[codex] Revalidate workflow owners before webhooks

[jmecom]

What Changed

CallWebhook now reloads the workflow run and workflow row immediately before sending an outbound request, checks the workflow owner's current channel membership against Postgres, and denies the action if the owner has been removed. When that check fails, the workflow is disabled so later channel events do not keep scheduling the same outbound attempt.

This closes the workflow exfiltration path where a former private-channel member could leave behind a message_posted workflow and continue receiving future message contents through a public webhook.

Safety

The check is scoped through the run's community and workflow row, so it does not trust trigger input or the relay's membership cache. Channel-less workflows keep their existing behavior. Membership lookup failures fail closed: the webhook is not sent.

The regression coverage exercises both the allowed path for a current member and the denied path after removal, including the automatic workflow disable.

Testing

• cargo fmt --check
• cargo test -p buzz-workflow --lib
• cargo clippy -p buzz-relay --lib -- -D warnings
• env -u BUZZ_GIT_REPO_PATH cargo test -p buzz-relay --lib -- --test-threads=1
• BUZZ_TEST_DATABASE_URL=postgres://buzz:buzz_dev@127.0.0.1:55432/buzz cargo test -p buzz-workflow webhook_owner_membership_revalidation -- --ignored --test-threads=1

[dophsquare]

Review — [codex] Revalidate workflow owners before webhooks

Verdict: logic correct, fail-closed, DB signatures all check out. MERGEABLE, CI green. Reviewed at commit 97f7030.

• dispatch_action(… run_id: Uuid) is in scope; the new revalidate_webhook_owner_membership fires first in the CallWebhook arm (696).
• Traced every DB call against real signatures: get_workflow_run / get_workflow return WorkflowRunRecord / WorkflowRecord; WorkflowRecord has owner_pubkey: Vec<u8> (matches is_member(…, pubkey: &[u8])), channel_id: Option<Uuid> (matches the let Some(channel_id) = … else return Ok(())), enabled: bool. set_workflow_enabled(community_id, id, bool) matches. No type mismatches.
• Fail-closed is genuine: DB read at action time (not the membership cache), disables the workflow on owner-membership loss, and returns the blocking error even if the disable-write itself fails (logs a warn, still errors). Channel-less workflows correctly skip.

Action items

• Get the two new tests into a CI lane. Both are #[tokio::test] #[ignore = "requires Postgres"], so this safety-critical path isn't exercised in default CI. Add a Postgres-backed lane or justify the ignore.
• Rebase-verify: the diff anchors near resolve_send_message_channel, which is at line 468 on the branch (drifted from an earlier 509). Confirm hunks still apply cleanly on latest main.
• Review approval.

---

Independent review by Fizz 🐝 — read the logic, DB signatures, and tests against the checked-out branch.