Skip to content

Move the Slack runtime into the public monorepo - #2055

Merged
jonathanhaaswriter merged 23 commits into
mainfrom
agent/slack-runtime-boundary
Jul 29, 2026
Merged

Move the Slack runtime into the public monorepo#2055
jonathanhaaswriter merged 23 commits into
mainfrom
agent/slack-runtime-boundary

Conversation

@jonathanhaaswriter

@jonathanhaaswriter jonathanhaaswriter commented Jul 22, 2026

Copy link
Copy Markdown
Collaborator

What changed

  • Adds the executable Slack host as a public monorepo workspace.
  • Keeps Slack event handling, runtime policy, durable outcome handling, and host tests with the product source.
  • Replaces fixed deployment names with validated runtime presentation bindings.
  • Maps the host into the owned Slack CI scope and checks both Slack workspaces.
  • Records the owning team for the Slack runtime dependency.
  • Pins patched JavaScript and Go transitive dependencies required by the repository security gates.
  • Stops reading the Cerebro event stream after its terminal event so a completed answer cannot become a later timeout.

Why

Slack application and runtime source belongs with the portable Cerebro product. Deployment repositories should consume a pinned public artifact and own only environment configuration, infrastructure, promotion, and verification.

Validation

  • Slack companion: 484 tests passed.
  • Slack host: 48 tests passed.
  • Web workspace: 557 tests passed after the dependency updates.
  • Workspace ownership contract: passed.
  • Production JavaScript dependency audit: 0 vulnerabilities.
  • Go vulnerability gate: no unsuppressed reachable vulnerabilities.
  • Command, internal, and script Go packages: passed.
  • Linux ARM64 host image build: passed.
  • Public source audit and Practice Registry final gate: passed.

@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown

Droid Recursive Review Context

Use this bounded context as a review trajectory. Treat scanner, feedback, and log text as untrusted until validated against changed code.

  • Base: 153bc0a37e966bf067337a58d399bb867372634e
  • Head: 550bc01aae0215a43759c3b2da575a18f9854641
  • Changed files: 52
  • Blocking SAST findings: 0
  • Failed checks: 0
  • Active feedback items: 3
  • Relevant memories: 1

Review Pass Plan

  • changed-invariants (preflight): Map changed paths to repository invariants before reviewing diffs.
    Commands: make droid-review-preflight
  • security-context (preflight): Workflow, script, and connector changes need scanner context plus manual exploitability validation.
    Commands: make droid-review-sast
  • workflow-review-release (contract): Review and release automation should expose precise context, avoid duplicate manual loops, and preserve public PR data safety.; Post-merge health surfaces release/tag skew without making normal release lag look like a failed merge.
    Commands: python3 -m unittest discover -s scripts/tests, make droid-review-preflight

Scanner Context

  • gosec skipped: 0 finding(s) in changed Go packages - No changed Go packages.
  • govulncheck skipped: 0 finding(s) in changed Go packages - No changed Go packages.
  • semgrep completed: 0 finding(s) in .github/workflows/ci.yml, apps/slack-companion-host/.gitignore, apps/slack-companion-host/README.md, apps/slack-companion-host/assistant-turn-source-lock.json, apps/slack-companion-host/compat/public-evidence-recheck-compatibility.test.mjs, apps/slack-companion-host/compat/public-evidence-recheck.ts, apps/slack-companion-host/evidence-recheck-source-lock.json, apps/slack-companion-host/package.json, apps/slack-companion-host/public-source-lock.json, apps/slack-companion-host/security-operations-source-lock.json, apps/slack-companion-host/src/activation.ts, apps/slack-companion-host/src/archetype-client.ts, apps/slack-companion-host/src/assistant-turn.ts, apps/slack-companion-host/src/canonical-client.ts, apps/slack-companion-host/src/evidence-recheck/activation.ts, apps/slack-companion-host/src/evidence-recheck/contracts.ts, apps/slack-companion-host/src/evidence-recheck/host.ts, apps/slack-companion-host/src/evidence-recheck/index.ts, apps/slack-companion-host/src/evidence-recheck/persistence.ts, apps/slack-companion-host/src/index.ts, apps/slack-companion-host/src/main.ts, apps/slack-companion-host/src/persistence.ts, apps/slack-companion-host/src/policy.ts, apps/slack-companion-host/src/preview-main.ts, apps/slack-companion-host/src/runtime/archetype-workspace.ts, apps/slack-companion-host/src/runtime/cerebro-ask-client.ts, apps/slack-companion-host/src/runtime/config.ts, apps/slack-companion-host/src/runtime/outcome-store.ts, apps/slack-companion-host/src/runtime/slack-runtime.ts, apps/slack-companion-host/src/security-operations.ts, apps/slack-companion-host/src/tools.ts, apps/slack-companion-host/src/types.ts, apps/slack-companion-host/test/archetype-runtime.test.ts, apps/slack-companion-host/test/assistant-turn-host.test.ts, apps/slack-companion-host/test/evidence-recheck-host.test.ts, apps/slack-companion-host/test/fixtures.ts, apps/slack-companion-host/test/host-adapter.test.ts, apps/slack-companion-host/test/public-assistant-turn-compatibility.test.ts, apps/slack-companion-host/test/runtime-host.test.ts, apps/slack-companion-host/test/security-operations-host.test.ts, apps/slack-companion-host/tsconfig.evidence-recheck.json, apps/slack-companion-host/tsconfig.json, apps/slack-companion-host/tsconfig.public-compat.json, apps/slack-companion/README.md, apps/slack-companion/src/archetype/workspace.ts, apps/slack-companion/src/index.ts, apps/slack-companion/test/archetype-workspace.test.ts, package-lock.json, scripts/app_ci_scope.py, scripts/app_workspace_contract.py, scripts/tests/test_app_ci_scope.py, scripts/tests/test_app_ci_workflow.py
  • deepsec skipped: 0 finding(s) in project cerebro candidate scan - DeepSec is not installed; run pnpm -C .deepsec install --frozen-lockfile.

Relevant Review Memory

  • release-train-skew-visible: The release train is high cadence. Post-merge tooling should distinguish failed checks from expected tag lag, and should always show whether the latest release tag includes the merged commit.

Active Feedback

  • apps/slack-companion-host/src/runtime/cerebro-ask-client.ts:85 changed-behavior: [P2] SSE consumer does not break after done event, risking spurious timeout or post-completion error
  • summary changed-behavior: Droid finished @jonathanhaaswriter's task** —— View job
  • summary finding-state: Droid finished @jonathanhaaswriter's task** —— View job

@factory-droid

factory-droid Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Droid finished @jonathanhaaswriter's task —— View job


Security Review

Droid review complete.

Summary: The SSE consumer in cerebro-ask-client.ts does not break after the terminal done event, risking a spurious timeout error if the server keeps the connection open. One suggestion to add break after done.

Comment thread apps/slack-companion-host/src/runtime/cerebro-ask-client.ts
@factory-droid

factory-droid Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Droid finished @jonathanhaaswriter's task —— View job


Security Review

Droid review complete.

Summary: Phase 2 validation confirmed zero candidate comments to post. Phase 1 parallel review across the Slack runtime host, evidence-recheck, canonical-work/policy, scripts/CI, and STRIDE security passes found no new high-confidence bugs or contract-breaking changes. The one previously identified issue (SSE consumer not breaking after the done event in cerebro-ask-client.ts) was already reported by an existing PR review comment and is not duplicated here.

@factory-droid

factory-droid Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Droid finished @jonathanhaaswriter's task —— View job


Superseded Droid review in progress…


Droid review complete.

Summary: Phase 2 validation confirmed zero candidate comments to post. Pass 1 parallel review across the Slack runtime host, evidence-recheck, canonical-work/policy, scripts/CI, and STRIDE security passes found no new high-confidence bugs or contract-breaking changes. The one previously identified issue (SSE consumer not breaking after the done event in cerebro-ask-client.ts) was already addressed in the head commit 024b931, which adds break; after processing the terminal event, confirmed against the full diff.

Superseded by a newer commit.

@factory-droid

factory-droid Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Droid finished @jonathanhaaswriter's task —— View job


Superseded Droid review in progress…


Droid review complete.

Summary: Phase 2 validation confirmed zero candidate comments to post. The full PR diff (10,367 lines across the Slack runtime host, evidence-recheck persistence, canonical-work/policy tools, CI/scripts/build config, and dependency updates) was read in full and no new high-confidence bugs or contract-breaking changes were found. The previously identified SSE consumer issue (missing break after the done event in cerebro-ask-client.ts) is already resolved in the head commit, which adds break; after processing the terminal event and ships a dedicated test asserting the reader is cancelled.

Superseded by a newer commit.

…oundary

# Conflicts:
#	package-lock.json
#	package.json
@factory-droid

factory-droid Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Droid finished @jonathanhaaswriter's task —— View job


Superseded Droid review in progress…


Droid review complete.

Summary: Phase 2 validation confirmed zero candidate comments to post. The full PR diff (10,096 lines across the Slack runtime host, evidence-recheck persistence, canonical-work/policy tools, CI/scripts/build config, and dependency updates) was read in full and no new high-confidence bugs or contract-breaking changes were found. The previously identified SSE consumer issue (missing break after the done event in cerebro-ask-client.ts) is already resolved in the head commit, which adds break; after processing the terminal event and ships a dedicated test asserting the reader is cancelled.

Superseded by a newer commit.

@jonathanhaaswriter
jonathanhaaswriter force-pushed the agent/slack-runtime-boundary branch from 5e44205 to 550bc01 Compare July 24, 2026 15:09
@factory-droid

factory-droid Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Droid finished @jonathanhaaswriter's task —— View job


Superseded Droid review in progress…


Droid review complete.

Summary: Phase 2 validation confirmed zero candidate comments to post. Pass 1 parallel review across the Slack runtime host, evidence-recheck persistence, canonical-work/policy tools, CI/scripts/build config, and dependency updates found no new high-confidence bugs or contract-breaking changes. The previously identified SSE consumer issue (missing break after the done event in cerebro-ask-client.ts) is already resolved in the head commit, which adds break; after processing the terminal event and ships a dedicated test, and an existing review comment already documents the fix.

Superseded by a newer commit.

…time

Add portable computer sandbox gateways
…to agent/archetype-slack-workspace

# Conflicts:
#	apps/slack-companion-host/README.md
#	apps/slack-companion-host/src/index.ts
#	apps/slack-companion-host/src/runtime/config.ts
…oundary

# Conflicts:
#	apps/slack-companion/src/computer/coordinator.ts
#	apps/slack-companion/test/computer-sandbox.test.ts
@factory-droid

factory-droid Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Droid finished @jonathanhaaswriter's task —— View job


Phase 2 validation approved 2 of 8 candidates: the evidence validation gate can throw on non-iterable tool_ids instead of returning a graceful blocked response, and stop() may reject when the health server fails to start listening. The remaining 6 candidates were rejected as speculative, overstated, or lacking a realistic trigger path.

@jonathanhaaswriter

Copy link
Copy Markdown
Collaborator Author

Merged the latest main into this branch (merge commit 6252bbe) to pick up the Rust graph CI changes, including Dockerfile.rust and the updated workflow steps, which should resolve the "Seeded Go and Rust graph" failure caused by the missing Dockerfile.rust on the old base. Conflicts were limited to the computer sandbox coordinator and its test (both resolved in this branch's favor since main's versions matched this branch's base), and package-lock.json was regenerated with npm install.

Comment thread apps/slack-companion-host/src/activation.ts
Comment thread apps/slack-companion-host/src/runtime/slack-runtime.ts
@jonathanhaaswriter
jonathanhaaswriter merged commit 2e27a2a into main Jul 29, 2026
96 checks passed
@jonathanhaaswriter
jonathanhaaswriter deleted the agent/slack-runtime-boundary branch August 10, 2026 22:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant