[DoodleBears]

Refs #1031 | Agent claim | Provider candidate #14

Task: codex/local/01a1131c-b268-7212-9ac8-d1c7bf9b6e28.

Why the change

A paired Lark responder can answer a native Human question through its original private card or an explicitly correlated text reply while the original question owner accepts one canonical answer and the same Session continues.

Special things to note

• Merge risk: one-way door for database downgrade — schema generation 61 adds notification metadata; a rollback must retain generation-61 compatibility rather than start a schema-60 binary. Large blast radius — native Human answers and live model Sessions are authority boundaries; review actor/account/receipt fences, Web/IM races, post-commit uncertainty, explicit reconciliation and restart refusal. Canonical question and answer content remains in Channel history.
• Requires the independently checked Provider question contract at a9f6cbc (#14); no qualified pin update, package publication or deployment. The first guarded platform window stopped Lark card creation on its 1000-character input limit; the candidate now renders and validates that limit, but actual form/SDK callback/final card qualification still awaits a new Human-authorized window. QA authority was revoked and production restored; the Human confirmed both Lark and Discord normal. Keep draft and seek tracer feedback before expansion; native waits still block and no Inbox continuation is claimed.
• Native Windows: 209 unique focused BotHarness tests passed across eleven files; Provider 791 passed / 5 existing platform-related skips; lint, format, typecheck and build passed. Direct Astro docs build passed (392 pages); the combined docs entry remains blocked by the existing Windows slides launcher (spawnSync pnpm ENOENT). The real model's two-question Web run committed one option/custom answer, resolved the original ask_user_question and completed that Session's turn. Existing broader Windows cleanup/updater/POSIX failures are not claimed green. The local UTC cutoff was actually exercised with IM disabled and stopped the exact QA Host.

Change outline

original native ask_user_question
  → committed Channel request + live ChannelUserQuestions owner
  → notification projection (no copied question/answer authority)
  → configured management DM, Answer-only capability
  → checked Provider form / explicit /answer reference / original-card reply
  → actual actor + account + receipt + original values + live owner
  → authorization rechecked immediately before canonical Channel append
  → one answer → same native Promise → same Session continues

uncertain submission → preserve original wait → explicit Web reconciliation
cancel/restart → original card terminal state, no restored Promise/replay
ordinary clarification → existing source conversation

-- Operational schema generation 61: delivery metadata only.
CREATE TABLE messaging_question_deliveries (
  id TEXT PRIMARY KEY,
  bot_slug TEXT NOT NULL,
  body TEXT NOT NULL CHECK (json_valid(body))
);
-- Existing authenticated API Gateway management bridge:
-- questionRetry({ slug, id }) → same-owner reconciliation or known-failure repair.

 MessagingProfile
  ├─ PairingSettings          Answer capability remains independent
  ├─ ApprovalSettings        shared revisioned management destination
+ └─ QuestionNotifications   native state / delivery / submission / explicit repair

Management Profile — 1440 × 960, Chinese, disabled receiver

Same QA Bot name and empty route/binding state; the candidate's older QA sidebar entries are incidental history. These are actual native screenshots, not Lark delivery evidence.

Before, light — only approval notifications.

After, light — separate question notifications and capability-specific management destination.

Before, dark

After, dark

Existing native Web owner — pending and answered

The pre-existing Web question form verifies the unchanged owning Session path. Lark question forms still need the newly authorized platform review; the previous #1029 approval window does not qualify this slice.

Sanitized versioned evidence records source digests, native result, checked package identity and limits. The English/Chinese Lark guide documents explicit correlation, clearing a single choice before custom text, uncertain outcomes, repair, revocation and restart.

The first guarded platform attempt records Lark error 11310, zero canonical answers, no unknown-result replay, expired original wait after restart, complete QA revocation and production recovery within ten minutes. Provider a9f6cbc fixes the observed field limit and passes the same 791 contracts; it is installed and digest-verified with reception disabled. This failure is not form qualification.

Runnable review: build this commit on native Windows with DSH 0.2.0-rc.1, install Provider a9f6cbc into an isolated disabled Profile, then use a fresh guarded receiver window for Human /pair, Answer only, a two-question option/custom form (each form input up to 1000 characters) and a separate explicit-reference text answer. Verify one canonical answer, original native result/continuation and original final card; revoke/unbind/disable and stop the exact local receiver before restoring production and checking both Lark and Discord.

CI follow-up: 29dbcd0b keeps IM question attachment gated on database readiness and updates the exhaustive bridge contract test. All 35 relevant recovery/plugin/native-question/Lark tests passed on Windows, along with lint, format, typecheck and build; the fresh Linux CI run passed with 3066 tests passed / 9 skipped, lint, format, typecheck and build. The rebuilt source is running in the authenticated isolated QA Profile with the exact Provider digest checked, reception disabled, no active identities and no approved pairings.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[DoodleBears]

Closing per the owner's PR cleanup; the feature is still wanted and #1031 stays open (main's docs/lark-connection.md still says Lark question answering is delivered separately). This branch conflicts in 22 files, its schema generation 61 collides with main's existing generation 61 (main is now at 83), the messaging-profile.tsx settings it edits were removed on main, and Provider PR BotHarness/dsh-im#14 is unmerged. A fresh slice should use the next free generation, put settings in the Bot DM sidebar, follow #1540's rule that asks go to their source Channel, and can reuse question-messaging.ts and lark-questions.test.ts from this branch, which is kept for reference.

---

Generated by Claude Code