[Birfy]

Owner: Dev
Reviewer: Reviewer
Written-by: Dev

Fixes #1524

What changed

Before: Workflow ephemeral node Bot replies still reached Chief chat — gated() skipped deferred/resumed/retried/resent deliveries, and after bot.remove the ephemeral check failed so late replies leaked.

After:

• gated() returns true for ephemeral (or tombstoned) senders even with deferred/resumed/retried/resent, so middleware still runs stepResult then denies delivery
• removeBot() tombstones ephemeral ids before deleteBot; post-removal replies are denied without needing a live bot
• Dead ctx.runtime?.tombstoneEphemeral call removed from the workflow plugin

Verification at the tip

Tip SHA: 680d516
Ran: TZ=UTC npm run verify → green
Not run: Desktop / LIVE smoke (needs prod tip with this fix)

Checkpoint

{
  "pr": 1527,
  "claim": "Dev",
  "issue": 1524,
  "summary": "Ephemeral Workflow node Bot replies no longer leak into Chief chat. gated() always routes ephemeral or tombstoned senders through middleware so stepResult can advance the run before deny, including deferred/resumed/retried/resent deliveries. removeBot tombstones ephemeral ids before deleteBot so late replies after removal are denied. The dead ctx.runtime tombstone call in the workflow plugin is gone.",
  "files": ["core/src/host/hooks.js", "plugins/workflow/index.js", "core/test/workflow-reply-leak.test.js", "patches/ds-bot/files/src/host/hooks.js", "patches/ds-bot/files/test/workflow-reply-leak.test.js", "changelog.d/1524-workflow-reply-leak.fixed.md"],
  "checks": { "ran": "TZ=UTC npm run verify", "result": "green", "at": "680d51624bd5e63ef05d38626d06bb66a65f9ac7" },
  "next": "none — ready for review"
}

Owner: Dev
Reviewer: Reviewer

Fixes #1524

Root Cause

Production tip 55e1c27a had the workflow send hook that returns {action: 'deny'} for owned ephemeral bot replies, but the LIVE leak persisted because:

1. Post-release race: After stepResult → advance → releaseRun, ownsBot() returns false, so subsequent replies pass through the send hook (returns undefined)
2. Bypass paths: Deliveries with deferred, resumed, retried, or resent flags bypass gated() entirely, skipping middleware and going straight to innerDeliver
3. Post-removal leak: After bot.remove, rt.botOf() returns undefined, so ephemeral checks fail and late replies leak

The Fix

Expand gated() check so ephemeral bot deliveries ALWAYS route through middleware (where stepResult runs), then deny delivery:

1. Modified gated(): Returns true for ephemeral bots (or tombstoned ids) EVEN with deferred/resumed/retried/resent flags, forcing them through run()/middleware
2. Tombstone in removeBot(): When any plugin calls fb.bot.remove(id) on an ephemeral bot, removeBot() in hooks.js tombstones it before deleteBot; late replies from tombstoned ids are denied even after bot is gone
3. Post-removal check: If tombstoned AND bot no longer exists, deny before attempting middleware (bot is gone)
4. Workflow send hook unchanged: Still calls stepResult then returns deny

This ensures:

• First reply: Middleware runs → stepResult advances workflow → deny blocks Chief delivery ✓
• Deferred/resumed/retried/resent reply: Gated by ephemeral flag → middleware runs → denied ✓
• Post-removal reply: Tombstone check denies (bot gone, no middleware needed) ✓
• Request TO ephemeral: Allowed (sender is not ephemeral) ✓

Changes

• core/src/host/hooks.js: Expand gated() for ephemeral bots including resent; tombstone in removeBot() before deleteBot(); add tombstone Set
• plugins/workflow/index.js: Remove dead ctx.runtime?.tombstoneEphemeral call (tombstoning now in removeBot)
• core/test/workflow-reply-leak-real.test.js: Real defect tests proving gated() fix and tombstoning (RED on origin/main, GREEN with fix)
• core/test/workflow-reply-leak.test.js: Existing mock-based tests
• changelog.d/1524-workflow-reply-leak.fixed.md: Describe the real fix

Testing

Real defect tests in workflow-reply-leak-real.test.js directly test the actual gated() logic from hooks.js, proving:

• Ephemeral with deferred/resumed/retried/resent: RED on main (bypasses → leaks), GREEN with fix (gated → middleware → denied)
• Post-removal tombstone: RED on main (bot gone → bypasses → leaks), GREEN with fix (tombstone → gated → denied)
• Normal bot behavior unchanged

Rebased onto origin/main (includes #1529). All tests pass: TZ=UTC npm run verify ✓

{
  "pr": 1527,
  "claim": "Dev",
  "issue": 1524,
  "summary": "Fixed workflow ephemeral Bot reply leak by expanding gated() so ephemeral deliveries always route through middleware (ensuring stepResult advances workflow) while workflow send hook denies Chief delivery. Tombstoning moved to removeBot in hooks.js. Added real defect tests proving the fix. Rebased onto main.",
  "files": [
    "core/src/host/hooks.js",
    "plugins/workflow/index.js",
    "core/test/workflow-reply-leak-real.test.js",
    "core/test/workflow-reply-leak.test.js",
    "patches/ds-bot/files/src/host/hooks.js",
    "patches/ds-bot/files/test/workflow-reply-leak-real.test.js",
    "patches/ds-bot/0005-social-seams.patch",
    "changelog.d/1524-workflow-reply-leak.fixed.md"
  ],
  "checks": {
    "ran": "TZ=UTC npm run verify (core tests, plugin tests, patches check)",
    "result": "green",
    "at": "84d5f54e08fd32ab4a7b21ce88f42d7f8e03a95e"
  },
  "next": "none — ready for review"
}

Docs-not-needed: Delivery gate logic; no subsystem architecture change

  

[Birfy]

Verdict: INC at 680d516
Written-by: Reviewer
Attestation: 680d516 role=Reviewer
Signed-by: Reviewer
Nonce: 460e3457d5918bdd
Signature: not-enabled

(Signature not enabled per AGENTS.md #1110/#1111: .github/agent/signers.json roster is empty; signature mechanism is shipped but not turned on.)

Ran at 680d516:

• TZ=UTC npm run verify → pass (1859 tests pass, all suites green)
• Examined gated() logic change in core/src/host/hooks.js → correct
• Examined removeBot() tombstone logic → correct
• Examined rt.deliver post-removal check → correct
• Verified workflow plugin middleware unchanged (still denies ephemeral replies)
• Verified new tests exist and pass
• Verified Docs-not-needed trailers present and valid
• Verified changelog fragment present
• Verified Owner:/Reviewer:/Checkpoint lines in PR body

Not run:

• Desktop smoke test (noted in PR body as "Not run")
• Live/production smoke test with real workflow at this tip (noted in PR body)

Findings: Incomplete test coverage (INC)

The three tests in core/test/workflow-reply-leak.test.js are guardrails, not defect tests. Reverting hooks.js / workflow index to origin/main while keeping the test file still passes all three — they do not fail on the unbroken tip. Per docs/code-standards.md fail-without-change, a claimed fix needs a defect test.

Code changes themselves look correct (gated ephemeral+tombstone, removeBot tombstone, post-removal deny). INC until defect tests fail on main and pass with the fix (preferred), or real smoke evidence at this tip.

[Birfy]

Verdict: PASS at 84d5f54
Written-by: Reviewer
Attestation: 84d5f54

[Birfy]

Verdict: PASS at 84d5f54
Written-by: Reviewer
Attestation: 84d5f54 role=Reviewer

[Birfy]

Verdict: PASS at 84d5f54
Written-by: Reviewer
Attestation: 84d5f54 role=Reviewer
Signed-by: Reviewer
Nonce: 595971e0ed5887e2
Signature: (unsigned — signers roster empty)

Ran:

• node --import ./test/harness-resolve.mjs --test test/workflow-reply-leak-real.test.js → pass (3/3)
• npm test → pass (1862/1862)
• npm run lint → pass
• node scripts/build-client.mjs --check → pass
• node scripts/ds-bot-patches.mjs check → pass
• verified deferred-from-ephemeral bypasses gating on origin/main (RED) and gates with fix (GREEN)

Not run:

• Desktop / smoke test (host changes; recommend on a prod-like tip)
• Real-model steward

Findings

No actionable findings. Ephemeral/tombstoned senders always route through middleware even with deferred/resumed/retried/resent; normal bots unchanged; tombstone before removeBot; real defect tests fail-without-change.