From 9aa7d4d51828de1e0a46b3322909c0d26e545cdb Mon Sep 17 00:00:00 2001 From: Sawyer Date: Wed, 2 Sep 2026 08:41:03 -0700 Subject: [PATCH 1/2] Update docs: scheduled fires authorize as the run principal (CL-7354) --- docs/workflow-model.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/workflow-model.md b/docs/workflow-model.md index 15c57ad74..2f6aab99c 100644 --- a/docs/workflow-model.md +++ b/docs/workflow-model.md @@ -54,7 +54,7 @@ storage. | Store source (create / republish) | `@corbits/workflows`'s `./authoring` registry → `AssetService.createAsset` / `populateAsset` (hub-signed commit) | Initiating tenant + principal; `@intx/authz` `authorize` on `asset:*`/`create` or `asset:`/`write` | None (writing source is not a side effect) | | Deploy source | `POST /api/tenants/:tenantId/workflows/deployments` → vendored `SessionService.deployWorkflowFromSource` | Tenant session or run bearer; `workflow:*`/`create` | Agent-initiated deploys go through an `approval: "ask"` tool call carrying the probed capability surface (below) | | Create / update a routine | `createRoutineRoutes` `POST /routines`, `PATCH /routines/:id`; the run-authenticated mirror `createWorkflowRoutineRoutes` delegates to the same store | Tenant + principal; target validated against the resolution rule above before persisting | None; a routine only references a definition asset — nothing executes at create/update time | -| Launch | `launchAndCorrelate` (`packages/routines/src/routes.ts`) → hub `RoutineLauncher` | Routine's tenant; grants materialized by the native launch path | Runtime tool calls with `approval: "ask"` park on the native `approval` resource | +| Launch | `launchAndCorrelate` (`packages/routines/src/routes.ts`) → hub `RoutineLauncher` | The workflow run's own principal, granted natively (per-pin tool grants, mail-triggered run grants); no creator re-authorization — the fire's gates are fail-closed target resolution plus native grant materialization | Runtime tool calls with `approval: "ask"` park on the native `approval` resource | | Approve | Native `POST /api/tenants/:tenantId/approvals/:id/approve` | A principal holding `approval:*`/`resolve` — a human; no agent holds it | This is the approval | Credentials and resolved provider secrets never enter source trees, deploy From 0dd2dc04a01778fcaf8c24dc6efd444c8829092a Mon Sep 17 00:00:00 2001 From: Sawyer Date: Wed, 2 Sep 2026 08:49:09 -0700 Subject: [PATCH 2/2] Fix prettier formatting in workflow-model.md table (CL-7354) --- docs/workflow-model.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/workflow-model.md b/docs/workflow-model.md index 2f6aab99c..386c7074c 100644 --- a/docs/workflow-model.md +++ b/docs/workflow-model.md @@ -49,13 +49,13 @@ storage. ## Authority boundaries -| Operation | Canonical operation | Authorized as | Human approval | -| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------- | -| Store source (create / republish) | `@corbits/workflows`'s `./authoring` registry → `AssetService.createAsset` / `populateAsset` (hub-signed commit) | Initiating tenant + principal; `@intx/authz` `authorize` on `asset:*`/`create` or `asset:`/`write` | None (writing source is not a side effect) | -| Deploy source | `POST /api/tenants/:tenantId/workflows/deployments` → vendored `SessionService.deployWorkflowFromSource` | Tenant session or run bearer; `workflow:*`/`create` | Agent-initiated deploys go through an `approval: "ask"` tool call carrying the probed capability surface (below) | -| Create / update a routine | `createRoutineRoutes` `POST /routines`, `PATCH /routines/:id`; the run-authenticated mirror `createWorkflowRoutineRoutes` delegates to the same store | Tenant + principal; target validated against the resolution rule above before persisting | None; a routine only references a definition asset — nothing executes at create/update time | +| Operation | Canonical operation | Authorized as | Human approval | +| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | +| Store source (create / republish) | `@corbits/workflows`'s `./authoring` registry → `AssetService.createAsset` / `populateAsset` (hub-signed commit) | Initiating tenant + principal; `@intx/authz` `authorize` on `asset:*`/`create` or `asset:`/`write` | None (writing source is not a side effect) | +| Deploy source | `POST /api/tenants/:tenantId/workflows/deployments` → vendored `SessionService.deployWorkflowFromSource` | Tenant session or run bearer; `workflow:*`/`create` | Agent-initiated deploys go through an `approval: "ask"` tool call carrying the probed capability surface (below) | +| Create / update a routine | `createRoutineRoutes` `POST /routines`, `PATCH /routines/:id`; the run-authenticated mirror `createWorkflowRoutineRoutes` delegates to the same store | Tenant + principal; target validated against the resolution rule above before persisting | None; a routine only references a definition asset — nothing executes at create/update time | | Launch | `launchAndCorrelate` (`packages/routines/src/routes.ts`) → hub `RoutineLauncher` | The workflow run's own principal, granted natively (per-pin tool grants, mail-triggered run grants); no creator re-authorization — the fire's gates are fail-closed target resolution plus native grant materialization | Runtime tool calls with `approval: "ask"` park on the native `approval` resource | -| Approve | Native `POST /api/tenants/:tenantId/approvals/:id/approve` | A principal holding `approval:*`/`resolve` — a human; no agent holds it | This is the approval | +| Approve | Native `POST /api/tenants/:tenantId/approvals/:id/approve` | A principal holding `approval:*`/`resolve` — a human; no agent holds it | This is the approval | Credentials and resolved provider secrets never enter source trees, deploy requests recorded by `@corbits/workflows`'s `./deploy-source`, or routine rows.