fix(workflows): authorize automated runs by deployment

[TheodoreSpeaks]

Summary

• authorize actorless and external webhook executions through their bound deployed workflow
• keep billing-owner IDs limited to legacy storage and provenance attribution
• preserve generic webhook, schedule, and Slack principal semantics without inventing Sim users

Type of Change

• Bug fix

Testing

• 323 focused tests
• app and auth type checks
• lint, block-registry validation, and 37 repository audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added or updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 28, 2026 12:38am

[greptile-apps]

Greptile Summary

The PR authorizes subjectless automated executions through their bound deployed workflow while preserving generic webhook, schedule, and external-provider principal semantics.

• Adds deployment-backed authorization for actorless executor delegations.
• Separates human subjects from billing and legacy storage attribution.
• Updates knowledge and table provenance handling and adds focused compatibility tests.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/auth/src/principal.ts	Keeps actorless webhook principals subjectless while extending delegated executor attribution.
apps/sim/lib/core/application/workspace-authorization.ts	Authorizes actorless executor operations only when the current workflow authority represents a deployment.
apps/sim/lib/knowledge/api/internal-route.ts	Separates Knowledge authorization subjects, analytics identities, billing restoration, and persisted provenance.
apps/sim/lib/table/application/rows.ts	Allows actorless deployed executions to use workspace-scoped table provenance handling.
apps/sim/lib/billing/core/billing-attribution.ts	Adds restoration of trusted executor billing snapshots constrained by canonical workspace.

_{Reviews (2): Last reviewed commit: "fix(workflows): authorize automated runs..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 14 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cubic review

[cubic-dev-ai]

@cubic review

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 20 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}