jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-11-01 06:51:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(testing): clarify webhook ban classification

Browse Source 
Signed-off-by: seiler <seiler@squareup.com>
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 2374e1c05352db37eafa42d502a148b57dc21080)
Signed-off-by: Brad Seiler <seiler@squareup.com>
This commit is contained in:
seiler
2026-10-05 21:29:44 +00:00
committed by Brad Seiler
parent 116c331e93
commit 4b14fdb6e6
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
TESTING.md
View File

@@ -80,9 +80,9 @@ Workflow webhooks also use a secret-authenticated caller with no user principal.
Before creating a run, the handler separately checks the saved workflow owner's
channel membership and role, but it does not check that owner's community-ban
state. The inventory's `not_applicable:webhook_secret_auth` entry is a
provisional caller-auth classification, not proof that an owner ban is
irrelevant. Whether the owner's ban should gate webhook trigger and run
creation remains an explicit policy question.
provisional restriction classification based on secret-only caller auth, not
proof that an owner ban is irrelevant. Whether the owner's ban should gate
webhook trigger and run creation remains an explicit policy question.
Root and huddle admission, final-admission races, fail-closed reads, owner-to-
agent restriction, timeout behavior, and tenant-scoped eviction point to their