Repository navigation
Lark tracer: paired DM Allow once and Reject with canonical execution receipts #1029
Description
Parent
What to build
A Human selects a named, authorized Lark DM route, receives each committed native tool-approval request automatically, and decides Allow once or Reject from its card with canonical status and an actual execution result.
Acceptance criteria
- The Profile route picker, test send and delivery state use verified target references and this PersonaBot’s own authorized identity.
- One distinct committed request creates one prompt; replay deduplicates the same request and different requests are individually notified, respecting platform limits.
- Use checked actionable card send/update and callback provenance; acknowledge promptly without holding inbound handling until a later click.
- Validate current actor/account/conversation, receipt/request correspondence, offered action, live owner and complete operation before the existing approval authority settles.
- A real approved native call executes once and produces its actual result; rejection executes nothing. Click acknowledgement, native decision and execution success are distinct.
- Web and IM first-decision races, wrong actor, duplicate click, revoked actor, owner cancellation, expiry and restart cannot authorize another call or execute twice.
- Expose known-unsent finite retry and Unknown Outcome inspection through Web; do not blindly repeat a possibly sent card or an accepted decision.
- Default live operation expiry is 24 hours or earlier owner invalidity. Old cards are rejected after restart; this slice does not claim non-blocking native waits.
- Test through checked Provider and authenticated management/owning service boundaries; keep existing canonical persistence and no parallel content/decision authority.
- Retain real sanitized screenshots/step evidence and maintain the affected English/Chinese tutorial section; UI changes include matched baseline/changed light/dark evidence and no private secrets.
- Provide the exact-version runnable review path and focused behavioral coverage; pause for Human QA before expansion, without automatic merge/deployment.
Activity
21 remaining items
docs: record Windows approval qualification traps (#1029)
docs: explain Windows AppData redirection in Human QA (#1029)
docs: record real Windows Lark approval qualification (#1029)
DoodleBears commentedon Oct 7, 2026
Agent outcome — native Windows Lark qualification completed
codex/local/01a1131c-b268-7212-9ac8-d1c7bf9b6e288936777b9d055298add138602ca40bc56ff281b4; checked Provider draft #13, source1422b07f8709e3d2d1e6469bfbcc2891c5a0cd14. Candidate source/runtime/locale checks matched 399 Provider files. This continuation adds documentation only, ending at c0ef4c74.The Human explicitly authorized a fresh exclusive receiver window of at most ten minutes. A server-owned nine-minute restoration timer was armed before stopping production; the local eight-minute cleanup was scheduled before enabling the candidate IM Fiber. Fresh real
/pairintake was matched to the intended DM through trusted SDK actor/account metadata and Human confirmation, then reviewed through authenticated Web with approve/reject only. No ordinary Inbox reception, answer or saved-rule capability was granted.allowed-once; exactly one target Node print call; successful native result,isError: false, expected stdout markerexecutedrejected; native rejection error,isError: true; target operation did not succeedrejectedThe completed caller contains exactly these two original calls, with their exact commands and no replacement call. Both decisions came from the Human's Lark buttons, with no Web decision substitution. Native delivery/card projections match the table, and the Human confirmed both final displayed states. Authenticated Web preflight remains separate evidence. Private DM screenshots and native records stay local; the historical public Profile screenshots are not presented as fresh final-state captures.
Cleanup is complete: route off, QA pairing revoked, identity unbound, IM Fiber disabled and exact local Host stopped. A read-only check of canonical persisted state confirms zero active pairings, identities or reception grants, with the revoked pairing/binding retained. The QA listener is absent. Production was restored by 14:12:17 JST, within the ten-minute bound; service state is active/running, and the Human subsequently confirmed normal production DM replies in both Lark and Discord. The restore timer was stopped after restoration. No product or Provider was deployed or published.
The eight-minute helper ran and disabled IM, but its process-start timestamp comparison refused the owned Host because PowerShell had converted the ISO string to a typed DateTime. Explicit cleanup verified the same process start instant with zero difference, then stopped that Host before production restoration. The helper and debugging playbook are corrected; independent automatic Host-stop success is not claimed. The service recovery and actual final cleanup have separate evidence.
Native Windows validation: Node 24.21.0 / pnpm 12.4.2 frozen installation, build, typecheck and focused approval/pairing tests 16/16 passed. Final documentation formatting and both bilingual release-ledger checks pass. There was no new complete-suite run; the previous unchanged cross-Channel history timeout and isolated 3/3 rerun remain accurately reported.
The bilingual guide now records this source-specific qualification. Windows AppData redirection, candidate installation, Shell exit evidence and timestamp guards are recorded in the DSH debugging playbook. The historical missing
/paircause remains unproven; this fresh successful intake does not retroactively establish it. Both PRs remain drafts, the globally qualified Provider pin is unchanged, and merge/publication/deployment and broader platforms remain outside this task. Fresh public final-state screenshots remain a capture exception: the privileged window has ended and supplied captures contain private context; reviewers can reproduce with a newly authorized bounded window,/pair, approve/reject-only review, one harmless portable Node print per decision, canonical result inspection, revocation and restoration.DoodleBears commentedon Oct 7, 2026
Agent work resumed — authorized merge integration
codex/local/01a1131c-b268-7212-9ac8-d1c7bf9b6e28codex/1029-lark-approvalBoth original PRs currently report conflicts with their current main branches. Their tested heads and completed Human QA remain recorded in the qualification outcome. Conflict integration requires fresh validation; it is not a production deployment or permission to interrupt live services. After this slice merges, continue the next unclaimed Lark slice #1031 through its normal tracer-bullet workflow.
Merge main into checked Lark approval cards
Merge main into checked Lark approval slice
Merge portable Git installation into checked Lark approval slice
feat: checked Lark DM allow-once and reject cards (#1029) (#1075)
DoodleBears commentedon Oct 7, 2026
Agent work outcome
codex/local/01a1131c-b268-7212-9ac8-d1c7bf9b6e289aa0e04e; BotHarness #1075 merged at009e020b.9bf74751, retaining native sender enrichment, Lark images and portable Git actions. Lark approval ADR renumbered to 0141.