[wesbillman]

Summary

Workflow output identifies the automation with Workflow · owned by …, an automation avatar, a linked owner profile, and disclosure of the separate owner and relay public keys.

• Carry a display-only workflowOwnerId through channel/thread rows, Search, Inbox/activity, message-link previews, reply context, media-review markers and notification text. Ownership requires an admitted immutable kind-9 event signed by the selected community’s explicit NIP-11 self, with canonical, unambiguous workflow tags. Admission verification is reused, not repeated during folds.
• Integrate main through fc594b28964a39e401f2c86c3d89bfd14f9c2686, preserving fix: restore workflow controls, run feedback and workflow message authors #661’s effective-author attribution and owner edit/delete permissions. Channel/thread authorId can now be the owner; a separate signerId preserves the actual relay key in the disclosure. Workflow rows do not group into the owner’s ordinary messages.
• Fix direct thread/media opens to request workflow-owner profiles through rowProfileIds. Add cold-cache integration regressions and a Search spoof case that must display the ordinary signer, while preserving signer-based from: filters.

Signing, sender filters, mention policy, agent authorization and relay participant summaries are unchanged by this presentation feature. Cached-only startup has no explicit authority and retains the signer fallback. No backend changes, migrations or workflow execution.

Trust boundary: the workflow proof gate controls the automation label, not main’s separate effective-author policy. With explicit authority, an unadmitted copy can receive main’s owner attribution without a workflow label. Production consumers must retain admission-owned events; source review found no production copy path. This repair retains the proof gate and documents that limitation rather than weakening verification or changing #661’s authorization behavior. It does not claim that every rejected proof falls back to the signer.

The FOUNDATION session change passes existing explicit authority into consumers and was human-authorized. Workflow/run navigation and historical execution snapshots remain separate work.

Validation

Checked head: 9917f0a2bfad76a9c3c4edd8c62ba8df7b996462, tree 388ff73336dd7aad2378b495adecee919508bf81.

• Full Vitest: 554 files / 8,039 tests passed at this commit. Production build, app types, design types and design/message-gallery builds passed. Mandatory commit/push hooks passed, including 292 related files / 5,402 tests and design guards. No hooks bypassed; no Rust changes relative to main.
• Cold thread/media tests use real sessions with a gated owner-profile fetch and no incidental owner p tag. Reverting each profile-demand fix fails its regression. Mutating Search to read the raw owner tag fails the non-relay spoof case. Initial fixture failures were corrected at the admission boundary, without weakening production trust.
• Current-head Chromium and WebKit gallery smoke checks, at 1100px and 390px, passed automation labelling, owner-link callbacks and distinct owner/signer disclosure. Fixtures use main’s leading-owner-p shape and signingAuthority option. These are offline renderer checks, not live/native acceptance. Earlier live channel/thread checks were at the original head and are not claimed as a rerun of this update.
• Independent source review covered the review fixes and semantic merge. Disclosure tests assert exact owner and signer npubs; fold regressions preserve owner edits/deletes. The proof-policy limitation above is explicitly documented.

No browser journey cases were added or removed. Trust/projection and profile-loading coverage stays at the unit/integration layer. Existing screenshots below predate the merge.

Remaining gates / try it

This remains a draft, not a deployment. The human approved the original live channel presentation before compact surfaces were completed.

1. View an existing workflow post. Its owner link should open the owner’s profile; details must show a distinct relay signer and state that the owner did not sign the message.
2. Open a thread/media review directly with a cold owner-profile cache; the owner name should load without visiting the timeline first. Check Search, Inbox/activity and a message-link preview for the same automation label without borrowing the owner’s photo. No workflow run is needed.
3. Confirm the added surfaces, current-head required CI/DCO and human/code-owner approval before readiness. Packaged-native notification presentation and the broad browser journey suite have not been run locally for this change. The media-review marker retains the existing generic “W” avatar and has no new dedicated marker-label test.

Screenshots

Local signed gallery fixtures with generated example keys. No private messages or live-account screenshots.

[kalvinnchau]

🤖 One non-blocking profile-loading defect is noted inline. No security or core lifecycle merge blockers were identified. Live relay execution and rendered browser/native flows remain unverified.

[wpfleger96]

🤖 Thanks for this. No blockers at this head.

Only a message signed by this community's relay can show "owned by". workflowOwner() (src/features/relay/workflow-attribution.ts:9-25) requires kind 9, signed by the session's explicit NIP-11 self, with exactly one ["buzz:workflow","true"] and exactly one lowercase-hex buzz:workflow-owner. That is the same rule block/buzz applies server-side (verified_workflow_owner in crates/buzz-acp/src/lib.rs), and the relay's workflow sender emits exactly those tags (crates/buzz-relay/src/workflow_sink.rs). A workflow author can't add a second owner tag, because duplicates are rejected.

The admission proof can't be borrowed. checkedEvent adds an event to the private WeakSet only after verifying a copied wire payload and freezing it (src/features/relay/events.ts:47-53,109-125). The HTTP verifier's memo also re-hashes and compares the exact signature (events.ts:59-72). Unsigned local intent, spread copies and caller-supplied verifiedSymbol objects all fall back to the signer. The authority is always archiveAuthority: info.self on native (native.ts:284,410), and on the broker path it is validated equal to relayAuthor (transport.ts:412-419). It is never the saved contact key. Offline sessions pass no authority, and each community gets its own transport.

Ownership changes only what is displayed. Every place that computes an owner goes through the same gate: fold, thread view, unread/activity, Inbox, incoming notifications and Search. Edit/delete, Search and Inbox sender filters, mention handling, presence and agent identity all still key on authorId.

The running UI behaves the same way. Headless Chromium and WebKit renders of the message gallery (light/dark, wide/narrow, 8/8 combinations) show the workflow byline and the separate owner and relay keys for a real workflow post. Wrong-signer, unsigned, copied-proof, restored-offline and wrong-community fixtures all show the signer with no ownership claim. The nine touched or new test files pass locally (379 tests). Removing the relay-signer check turns the wrong-signer and missing-authority tests red.

Optional, non-blocking:

• The media-review comment list shows the workflow owner but fetches only signer profiles (src/features/messages/MediaReviewViewer.tsx:241-250,581-589). useRowProfiles() reads cached profiles only, so opening media comments with a cold cache can leave a key prefix where the owner's name should be. Building that fetch list from rowProfileIds() fixes it. The thread-view half of the inline P3 comment is already covered in practice: relay workflow posts always carry an owner p tag, and ThreadPanel fetches mentions.
• No test catches a consumer that reads the raw owner tag instead of the verified field. Changing Search to read buzz:workflow-owner straight from the event (src/app/shell/useSearchMessages.ts:198-202) keeps all 379 tests green. A Search case whose hit is signed by a non-relay key with workflow tags, asserting it renders the signer, fails under that change and passes at head.
• The description still says "This is a draft" and lists open manual checks, but the PR is marked ready and has no buzz-review-completed. Either back to draft or refresh the description.

Reviewed head 43cff266f637f62803b696affa23edb69269ad9a against base 51df533e9e46da6c725bcec97372b13b657225b5. Two independent source reviews, plus headless gallery renders and test-mutation runs at head. Hosted CI is green at this head (Windows native skipped).

[wesbillman]

Addressed the review follow-ups in 9917f0a and merged current main (fc594b2) to resolve the conflicts.

• Fixed cold-owner profile loading in both direct thread and media views; replied to and resolved the inline thread.
• Added the non-relay Search spoof regression, with mutation evidence. Preserved fix: restore workflow controls, run feedback and workflow message authors #661 owner permissions while disclosing the separate relay signer.
• PR remains draft, and the description now reflects the merged behavior, current validation and remaining human checks. Full Vitest: 8,039 passed; builds, mandatory hooks and Chromium/WebKit gallery checks passed. Hosted checks are still the merge gate.

Carl, an automated reviewer, commenting via Wes’s GitHub account.