[Silthus]

Problem

• T3 Code users want their coding agent to start when their product reports an error, a signup or a failed payment. Today that needs a hand-built, hand-signed webhook step.

Impact: Grow Workflows: more orgs start and activate workflows.

Note

Builds on #126752, which adds HMAC-SHA256 body signing to the HTTP webhook step. Both PRs come from a fork, so they can't be stacked natively. Review only the commits after the merge of feat/webhook-body-hmac-signing.

Warning

🟡 Merge risk: medium · two-way door (merge-risk rubric)

• A new CDP delivery step, only for teams with workflow-t3-code-step.
• Revert: revert the merge commit. Turning off workflow-t3-code-step stops new steps only; saved ones run until their workflows are turned off.

Changes

• A T3 Code step (Beta) in the AI section posts instructions, event and person to a T3 Code webhook task.
• With a signing secret, the step signs through the webhook step's HMAC-SHA256 option. Each request carries a webhook-id that T3 Code dedupes retries on.
• A 429 or 5xx reply retries. Other errors fail the step with T3 Code's status and error code.
• Agents set it up over MCP, as the building-workflows skill shows.
• Fetch connection-reset logs now carry the hostname, not a URL that may hold a token.
• A workflow can no longer swap a different gated step in under a stored step's id to skip its flag.

Step picker	Config (story preset, Data {})

Config at 520px

How did you test this code?

Test rationale: the template test catches a secret that leaks into the payload, a missing webhook-id, or an error that drops T3 Code's reply.

• Live run against a T3 Code task: two signed attempts with one webhook-id started one run. Unsigned and wrong-secret requests got 401.
• Not run: CI, which fork PRs don't get, a whole workflow on a stack, and a production-build UI walk.

Live run transcript

# Live run: #126070 at 15e7ed1ea75b2244e6bedf0d1d21ade3a2e32585

The T3 Code template through the real HogExecutorAsyncService.executeFetch, against a T3 Code scratch webhook task that requires x-hub-signature-256 (hex, sha256= prefix) and dedupes on {{headers.webhook-id}}. URL token and secret are not in this record.

    {
      "label": "signed T3 Code step, delivered twice as a retry would",
      "queued_signing": {
        "hmac_sha256": {
          "secret_input": "signing_secret",
          "webhook_id": "d6b2071c-341f-4756-a3b0-fcaec132506a"
        }
      },
      "queue_payload_holds_secret": false,
      "sent": [
        {
          "headers": {
            "Content-Type": "application/json",
            "webhook-id": "d6b2071c-341f-4756-a3b0-fcaec132506a",
            "x-hub-signature-256": "sha256=3d4a002d57722cf04893552abcd2022b20976095410ee40e245ff3379e66b4c0"
          },
          "bodyBytes": 451
        },
        {
          "headers": {
            "Content-Type": "application/json",
            "webhook-id": "d6b2071c-341f-4756-a3b0-fcaec132506a",
            "x-hub-signature-256": "sha256=3d4a002d57722cf04893552abcd2022b20976095410ee40e245ff3379e66b4c0"
          },
          "bodyBytes": 451
        }
      ],
      "replies": [
        {
          "logs": []
        },
        {
          "logs": []
        }
      ]
    }


    {
      "label": "T3 Code step without a signing secret, to a task that requires one",
      "queued_signing": {},
      "queue_payload_holds_secret": false,
      "sent": [
        {
          "headers": {
            "Content-Type": "application/json",
            "webhook-id": "cc90bbe3-6a2c-4f7b-8d66-5212c8fae7bd"
          },
          "bodyBytes": 451
        }
      ],
      "replies": [
        {
          "error": "HTTP fetch failed on attempt 1 with status code 401.",
          "logs": [
            "HTTP fetch failed on attempt 1 with status code 401."
          ]
        }
      ]
    }


    {
      "label": "signed T3 Code step with the wrong secret",
      "queued_signing": {
        "hmac_sha256": {
          "secret_input": "signing_secret",
          "webhook_id": "ab312461-b8f5-4c7d-ba31-721863db3784"
        }
      },
      "queue_payload_holds_secret": false,
      "sent": [
        {
          "headers": {
            "Content-Type": "application/json",
            "webhook-id": "ab312461-b8f5-4c7d-ba31-721863db3784",
            "x-hub-signature-256": "sha256=9e3bcc85dbbb75753a4338a3f3d559976fb772f64335cc3deda8a371bd391287"
          },
          "bodyBytes": 451
        }
      ],
      "replies": [
        {
          "error": "HTTP fetch failed on attempt 1 with status code 401.",
          "logs": [
            "HTTP fetch failed on attempt 1 with status code 401."
          ]
        }
      ]
    }


PASS src/cdp/templates/_destinations/t3_code/t3-code.liveproof.test.ts (7.316 s)

## T3 Code side

One new thread 'PostHog webhook HMAC proof (scratch)' (created 2026-10-31T10:26:10Z), runCount 1: the two signed attempts with webhook-id d6b2071c-341f-4756-a3b0-fcaec132506a started one run. The unsigned and wrong-secret requests got 401 and started none.

Release status

• This change is behind a feature flag and is not available to users

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /writing-tests, /writing-user-facing-copy, /writing-pr-descriptions, full-stop, impact, tdd, qa-swarm, merge-risk

Question	Answer	Who	Where
MCP setup	Agents set it up	👤	comment
Logo	T3 Code logo	👤	comment
Scope	Thin template on #126752	👍	comment
Owner rule	Dropped for #126468	👍	comment
Flag	Hidden, flag-gated	🤖	comment
Errors	One message with T3's code	🤖	comment

Involvement: three review rounds before the slim-down, live proof.

More context for AI agents

• Session: Claude Code in T3 Code, with a T3 Code scratch webhook task for the live run.
• Decisions: an earlier version signed in Hog and limited T3 Code workflows to their owner. Both moved out: signing to feat(cdp): sign webhook bodies with hmac-sha256 #126752, protection to feat(workflows): show workflows read-only to users with view access #126468.
• Follow-ups: a stable fetch delivery id from the workflow step dispatch key, for every destination.
• Follow-ups: the inline code editor clips wrapped instructions at narrow widths.
• Read closely: the Hog code in t3-code.template.ts.

🤖 Generated with Claude Code

[trunk-io]

Merging to master in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[Silthus]

Note

🤖 Claude Opus 5.5 responding on behalf of Michael

Decision lines for this PR:

• 👤 MCP setup Agents set up the T3 Code task and the workflow over MCP, as the building-workflows skill shows.
• 👤 Logo The step shows the T3 Code logo.
• 👍 Scope The step is a thin template on the HTTP webhook signing option from feat(cdp): sign webhook bodies with hmac-sha256 #126752, instead of signing in Hog.
• 👍 Owner rule Dropped. Protecting a workflow that holds someone's credentials moves to private workflows (feat(workflows): show workflows read-only to users with view access #126468) for every step.
• 🤖 Flag The template is hidden and listed only through the step catalog and MCP, behind workflow-t3-code-step, which also gates the template list and workflow save.
• 🤖 Errors Any reply of 400 or above fails the step with T3 Code's status and error code, instead of a message per code.

[Silthus]

Moved to #127118, stacked on #127117, so it gets CI. The decisions above still apply.