Deploy Myra-authored assets through the native source pipeline (CL-7361) - #553
Merged
Merged
Conversation
TheGreatAxios
force-pushed
the
cl-7361-native-deploy
branch
2 times, most recently
from
September 2, 2026 08:32
4ca89eb to
8e3902f
Compare
TheGreatAxios
force-pushed
the
cl-7361-native-deploy
branch
from
September 2, 2026 08:35
8e3902f to
b32ee07
Compare
TheGreatAxios
force-pushed
the
cl-7361-native-deploy
branch
from
September 2, 2026 09:12
b32ee07 to
3966ce4
Compare
A create or PATCH-carried retarget now must clear the same two gates before it is persisted: resolveLaunchableDefinition must resolve the asset, and the acting principal must be authorized for workflow-definition:<id>/read — the same verb listRoutineTargets already checks per row. A denial is a typed 403 alongside the existing 400/404/409 target envelopes, on both the tenant-session and Myra's workflow-run-authenticated routine surfaces. Also routes a pre-existing catch in postRoutineEnabledNotice through reportError, since this change's diff now touches that line and check:report-error requires it.
…ine (CL-7361) Add a run-authenticated POST /:assetId/deploy route to agent-workflow-authoring that resolves the tenant's inference sources server-side and calls the same sessionService.deployWorkflowFromSource the native /workflows/deployments route drives, via a WorkflowDeployer apps/hub injects. Add the workflow_deploy tool (approval: "ask") to workflow-authoring-tools so a human approves before an agent-authored workflow becomes a routine target.
Replace the "not yet built" deploy seam in workflow-source-authoring.md with the run-authenticated /:assetId/deploy route and workflow_deploy tool now in place; the probe-preview step stays CL-7362's.
TheGreatAxios
force-pushed
the
cl-7361-native-deploy
branch
from
September 2, 2026 10:52
4b5f9d7 to
d4a366d
Compare
TheGreatAxios
marked this pull request as ready for review
September 2, 2026 11:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /api/workflow-workflow-authoring/:assetId/deployroute to@corbits/agent-workflow-authoring, gated by an own-tenant asset check plus a realworkflow:*/createauthorization check.resolveDefinitionSources, falling back to the tenant's catalog default model) — an agent never supplies or sees a provider secret — then calls aWorkflowDeployerapps/hub injects, which wraps the exactsessionService.deployWorkflowFromSourcecall (withDeploySourceRecordingincluded) the native tenant-session/workflows/deploymentsroute's non-exclusive branch makes. No install/probe/gate/freeze logic is reimplemented.workflow_deploytool to@corbits/workflow-authoring-tools(bumped to 0.0.2, pin updated inworkflows/assistant/src/index.ts), the only tool in the bundle carryingapproval: "ask"— a human must approve before an agent-authored workflow becomes selectable as a routine target.not_found(asset/commit missing),invalid(rejected package/definition),unavailable(sidecar unreachable, 502),forbidden(403).Linear: https://linear.app/abklabs/issue/CL-7361
Not done (by design)
CL-7362 owns the preview/probe-only step from
docs/workflow-model.md's "Deploy approval for agent-authored workflows". Until that lands,workflow_deploy's parked approval snapshot is the tool call's own arguments (asset id, commit sha, entry) — a human sees what will be deployed, not yet the probed capability/grant surface it will hold.Test plan
bun test packages/agent-workflow-authoring packages/workflow-authoring-toolsbunx tsc --noEmit -p packages/agent-workflow-authoringbunx tsc --noEmit -p packages/workflow-authoring-toolsbunx tsc --noEmit -p apps/hubbun run check:tool-package-pinsbun run scripts/checks/report-error.tsResolves CL-7361