feat(acp): isolated workflow-delivery verifier (node E)

[loganj]

🤖

Summary

• Node E of the workflow replacement tree (delegation contract: A → B → E), stacked on B (feat(workflows): define delivery protocol vocabulary #6818, darryl/delivery-protocol-vocabulary).
• Adds crates/buzz-acp/src/verifier.rs: a pure, zero-I/O module that centralizes exact definition/message/owner/channel/step/cause verification for durable workflow deliveries, built on the canonical buzz_core::workflow_delivery vocabulary.
• Dormant by contract: no polling, claims, dispatch, producer, or production reachability. The capability-gated ACP runtime (node F) is the future caller. PRs fix(workflows): authorize owner-triggered agent wakes via signed doorbells #2737 and fix(workflows): let owners manage agent-created workflows #6697 are unchanged.

Details

Why. The preserved #2737 verifier flattened every failure to None, so a transient fetch failure was indistinguishable from a forged binding, and the recorded run cause was never re-verified. This node fixes both while preserving the fail-closed behavior of every existing check.

Typed outcomes. verify_workflow_delivery returns VerifyError::Mismatch(MismatchKind) (permanent — binding disagreement or forgery; never retried) vs VerifyError::Unavailable(UnavailableKind) (transient — required signed authority not supplied; retriable). Neither variant may become dispatch. The verifier performs no I/O: callers fetch the signed definition/message/cause events and pass them in (FetchedAuthority), so absence is typed as Unavailable, never conflated with mismatch.

Canonical vocabulary (from B).

• Wake authentication uses the identifier-only WorkflowDeliveryWake strict parse (kind 24620, relay-authored, signature-verified, exact target). Wakes are hints: they name a delivery and nothing else; every binding field is verified against signed authority, not wake tags.
• Target admission uses message_v1_targets: only the canonical four-field message-v1 marker p-tag admits a durable delivery recipient. Ordinary mentions never do; malformed marker tags fail closed.
• The recorded WorkflowDeliveryCause is re-verified. An Event cause requires the exact signed event (id + signature + channel binding → Mismatch on disagreement, Unavailable when not supplied). Schedule/Webhook identities are opaque typed server-side authority and cannot be conflated with an absent signed cause.

Preserved behavior. Definition identity (kind 30620, d workflow UUID, h channel), message identity (kind 9, channel, relay authorship, workflow-definition/run/step tags), step lookup + send_message action + channel-field consistency, trigger-context revision binding, and exact template re-render equality all match the preserved #2737 source; so do workflow_delivery_principal / is_workflow_delivery_candidate fail-closed admission.

Tests. 10 pure tests including mutation vectors: every binding field (workflow, run, step, channel, target, definition event, message event, cause, rendered content) is flipped one at a time and must produce a permanent Mismatch; every dropped input must produce a transient Unavailable; a control fixture verifies. Cause verification requires independent authority for every cause class — the exact signed event for Event, the durable scheduled_workflow_fires claim binding (community, workflow, slot, linked run) for Schedule, and the durable invocation record binding for Webhook (the record itself is owned by a later node; modeled as the required typed authority input). The claimed delivery row is never its own proof: absent authority is Unavailable(Cause); disagreeing, unbound, or wrong-class authority is Mismatch(Cause), covered by one-field row mutations (different community, same-slot different workflow, different slot/invocation, different linked run, unattached run) for both durable classes. Validated with cargo fmt --check, cargo clippy -p buzz-acp --all-targets -- -D warnings, and cargo test -p buzz-acp (811 unit + 9 integration passing) at this exact head.

Buzz channel: buzz-workflow-owner-trigger-a-foundation (11ae68c1-38e7-4591-958e-e4da94d758f0)