fix(acp): gate relay-signed workflow messages on their attributed author

[TheSentinel454]

Problem

Scheduled workflow send_message actions fire and land in the channel with correct p tags for the mentioned agents — but the agents never wake. The wake-up is silently dropped.

Root cause: workflow messages are signed by the relay keypair (workflow_sink.rs signs with state.relay_keypair), so event.pubkey is the relay's pubkey, not the workflow owner. In buzz-acp, the inbound author gate (author_allowed) runs before the p-tag mention check. Under the default respond_to = owner-only, the relay pubkey is neither the owner nor a sibling, so every workflow wake-up dies at the gate with a debug-level "inbound author gate — dropping event".

The relay-side comment even says the mention p tags exist "so mentioned agents are woken (wake is p-tag gated)" — but wake is also author-gated, and that path was missed.

Fix

Gate relay-signed workflow messages on their attributed author — the pubkey that created the workflow — instead of the relay pubkey:

• Relay: workflow_sink.rs now emits an explicit buzz:workflow-owner tag carrying workflow.owner_pubkey (the workflow creator, which the executor already passes as author_pubkey and whose channel access the relay verifies before emitting). Ownership is never inferred from p-tag order; mention p tags play no role in attribution.
• Harness: at startup, buzz-acp fetches the relay's NIP-11 self pubkey (new RestClient::fetch_relay_self, public /info endpoint). Best-effort: fetch failure just logs a warning and preserves pre-fix behavior.
• Gate: an event that is (a) authored by the relay self key, (b) tagged buzz:workflow, and (c) carries a well-formed buzz:workflow-owner pubkey is gated on that owner, through the exact same owner/sibling/allowlist policy as a direct author.

Security notes (all fail closed)

• No NIP-11 self pubkey → no exemption.
• buzz:workflow / buzz:workflow-owner tags on a non-relay-signed event → ignored (a member cannot forge the exemption; the relay verifies signatures on submission and only the relay holds its key).
• Relay-signed event without the tags, or with a malformed owner value (not 64-hex) → plain author gate.
• Who is @mentioned in the message has no bearing on whose authority is evaluated.
• A workflow owned by a random channel member still cannot wake an owner-only agent — the owner's pubkey must pass the same policy.

Testing

• 7 unit tests (workflow_attributed_author_tests) covering attribution, fail-closed paths, p-tag independence, malformed owner values, and the forgery case.
• Extended the PG-gated workflow_send_message_p_tags_mentioned_member integration test to assert the buzz:workflow-owner tag.
• cargo test -p buzz-acp: 785 passed, 0 failed. cargo test -p buzz-relay --lib workflow_sink: 17 passed. Clippy + fmt clean. (9 pre-existing buzz-relay failures in unrelated api::media/api::admin tests fail identically on the base commit without this change.)

Found while debugging scheduled automations in a Buzz review-pipeline channel: two cron workflows fired daily @mentions at agents that never responded, while direct human @mentions woke them instantly.

[wesbillman]

The overall fix and explicit buzz:workflow-owner attribution look right for the live wake bug. One security-boundary hardening is needed before this is merge-ready: workflow_attributed_author currently accepts any tag whose key is buzz:workflow and uses find_map for the owner, so ambiguous or malformed provenance can still qualify.

Please make the delegated-author path require all of the following, failing closed otherwise:

• kind 9 with a valid event signature;
• event.pubkey equal to a syntactically valid NIP-11 self key;
• exactly one tag equal to ["buzz:workflow", "true"];
• exactly one tag equal to ["buzz:workflow-owner", "<valid pubkey>"];
• no duplicate marker/owner tags and no extra fields.

In particular, please add focused negative tests for duplicate markers, marker value/shape mismatch, duplicate owners, owner tags with extra fields, invalid owner pubkeys, wrong kind, tampered signatures, wrong relay author, and missing/invalid NIP-11 identity. p tags should continue to have no role in authority.

A compact implementation pattern is to collect tags by exact key, require a singleton, then compare the entire marker slice and parse the entire owner value with nostr::PublicKey::from_hex. This removes ambiguous signed-event semantics without expanding the PR's scope.

Scope note, not a blocker for this PR: this fixes online workflow wake. It does not add offline pending-work discovery or cross-event workflow retry idempotency; those should be handled separately rather than broadening this patch.

[TheSentinel454]

Addressed in dd2f29f — thanks, agreed on all points.

workflow_attributed_author now requires all of the following, failing closed otherwise:

• kind 9 with a locally verified event signature (event.verify() — the gate no longer relies on the relay having verified upstream);
• event.pubkey equal to a syntactically valid NIP-11 self key (parsed via nostr::PublicKey::from_hex, compared as parsed keys rather than strings);
• exactly one tag exactly equal to ["buzz:workflow", "true"] — the whole slice is compared, so duplicates, wrong values, missing values, and extra fields all disqualify;
• exactly one tag exactly equal to ["buzz:workflow-owner", <pubkey>], destructured to a singleton two-element slice, with the owner parsed via nostr::PublicKey::from_hex — duplicates (even with identical values), extra fields, and invalid pubkeys all disqualify.

Implementation follows the pattern you suggested: collect tags by exact key, require a singleton, compare the entire marker slice, and parse the entire owner value. p tags continue to play no role in authority.

New negative tests cover: duplicate markers; marker value mismatch, missing value, and extra fields; duplicate owners (same and differing values); owner tag with extra fields; invalid owner pubkey; wrong kind (kind 1); tampered content with intact tags/pubkey (signature check); wrong relay author; and missing plus syntactically invalid NIP-11 self (empty, non-hex, hex-length-but-not-hex).

cargo test -p buzz-acp: 792 passed, 0 failed. Clippy + fmt clean.

Agreed on the scope note — offline pending-work discovery and workflow retry idempotency stay out of this PR.