feat(messaging): default/channel policies and native scoped file transfers #343
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/channel-policy-files"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Operator request
Implement configurable per-channel response and access rules WITH DEFAULTS, plus binary content, generically and roll out on native Karsten. Karsten allows all human users in every channel the bot can access. Other installations need restrictive defaults/overrides. Access is not administration.
Generic contracts
Strict gateways.overrides..conversation policy: defaults.users/activation/replyLocation, allowedChannels and per-channel field overrides, deep layer merge with arrays replacing. Supported adapters explicitly opt in; configured policy fails closed on unsupported adapters. Native admin-only conversation-policy command persists/applies rules for future ingress.
plugin_message gains optional file {path,name} and caption. Host snapshots a regular workspace file or own inbound blob, rejects foreign/hidden/agent storage/symlinks/oversize, rechecks content hashes and binds origin session in SendMeta. Same no-replay receipt mechanism; file fingerprints detect changed content, identical sends do not reupload. Optional per-adapter files/size/policy facts and host outbound contract v1; no Slack tokens/SDK in Core. One file, <=10MiB; user mandate still authorizes content/audience.
Verification
Full Core: 1886 passed/1 existing skip. Plugins: 105 passed, including 53 Slack tests and actual host tool-to-upload integration. TypeScript/diff clean. Tests: strict policy inheritance, default restriction overrides, unsupported-adapter refusal, admin command, exact binary staging, protected/foreign/symlink/oversize refusal, caption/reference propagation and no replay.
Activation
Companion Slack commit includes actual policy enforcement and C/G/D root/thread upload handling. Use normal release/native owner and immutable module rollout; configure Karsten defaults users="", allowedChannels="", threads/thread, preserving admins, old histories and paused tasks. Actual model + provider file readback required before completion. File payloads are data, not authorization; no parser/universal audio/video understanding claim.
Release blockage traced to an orphan automation/builtin-plugins-lock branch at
e80cf127, fully merged via #336 /3f8d31eand ancestor of current main; no open PR referenced it. Publisher correctly refused to silently adopt it and failed creation with 409. Exact head was rechecked, completed branch removed normally, unchanged image/lock pipeline re-dispatched. No code/check/admission bypass.Live rollout completed on native Karsten (work): released Core 0.1.238 /
43f30c7a64and exact five-file Slack snapshot 86853e3a4bbfb083c9171bafa84ebd00fce16dee. Native owner prepared/activated Core through fresh idle admission; subsequent module/config selection also used a real admitted lease and graceful restart. Actual owner PID/identity and all module SHA256 values verified; authenticated API HTTP 200; real final POST admission 201 admitted blockers=[], verification lease released.Effective config: gateways.overrides.slack.conversation = {allowedChannels:"", defaults:{users:"", activation:"threads", replyLocation:"thread"}}. No channel-specific exceptions. Actual model queried native gateway facts and correctly explained all-user/new-channel admission, no repeat mention in engaged threads and no admin grant. Removed an old conflicting hard-coded every-message mention gate from local SOUL, replacing only technical transport rules with effective-policy reference; business role/privacy/liaison routing preserved.
Actual model used only plugin_message to send a 46-byte binary file with caption as a new post in private operator channel. Slack history + authenticated binary download verified exact SHA256 31a0c6349f024fe431b6808131385d86c506b6ac29ca1403d5f86d8aa4158f1d. Identical native retry returned same delivered receipt; provider file count remained one. Actual model also sent 68-byte PNG, independently downloaded and hash-verified c6ad2c0b6723a3d103ee5587f2e5f4fc0c95efc3b322c84536e6c4f47469eade, count one. No shell/HTTP/credential workarounds in model runs.
54 Slack tests pass on the actual Darwin host, no skips; full Plugins suite 106 passed; final Core full suite 1887 passed/1 existing skip. Includes actual Core-to-Slack file-tool integration, C/G/D root uploads, policy inheritance/denials/races, immutable staging and replay refusal. Per-channel ingress modes/access are native regression tested; no fabricated human Slack event or claimed live-human message roundtrip.
Generic docs: Core docs/conversation-policy.md and docs/messaging.md; Slack docs/slack-gateway.md. Existing admins/tokens/models/history and paused/waiting mandates preserved. File support is byte transfer, not a claim of universal PDF/audio/video understanding. Private receipts on work: ~/.local/share/vanillacore-karsten/policy-files-{activation,final-verification,final-policy-verification,binary-readback}.json and policy-files-native-tests.log. Local summary ~/.cache/hayate-maintenance/channel-policy-files/summary.json.
Fleet rollout follow-up: normal promotion PRs SaaStaq #123/#124, RackTaq infrastructure #669, Overlays #357/#358 merged. Actual running 0.1.238 /
43f30c7averified on all six active Kubernetes installations (process entry, immutable build, authenticated API identity where configured, Matrix connection after startup), Karsten native and Peter native. Existing access/channel policy unchanged; other audited installations have no configured Slack integration.NOT fleet-converged yet: Shikamaru remains 0.1.236, busy dispatcher, 15-minute fresh-admission attempt deferred without restart; Akira remains 0.1.236, busy dispatcher/foreground, bounded admission waiter running. Severus on actual isolated 192.168.1.107 remains 0.1.236: unsupported memory-consolidation update owner. Core 0.1.238 has been OCI-verified, staged and probed unprivileged there, not activated. Generic consolidation fencing/draining fix merged in Plugins #90 (999e011, exact-head CI passed); no fake lease or forced restart of the old unsupported plugin. Peter actual host is 192.168.1.103, active and now verified 0.1.238.
Evidence: local ~/.cache/hayate-maintenance/fleet-messaging/{summary,kubernetes,peter,severus,akira,karsten,shikamaru}.json. No changes to tokens/admin privileges/personas or paused/waiting/running work.
COMPLETED messaging capabilities rollout (0.1.238 or newer) across all 11 active installations. Fresh evidence: {"che-guevara": "0.1.242", "randy-waterhouse": "0.1.242", "minato": "0.1.242", "kakashi": "0.1.238", "hayate-moist-hayate": "0.1.238", "hayate-odo": "0.1.238", "karsten-agent": "0.1.242", "akira": "0.1.238", "peter": "0.1.238", "severus-snape": "0.1.238", "shikamaru": "0.1.238"}.
User explicitly authorized durable-agent restart. Shikamaru and Severus switched via graceful SIGTERM checkpoint/recovery; process executable/build/API identity verified, no ledger editing/cancellation/forced worker resume/fake idle admission. Akira had already completed its admission-based rollout and is freshly verified. Severus standalone memory adapter now uses approved Plugins #90 bytes (999e011); post-restart update admission idle with no blockers.
Final audit additionally found Odo unavailable after rescheduling: private tailnet init lacked registry credentials. SaaStaq #133 references the existing forgejo-pull-secret; normally merged and GitOps reconciled. Odo now runs exact Core 0.1.238 and reconnected Matrix. Randy 0.1.242 authenticated API checked over TLS against the existing private CA with certificate identity verification. All six Kubernetes processes checked; other native process/API identities checked.
Evidence: ~/.cache/hayate-maintenance/fleet-messaging/summary.json and per-target JSON. Agent permissions/credentials/admin rules unchanged. This completes the requested messaging rollout, not equalization of every instance to the subsequently released 0.1.242.