Slack: minimal opt-in setup, doctor, and runbook for v1.5.0

[jeffhuber]

Canonical reduced v1.5.0 scope — owner-approved 2026-09-17

This section supersedes the original general integrations, telemetry and Board/cloud scope below.

Deliver one minimal OSS PR for: explicit opt-in manifest preparation for one private workspace; a separate redacted readiness doctor for install/policy/qualified-supervisor/hosted-transport/cap state; safe remediation; start/status/answer/cancel runbook; and fresh install, upgrade, disable, rollback and uninstall guidance. Default Claude + Codex installation remains unchanged and performs no Slack prompt, login, dependency or service setup.

#921/#978 telemetry, hosted aggregate views, Board links, a general integrations picker, rich Slack UX, Slack Connect and public channels are v1.5.1. The implementation PR is #1024; verified publication bootstrap correction #1025 must land before its exact-head Claude PASS can satisfy the authoritative gate.

Part of #903.

Problem

Slack and other integrations need discoverable setup without crowding the simple participant-first installation.

Scope

Add a separate optional-integrations picker for Coworker, Graphify, Slack, and hosted Devin; keep the participant default Claude + Codex. Add Slack manifest/OAuth/policy/channel/provider readiness doctor checks, redacted remediation, installation/upgrade/troubleshooting docs, and Board/cloud status links.

Dependencies

• v1.5.1: Slack telemetry contract and OSS Board/cloud emitters #921 — OSS telemetry contract and gated emitters.
• v1.5.1: CodeMower.com Slack telemetry, aggregation, and fresh views #978 — separately reviewed/deployed hosted acceptance and fresh views.
• Participants: enforce role-specific qualification for hosted builders #975/Adoption polish: report effective review authority and superseded Devin bridge drift #955 — role qualification and effective-authority reporting.
• Slack: connect authorized tasks to a qualified Code Mower supervisor #977 — real qualified supervisor readiness and connection.

Acceptance criteria

• Fresh default setup has no Slack login, dependency, service, or extra prompt.
• Scripted and interactive users can opt in explicitly.
• Doctor distinguishes app install, identity mapping, repository/channel authorization, provider readiness, and cloud telemetry readiness.
• Diagnostics disclose no private identities, channels, repository mappings, URLs, tokens, or task text.

Code Mower delivery

Produce exactly one independently reviewable PR for this issue. Record the named builder, keep one writer on the branch, run focused tests and applicable full checks, obtain an independent Code Mower review against the exact current head, resolve every P0/P1/P2 finding, and pass normal CI plus code-mower/gate. Update the parent epic with PR/head, review, validation, outcome, and safe metadata-only upload evidence. Do not put credentials, source, diffs, prompts, transcripts, private context, task/message prose, or raw provider output in cloud data.

Revised readiness and PR mapping

One planned OSS PR, planned Code Mower Claude builder with independent qualified Code Mower Codex review. Doctor must distinguish configured registration, actual qualified supervisor reachability, hosted builder transport, task/aggregate budget, authorization, stored receipt, and fresh aggregate visibility. Missing supervision prevents dispatch with a bounded remediation; setup must not imply Devin orchestration qualification. Default setup remains Claude + Codex with no Slack prompts, services, or login. A hosted UI change belongs in its owned hosted child, not this OSS PR.

---

Reduced v1.5.0 scope (owner-approved 2026-09-17)

Provide the smallest supported operator path for the basic v1.5.0 Slack release:

• Explicit opt-in setup for one private workspace.
• Slack app/OAuth configuration and immutable user/channel/repository policy binding.
• Readiness checks for installation, policy, qualified supervisor reachability, hosted Devin transport, and configured task/campaign caps.
• Safe remediation for disabled, revoked, stale, mismatched, or unreachable components.
• A concise start/status/answer/cancel operating runbook.
• Fresh install, upgrade, disable, rollback, and uninstall guidance.

Default Code Mower setup remains Claude + Codex and does not prompt for Slack. Diagnostics disclose no private identities, mappings, tokens, URLs, provider references, or task prose. Telemetry readiness, Board/cloud links, a general integrations picker, rich Slack UX, Slack Connect, and public-channel guidance are deferred to v1.5.1.

Dependencies: implemented #918/#920 surfaces and qualified supervisor #977. This issue no longer depends on #921 or #978.

[jeffhuber]

Code Mower Codex is the sole builder/writer for this unit. Draft PR: #1024

Current head: 1dd92ace0c64ebb9c12aa2513a188c5aaa75fc67.

Implemented the reduced OSS scope: separate explicit manifest preparation, redacted read-only Slack readiness, and private-workspace installation/operation/upgrade/removal guidance. Default Claude + Codex setup is unchanged. The private host supplies authenticated readiness observations through an explicitly selected bounded probe; offline snapshots cannot establish live readiness.

Validation so far: 45 focused Slack tests, repository Ruff, privacy scan, package workflow guard, all 22 release-readiness checks, wheel/sdist build, Twine, and packaged Slack resource verification passed. Broader checks and GitHub CI are in progress. Independent exact-head Claude review is requested with needs-claude-audit; review and code-mower/gate are not yet claimed passed.

No deployment, credentials, live Slack/provider operation or cloud upload occurred. All probe fixtures are synthetic. Remaining: complete validation, independent review/fix rounds and final gate evidence. Live hosted adapter configuration and capped acceptance remain operator/#923 work.

[jeffhuber]

Independent audit is blocked on the supported runner/authentication boundary. PR #1024 remains draft at 1dd92ace0c64ebb9c12aa2513a188c5aaa75fc67, with Code Mower Codex as sole source writer and needs-claude-audit retained.

The trusted audit request succeeded, but https://github.com/codemower-ai/code-mower/actions/runs/35306082524 has no assigned reviewer runner. GitHub reports zero repository-level self-hosted runners; this account cannot inspect organization runners. The supported local fallback command tools/run_claude_audit_pr.sh --repo codemower-ai/code-mower --pr 1024 --repo-paths OWNER/REPO:SEPARATE_CHECKOUT --dry-run --publication workflow --timeout 900 --max-budget-usd 2 --no-spend-capture stopped before any provider invocation because its required GITHUB_TOKEN input is unavailable. No authentication material was searched for or read, and no permission/scope change was attempted.

Owner actions:

1. Restore an authorized self-hosted audit runner available to this repository with labels self-hosted, macOS, and code-mower-audit, using the existing reviewer authentication and short-lived workflow-token setup in docs/local-audit-runner.md.
2. Let the queued trusted workflow audit the exact PR head above, or re-request needs-claude-audit if that queue expires. Do not substitute an unsealed local verdict for the workflow publication.
3. Return any P0/P1/P2 findings to the Codex branch owner for a same-branch fix round and fresh exact-head review. Keep the PR draft until independent review, normal CI and authoritative code-mower/gate pass.

No live Slack/provider operation, credential change, deployment or cloud upload was performed. Existing validation runs may finish independently; their terminal state will be recorded where available. This unit stops at the owner boundary rather than configuring runners or credentials.

[jeffhuber]

Update: the earlier queued-run observation is superseded. An audit runner did pick up the first request, but the Claude audit step failed and no independent verdict was published. The audit workflow also reports ModuleNotFoundError: No module named 'code_mower' in its metadata commands. See https://github.com/codemower-ai/code-mower/actions/runs/35306082524 . Raw audit output remains private; no provider verdict is inferred from the job exit.

The completed CI run found only the new CLI registry entry and two package extraction inventory omissions. Those are fixed in the same Codex-owned branch. New head: 942f1b37d7e1d3f1b404af792e7c41e3ace361f2. Six targeted registry/extraction/inventory regressions, Ruff, privacy and release-readiness checks now pass. New full CI: https://github.com/codemower-ai/code-mower/actions/runs/35306548110 . needs-claude-audit was re-requested for the new head.

Revised owner actions:

1. Repair the trusted audit runner/workflow's Python package/import setup and inspect its private wrapper failure locally. Keep raw provider output and authentication material out of issue comments; no authentication material was sought by this builder.
2. Complete the trusted Claude audit/publication for PR Slack: explicit private-workspace setup, readiness doctor and runbook #1024 at the new head above. The local fallback cannot publish a sealed workflow verdict and its required token input is unavailable here.
3. Return any P0/P1/P2 findings to Codex for same-branch fixes and fresh review. Keep the PR draft until independent review, normal CI and authoritative code-mower/gate pass.

The needs-owner boundary remains limited to independent audit infrastructure/authentication. No runner, credential or permission configuration is changed by this unit.

[jeffhuber]

Codex delivery: #922

Implemented and pushed one draft PR: #1024 (closes #922).

Head: 942f1b37d7e1d3f1b404af792e7c41e3ace361f2. Named builder and sole source writer: Code Mower Codex, branch codex/922-slack-operator-setup.

The reduced OSS scope includes explicit interactive/scripted hosted manifest preparation, separate redacted readiness checks, and the private start/status/answer/cancel plus install/upgrade/disable/rollback/uninstall runbook. Default Claude + Codex setup remains unchanged. Live readiness requires the explicitly configured trusted private host probe; offline snapshots cannot pass.

Validation:

• Exact-head CI passed: Python 3.12/3.13/3.14, Linux/macOS containment, Board qualification, package validation and installation rehearsals. Python 3.14 ran 4,795 tests with 12 skips.
• Locally, 45 focused Slack tests, 221 doctor regressions, and six extraction/registry/inventory regressions passed. Ruff, privacy, workflow guard, compile, all 22 release-readiness checks, final wheel/sdist build, Twine, installed-wheel smoke and extracted-package Slack/resource verification passed.
• The attempted local full suite was not green because initial dependency gaps and sandbox private-store restrictions invalidated that run. CI provides the clean full-suite result. The first CI run's registry/inventory omissions were corrected on this same branch.

Remaining: independent audit and gate. The trusted Claude audit workflow failed without publishing a verdict; metadata commands reported a missing code_mower module. The local wrapper also lacks its required token input. needs-claude-audit was re-requested after pushing; needs-owner remains on the PR and issue, and code-mower/gate is pending.

Owner actions:

1. Repair the trusted audit runner/workflow Python/import setup and inspect its private wrapper failure locally.
2. Complete qualified Claude review and verified publication against the exact head above.
3. Return any P0/P1/P2 findings to Codex for same-branch fixes and fresh review; keep the PR draft until review and the authoritative gate pass.

Outcome: implementation delivered for review; owner action required for audit infrastructure. .code-mower/lane-outcome.json records owner_action. No merge, release, deployment, credential change, live Slack/hosted Devin canary or Code Mower cloud upload was performed. Upload evidence is not claimed for the reduced scope; only safe public PR/head, validation and workflow-status metadata is recorded here. Live acceptance remains #923 work.