Design: reusable group behavior permissions with explicit overlap and conflict visibility

Parent: #1372. Project: IM Identities & Messaging (#10).
Follow-up to the completed #1392 / #1406; related current pairing-review work #1414 and saved-operation rules #1033 remain separate.

Human request

Make natural-language behavior permissions reusable through authorization groups, with visible overlaps/conflicts when a paired person belongs to several groups. The Human asks whether this can solve the current Group UI's structured-capability-only limitation. The Human accepted the reusable-item design and its first real Lark tracer. One primary Role remains; Group items extend its behavior within its constraints.

Accepted first slice

Introduce an application-defined, Bot-scoped reusable behavior permission item with a stable ID, name, bounded natural-language behavior text and revision. The accepted term is recorded in CONTEXT and ADR-0173 in PR #1428. Group editors select shared items by checkbox and record explicit Allow/Deny references; they do not copy a second free-form Role into each group. Retain one primary behavior Role, ordinary Chat pairing/current App Binding fences, and the existing separate Host-checked management capabilities.

Within one reviewed Bot/Lark test path: create one item, assign it to two groups, add one paired person to both, inspect the deduplicated current effective item and sources, change one contribution to Deny and inspect the conflict/result, then remove that contribution and re-query. The authenticated settings Client, Messaging owner and Operational Database remain the authority; model permission queries read current canonical state through the existing seam.

Overlap and conflict semantics

Scenario	Result / remaining scope	UI evidence
Same item ID allowed by Group A and B	One effective item, two sources; this is overlap, not contradiction	Show both groups; removing A leaves B effective
Same item ID allowed by A and denied by B	Explicit Deny takes precedence; assemble the item's explicit prohibition for model behavior	Conflict badge, both source effects, effective Deny and link to resolve
Same item denied by both	One effective prohibition, two sources	Deduplicate without hiding sources
Different item IDs with manually declared mutual exclusion	Deterministic conflict warning based on authored metadata	Name both items and groups; require Human resolution before granting an ambiguous new combination
Different free-form texts that might contradict	No guaranteed semantic detection	Optional advisory/manual review; never claim arbitrary natural-language conflicts are proven absent

Primary Role instructions remain applicable. Detectable conflicts with them require explicit item references/declared constraints, rather than assuming all existing free-form Role text can be parsed as an ACL. Define the actual effective-policy assembly and incompatible-edit behavior before implementation. Never silently select a group by order or ask an LLM to become the durable authorization decision-maker.

Group contribution updates, member additions and permission-item text edits must preview affected paired people and the resulting effective permissions/conflicts. Use stable IDs rather than matching names or text. Central item updates require revision checks and a visible affected-source preview; item deletion/revoke/re-pair/Binding replacement must not leave copied policies or restore previous memberships.

Important boundary

The Allow/Deny algebra and conflict display are deterministic for named records. The natural-language content remains accepted prompt behavior, not enforcement of arbitrary mail/code/filesystem/Shell resources. Host-supported management capabilities still use their own current resolver, explicit Deny and separate delegation ceiling. Behavior-item selection must not create chat eligibility, native execution approval rules, management authority or delegated machine-owner authority. Any future hard resource control must be implemented at the owning Service boundary and qualified separately.

Acceptance / review gates

Review the accepted same-ID item semantics and primary Role interaction; record CONTEXT, ADR-0173 and the living architecture.
Define declared mutual exclusion and incompatible-edit gating in a subsequent runnable slice.
Deliver one real Lark tracer: Host persistence, searchable checkbox selection, person effective-source/conflict details, current permission lookup and model-observable behavior. Obtain first-slice Human feedback before broader policy variants/platforms.
Public behavior coverage for repeated Allows, same-ID Allow/Deny conflict, source removal with independent Allow, text revisions, exact Bot/App scope, revoke/re-pair and restart.
Add declared-mutual-exclusion behavior and coverage in the later slice.
Explain prompt-policy limits accurately; show every source/effect, preserve independent management/delegation checks and direct authenticated Web Human authority.
Include narrow/light/dark UI evidence, full interaction steps, accessible exact-head PR explanation and aligned English/Chinese release records when implementation ships.

Status: In progress, awaiting PR #1453 merge review. First slice PR #1428 is merged and accepted. The declared mutual-exclusion and incompatible-edit slice is implemented, full CI passed, and its real Lark interaction was accepted. The Ready PR contains complete workflow, exact-head explanation and verified rendered screenshots. QA1 receiver stopped and window released. Optional semantic text advice remains a separate possible extension; no automatic semantic proof is claimed.

Claim and task history · Accepted Human feedback. QA1 receiver stopped; window released.

Agent work claim — first Group behavior-permission slice

Agent: Codex
Task: codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76 (not a DSH Session)
Issue scope: the Human accepted the named permission / Group selection / overlap and Deny-conflict proposal and asked to continue after Review Lark pairing from shared group cards with current delegation authority #1418 integration. Deliver a reusable item through Messaging persistence, authenticated settings, Group selection and a fresh current-permission query; preserve separate primary Role and Host management/delegation authority.
Branch: codex/1423-group-behavior-permissions
State: active; preparation uses the requalified Review Lark pairing from shared group cards with current delegation authority #1418 integration head while its final CI completes. Check all current claims/comments/PRs before work: none found for this issue; no open native blocker.
Initial semantics: items describe positive behavior/action scopes; explicit Group Deny displays an explicit prohibition, deduplicated by stable ID with all current source revisions. Primary Role constraints remain applicable and cannot be widened by Group Allows. Same-ID Allow+Allow is overlap; Allow+Deny is a visible resolved conflict with Deny winning.
This first runnable slice stops for Human feedback before expanding semantic conflict analysis, declared-mutual-exclusion controls or other Providers. Arbitrary free-form text is never treated as a proven resource ACL or an authority to execute/approve/delegate.
QA1 is stopped; no old exclusive window is inherited or receiver started. Real Lark receiver availability and review are a later gate, after a concrete runnable path exists.

Publish sanitized #1423 review evidence

Agent work outcome — handed off for review

Agent: Codex; task: codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76 (not a DSH Session). Claim.
State: handed-off. PR #1428 is ready for review at 6978f4767b531b4ad1e9ed1b30ca0a1981cac188; full final-head CI passed. No merge or deployment performed.
The Human accepted the first real Lark slice. Subsequent requested UI refinements are implemented: wide Group editor, searchable/sortable permission selection, checkbox-only Allow/Deny cells, compact Channel-sidebar disclosure styling, and modal-body scrolling with a fixed title/footer on short mobile screens.
Final review evidence includes publicly downloadable exact-head HTML and readable Markdown. The PR body contains the full interaction workflow and 17 GitHub-rendered before/after images, checked on the public PR page. CONTEXT, ADR-0173, architecture and bilingual release records are aligned.
Remaining scope: review/merge this first slice; then implement declared mutual exclusion and incompatible-edit gating as the next validated slice. Optional semantic advice remains advisory, never a guaranteed natural-language conflict detector. Design: reusable group behavior permissions with explicit overlap and conflict visibility #1423 stays open and Project In progress; this PR uses Refs rather than Closes.
QA1 receiver remains stopped and its exclusive test window released. The local review UI reuses the existing port with a receiver-free copy; it does not take over another App receiver.
Latest issue comments show no other active claim. This task's agent:active marker is released for review handoff; the claim and outcomes remain the ownership history. A successor must check the open PR and coordinate before editing its scope.

Add reusable Group behavior permissions and conflict previews (#1428)

First-slice merge outcome — Human authorized

Task codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76: completed for the first shared behavior-item slice. The Human accepted the compact disclosure UI and authorized merge. PR #1428 squash-merged into main at 73c75f86aa50767be34a5c8d2cadc17b6a3e8862; its exact premerge head 6978f4767b531b4ad1e9ed1b30ca0a1981cac188 passed full CI. Review evidence.

This is partial delivery of #1423, not whole-issue completion: declared mutual exclusion, incompatible-edit gating and optional semantic advice remain open. No deployment, release, or QA receiver restart occurred. The other collapsible UI audit was handed to a separate Human-initiated session with no implementation claim; this session continues the roles/IM-pairing Project. Claims for existing IM tasks remain unchanged.

Agent work claim — declared Group behavior conflicts

Agent: Codex
Task: codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76 (not a DSH Session)
Issue scope: resume Design: reusable group behavior permissions with explicit overlap and conflict visibility #1423 after Human explicitly selected its second slice. Add manually declared mutual exclusion between stable Bot-scoped behavior item IDs, affected-person/source previews and canonical refusal of incompatible new grants or edits. Preserve the accepted first-slice same-ID Deny precedence, primary Role and separate management/delegation authorization.
Branch: codex/1423-declared-conflicts, isolated worktree based on current main e513ac414ab6c38ee95173377ebeb0950324d7dc.
State: active. Fresh body/comments, native dependencies and open PR check found no competing task; first-slice PR Add reusable Group behavior permissions and conflict previews #1428 is merged and its Human feedback gate is satisfied. This is the same task's new bounded continuation, not takeover of another owner.
Proposed deterministic semantics: author exclusions by item IDs; an authored pair is symmetric. Only effective Allows contradict each other; an explicit Deny still takes precedence. Validate the resulting group/member configuration and item metadata before commit, including edits/removal that would expose a conflict. Keep raw text interpretation advisory; no automatic natural-language contradiction detector or arbitrary resource isolation.
Lark tracer: explicitly saved approval rules and creator-authorization revocation #1033 is read-only audited concurrently for existing Web/native rule-saving versus Lark support. It is not claimed or implemented in this slice.
No receiver start, inherited QA window, App permission change, production deployment or automatic merge. Reuse the existing review port and coordinate a fresh QA1 window when the runnable slice is ready.

Separate authored exclusions from effective sender behavior

Agent work outcome — declared-exclusion slice ready for review

Agent: Codex
Task: codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76 (not a DSH Session)
State: handed-off for merge review; implementation and new-slice Human QA complete
Branch: codex/1423-declared-conflicts
PR: #1453, Ready, head aefdf9a82d1f18ef162a9914253d39cdcd522c53
Human feedback: accepted this round's interaction in the task, after actual two-item UI/Host refusal, explicit Deny resolution, fresh Lark permission queries and post-restart result. Values 3127 / 3599 / 4087; management/delegation remain empty. Configuration-only exclusion IDs are omitted from sender queries after a real-model ambiguity was reproduced and corrected.
Full exact-head CI: passed; 27 focused tests and final Standards/Spec reviews passed. CodeRabbit's ready-transition review is rate-limited, with no substantive review despite its status context.
Evidence: six desktop dark/light/narrow before/after pairs, actual creation and cropped native Lark reply, complete workflow, exact-head HTML explanation and rollback risk are in the PR. All 14 body images rendered on GitHub; all 18 public files matched local bytes.
QA1 receiver stopped and exclusive window released. Screenshot Hosts stopped. No production receiver, merge or deployment performed.
Remaining: merge review. Optional semantic text advice remains outside this deterministic declared-ID slice; it is not a permission enforcement gate. Keep this Issue open/In Progress until the PR is merged. No replacement implementation claim is needed.

The earlier first-slice claim/history is preserved. #1033 remains separately tracked; read-only code audit shows Web rule saving exists but external Lark approve-matching/rule authority is still missing.

Gate incompatible Group behavior grants with declared exclusions (#1453)

Agent work completed — declared Group exclusions merged

Agent: Codex; Task: codex/local/01a12734-8226-7ae3-8d1b-db08bde64d76.
State: completed.
Human authorized merge after accepting the real interaction. PR #1453 merged at 65bfa22e1bf27840fff5b9b2f198b42c45c7b2ed with Issue/Agent-Task trailers retained.
Exact-head full CI, parallel Standards/Spec reviews, accepted native Lark QA and all 14 rendered screenshots were verified before merge. CodeRabbit remained rate-limited and was not counted as substantive approval.
Design: reusable group behavior permissions with explicit overlap and conflict visibility #1423 implementation criteria are complete; optional semantic text advice remains outside this deterministic declared-ID contract. Issue closed, Project M3: Bot 模式 IA 与聊天外壳（列表/Section/DM/本地消息） #10 Done.
QA1 receiver and screenshot Hosts remain stopped; the exclusive window is released. No deployment or production receiver takeover.

Navigation Menu

Repository navigation

Design: reusable group behavior permissions with explicit overlap and conflict visibility #1423

Human request

Accepted first slice

Overlap and conflict semantics

Important boundary

Acceptance / review gates

Agent work claim — first Group behavior-permission slice

7 remaining items

Agent work outcome — handed off for review

First-slice merge outcome — Human authorized

Agent work claim — declared Group behavior conflicts

Agent work outcome — declared-exclusion slice ready for review

Agent work completed — declared Group exclusions merged

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Design: reusable group behavior permissions with explicit overlap and conflict visibility #1423

Description

Human request

Accepted first slice

Overlap and conflict semantics

Important boundary

Acceptance / review gates

Activity

DoodleBears commented on Oct 11, 2026

Agent work claim — first Group behavior-permission slice

7 remaining items

DoodleBears commented on Oct 11, 2026

Agent work outcome — handed off for review

DoodleBears commented on Oct 11, 2026

First-slice merge outcome — Human authorized

DoodleBears commented on Oct 11, 2026

Agent work claim — declared Group behavior conflicts

DoodleBears commented on Oct 11, 2026

Agent work outcome — declared-exclusion slice ready for review

DoodleBears commented on Oct 11, 2026

Agent work completed — declared Group exclusions merged

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions