Harden workflow approvals and ACP publishing

[nocodedltd]

Summary

• persist the exact approval request package and display it before an approver can grant a workflow gate
• require a signer-bound, parent-bound completion envelope before Stage B can continue
• add a durable per-step dispatch journal so a crash cannot duplicate post-approval side effects
• persist a general one-run-per-workflow reply-parent guard in migration 0030
• keep multi-channel NIP-01 #h queries scoped to every authorised channel instead of incorrectly pushing down one arbitrary channel
• publish workflow events and relay commands through ACP with explicit liveness and fail-closed permission defaults
• add validation tooling and contract tests covering the Hermes re-engagement workflow

Why

The previous gate record did not retain the content being approved. A reviewer could therefore approve an external send without seeing the exact package, and a crash after dispatch but before trace persistence could cause the same post-gate instruction to be emitted twice. Completion replies also needed stricter signer and parent correlation so unrelated agent output could not resume a workflow.

The Desktop requests workflow definitions for all joined channels in one #h filter. Treating that OR filter as one exact SQL channel predicate made the signed app show an empty workflow list even though the definitions existed. Multi-value filters now retain the complete authorised channel scope, while single-value filters still use the exact-channel optimisation.

Safety properties

• approval grants remain owner-signed and token-bound
• the approval UI renders the byte-for-byte request package separately from the approver note
• expired or missing grants fail closed
• each (community_id, run_id, step_id) dispatch is claimed once in Postgres
• each (community_id, workflow_id, reply_to_message_id) starts at most one workflow run
• interrupted dispatches remain blocked for operator review rather than being retried automatically
• completion events must match the expected signer, parent event and structured package
• multi-channel event reads cannot escape the requester's authorised channel set

Validation

• cargo fmt --all -- --check
• cargo test -p buzz-db (94 passed, 154 Postgres tests ignored)
• cargo test -p buzz-workflow (172 passed, 11 Postgres tests ignored)
• cargo test -p buzz-acp plus integration tests (701 passed)
• focused relay regression tests for single-channel pushdown and multi-channel authorised scope
• cargo clippy -p buzz-db -p buzz-workflow -p buzz-acp -p buzz-relay --all-targets -- -D warnings
• cargo test --manifest-path desktop/src-tauri/Cargo.toml (2,262 passed, 14 ignored)
• cargo clippy --manifest-path desktop/src-tauri/Cargo.toml --all-targets -- -D warnings
• pnpm test in desktop (full suite)
• pnpm typecheck, pnpm check and pnpm build
• relay suite against an isolated fully migrated Postgres: 863 passed, 40 ignored; one existing macOS mesh echo integration test timed out, in code untouched by this branch
• local production baseline after deploying wf12: all checks passed, including migrations 0029 and 0030, the signed Desktop workflow listing, both authenticated Hermes runtimes, and a clean zero-approval, zero-dispatch state

Migration note

This branch uses migration 0029 for approval package persistence and the dispatch journal, and migration 0030 for the general reply-parent deduplication constraint.