Repository navigation
IM tracer: continuous authorization groups and explicit person exceptions #1406
Description
Parent: #1392; delivery coordination #1372, Project #10.
Human-confirmed contract — 2026-10-11
The Human approved the AWS-informed recommendation and instructed implementation after the four original Lark slices merged. This first tracer manages continuous authorization groups, supported structured capabilities and explicit individual exceptions. It does not union natural-language Roles or build AWS IAM's full policy engine.
- Keep one primary behavior Role per ordinary chat pairing. Its natural-language policy remains model behavior, not an arbitrary resource ACL.
- Within one Bot/platform/current App Binding, a person may belong to multiple authorization groups. Membership refers to the exact approved ordinary conversation pairing, not display name, platform conversation membership or an enduring cross-Binding user directory.
- Effective structured capability: applicable legacy management grant + primary Role Allow + active Group Allow + direct-person Allow, minus any explicit Group/person Deny. No applicable Allow means denied. Show sources and revisions; removing one group contribution does not cancel an independent Allow.
- The first supported editable capability set is
approve/reject, using the existing native private-approval path. Existing stored answer/save-rules grants remain compatible; this slice does not deliver those controls or permit a Group to grant machine-owner authority. - Group membership does not create pairing/chat eligibility. Revocation, disabled/replaced Binding, unavailable Role and re-pairing fail closed; fresh pairing does not restore old memberships or individual exceptions. Scope and current state are rechecked at the actual management decision, including delayed cards and restart.
- Direct authenticated Web Human input retains default full Human/Super Admin product authority without IM pairing, configuration or prompts. Native execution approval is preserved; externally sourced text displayed in Web cannot acquire Human provenance.
Runnable slice
Create one ordinary Role and approve a test person using existing settings. Create an authorization group with Approve/Reject Allow/Deny choices in a separate native dialog; add the paired person. Inspect effective capability sources in People and a fresh read-only permission Tool result. Exercise actual Allow once and Reject; edit/remove the group or membership and prove a delayed unauthorized card no longer succeeds. Add another independent source and demonstrate union and deny precedence; apply/remove a direct-person exception. Restart and confirm current group/member/exception authority. Submit a normal direct Web DM while external restrictions are active, without external permission setup.
Acceptance
- Messaging owns canonical bounded group/membership records and individual exceptions in Operational Database; no second listener/store or native DSH RBAC. Transactions and exact revisions refuse stale edits. Migration preserves existing Role, pairing, policy and management grants.
- Authenticated API Gateway/Client commands create/edit/delete groups, update exact member sets and person exceptions. Current permission queries and supported actual private decisions share one effective-capability resolver.
- Existing native wide pairing workspace has a searchable/sortable Groups table, compact creation/change time, details, separate create/edit dialog and scoped member choices. People show effective permissions and their sources; explanatory text uses info tooltips.
- Public behavior tests cover multi-group Allow, Deny precedence across independent sources, direct exceptions, removal without copied grants, stale revisions, wrong Bot/App/actor, disabled/replaced Binding, revoke/re-pair, restart and unchanged Web Human authority.
- Isolated Host → canonical writes → real Client → fresh permission query → actual supported approval/rejection verification, with before/after light/dark/narrow and complete workflow PR-body evidence. Arrange a fresh exclusive receiver window before real Lark connection; preserve other owners and production.
- Integrate accepted product vocabulary/ADR/living architecture and bilingual ledgers; PR includes task trace, merge risk, accessible exact-head explainer and final CI evidence. Human feedback on this first tracer is required before broadening group/provider variants.
No dependency on the unimplemented one-time pairing-code #1404. Existing questions #1031, saved rules #1033 and management destinations #1034 retain their tickets/owners. No deployment or new merge authorization is inferred.
Accepted qualification — 2026-10-11
Human feedback, exact-head checks and review limits. All first-tracer acceptance items above are satisfied. Product PR #1407 and Provider PR #20 are merged. This issue is closed and Project Done; completion and integration evidence concludes the implementation claim.
Activity
DoodleBears commentedon Oct 11, 2026
Agent work claim
Live #1392 preflight found no competing claim, native blocker, child or implementation PR. This newly focused first-slice ticket is attached under that accepted design. Other IM claims and #1404 remain untouched; real Lark connection requires a freshly coordinated exclusive test window.
Publish exact-head #1406 review explainer
DoodleBears commentedon Oct 11, 2026
Agent work evidence — first tracer under review
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; state: active, awaiting the complete Lark/native acceptance path.29ba1541e4537131a8f7923581bbacc2032a613e.WEB1406_OKthrough the real model andchannel_send.Update Inbox upgrade regression for authorization-group schema
Publish exact-head #1406 review explainer
10 remaining items
Publish exact-head #1406 review explainer
DoodleBears commentedon Oct 11, 2026
Agent verification update — #1406 first tracer
Task:
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; state: active, awaiting first-tracer Human feedback.Product PR #1407 at
cefa12fac05856c182bfab4b80f565f7ec074f06now includes current main, combined bilingual ledgers and ADR-0168 without changing the group permission model. Provider PR #20 supplies the bounded shared-card renderer repair; the exact Provider candidate is adopted and digest-verified.All six real QA1 native scenarios are complete: group-derived Allow once; independent Reject; old-card Allow blocked by current group Deny while another group still Allows; fresh Allow after Profile restart; repaired original-card Allow; repaired original-card Reject. Native results and actual private replies agree, and the last two original cards visibly show final status with zero buttons. Committed sanitized QA record.
QA1 receiver is stopped and its exclusive window released. Original group permissions and personal Deny are restored; temporary management pairings revoked, route off, no native approval pending. The dirty #1031 Provider checkout and other owners' scopes were preserved.
Current Linux CI passed. Provider 105 local related tests/build/package verification pass; no Provider CI run is reported. Review evidence and exact-head limits. Human feedback is still required before expanding sibling features; no merge/deployment or Done transition.
Publish exact-head #1406 review explainer
DoodleBears commentedon Oct 11, 2026
Human acceptance and review handoff — #1406
The Human explicitly replied “接受这轮交互” on 2026-10-11, accepting the first authorization-group/person-exception tracer including real Allow once, independent Reject, delayed Deny, restart and final original-card display.
Task:
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; state: active, awaiting PR review/integration. The first-tracer Human feedback gate is satisfied.Product PR #1407, head
cefa12fac05856c182bfab4b80f565f7ec074f06: complete Linux verify passed — 4027 tests passed, 13 skipped, 481 files passed, seven skipped; lint/format/typecheck/build/docs/generated checks pass. Prerelease preparation also passed. No release was published.Provider repair PR #20, head
1bf6baa8ad09b337f80f119961d10c4783ea702e: 105 related regressions, build and package verification pass; real new Allow/Reject cards display final state with no buttons. GitHub reports no Provider CI run. The extra full native-Windows check ended with 3722 passed, 40 failed, seven skipped: failures are in unchanged image-input settings and update-service tests. These files and their owning modules are outside the four-file repair diff; that full local suite is not claimed green.Thirteen actual settings/Lark screenshots render in the product PR body; its accessible exact-head explanation and sanitized QA record are linked there. QA1 receiver is stopped and its window released, temporary private management pairings revoked, notification route off, original group Allow/person Deny restored, and no native approval remains pending.
Both PRs are ready for review. Issue/Project remain open/In Progress pending PR review and integration; this records acceptance, not a PR merge or deployment authorization. Existing #1031/#1033/#1034 owners and #1404's undecided pairing-code contract are unchanged.
Publish exact-head #1406 review explainer
Merge pull request #20 from DoodleBears/codex/1406-lark-shared-approv…
Merge pull request #1407 from BotHarness/codex/1392-im-group-authority
DoodleBears commentedon Oct 11, 2026
Agent work outcome — completed
Task:
codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76; state: completed for the confirmed authorization-group/person-exception tracer and bounded Provider card-display repair.The Human accepted the full real Lark tracer and then explicitly authorized merge. Product PR #1407 merged to main at
0c56a8b558d01e6012c50de2029d4c53e6260369; Provider PR #20 merged to the qualifiedcodex/1111-inline-app-setupline at81b91291600edba36b1947940c2be8e50abc9fdf. Product merge tree equals the exact qualified head, whose verify and prerelease preparation passed (4027 tests passed, 13 skipped).The recorded Human acceptance, native six-scenario evidence, 13 GitHub-rendered screenshots and exact-head review artifact remain linked in the PR/Issue. Provider full native-Windows limitations remain disclosed; no complete Provider CI pass is inferred. QA1 is stopped and its window released. No publication, deployment or production receiver takeover occurred.
The native #1406 child fulfills #1392's confirmed first-tracer contract. The separate pairing-code design #1404 and existing questions/save-rules/destination owners retain their own scope. Project cards move to Done only for these completed issues; Hub #1372 stays open for #1404.
Add current scoped IM authorization groups and person exceptions