feat(agent-trigger): Webhook and Manual trigger backends (CodeDiscovery B-02)

[esafwan]

Problem

CodeDiscovery finding B-02: Agent Trigger.trigger_type declares Webhook / App Event / Manual, but only Schedule and Doc Event have backend consumers — a user can save a Webhook or Manual trigger and nothing can ever fire it. (Decomposition dossier on file. App Event is deliberately excluded — design-first, two glossary terms unratified.)

Scope

• New huf/ai/agent_trigger_api.py:
  • agent_trigger_webhook(slug, webhook_key) — guest endpoint: deterministic enabled-trigger lookup by slug (ambiguity-safe), constant-time fail-closed key check (hmac.compare_digest, empty configured key rejects), raw-body size cap BEFORE parsing, payload embedded as explicitly-labeled untrusted data in the prompt, enqueues run_agent_sync as the trigger owner (frappe.set_user, same pattern as flow_webhook) with channel_id="webhook".
  • run_trigger(trigger_name, prompt?) — authenticated Manual trigger runner: Agent Trigger read permission + agent.use capability, runs synchronously as the session user with channel_id="manual".
• agent_trigger.py: validate() requires slug+key for Webhook triggers and enforces slug uniqueness across enabled webhook triggers; event_name gets its missing depends_on.

Key decisions

• Webhook key is the auth boundary (fail closed); execution identity = trigger owner, never Guest.
• Manual runs synchronously in-request (mirrors chat behavior; long agents block the response — documented).
• Deferred per decomposition: W3 (webhook_key Data→Password migration), W5 (URL display in UI), W6 (tests — suite currently can't run on develop, see fix(tests): migrate off deprecated FrappeTestCase so the suite runs on Frappe 16 #407), all App Event work.

Agent contributions

Implementation by the release-orchestration pipeline; an independent second review REJECTED the first cut (Guest execution identity, nondeterministic slug lookup, post-parse payload cap); all three findings fixed by the pipeline; second commit.

Tests executed

• py_compile + JSON schema validation.
• Isolated bench 16_ro console smoke: owner set_user present, disabled-filter + raw cap present, key check accepts/rejects correctly, untrusted labeling present.

Risks and limitations

• Guest-facing endpoint: the key is the only barrier — leaked key = run the agent as its owner (bounded by key secrecy; same trade-off as flow webhooks).
• webhook_key is still a plain Data field (plaintext at rest) until W3 lands.
• Not yet exercised with a live HTTP webhook round-trip (site-level smoke recommended before undrafting).

Rollback

Revert the 2 commits; Webhook/Manual types return to inert (current develop behavior).

Remaining work

• W3 (Password field migration), W5 (UI URL display), W6 (tests after fix(tests): migrate off deprecated FrappeTestCase so the suite runs on Frappe 16 #407), App Event design ratification (owner decision: Source System / Virtual Trigger glossary terms).