Skip to content

Lark tracer: DM pairing, Web review and revocable Bot-scoped authority #1027

New issue
New issue
Closed
#1058
Closed
Lark tracer: DM pairing, Web review and revocable Bot-scoped authority#1027
#1058
Labels
area:fullstackEnd-to-end Host and Client implementationfeature:messagingMessaging module and external providersready-for-humanRequires human implementationscope:tracerHuman-testable implementation slice
Milestone
v1.2

Description

@DoodleBears
DoodleBears
opened on Oct 6, 2026

Parent

#1019

What to build

A Lark user requests pairing in the Bot DM, authenticated Web management reviews the verified applicant and explicitly grants or revokes current-PersonaBot capabilities.

Acceptance criteria

  • Use checked account-scoped control intake before ordinary Inbox/model/Memory admission; do not enable a second consumer or the standalone bridge.
  • Web shows the genuine account and visible identity, with approval, rejection, question and rule-saving capabilities explicitly selected; no first-applicant promotion.
  • A pending challenge has explicit expiry and bounded attempts/capacity; repeated requests and duplicate review cannot create competing grants. Record the chosen engineering defaults.
  • A visible per-Bot authorization survives restart; revoke takes effect immediately and re-pairing requires fresh review. Pairing does not grant other-Bot, approver-management, VPS or native API authority.
  • Wrong account/sender, expired challenge and unauthenticated review are refused; ordinary community chat remains separate. No long-lived tokens or control secrets enter Memory/logs.
  • Provide a real Lark DM → Web review → grant/revoke demonstration using the actual packaged Provider.
  • Test through checked Provider and authenticated management/owning service boundaries; keep existing canonical persistence and no parallel content/decision authority.
  • Retain real sanitized screenshots/step evidence and maintain the affected English/Chinese tutorial section; UI changes include matched baseline/changed light/dark evidence and no private secrets.
  • Provide the exact-version runnable review path and focused behavioral coverage; pause for Human QA before expansion, without automatic merge/deployment.

Blocked by

None (can start immediately).

Activity

  1. DoodleBears
    added this to the v1.2 milestone on Oct 6, 2026
  2. DoodleBears
    added a parent issue on Oct 6, 2026
  3. github-project-automation
    added this to Roadmapand IM Identities & Messagingon Oct 6, 2026
  4. github-project-automation
    moved this to Todo in Roadmapon Oct 6, 2026
  5. DoodleBears
    marked this as blocking on Oct 6, 2026
  6. DoodleBears
    added
    ready-for-agentFully specified, ready for an AFK agent
    area:fullstackEnd-to-end Host and Client implementation
    feature:messagingMessaging module and external providers
    scope:tracerHuman-testable implementation slice
    on Oct 6, 2026

  7. DoodleBears commented on Oct 6, 2026

    @DoodleBears
    DoodleBears
    on Oct 6, 2026
    ContributorAuthor

    Agent work claim

    • Agent: Codex
    • Task: codex/local/01a10d1e-de2a-7660-86ba-52562d93d71b (not a DSH Session)
    • Issue scope: Lark DM pairing before Inbox admission, authenticated Web review and revocable current-Bot capabilities; real packaged Provider and bilingual tutorial evidence.
    • Branch: codex/1027-lark-pairing
    • Started: 2026-10-06 14:10 UTC
    • State: active
  8. DoodleBears
    added
    agent:activeOne or more coding-agent tasks currently claim this issue; see claim comments for task IDs
    on Oct 6, 2026

  9. DoodleBears commented on Oct 6, 2026

    @DoodleBears
    DoodleBears
    on Oct 6, 2026
    ContributorAuthor

    Agent work update — implementation published, external QA pending

    • Agent task: codex/local/01a10d1e-de2a-7660-86ba-52562d93d71b; claim: #issuecomment-6018122003.
    • PR: feat: reviewed Lark pairing scoped to one Bot (#1027) #1058 (draft), head 1350312527f9b68cc74ed0b65ce95d9f8768c0bf, milestone v1.2; only Lark tracer: DM pairing, Web review and revocable Bot-scoped authority #1027 is included.
    • Full regression passed 2,904 tests (9 configured skips); subsequent recovery changes passed 105 focused tests. Typecheck, lint/source policy, format, bilingual ledgers, product build and docs build passed. Authenticated Host owns review; an unauthenticated request returned HTTP 401.
    • Real Lark DM request persisted through restart but expired before Web review. Actual expired-state light/dark screenshots and matching before entry-point captures render in the PR. Validated PR Lens architecture/data-flow renders are attached separately. Bilingual tutorial and ADR-0135 distinguish implemented pairing from later IM decision controls.
    • Temporary Lark-only changes were restored; the production Host is active. Its Provider reconnects configured accounts every 15 seconds, so native single-account disconnect cannot keep QA exclusive. The local Provider is disabled. Awaiting the user's choice of an explicitly authorized <=10-minute whole-Host outage or a dedicated test app before real grant/revoke/re-pair verification.
    • Work remains active on this task; no merge/deploy or Human QA acceptance. Lark tracer: paired DM Allow once and Reject with canonical execution receipts #1029 has not begun. Complete external evidence and Human QA before broadening the next slice.
  10. DoodleBears
    added a commit that references this issue on Oct 6, 2026

    fix: recover pairing capacity after identity replacement

    dabaff4

  11. DoodleBears commented on Oct 6, 2026

    @DoodleBears
    DoodleBears
    on Oct 6, 2026
    ContributorAuthor

    Agent work update — review fixes verified

    Task codex/local/01a10d1e-de2a-7660-86ba-52562d93d71b, PR #1058, head dabaff4a36eca3f234b5e13f3f706fd83309c246.

    • Standards review: receiver acquisition/release diagnostics and PR UI-composition provenance findings addressed.
    • Spec review: replaced identities recover the approval-capacity budget, while the 100-active-grant limit remains enforced and old authority stays unusable. Native Bridge tests verify strict review input, wrong-Bot refusal, duplicate review and revoke.
    • Final full regression: 349 files passed / 5 skipped; 2,905 tests passed / 9 configured skips. Build, types, lint/source policy, formatting and both ledgers passed. PR Lens validated for this head; unchanged SVG hashes preserve the inspected light/dark diagrams.
    • Real authenticated native API refused the expired request, wrong Bot, forged attribution and unknown capabilities; unauthenticated review returned 401. The actual QA database retains one real pairing, zero approved grants, zero ordinary IM Source Events and zero Inbox Admissions.

    Remaining acceptance: real packaged-Provider pending → Web approval → revoke → fresh request evidence, then Human QA. Production remains online; local QA Provider is disabled. Still waiting for the previously requested exclusive-app test authorization or a dedicated application. No sibling issue, merge or deployment started.

  12. DoodleBears
    added 2 commits that reference this issue on Oct 6, 2026

    docs: record real Lark pairing approval and recovery

    3cdc14c

    docs: correct pairing screenshot theme labels

    deb304a

  13. DoodleBears commented on Oct 6, 2026

    @DoodleBears
    DoodleBears
    on Oct 6, 2026
    ContributorAuthor

    Agent work handoff — real Lark pairing verified

    • Task: codex/local/01a10d1e-de2a-7660-86ba-52562d93d71b; original claim. State: handed-off for Human QA.
    • PR: feat: reviewed Lark pairing scoped to one Bot (#1027) #1058, ready for review, final head deb304a2e539bb37f09a20ef95120a13d47772a0, milestone v1.2. Only Lark tracer: DM pairing, Web review and revocable Bot-scoped authority #1027 is included.
    • The user manually sent two genuine /pair messages through the qualified packaged Lark Provider. Authenticated Web granted only answer, a real cold Host restart retained it, Web revocation cleared it, and the second DM created a different request with empty capabilities and a disabled approve button. After production restoration, authenticated local Web rejected that test request with its Provider disabled. Final records are expired/revoked/rejected, all capabilities empty; zero ordinary IM Source Events and zero Inbox Admissions.
    • The explicitly authorized exclusive whole-Host test window lasted 482 seconds. The original VPS service and both Discord/Lark identities were verified active/available afterward. Local QA reception is disabled; no production code deployment, merge, scope expansion or credential deletion occurred. This supersedes the earlier external-verification blocker.
    • Implementation regression at dabaff4a: 349 files passed / 5 skipped, 2,905 tests passed / 9 configured skips; types/build and required source checks passed. Final evidence-only head: 378-page docs build, lint/source policy, formatting and both ledgers passed. The runtime suite was not repeated after docs-only updates.
    • Eight sanitized real captures and the bilingual source tutorial are retained. Corrected dark-image filenames and explicitly labelled the light disconnect/recovery capture as last-observed state. Final-head before/after screenshots and all PR Lens diagrams were verified rendered in GitHub.
    • Independent Standards and Spec reviews resolved the previously recorded findings. Remote checks/reviewer results remain separate from these local checks. Human QA acceptance remains pending.

    Remaining: Human review of the runnable pairing/Web authority slice described in PR #1058. Native IM approvals/questions are later issues; #1029 has not begun. No automatic merge or deployment.

  14. DoodleBears
    added
    ready-for-humanRequires human implementation
    and removed
    ready-for-agentFully specified, ready for an AFK agent
    agent:activeOne or more coding-agent tasks currently claim this issue; see claim comments for task IDs
    on Oct 6, 2026

  15. DoodleBears commented on Oct 6, 2026

    @DoodleBears
    DoodleBears
    on Oct 6, 2026
    ContributorAuthor

    Agent work update — final integration refresh

    Task codex/local/01a10d1e-de2a-7660-86ba-52562d93d71b resumes active work on PR #1058 only. Final remote refresh found new main commits and merge conflicts, including another ADR-0135. The earlier handoff remains the live-verification record; Human QA handoff waits for conflict resolution and renewed checks. No merge/deploy or sibling issue work.

  16. DoodleBears
    added
    agent:activeOne or more coding-agent tasks currently claim this issue; see claim comments for task IDs
    on Oct 6, 2026
  17. DoodleBears
    added a commit that references this issue on Oct 6, 2026

    fix: integrate current schema and surface pairing review failures

    9987ba9

  18. DoodleBears commented on Oct 6, 2026

    @DoodleBears
    DoodleBears
    on Oct 6, 2026
    ContributorAuthor

    Agent work outcome — integrated head ready for Human QA

    • Task codex/local/01a10d1e-de2a-7660-86ba-52562d93d71b; state handed-off. PR feat: reviewed Lark pairing scoped to one Bot (#1027) #1058 is ready for review, final head 9987ba983afc2b8c4a840ecddc1c92c7b8d7369d, milestone v1.2.
    • Integrated current main while preserving its Discord migration generation 58; pairing now follows at 59. Renamed the pairing decision ADR-0136 and preserved both release entries. Added upgrade regression preserving immutable Discord history.
    • Fixed the remote-review finding: pairing review/refresh errors appear beside their controls, separately from Bridge errors. Component regression verifies refusal feedback, successful refresh recovery and no repeated review. Six genuine isolated Web failure/recovery captures are added in both themes; all final-head screenshots and PR Lens diagrams render in GitHub.
    • Exact-head remote verify passed: complete test suite, lint, format, typecheck, build and artifact consistency. Local integrated full run had two resource-sensitive timeouts, both passed serial retries; the final UI/migration group passed 34 tests. Docs build: 380 pages. Independent Standards and Spec reviews found no remaining source finding; the Chinese integration wording correction was applied.
    • Real Lark evidence from the authorized earlier runtime remains: actual DM → explicit answer-only Web grant → cold restart → revoke → actual fresh DM with zero inherited capabilities → rejection cleanup. Its earlier preview database is retained as evidence-only, not rewritten or reopened under the integrated schema. A fresh integrated QA page verifies Web transport failure and recovery without any external IM application connected. No repeat production outage was started.
    • The original VPS service and Discord/Lark identities were restored after the authorized 482-second window; no production code deployment or merge occurred. No pending/approved test grants remain in the real pairing preview.

    Remaining: Human QA of this #1027 slice. The PR distinguishes earlier external Lark evidence from current integrated-head CI and local Web checks. Native IM approval/questions remain separate tickets; #1029 has not begun. No automatic merge/deployment or sibling expansion.

  19. DoodleBears
    removed
    agent:activeOne or more coding-agent tasks currently claim this issue; see claim comments for task IDs
    on Oct 6, 2026
  20. DoodleBears
    added a commit that references this issue on Oct 6, 2026

    feat: reviewed Lark pairing scoped to one Bot (#1027) (#1058)

    e230fba
  21. DoodleBears
    closed this as completedin #1058on Oct 6, 2026

  22. DoodleBears commented on Oct 6, 2026

    @DoodleBears
    DoodleBears
    on Oct 6, 2026
    ContributorAuthor

    Agent work outcome

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:fullstackEnd-to-end Host and Client implementationfeature:messagingMessaging module and external providersready-for-humanRequires human implementationscope:tracerHuman-testable implementation slice

    Type

    No type

    Projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions