[tee8z]

Behavior

A gateway-owned workflow can now prompt that gateway's owner's remote agents. The relay must sign the workflow prompt and prove that the stored step explicitly named the target agent. The launcher and harness then apply the same live owner grant, posting membership and channel scope checks used for direct gateway prompts.

This replaces #157 with a linear consumer branch while preserving that published history. Its feature patch is byte-identical to the reviewed implementation.

This consumer depends on #154 and targets its branch. Onboarding and terminal attach are separate consumers of that foundation.

Boundary	Required authority
Mention listener	Verified relay identity, workflow owner and explicitly authored agent mention
Launch	Fresh grant, current owner/agent/gateway posting membership, current remote registration and channel state
Model ingress and queued dispatch	Verified workflow signature and target; live grant and matching bound channel membership

The final launch boundary verifies the workflow proof again. Custom owner tags and substituted mentions convey no authority. Gateway-owned workflow definitions retain ordinary account permissions; this adds no authority over the human owner's workflow definitions, administration, DMs or model settings.

ACP reuses the relay identity from the same bounded membership snapshot. Reaper channel and registration authority reads now also request the writer explicitly.

Validation

• ACP full library suite: 1133 passed, 3 ignored. Reaper full suite: 145 passed, 3 ignored.
• Focused gateway tests: ACP8 and reaper4 passed. They cover a successful workflow launch, forged or tampered proof, wrong channel or target, expired/revoked grants and membership removal. The ACP cases exercise both ingress and queued dispatch.
• The PostgreSQL discovery and wrapper convention checks also pass with the foundation fix included.
• Both packages pass all-target Clippy with warnings denied; formatting, differential file-size and diff checks pass.
• Three production guard mutations failed regression assertions: trusting a raw owner tag, omitting the bound-channel comparison, and omitting the final launch proof. Sources were restored; ACP8, the full reaper suite and Clippy passed again.
• Repository-wide just ci, the complete relay integration gate, the final combined runtime review and human acceptance remain pending. This PR stays draft.

Human acceptance: grant a separate gateway already admitted to the relay and test channel, create a workflow with that gateway key and an explicit agent mention in the stored step, then trigger it. Confirm one owned agent sandbox answers. Revoke the gateway or remove its channel membership, wait for the 30-second harness cache bound, and trigger again: no further gateway model prompt or cancellation should be admitted. A target introduced only through substituted trigger text must remain unauthorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tee8z]

Independent review of the gateway workflow consumer change (9370cfad4, equivalent consumer patch to 2a73e9a68): no concrete blocker found. Minimalism 9/10, elegance 9/10, correctness 9/10.

I traced ACP ingress and queued dispatch, relay-signature and explicitly authored agent-target proof, signed channel scope, fresh delegation/membership reads, reaper delivery admission, and final Start validation. Invalid proof, mismatched target/channel, expiration, revocation, and channel removal fail closed; the gateway does not gain owner workflow administration.

I independently reran the compiled production-seam journeys gateway::tests::workflow::gateway_workflows_require_provenance_scope_and_live_authority and mentions::tests::workflow::gateway_owned_workflow_launches_only_with_live_proven_authority; both pass. Live local relay testing separately confirms direct gateway dispatch, decryptable telemetry, and cancellation reaching a deterministic ACP peer, with no model calls. The full deployment and human testing gate remains open.

The optional documentation correction is resolved in d0149cdfc: the workflow example now passes YAML through stdin (--yaml - < workflow.yaml), matching the CLI contract. The PR remains draft pending human runtime confirmation.