mosaicstack/stack
16
0
Fork 1
Code Issues 330 Pull Requests 12 Actions Packages Projects Releases 15 Wiki Activity

Discord plugin: managed binding and authorization administration #817

New Issue
Open
opened 2026-07-17 16:50:58 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-07-17 16:50:58 +00:00
Owner
Copy Link
Copy Source

Context

#756 deliberately uses configuration-owned Discord bindings and paired-user role mappings. Static configuration is appropriate for the initial adapter, but a safe operational lifecycle needs a separately designed administrative surface rather than ad-hoc edits or Discord-side commands.

Scope

  • Design and implement authenticated, audited management of Discord channel bindings, paired principals, and role policy.
  • Preserve the #756 logical-agent plus native channel/thread route model; do not accept harness, provider, model, or client-selected agent identifiers.
  • Require server-side validation of guild/channel relationships, binding-to-agent configuration, role policy, and tenant/workspace scope before mutations take effect.
  • Provide safe listing, create/update, disable/revoke, and rotation workflows, including explicit validation and dry-run/read-only visibility where applicable.
  • Document administrator setup, audit evidence, revocation behavior, and recovery.

Acceptance criteria

  1. Only authorized Mosaic administrators can mutate bindings or identity/role mappings; every mutation is auditable and correlation-linked.
  2. Invalid, cross-tenant, mismatched-parent/thread, stale, or disabled bindings fail closed and cannot dispatch Discord ingress.
  3. Revocation takes effect predictably for new ingress and does not expose existing transcripts or secret material.
  4. Tests cover authorization, tenant scope, validation, audit records, disabled bindings, and route continuity.
  5. The UI/API never displays bot tokens, gateway credentials, raw message content, or other secret values.

Boundaries and dependencies

  • This does not authorize live deployment or Discord cutover; #816 owns production qualification and rollback.
  • This is not multi-guild/DM/slash-command/voice support; those need separate scoped requirements.
  • Do not alter #754/#755 lease/fencing or Fleet/Hermes/connector behavior.
  • Consumes the #756 shared channel contract and is related to the broader Tess interaction milestone #709.
## Context #756 deliberately uses configuration-owned Discord bindings and paired-user role mappings. Static configuration is appropriate for the initial adapter, but a safe operational lifecycle needs a separately designed administrative surface rather than ad-hoc edits or Discord-side commands. ## Scope - Design and implement authenticated, audited management of Discord channel bindings, paired principals, and role policy. - Preserve the #756 logical-agent plus native channel/thread route model; do not accept harness, provider, model, or client-selected agent identifiers. - Require server-side validation of guild/channel relationships, binding-to-agent configuration, role policy, and tenant/workspace scope before mutations take effect. - Provide safe listing, create/update, disable/revoke, and rotation workflows, including explicit validation and dry-run/read-only visibility where applicable. - Document administrator setup, audit evidence, revocation behavior, and recovery. ## Acceptance criteria 1. Only authorized Mosaic administrators can mutate bindings or identity/role mappings; every mutation is auditable and correlation-linked. 2. Invalid, cross-tenant, mismatched-parent/thread, stale, or disabled bindings fail closed and cannot dispatch Discord ingress. 3. Revocation takes effect predictably for new ingress and does not expose existing transcripts or secret material. 4. Tests cover authorization, tenant scope, validation, audit records, disabled bindings, and route continuity. 5. The UI/API never displays bot tokens, gateway credentials, raw message content, or other secret values. ## Boundaries and dependencies - This does not authorize live deployment or Discord cutover; #816 owns production qualification and rollback. - This is not multi-guild/DM/slash-command/voice support; those need separate scoped requirements. - Do not alter #754/#755 lease/fencing or Fleet/Hermes/connector behavior. - Consumes the #756 shared channel contract and is related to the broader Tess interaction milestone #709.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#817