fix(gateway): secondary-profile bots no longer inherit the default profile's allow-all / allowlists (salvage #77548, #88559, #94657, #87698, #102752)

[teknium1]

Under gateway.multiplex_profiles, a secondary profile's bot no longer inherits the default profile's GATEWAY_ALLOW_ALL_USERS / GATEWAY_ALLOWED_USERS / platform allowlists — every adapter-owned authz gate now reads them through the profile secret scope.

Changes

• email _allow_all_senders / _allowlist_in_effect: GATEWAY_* half read via the scoped reader (the EMAIL_* half already was) — the default's allow-all no longer opens a secondary mailbox to any sender / skips From: authentication.
• qqbot _open_dm_opted_in, whatsapp_common _open_dm_opted_in + _live_dm_allow_from: both allow-all names and the live pairing allowlist via get_scoped_secret.
• matrix _is_authorized_user, MATRIX_ALLOWED_USERS, MATRIX_IGNORE_USER_PATTERNS, _extra_csv_set (allowed / free-response rooms): via the module's _startup_env_secret.
• teams _card_action_denied; slack _slack_allow_bots / _slack_api_human_users; line allow-all + user/group/room allowlists; dingtalk _extra_get (allowed_users / allowed_chats / free-response chats / require_mention): via each module's existing _get_scoped_secret.
• No new helpers, no environ fallthrough after a scoped miss; the unscoped default-profile and single-profile paths keep the os.environ read (there it IS the profile's own value).
• Test: tests/gateway/test_adapter_authz_secret_scope.py — 2 invariants × 13 gates (default env never answers a scoped gate; scope opt-in opens it), red on base (20/26 fail), green with the fix.
• Docs: website/docs/user-guide/multi-profile-gateways.md "What does not change" now states authz is per profile.

Live repro

Temp HERMES_HOME, set_multiplex_active(True), default env GATEWAY_ALLOW_ALL_USERS=true + default allowlists, secondary scope bot2 with no opt-in (/tmp/mux_audit/fix-allow-all-authz/repro.py).

Before (origin/main 77e55b4):

email._allow_all_senders (expect False)                -> True
email._allowlist_in_effect (expect False)              -> True
qqbot._open_dm_opted_in (expect False)                 -> True
whatsapp._open_dm_opted_in (expect False)              -> True
whatsapp._live_dm_allow_from (expect set())            -> {'+15550001111'}
teams._card_action_denied (expect denial, not None)    -> None
matrix._allowed_user_ids (expect bot2's)               -> {'@default-admin:example.org'}
matrix._ignored_user_patterns (expect [])              -> ['^@default-spam:.*']
matrix._is_authorized_user('@stranger') (expect False) -> True

After:

email._allow_all_senders                               -> False
email._allowlist_in_effect                             -> False
qqbot._open_dm_opted_in                                -> False
whatsapp._open_dm_opted_in                             -> False
whatsapp._live_dm_allow_from                           -> set()
teams._card_action_denied                              -> '⛔ Approval buttons require TEAMS_ALLOWED_USERS to be configured.'
matrix._allowed_user_ids                               -> {'@bot2-admin:example.org'}
matrix._ignored_user_patterns                          -> []
matrix._is_authorized_user('@stranger')                -> False

Root cause: these gates read authorization env raw via os.getenv, and under multiplex os.environ is the DEFAULT profile's .env (same class as #72348 / #86905; gateway/AGENTS.md § "Multiplex profile-scoped env reads MUST fail closed").

Tests: scripts/run_tests.sh tests/gateway/ tests/plugins/ → 921 files, 9831 tests passed, 0 failed (one pre-existing timing flake in test_session_hygiene.py, passed on retry, unrelated).

Credits

• @Drexuxux — earliest fix (fix(gateway): scope GATEWAY_ALLOW_ALL_USERS in self-gating adapters' open-DM gate #77548, self-gating adapters' open-DM gate); salvaged, Co-authored-by
• @FirmaSpring — fix(gateway): read adapter allowlists through profile secret scope #88559 (adapter allowlists via secret scope, matrix); salvaged, Co-authored-by
• @Svector-anu — fix(matrix): read gateway_allow_all_users from profile secret scope #94657 (matrix GATEWAY_ALLOW_ALL_USERS, GHSA-p47r-wg2f-2mw4); salvaged, Co-authored-by
• @babatorik — fix(whatsapp): use _get_wsecret in _live_dm_allow_from instead of os.environ #87698 (whatsapp _live_dm_allow_from); salvaged, Co-authored-by
• @salch-cred — fix(gateway): scope the remaining adapter authz env reads (qqbot, teams, email) #102752 (qqbot/teams/email); salvaged, Co-authored-by

Supersedes #77548, #94657, #87698, #102752 and the adapter-side half of #88559 (its authz_mixin/run.py routed-primary changes are out of this lane's scope). Cherry-picks did not apply cleanly (weixin already fixed on main; line-wrap drift), so reimplemented with Co-authored-by trailers.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on be000e7 — fix(gateway): secondary-profile adapters no longer inherit t}

⚠️ Warnings

OSV vulnerability scan · View job

80 known vulnerabilities found in pinned dependencies.

• CVE-2026-83608 in package-lock.json
• CVE-2026-83608 in package-lock.json
• CVE-2026-84375 in package-lock.json
• CVE-2026-84375 in website/package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-85062 in package-lock.json
• CVE-2026-85062 in website/package-lock.json
• CVE-2026-83609 in package-lock.json
• CVE-2026-82417 in scripts/whatsapp-bridge/package-lock.json
• CVE-2026-82417 in website/package-lock.json
• CVE-2026-84369 in website/package-lock.json
• CVE-2026-83605 in package-lock.json
• CVE-2026-83605 in package-lock.json
• CVE-2026-75931 in package-lock.json
• CVE-2026-75931 in website/package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83611 in package-lock.json
• CVE-2026-83611 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 5m38s vs 6m44s (-16.3%). 6 job(s) slower, 8 faster, 1 unchanged.

• OSV scan / Emit review status: +43.0s
• OS-specific tests / Windows-only tests: +26.0s
• Python lints / Windows footguns (blocking): +21.0s
• Check no committed infographics / check-no-committed-infographics: -15.0s
• Python tests / e2e: -13.0s

[andrexibiza]

Reviewed exact head 8120bf51f86ee6f49dad2af603cec5b225e8c861 after canonical All required checks pass completed successfully on that same SHA. This closes the right authority boundary: under multiplex, the default profile's process environment is not authorization state for a secondary profile, so allow-all flags, allowlists, approval principals, and bot-admission policy now resolve through the selected profile's scoped secret reader and fail closed on a scoped miss. The red-on-base matrix is especially useful because it proves both non-inheritance and explicit per-profile opt-in across the adapter set. No blocking finding on this carrier. Interlock #107617 carefully when either head moves: it touches overlapping adapters but owns the distinct credential↔endpoint identity lane, and its rebase must preserve these authz reads rather than collapsing the two semantics back into raw process env.