Repository navigation
Design: external users and groups with default Web Human authority #1392
Description
Goal
Design Bot-scoped external users and user groups after the reviewed single-role Lark pairing slices (#1371, #1372, #1373–#1376), without requiring local-only users to configure permissions. This is a separate follow-up, not part of PR #1377's approved UI revision.
Human-confirmed decisions
- The authenticated Human who directly uses the local Web interface and talks to the Bot has the product's Super Admin authority by default. Direct Web input must not require IM pairing, a role assignment, permission setup or pairing prompts. Local-only users keep the existing unrestricted product experience.
- Inbox input originating directly from the authenticated Web Human retains that trusted provenance and full Human authority. An external IM message, copied text, a shared source or a model-supplied claim of being Web/Super Admin must not acquire that authority merely because it is displayed in a Web Channel or admitted to the Inbox.
- External IM people retain the existing trusted platform/Bot/current-App-Binding scope. Their ordinary-chat eligibility and supported management capabilities stay explicit; the current shipped candidate assigns one Role per chat pairing.
- PR Add ordinary Lark roles and reviewed automatic chat pairing #1377 first improves that existing model's layout: people / roles / requests tables, selected-person details, separate role dialogs and contextual information icons. It does not introduce user groups or per-person direct permissions.
Human-confirmed contract — 2026-10-11
The Human approved the AWS-informed recommendation and instructed implementation after the four original Lark slices merged. This first tracer manages continuous authorization groups, supported structured capabilities and explicit individual exceptions. It does not union natural-language Roles or build AWS IAM's full policy engine.
- Keep one primary behavior Role per ordinary chat pairing. Its natural-language policy remains model behavior, not an arbitrary resource ACL.
- Within one Bot/platform/current App Binding, a person may belong to multiple authorization groups. Membership refers to the exact approved ordinary conversation pairing, not display name, platform conversation membership or an enduring cross-Binding user directory.
- Effective structured capability: applicable legacy management grant + primary Role Allow + active Group Allow + direct-person Allow, minus any explicit Group/person Deny. No applicable Allow means denied. Show sources and revisions; removing one group contribution does not cancel an independent Allow.
- The first supported editable capability set is
approve/reject, using the existing native private-approval path. Existing stored answer/save-rules grants remain compatible; this slice does not deliver those controls or permit a Group to grant machine-owner authority. - Group membership does not create pairing/chat eligibility. Revocation, disabled/replaced Binding, unavailable Role and re-pairing fail closed; fresh pairing does not restore old memberships or individual exceptions. Scope and current state are rechecked at the actual management decision, including delayed cards and restart.
- Direct authenticated Web Human input retains default full Human/Super Admin product authority without IM pairing, configuration or prompts. Native execution approval is preserved; externally sourced text displayed in Web cannot acquire Human provenance.
Current delivery
- Implementation tracer: IM tracer: continuous authorization groups and explicit person exceptions #1406 (native child), completed and Project Done.
- One primary behavior Role remains; continuous groups and explicit personal exceptions resolve current supported management capabilities.
- The first tracer is implemented, real Lark QA is complete and the Human accepted its group/exception and approval interactions. Acceptance and exact-head CI; PR Add scoped IM authorization groups and person permission exceptions #1407 and Provider repair PR [Retired] Roadmap hub: M1–M7（PersonaBot → SoulSnapshot → Registry） #20 are merged; the native child and this design issue are closed. Product CI is green; Provider's full Windows check has disclosed failures in unchanged image-input/update tests.
- Pairing codes remain separate in Design: reviewer DM pairing cards and one-time Lark/IM codes #1404; no takeover of questions, save-rules or management-destination work.
Parent: #1372. Project: IM Identities & Messaging (#10). Live claims, dependencies and Human gates remain authoritative.
Activity
DoodleBears commentedon Oct 11, 2026
Design research — AWS IAM practice, not an accepted permission contract
The Human asked how the proposed first Group slice compares with industry/AWS IAM practice. No Group behavior was approved by that question, and no implementation claim is made here.
Primary sources checked on 2026-10-11:
Revised proposal, requiring reviewed design before implementation:
The earlier single-Role batch assignment suggestion remains a possible narrow delivery option, not industry best practice or a Human-selected design. #1392 remains needs-triage/Todo.
DoodleBears commentedon Oct 11, 2026
Human confirmed the AWS-informed continuous Group authorization recommendation and instructed implementation on 2026-10-11. The approved first contract keeps one primary natural-language Role; applicable structured Allow sources combine and any explicit Group/person Deny wins. Direct Web Human authority remains full by default. First delivery edits supported approve/reject only, preserves legacy management grants, binds memberships/exceptions to exact current ordinary pairing and App Binding, and shows current permission sources. The first runnable tracer follows this design issue; earlier not-ready statements are superseded for this bounded contract. No other current claim/blocker found; #1404 remains separate.
DoodleBears commentedon Oct 11, 2026
Agent work claim
DoodleBears commentedon Oct 11, 2026
Agent work evidence — first tracer under review
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; state: active, awaiting the complete Lark/native acceptance path.29ba1541e4537131a8f7923581bbacc2032a613e.WEB1406_OKthrough the real model andchannel_send.DoodleBears commentedon Oct 11, 2026
CI repair and receiver status
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; active claim retained for the unfinished acceptance scope.550898dd4cc3f11198e1eab904755826906381f1.DoodleBears commentedon Oct 11, 2026
Agent work evidence — CI passed; real acceptance pending
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; state: active for remaining acceptance, with the same claim and branch.550898dd4cc3f11198e1eab904755826906381f1.DoodleBears commentedon Oct 11, 2026
Agent verification update — #1406 first tracer
Task:
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; state: active, awaiting first-tracer Human feedback.Product PR #1407 at
cefa12fac05856c182bfab4b80f565f7ec074f06now includes current main, combined bilingual ledgers and ADR-0168 without changing the group permission model. Provider PR #20 supplies the bounded shared-card renderer repair; the exact Provider candidate is adopted and digest-verified.All six real QA1 native scenarios are complete: group-derived Allow once; independent Reject; old-card Allow blocked by current group Deny while another group still Allows; fresh Allow after Profile restart; repaired original-card Allow; repaired original-card Reject. Native results and actual private replies agree, and the last two original cards visibly show final status with zero buttons. Committed sanitized QA record.
QA1 receiver is stopped and its exclusive window released. Original group permissions and personal Deny are restored; temporary management pairings revoked, route off, no native approval pending. The dirty #1031 Provider checkout and other owners' scopes were preserved.
Current Linux CI passed. Provider 105 local related tests/build/package verification pass; no Provider CI run is reported. Review evidence and exact-head limits. Human feedback is still required before expanding sibling features; no merge/deployment or Done transition.
DoodleBears commentedon Oct 11, 2026
Human acceptance and review handoff — #1406
The Human explicitly replied “接受这轮交互” on 2026-10-11, accepting the first authorization-group/person-exception tracer including real Allow once, independent Reject, delayed Deny, restart and final original-card display.
Task:
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; state: active, awaiting PR review/integration. The first-tracer Human feedback gate is satisfied.Product PR #1407, head
cefa12fac05856c182bfab4b80f565f7ec074f06: complete Linux verify passed — 4027 tests passed, 13 skipped, 481 files passed, seven skipped; lint/format/typecheck/build/docs/generated checks pass. Prerelease preparation also passed. No release was published.Provider repair PR #20, head
1bf6baa8ad09b337f80f119961d10c4783ea702e: 105 related regressions, build and package verification pass; real new Allow/Reject cards display final state with no buttons. GitHub reports no Provider CI run. The extra full native-Windows check ended with 3722 passed, 40 failed, seven skipped: failures are in unchanged image-input settings and update-service tests. These files and their owning modules are outside the four-file repair diff; that full local suite is not claimed green.Thirteen actual settings/Lark screenshots render in the product PR body; its accessible exact-head explanation and sanitized QA record are linked there. QA1 receiver is stopped and its window released, temporary private management pairings revoked, notification route off, original group Allow/person Deny restored, and no native approval remains pending.
Both PRs are ready for review. Issue/Project remain open/In Progress pending PR review and integration; this records acceptance, not a PR merge or deployment authorization. Existing #1031/#1033/#1034 owners and #1404's undecided pairing-code contract are unchanged.
DoodleBears commentedon Oct 11, 2026
Agent work outcome — completed
Task:
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; state: completed for the confirmed authorization-group/person-exception tracer and bounded Provider card-display repair.The Human accepted the full real Lark tracer and then explicitly authorized merge. Product PR #1407 merged to main at
0c56a8b558d01e6012c50de2029d4c53e6260369; Provider PR #20 merged to the qualifiedcodex/1111-inline-app-setupline at81b91291600edba36b1947940c2be8e50abc9fdf. Product merge tree equals the exact qualified head, whose verify and prerelease preparation passed (4027 tests passed, 13 skipped).The recorded Human acceptance, native six-scenario evidence, 13 GitHub-rendered screenshots and exact-head review artifact remain linked in the PR/Issue. Provider full native-Windows limitations remain disclosed; no complete Provider CI pass is inferred. QA1 is stopped and its window released. No publication, deployment or production receiver takeover occurred.
The native #1406 child fulfills #1392's confirmed first-tracer contract. The separate pairing-code design #1404 and existing questions/save-rules/destination owners retain their own scope. Project cards move to Done only for these completed issues; Hub #1372 stays open for #1404.