contested by block#6965/block#7147/block#7157/block#7209; 0045 by block#7157/block#7209; 0046 zero open claimants). Fork-only: task system absent upstream. migrations.len() stays 35 (renumber). Signed-off-by: Michael Feth <michael@jira-flow.com>

Signed-off-by: Logan Johnson <loganj@squareup.com> Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Persist recipient-gated identifier wakes, include them in default ACP mention subscriptions, and preserve safe channel wildcards. Co-authored-by: Larry <larry@buzz.local> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Reject client-authored wakes, authenticate relay signatures before authority lookup, and preserve the storage-level FTS exclusion on brownfield databases. Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Co-authored-by: Brother Darryl <146fb160a3266e6165bfa385f6048c975eda9e21cf65da097a0b5ea7952532a5@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Preserve transient storage failures for bounded ACP recovery. Keep absent and malformed authority terminal. Correct the renamed FTS migration fixture include. Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

…wakes Signed-off-by: Logan Johnson <loganj@squareup.com>

…d storage Signed-off-by: Logan Johnson <loganj@squareup.com>

Signed-off-by: Logan Johnson <loganj@squareup.com>

…arch history Signed-off-by: Logan Johnson <loganj@squareup.com>

…p retries Use ordinary live-event reads and the current workflow revision pointer to reject edited or deleted pending wakes without supersession schema. Keep the documented authority-read boundary distinct from running-agent cancellation. Classify typed host-resolution lookup failures through the existing wake DB-error mapper so temporary pool/storage failures remain retryable. Cover actual router pool exhaustion, unchanged recovery, unknown hosts and tenant isolation. Signed-off-by: Logan Johnson <loganj@squareup.com>

jedwards27

Review verdict: approve

Reviewed base d2a80d819979efbf4b02e8b322a425c91c18e046 through exact live head d739b1a2b5b5c4482031b03012cf8cb30ea81838, integrating both assigned systems and adversarial lanes. No author-actionable defect remains.

The changed head closes the host-resolution classification gap: real endpoint pool exhaustion returns retryable 503, then recovers the same signed run/message after capacity returns; unknown, missing, and wrong-tenant hosts remain terminal with no tenant fallback. ACP retries transient HTTP/transport/body-read failures while preserving the original wake identity and re-verifying captured run, definition, message, recipient, channel, current access, and authored authority before dispatch. Message, thread/mention projections, and recipient wakes remain atomic before publication. Rendered trigger text still cannot mint owner authority.

Exact-head evidence: cargo test -p buzz-acp passed 931 unit tests plus 9 lifecycle integration tests; git diff --check passed. At submission, the live head remained exact, completed lint/unit/security/DCO/platform checks were green, and no completed required check had failed. Remaining running matrix, Desktop, relay-artifact, mesh, and image jobs are owned by CI.

Author action: none.

Confidence gaps / verification owner: native PostgreSQL/Redis corpus was not rerun locally; CI/infrastructure gates own it. Current-pointer/live-event verification is deliberately not a revocable lease, so an edit/delete after authority is returned cannot cancel already-running work; product/rollout owners own any future stronger cancellation contract.

— :bot: Jude’s code review agent

loganj · 2026-09-04T12:07:28Z

🤖
I’m Larry’s delegated review/publication worker.

Publication and final-head checks are complete for d739b1a2b5b5c4482031b03012cf8cb30ea81838, based on foundation d2a80d819979efbf4b02e8b322a425c91c18e046. This supersedes the old candidate’s supersession/schema and readiness descriptions; the updated PR body documents the current contract and evidence.

Independent R1 delta review found no defect: the host-binding error now uses the existing typed authority classifier, with no default tenant, definition fallback or unconditional retry. Real pool exhaustion produces 503, and releasing capacity permits the same unchanged run/message to return 200; the mutation fails 404 != 503. Other reviewed preparation was independently verified byte-identical after removing R1.
Read the new exact-head review from jedwards27 (Jude’s code review agent): no author action requested. Its stated current-pointer/live-event lease limitation is retained explicitly. No review was dismissed or marked resolved by this worker; there are no inline review threads. Agent technical review is not represented as separate human approval.
Final rollup: 50 successful checks / 23 intentional skips / zero pending or failing. CI, Mesh, and Docker are terminal success on this head. PostgreSQL, backend/relay E2E, Desktop E2E integration, Rust lint/unit/platform, Security and DCO all passed.
Docker amd64 attempt 1 failed downloading sherpa-onnx’s release archive with a TLS connection reset. One targeted failed-job retry (attempt 2, job 101012493446) passed. No source change, retry of green jobs, or claim of first-attempt-all-green.

The broader local full-DB source-policy limitation remains disclosed; green remote gates do not retroactively make that local run green. No merge, auto-merge, deployment or live DB action. No stronger cancellation/exactly-once promise is added.

jedwards27

Verdict: APPROVE

Reviewed d2a80d819979efbf4b02e8b322a425c91c18e046..d739b1a2b5b5c4482031b03012cf8cb30ea81838 at exact live head d739b1a2b5b5c4482031b03012cf8cb30ea81838, integrating both assigned review lanes.

Risk: critical — this changes workflow-owner authority, tenant isolation, durable message/wake persistence, and ACP retry/replay behavior.

Behavior/contracts traced: Host binding remains the tenant selector with no default fallback. A wake is admitted only when the captured run revision still equals the workflow’s current pointer, the exact definition and message remain live, relay and channel membership are current, and run/message/definition/channel/owner/recipient tags agree. Rendered trigger text supplies only legacy routing tags; authority-bearing mention provenance comes independently from the owner-authored template. Message, thread/mention projections, and all recipient wakes commit in one transaction before fan-out. Transient authority lookup and body/transport failures replay the same signed wake through verification; terminal denial or malformed authority does not replay.

Findings: no blocking or non-blocking code defect identified. The R1 changed-head fix correctly maps real host-resolution pool/IO/recognized PostgreSQL failures to 503 while retaining unmapped-host/absent authority as 404 (crates/buzz-relay/src/api/workflows.rs:256-314). The production-seam regression exhausts the actual one-connection pool and proves the unchanged run/message recovers after release, without cross-tenant fallback (crates/buzz-relay/src/workflow_delivery_tests.rs:705-815). Current/live authority checks are at crates/buzz-relay/src/api/workflows.rs:324-420; atomic persistence and post-commit fan-out are at crates/buzz-db/src/store/workflow_delivery.rs:8-48 and crates/buzz-relay/src/workflow_sink.rs:455-525; ACP replay and full bundle verification are at crates/buzz-acp/src/lib.rs:3261-3318 and crates/buzz-acp/src/workflow_wake.rs:89-168.

Author action: none.

Verification owner: exact-head CI completed successfully; product/rollout ownership only if stronger cancellation semantics than the documented read-time authority boundary are desired later.

Validation: git diff --check d2a80d819979efbf4b02e8b322a425c91c18e046..d739b1a2b5b5c4482031b03012cf8cb30ea81838 passed at clean detached exact head. One lane ran cargo test -p buzz-acp: 931 unit and 9 lifecycle tests passed, 0 failed, with HEAD unchanged. My independent cargo test -p buzz-relay --lib attempt compiled the package but the test binary was SIGKILLed by the reviewer environment before results; this is not attributed to the PR. GitHub’s final immutable-head read reports 50 successful checks, no pending or failed checks, including Rust unit/lint, PostgreSQL and relay integration, ACP/mesh lifecycle, Desktop core/E2E, security, Windows/macOS, and Linux image builds.

Manual/native evidence: not applicable; no visual UI behavior changed.

Residual risk: authority uses separate current-pointer and live-event reads, not a lease. An edit/deletion after a successful response cannot retract already queued or running work; the endpoint and rollout guide explicitly document that bounded race. No independent local native PostgreSQL/Redis corpus was completed in this review session; exact-head integration gates and the real-pool regression cover that boundary.

— :bot: Jude’s code review agent

This comment has been minimized.

Sign in to view

loganj force-pushed the larry/workflow-revision-foundation-v4 branch from ca2c16c to e191591 Compare August 28, 2026 16:56

loganj force-pushed the larry/workflow-auto-mention-wake-v4 branch from b681de0 to afb19c3 Compare August 28, 2026 18:33

This comment has been minimized.

Sign in to view

loganj force-pushed the larry/workflow-revision-foundation-v4 branch 2 times, most recently from 8368014 to bb7de1e Compare August 28, 2026 21:30

loganj force-pushed the larry/workflow-auto-mention-wake-v4 branch from afb19c3 to 24922e1 Compare August 28, 2026 21:42

This was referenced Aug 28, 2026

Persist exact workflow revisions additively #6960

Open

Add owner-authorized manual workflow triggers #6964

Open

Reconcile provable legacy workflow revisions #6963

Closed

loganj marked this pull request as ready for review August 31, 2026 19:10

loganj requested a review from a team as a code owner August 31, 2026 19:10

loganj force-pushed the larry/workflow-revision-foundation-v4 branch from bb7de1e to 8a1ec91 Compare September 1, 2026 16:45

loganj force-pushed the larry/workflow-auto-mention-wake-v4 branch 2 times, most recently from 5c68804 to 15826a9 Compare September 1, 2026 18:25

jedwards27 approved these changes Sep 2, 2026

View reviewed changes

loganj and others added 11 commits September 4, 2026 06:22

loganj and others added 22 commits September 4, 2026 06:22

Integrate workflow delivery with domain datastore tracing

9a5f9d4

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Place wake migrations after updated workflow foundation

38dfdab

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

Point FTS migration fixture at renumbered wake migration

6c9a563

Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>

test(search): assert raw NULL and negated-query privacy for workflow …

ac53888

…wakes Signed-off-by: Logan Johnson <loganj@squareup.com>

fix(search): skip proven-safe wake FTS policies and preserve generate…

51a3359

…d storage Signed-off-by: Logan Johnson <loganj@squareup.com>

fix(workflow): bind wake admission and resumes to captured authority

12c47e8

Signed-off-by: Logan Johnson <loganj@squareup.com>

fix(workflow): retain deletion revocation on approval resume

f0c268d

Signed-off-by: Logan Johnson <loganj@squareup.com>

fix(acp): distinguish pending and absent wake signing identities

6db59cc

Signed-off-by: Logan Johnson <loganj@squareup.com>

test(acp): ignore heartbeat frames in wake replay assertion

2e370d5

Signed-off-by: Logan Johnson <loganj@squareup.com>

fix(workflows): rely on read authorization without rewriting event se…

ed2e303

…arch history Signed-off-by: Logan Johnson <loganj@squareup.com>

loganj force-pushed the larry/workflow-revision-foundation-v4 branch from 92f15c0 to d2a80d8 Compare September 4, 2026 11:29

loganj force-pushed the larry/workflow-auto-mention-wake-v4 branch from 15826a9 to d739b1a Compare September 4, 2026 11:35

jedwards27 approved these changes Sep 4, 2026

View reviewed changes

Navigation Menu

Uh oh!

Wake agents from verified workflow mentions - #6965

Wake agents from verified workflow mentions#6965
loganj wants to merge 33 commits into
larry/workflow-revision-foundation-v4from
larry/workflow-auto-mention-wake-v4

loganj commented Aug 27, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

This comment has been minimized.

jedwards27 left a comment

Uh oh!

jedwards27 left a comment

Uh oh!

jedwards27 left a comment

Uh oh!

loganj commented Sep 4, 2026

Uh oh!

jedwards27 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

loganj commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Stack and scope

Schema, cost, and rollout

Validation and review

Uh oh!

This comment has been minimized.

This comment has been minimized.

jedwards27 left a comment

Choose a reason for hiding this comment

Uh oh!

jedwards27 left a comment

Choose a reason for hiding this comment

Review verdict: approve

Verification and confidence gaps

Uh oh!

jedwards27 left a comment

Choose a reason for hiding this comment

Review verdict: approve

Uh oh!

loganj commented Sep 4, 2026

Uh oh!

jedwards27 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

loganj commented Aug 27, 2026 •

edited

Loading