Lark tracer: management conversation destinations with per-actor question and approval checks #1034

Parent

#1019

What to build

A Human selects a named management conversation from this Bot's existing external conversations for the shared question/approval route. This slice qualifies supported Lark groups and preserves the already qualified private DM path. Only explicitly authorized actors can resolve requests visible in the selected destination.

Placement and scope

Follow #1083 / ADR-0138: reuse the Bot DM Channel sidebar's Approvals, Approvers and Approval destinations. External identities manages the Bot's sender accounts; Profile is not the configuration page. Source community X and management destination Y can be different. Do not add a separate group-only route store or a competing destination picker. #1041 consumes the same route for failure alerts, while #1036–#1039 own native waiting/continuation.

Acceptance criteria

• Select the destination by visible name from the current Bot's genuine external conversation entries, using existing checked outgoing authorization; test the configured management group rather than implicitly sending private requests to the source community.
• A card recipient or group member cannot answer/approve without the current paired actor's explicit per-Bot capability; the first canonical accepted Web/IM decision wins.
• Use this PersonaBot’s authorized group target and own sender; target membership/visibility and decision capability remain separate.
• Demonstrate native tool approval and a formal question in a real group with one authorized and one unauthorized participant.
• Refuse a forwarded/copied card, wrong conversation, unpaired group member and revoked identity; preserve the DM path.
• Show appropriate visibility and sanitization choices before selecting the management group; public-origin chats receive no private management detail implicitly.
• Ordinary clarification in the original group follows its normal intake policy and is not administrator enrollment.
• Existing available rule controls retain their explicit capability checks without group membership granting them.
• Test through checked Provider and authenticated management/owning service boundaries; keep existing canonical persistence and no parallel content/decision authority.
• Retain real sanitized screenshots/step evidence and maintain the affected English/Chinese tutorial section; UI changes include matched baseline/changed light/dark evidence and no private secrets.
• Provide the exact-version runnable review path and focused behavioral coverage; pause for Human QA before expansion, without automatic merge/deployment.

Blocked by

• Lark tracer: native Human questions answered from the paired DM #1031