[tee8z]

Behavior

A gateway-owned workflow can now prompt that gateway's owner's remote agents. The relay must sign the workflow prompt and prove that the stored step explicitly named the target agent. The launcher and harness then apply the same live owner grant, posting membership and channel scope checks used for direct gateway prompts.

This consumer depends on #154 and targets its branch. Onboarding and terminal attach are separate consumers of that foundation.

Boundary	Required authority
Mention listener	Verified relay identity, workflow owner and explicitly authored agent mention
Launch	Fresh grant, current owner/agent/gateway posting membership, current remote registration and channel state
Model ingress and queued dispatch	Verified workflow signature and target; live grant and matching bound channel membership

The final launch boundary verifies the workflow proof again. Custom owner tags and substituted mentions convey no authority. Gateway-owned workflow definitions retain ordinary account permissions; this adds no authority over the human owner's workflow definitions, administration, DMs or model settings.

ACP reuses the relay identity from the same bounded membership snapshot. Reaper channel and registration authority reads now also request the writer explicitly.

Validation

• ACP full library suite: 1133 passed, 3 ignored. Reaper full suite: 145 passed, 3 ignored.
• Focused gateway tests: ACP8 and reaper4 passed. They cover a successful workflow launch, forged or tampered proof, wrong channel or target, expired/revoked grants and membership removal. The ACP cases exercise both ingress and queued dispatch.
• Both packages pass all-target Clippy with warnings denied; formatting, differential file-size and diff checks pass.
• Three production guard mutations failed regression assertions: trusting a raw owner tag, omitting the bound-channel comparison, and omitting the final launch proof. Sources were restored; ACP8, the full reaper suite and Clippy passed again.
• Repository-wide just ci, the complete relay integration gate, independent consumer review and human acceptance remain pending. This PR stays draft.

Human acceptance: grant a separate gateway already admitted to the relay and test channel, create a workflow with that gateway key and an explicit agent mention in the stored step, then trigger it. Confirm one owned agent sandbox answers. Revoke the gateway or remove its channel membership, wait for the 30-second harness cache bound, and trigger again: no further gateway model prompt or cancellation should be admitted. A target introduced only through substituted trigger text must remain unauthorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tee8z]

Superseded by #161 on a linear branch based on the latest #154 foundation. The feature patch is unchanged and the complete source tree matches this branch; signed commit 9370cfa preserves the original commit attribution with a cherry-pick reference. Existing published history remains available here. Validation and independent review continue on #161.