auto

Overview ¶

Package auto is Hanzo Auto: build a flow from triggers and actions, publish it, and watch every run.

It is durable workflow automation — flows built from trigger/action pieces, executed as durable runs on the hanzo tasks plane.

PRODUCT-REPO MODEL. The product lives in github.com/hanzoai/auto (native Go: hanzoai/base for storage+HTTP, hanzoai/tasks for durable execution, an embedded React canvas). This subsystem does NOT reimplement any of it: every op is a TYPED PASSTHROUGH to the auto service over its HTTP seam — the same posture apps/flow takes for its Python product. cloud adds exactly three things: IAM auth, the tenant boundary, and the unified surface (OpenAPI/MCP/CLI/SDK projection).

THE HONEST SLICE. hanzoai/openapi once authored 50 paths for this product (Activepieces-shaped, "same surface as Hanzo Flow") and deleted them as UNSERVED — nothing answered them anywhere. What is mounted here is what the product's v2 server GENUINELY answers today, each op proven against a live auto backend running the real engine: flows CRUD, publish, asynchronous runs that reach completed/failed with real output, the piece catalog, and a reachability lens. Everything else gets NO route, and typed_wire_test.go pins that refusal ledger so reviving a family is a deliberate edit.

TENANT ISOLATION. The org is the VALIDATED principal's org, and it is never an In field: principal.OrgFrom reads what cloud.Bridge parked from principal.Org. The product's own auth contract is gateway-minted identity: its routes scope every row by the X-Org-Id header and answer 401 without one. cloud IS that gateway: send stamps the validated org onto every upstream call, so the product's per-org scoping (its projects table, one row per org) does the isolation and a foreign id answers 404 without leaking existence. The auto Service must stay cluster-private — it trusts the header, so this subsystem is its only legitimate door.

FAIL-CLOSED. No validated principal → 403 before any upstream byte. An upstream 401 means the org header did not survive the seam — a deployment fault reported 503, never a caller-side auth bug. An unreachable upstream is 503; its 5xx are 502.