Add owner-authorized manual workflow triggers

[loganj]

🤖
I’m Larry. This PR adds owner-authorized manual workflow triggering on the exact-revision foundation in #6960.

Summary

Manual runs now require the workflow identity or its immutable human owner, active channel membership, an enabled in-scope workflow, and the current signed revision. Missing or stale revisions, ordinary channel-member requests, and revoked owners fail closed. Approval resumes retain the run’s original signed revision instead of picking up later definition edits.

CLI and Desktop use the SDK trigger builder. Each new invocation carries a unique request ID, so two otherwise identical requests in the same second create distinct runs. Redelivering the same signed request returns the original committed run ID and identical response, provided its authorization and revision remain valid. Command persistence and run creation share one transaction.

Related issue

No exact duplicate found in the earlier scope search. Stacked on #6960 (bb7de1e3, workflow revision migration 0041); supersedes the corresponding manual-trigger scope from #6721. Does not change #2737 or #6697.

Testing

At 0f5fded7189a49160b6f3745143d757cb70f5309, on Blox:

• Full DB/relay package tests, all root unit-test groups, and Desktop Rust tests (2,993 unit tests plus integration targets); DB/relay and Tauri Clippy.
• The actual nextest archive/selector against a freshly pgschema-initialized database: 10 ignored manual-trigger/revoked-owner tests and all 11 workflow DB tests passed. Non-ignored parser/tag tests passed in the ordinary unit lane.
• Coverage includes older-after-newer delivery, same-second distinct requests, sequential replay, concurrent delivery/retries, authorization, approval revision binding, and revoked-owner disclosure.

The backend integration CI job now explicitly runs the ignored PostgreSQL manual-trigger regressions from its existing nextest archive. CI status and evidence are recorded separately rather than treating prior-head checks as validation of this head.

Compatibility: third-party trigger clients must preserve the same signed event for a retry and vary unsigned event fields for a distinct invocation. The SDK supplies this identity automatically. A retry after revocation, disabling, or revision replacement is rejected rather than treated as a new authorization grant. This PR does not add a workflow-run lookup index or schema-level uniqueness constraint; it relies on transactional event-ID deduplication in the manual-command route.

[loganj]

🤖 I’m Larry. The identity/replay fixes and restack are published at 5c314b3c25d2672bd6e1a1427974702fecbb47c8, based on 53b92fc6d0e5ad0ae28617aebe75f491cb73c276.

• Distinct invocations now receive distinct unsigned request IDs, including within one second. Exact replay recovers the committed run ID and returns the original response rather than a generic duplicate acknowledgement.
• Transactional persistence, immutable ownership, tenant/channel membership, current-revision checks, and approval-resume revision binding remain enforced. Revoked-owner definition disclosure is covered explicitly.
• Independent review cleared the identity/replay change, restack integration, and final CI-only delta. Final exact-head evidence review: 9.8/10, no findings. No further fix round is indicated unless final CI exposes a causal failure.

Exact-head validation

Blox workstation larry-buzz-6964-identity (2170726), with logs identifying the same SHA at completion:

Check	Result
SDK / CLI	302 / 414 passed
DB package	113 passed, 243 infrastructure tests ignored in ordinary run
Relay	994 library tests passed, 95 ignored; 13 additional target tests passed
Explicit PostgreSQL regressions	12 command-executor + 1 revoked-owner + 2 foundation revision tests passed
Root unit-test groups	All nine passed
Desktop Rust	2,980 library tests passed, 18 ignored; workspace integration targets passed
Lint	Root targeted and Tauri Clippy with warnings denied passed

Retained evidence directory: WORK_LOGS/buzz-workflow-manual-trigger-v4-evidence/.

• identity-publish-5c314b3c-root.log: SHA-256 9864aa2723a9d854665ec81ee72ac3b549b6b3aaac315849588576b930a766f7
• identity-publish-5c314b3c-desktop.log: SHA-256 e179be3fbc5d143d5402f9b77fb6b9ed19d65a58fa79490ac5bcce5480129300

Publication skipped only the local rust-tests and desktop-tauri-checks lanes because those exact unchanged-SHA checks already passed on Blox. Branch-skew, file-size, and push-head-scope guards ran and passed; DCO is green. All five commits retain Logan as author/committer, my co-authorship, and Logan’s sign-off.

Final-head CI is running. The new archive-based PostgreSQL gate still requires its actual CI execution result; previous-head CI is not evidence for this head. No merge or auto-merge was requested or performed.

Residual scope: third-party clients must preserve retry identity and distinguish new operations. No new run-lookup index or schema uniqueness constraint is included; the manual-command route uses transactional event-ID deduplication. These are documented compatibility/performance considerations, not a claim of arbitrary-client exactly-once execution. Protected PRs #2737 and #6697 were not changed.

[loganj]

🤖 I’m Larry. The final CI fixture correction is published at f9a9a12a3151f01c28939b9511f5c6a20dc5a89f, still based on 53b92fc6d.

The first archive-based CI run correctly exposed a bootstrap defect: our fixtures replayed SQLx migration history into CI’s already pgschema-initialized database. I removed fixture-owned migration replay from all three selected workflow fixture entry points. Production code is unchanged. Independent delta review is clear at 9.5/10, no findings.

Causal validation now matches CI: on Blox larry-buzz-6964-identity (2170726), I created a fresh database, applied pgschema plus the canonical reconciliation SQL, verified no SQLx migration history, built the same package/target archive using nextest 0.9.136, and ran the actual CI selectors. Results: 10/10 ignored manual-trigger/revoked-owner tests and 11/11 workflow DB tests passed. This local-to-Blox archive used the debug profile; GitHub supplies the final ci-profile run.

The same exact-head run also passed full relay (994 library + 13 target), SDK (302), CLI (414), DB (113) packages, all root unit groups, Desktop Rust (2,980 library tests plus integration targets), targeted root/Tauri Clippy, and formatting. Non-ignored command parser tests remain in the ordinary unit lane; ignored infrastructure tests outside the explicitly selected scope remain ignored.

Downloaded evidence: WORK_LOGS/buzz-workflow-manual-trigger-v4-evidence/identity-fixture-f9a9a12a-final.log, SHA-256 b8607f87e1b34bba251622f14acc79faf4d90d85a3ec891fe8e67a964212ad53. Blox command 14293644 completed successfully and records the final SHA. I verified the remote ref after pushing. Only rust-tests and desktop-tauri-checks were skipped locally, backed by that exact unchanged-head run; branch-skew, file-size, and push-head-scope guards passed.

Fresh-head GitHub checks remain the delivery gate. The prior-head backend failure is fixed and reproduced, not retried away. No merge/auto-merge; protected PRs #2737/#6697 unchanged.

[loganj]

🤖 I’m Larry. Engineering complete at f9a9a12a3151f01c28939b9511f5c6a20dc5a89f. No further fix round is required.

• GitHub reports 28 successful checks, 4 intentional skips, MERGEABLE, and CLEAN; no unresolved review threads. Base remains larry/workflow-revision-foundation-v4 at 53b92fc6d.
• CI, Docker images, and mesh lifecycle all completed successfully for this head.
• Backend Integration actually ran 10/10 manual-trigger/revoked-owner tests and 11/11 workflow DB tests from the CI-profile archive. This closes the schema-bootstrap failure; downstream integration steps also passed.
• Independent review cleared the implementation, restack, and fixture-only final delta (9.5/10). The previous exact-head Blox evidence is in the validation comment.

Downloaded CI backend log: identity-fixture-f9a9a12a-ci-backend.log, SHA-256 94fd7df9c976cdb7fcd8bb13bfbd0e9a6eedb5bad3529de5003ee9255ad4cb2c. Final PR/check metadata and all required Blox logs/patches are retained locally. Blox workstation 2170726 was deleted after artifact collection; only disposable build outputs, test database, and runner archive were discarded.

The PR remains draft, stacked on #6960, for the human-controlled ready/merge decision. I did not merge, arm auto-merge, or change protected PRs #2737/#6697. Compatibility and deferred index/uniqueness scope remain documented in the description.

[loganj]

🤖 I’m Larry. Restack published at 0f5fded7189a49160b6f3745143d757cb70f5309, on foundation bb7de1e37872746cec63a1c7b1feda4a242b32b9.

The database store extraction moves four transaction/retry wrappers to store/event.rs and store/workflow.rs; the workflow PostgreSQL CI selector follows store::workflow::. The subsequent migration-number restack is patch-identical for all six manual-trigger commits, retaining foundation migration 0041. Prior behavioral reviews remain applicable; no new feature fix was needed.

Exact-head Blox validation on larry-buzz-6964-store-restack / 2177084, command 14332649:

• Fresh pgschema database, actual nextest archive: 11/11 workflow DB, 10/10 manual-trigger/revoked-owner tests.
• Full DB 114+2, relay 994+13 tests; all root unit groups.
• DB/relay all-target Clippy, Tauri Clippy, formatting.
• Desktop Rust 2,993 unit tests plus all integration targets.

Local retained log: WORK_LOGS/buzz-workflow-manual-trigger-v4-evidence/migration-final.log, SHA-256 edaefc7b03a850403607a413e09df9b6ffa6cc997569b0e9eb91fcf542fb8386.

An earlier pre-restack run timed out in the unrelated mesh echo test; it passed both in isolation and in two subsequent full relay runs. The original failure log is retained; its cause is not established. Missing GTK/WebKit dependencies were installed on the same workstation before Tauri checks passed.

Publication skipped only the exact-head Blox-proven rust-tests and desktop-tauri-checks hooks; branch-skew, file-size, and push-head guards passed. Exact-head GitHub CI is the remaining gate. No merge or auto-merge was requested or performed.

[loganj]

🤖 I’m Larry. This PR is ready for human review at 0f5fded7189a49160b6f3745143d757cb70f5309, based on foundation bb7de1e37872746cec63a1c7b1feda4a242b32b9.

• Final-head checks: 29 successful, 4 intentional skips; CLEAN and MERGEABLE; no unresolved review threads.
• Backend integration actually executed 11/11 workflow DB and 10/10 manual-trigger/revoked-owner tests from the CI archive: https://github.com/block/buzz/actions/runs/33213617309/job/98995573800
• The isolated browser smoke shard rerun passed without a code change: https://github.com/block/buzz/actions/runs/33213617309/job/98998387137 . Its original expanded-DM timeout is retained in the work log; no navigation defect or causal fix is claimed.
• Exact-head Blox evidence and preserved behavioral reviews are recorded above. No further fix round is required for this PR.

Marked ready for review. No merge or auto-merge performed. Blox workstation 2177084 was deleted after source/log custody was downloaded and verified.

[loganj]

🤖 I’m Larry. Administrative correction: I restored this PR to draft, preserving the coordinating workstream’s requested state. It remains engineering-ready for human review; draft status does not reflect a remaining code blocker.

The post-readiness delivery concern was reconciled and withdrawn: buzz_db::event::extract_d_tag returns None for kind 46020, so manual triggers use event-ID insertion rather than NIP-33 replacement. The reviewer independently confirmed the exact-head source and CI delivery tests.

Fresh GitHub verification at unchanged 0f5fded7189a49160b6f3745143d757cb70f5309: workflow attempt 2 completed successfully; smoke shard job 98998387137 and aggregate Desktop job 99001440941 both SUCCESS. Overall: 29 successful checks, 4 intentional skips, CLEAN. No additional fix round required.