Repository navigation
test(agents): align harness fixture with owner authorization - #2445
Closed
kalvinnchau wants to merge 1 commit into
Closed
kalvinnchau wants to merge 1 commit into
kalvinnchau wants to merge 1 commit into
Conversation
use a non-owner signer for rejected workflow-marked input and assert that markers do not revoke direct owner authority. remove the stale blanket-rejection comment. Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz> Signed-off-by: Kalvin Chau <kalvin@block.xyz>
joahg
reviewed
Nov 4, 2026
joahg
left a comment
joahg
left a comment
Member
There was a problem hiding this comment.
🤖 Thanks, this fixes the failure too, but I'd close it in favor of #2444, which is ready and green.
- The non-owner workflow case repeats an existing check. Signing the refusal fixture with
mallorymakes it the same check as themallorymention just above it. It doesn't exercise a real relay workflow mention, which is the case the kit actually refuses:kit.conversationcallsfromOwnerwithout aWorkflowCheck. - The doc comment it removes is still true.
(a workflow's never is)still describes the kit, because a delegated workflow mention signed by the workflow key is never admitted. Dropping it hides a deliberate difference from the bundled harnesses. #2444 keeps the comment and also documents that difference indocs/workflows.md.
The owner-plus-marker assertion is useful, and #2444 has the same one.
loganj
added a commit
that referenced
this pull request
Nov 4, 2026
…#2444) 🤖 ## Summary - `main` fails the JavaScript unit tests at `src/features/agent-harness/kit.test.ts` ("refuses a mention from anyone else, and triggers that are not its"). This PR makes it pass again without changing what agents accept. - The cause is two PRs that merged in an order neither one expected. #2364 added the harness kit, which plugin agent types use to decide which messages start a turn. Its test was written against the rule from #2360, which refused every message that carried a workflow tag. #2399 merged before it and restored the older rule, which accepts any message the agent's owner signs. The test's "workflow" message was signed by the owner, so it was accepted. - The kit's behavior has not changed. It still accepts only messages from the owner or an agent the owner attests. A real relay workflow message is signed by the community's workflow key, so the kit still refuses it. Only the test fixture was out of date. ## Details - The fixture is now a real relay workflow mention: signed by the community's workflow key, owned by the agent's owner, and aimed at this agent. The bundled harnesses (Claude Code, Codex, Pi, Goose) would run this message. - Before checking the refusal, the test first checks that the bundled workflow check accepts the fixture. Without that step the negative test could pass for the wrong reason again. Giving the kit the bundled workflow check makes the test fail. - The test also checks that an owner mention with only a `buzz:workflow` marker is still accepted: the marker neither grants authority nor removes the owner's own. This covers the same fix as #2445, so this PR includes it. - `docs/workflows.md` listed only Claude Code and Codex as accepting workflow mentions. It now lists Pi and Goose too, and says that plugin agent types do not. ## Deliberate divergence A workflow that mentions an agent of a plugin-provided type is ignored, while the same workflow wakes a Claude Code or Codex agent. This is intentional. #2399 restored workflow mentions for the bundled harnesses only to keep existing behavior working, and it says the template/substitution issue from #2360 is still open. Plugin agent types have never accepted workflow mentions, so nothing regresses. Accepting them would give these agent types a known open issue. If the team wants plugin agent types to accept workflow mentions after the follow-up discussion on workflow authorization, that change belongs in its own PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Logan Johnson <loganj@squareup.com> Co-authored-by: Larry <627498bd4bd1f281a16431e3c6cce3b5c25b6692798c78672298aefbf2f8f8b5@buzz.block.builderlab.xyz> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main JavaScript CI fails because the harness rejection fixture is authored by the agent's owner while expecting a workflow marker to revoke that authority. #2399 intentionally restored direct owner/attested admission before #2364 introduced this fixture.
Use a non-owner signer for the rejection case and assert that the same marker does not revoke direct owner admission. Remove the stale blanket workflow-rejection API comment. Authorization implementation is unchanged; no delegated-workflow capability is added to the kit.
Validation:
1da5031ab0b11b6a43f249d1cfc3411cb5b30e5f, matching runs 41863318752 and 41865346731.c82bc104addfda3386a5c05253deddd33854fbdd: TypeScript, 28 related test files (742 passed, 1 skipped), and design types/guards. No full suite manually invoked.c82bc104addfda3386a5c05253deddd33854fbdd; CI required passed at 2026-11-04 17:20:58 UTC. All four JavaScript shards and 23 browser journey shards passed. The affected file passed 18/18 in JavaScript 1/4 (4,397 tests passed); the affected case passed 10/10 hosted repetitions.