CodeMower.com: single-workspace Slack OAuth installation and explicit policy binding

[jeffhuber]

Canonical remaining outcome — 2026-09-17

The implementation is complete and merged. This issue remains open only for operational acceptance in one owner-designated isolated Slack test workspace/app: authenticated admin setup, immutable user/channel/repository bindings, rotation, disable, deletion/reinstall, denial paths, sanitized platform/application/database/export checks, and rollout/rollback evidence. Public evidence must contain only the redacted readiness projection. Completion requires the designated workspace/app plus approved admin and deployment/log access through the private operational boundary.

Part of #903.

Problem

Slack installations, organization membership, repository aliases, users, channels, and token lifecycle need an explicit hosted trust boundary.

Scope

Implement OAuth v2 state validation and HTTPS redirect handling, encrypted bot/refresh/signing-secret storage, one-organization installation binding, explicit member mapping, repository aliases, per-user action roles, channel allowlists, Slack Connect policy, disable/uninstall, and rotation. Provide an administrator setup/disable surface.

Dependencies

• Slack: app manifest and authenticated bounded ingress envelope #917

Acceptance criteria

• Authorization uses immutable enterprise/team/app/user IDs, never names or email.
• Cross-organization, unbound user, arbitrary repository, disallowed channel, and revoked installation requests fail closed.
• Secrets are encrypted and absent from logs, exports, diagnostics, and OSS state.
• Admin setup, rotation, disable, and deletion are exercised in a private test organization.

Code Mower delivery

Produce exactly one independently reviewable PR for this issue. Record the named builder, keep one writer on the branch, run focused tests and applicable full checks, obtain an independent Code Mower review against the exact current head, resolve every P0/P1/P2 finding, and pass normal CI plus code-mower/gate. Update the parent epic with PR/head, review, validation, outcome, and safe metadata-only upload evidence. Do not put credentials, source, diffs, prompts, transcripts, private context, task/message prose, or raw provider output in cloud data.

Repository boundary and completion plan

One implementation PR in the authorized CodeMower.com repository; delivered by Code Mower Codex with independent qualified Code Mower Claude review. #917 is complete, so this unit is ready. Preserve private repository/PR bindings in the authorized record and publish only safe scorecard evidence. #919 consumes installation/policy readiness and the separately frozen OSS supervisor contract #977. Installation registration alone does not establish qualified runtime readiness or authorize provider spending.

[jeffhuber]

Roadmap reconciliation update:

• The authorized private implementation already exists; no duplicate PR was created.
• Its original implementation, CI, exact-head independent review, and gate evidence are historical because the branch now needs reconciliation with newer main.
• A Code Mower refresh attempt correctly made no target mutation and exposed public runner defect Lane runner: support dotted repository slugs in lineage writer IDs #1012: dotted repository slugs are rejected when an unsanitized slug is used as the strict lineage writer ID.
• Lane runner: support dotted repository slugs in lineage writer IDs #1012 is now being fixed through a separate Claude-written, Codex-audited public PR. After that fix is accepted, resume the existing private branch refresh, rerun current-head validation and independent review, then complete this issue.

No private repository binding, credentials, source, or task content is published here. No provider or paid hosted session was started.

[jeffhuber]

Implementation milestone:

• The existing authorized private implementation was refreshed onto current main through Code Mower; no duplicate PR or branch was created.
• The refreshed scope retained the original 22-file boundary and added authoritative revoked-session checks required by newer authentication behavior.
• Focused and full local validation passed, including 1,927 tests, build, production route smoke, schema/migration parity, and credential/client-bundle privacy scans.
• Normal CI passed all jobs. Disposable PostgreSQL 17 jobs qualified both fresh canonical installation and exact-main upgrade paths, including permissions, isolation, replay/race, lease/CAS, disable, and deletion cases.
• Independent Claude merge-authority review examined the complete exact-head diff and returned PASS with P0=0, P1=0, P2=0, P3=0.
• code-mower/gate passed and the exact reviewed head was merged. The feature remains disabled by default.

The implementation contract is now available to #919. This issue remains open only for its final private test-organization exercise and the documented deployment gates: production migration, secrets/configuration, platform/database log suppression, export inspection, canary, and rollback evidence. No private repository binding, credentials, source, prompts, or task content is published here.

[jeffhuber]

v1.5.0 qualification is now bounded to one private Slack workspace with explicit immutable user, channel, and repository authorization. Slack Connect and public-channel operation are outside this release; unsupported contexts must remain disabled or fail closed.

Core implementation is complete. This issue remains open only until setup, secret rotation, disable, and deletion are exercised in the private test workspace; rollout/rollback is rehearsed; and sanitized evidence confirms that secrets and private identities do not enter logs or exports. The minimal #922 runbook should carry this operator procedure.

[jeffhuber]

Parallel qualification preparation completed through Code Mower against the authorized private implementation. No live acceptance result is claimed.

The implementation already has a server-only administrative snapshot, but it includes identity/repository metadata and does not cover all six minimal readiness facts, so it must not be exposed directly to the public doctor. A small redacted projection may be needed after the live inputs are available.

The admin lifecycle exercise is ready but requires an owner-designated isolated Slack test workspace/app, its immutable bindings, authenticated administrator access, and deployment/platform/database log access. No arbitrary workspace was selected, no credentials were searched or printed, no feature flag changed, and no Slack/provider task was started. When those prerequisites are supplied through the private operator path, the exercise will keep interaction and hosted execution disabled, temporarily enable only the control plane, run install/rotation/disable/deletion/reinstall plus denial/rollback checks, and publish only sanitized booleans/counts/timing/pass-fail evidence here.

[jeffhuber]

Fresh read-only production preflight confirms that the reviewed application and disabled OAuth relay are deployed and fail closed. Vercel drains/integration resources are empty, the relay has no bindings/custom domains/active tails, preview URLs are disabled, and all Slack credentials and enable flags remain absent. No Slack request, provider session, feature enablement, or database write occurred.

The lifecycle exercise is not ready yet. The inspected production database has not received the three reviewed Slack migrations, and the current operator credentials cannot apply them or inspect the required database platform-log surfaces. The current Cloudflare token also cannot enumerate zone Worker routes or account Workers Trace Events Logpush jobs, so the strict telemetry inventory remains incomplete. Finally, no isolated private Slack workspace/app is configured.

Private immutable evidence bundles and digests are recorded on the authorized operational issue. The next step is operator access to Slack, Cloudflare, and the production database control plane; then migration, disabled configuration, synthetic privacy preflight, lifecycle/rollback, and sanitized closeout. #918 remains open and no live qualification success is claimed.

[jeffhuber]

Progress update: the three reviewed production Slack migrations passed a rollback dry run, were then applied, and passed fresh read-only verification. The live catalog now has exactly 18/18 expected Slack tables and 55/55 expected functions, RLS on every table, no direct client/service table DML, no Slack Realtime publication, exact reviewed function grants/search paths, and the code_mower.supervisor.v2 contract.

Slack remains disabled. Remaining preflight work is the privileged database parameter-log suppression and log/drain inspection, the two Cloudflare inventory reads, isolated Slack app configuration, then synthetic privacy and lifecycle/rollback exercises. No Slack request or provider session was started.

[jeffhuber]

Operational acceptance is complete in the owner-designated isolated Slack test workspace.

The exact v1.5.0 release candidate is public merge e5101a19626a16d5af17ebb2ea3a04318b76b91b, built by immutable candidate run 35420055466. Its retained wheel SHA-256 is 621ae5fdaf9928b58384d88a3bc56772f0822cdb8fa4ad97886ffbe27d51709b; its sdist SHA-256 is 687dc3aeeb29e3b0daedd7a28eec82a7bb33a39c533880df12b0df08b3487cd3.

Private acceptance exercised the full lifecycle: initial authorization, secret rotation, disable and uninstall, deletion of stored installation configuration and mappings, immediate reinstall and OAuth reauthorization, restoration of the same immutable private policy bindings, and requester-private /codemower command delivery. The final redacted projection is one active installation generation, one administrator mapping, one repository mapping, and one verified local channel mapping. Shared-channel and Slack Connect authorization remain disabled.

The reviewed production migrations passed exact catalog verification: 18/18 tables, 55/55 functions, RLS on every table, exact function grants and search paths, no direct client or service table DML, and no Slack Realtime publication. The reviewed web deployment returns 200 from health and 401 for unsigned command and interaction requests. The OAuth relay was enabled only for reauthorization and was returned immediately to its disabled source. Its query-free health endpoint remains healthy; it has no custom routes, domains, or bindings, and logs/traces remain disabled.

A fresh privacy scan of 1,000 production log records covering the lifecycle window found zero known Slack identifiers, token prefixes, authorization values, response URLs, OAuth code/state parameters, or /codemower command text. No raw logs, credentials, private identities, repository bindings, or task prose are published.

The disabled rollback is a single hosted-bridge flag plus exact reviewed redeployment. No provider create was part of this installation/policy exercise. Provider completion and cancellation qualification remains separately bounded by #920 and the release decision by #923.

All acceptance criteria for this issue are now satisfied.