refactor: single source of truth for agents, scope secrets per-org, webhook-only platforms

[buremba]

Summary

Six commits cleaning up the multi-tenant setup so agents and secrets are properly scoped per organization, with a single delivery story for chat platforms.

Commits

60a7b21 — Auto-bootstrap admin PAT, retire LOBU_LOCAL_BOOTSTRAP

ensureBootstrapPat self-skips when the user table is non-empty. The env-flag gate is gone; production deployments are protected by the user-count guard. scripts/e2e-lobu-apply.sh updated.

7a751bd + 8646802 — Slack Socket Mode iterations (superseded by ab742bc)

Two intermediate commits that first documented and then made the Socket Mode bridge multi-tenant. Both are neutralized by the final commit on the branch — included in history because they're already pushed; net effect is removal.

26a9d04 — Remove gateway boot-time lobu.toml file-loader

The big one. Gateway no longer reads lobu.toml at boot — file-declared agents enter Postgres exclusively via lobu apply. One source of truth.

Deleted: gateway/config/file-loader.ts, 5 file-loader tests, entryFromFileLoadedAgent, the system/manifest owner sentinel, loadAgentConfigFromFiles, populateStoreFromFiles, reloadFromFiles, onReloadFromFiles, getFileLoadedAgents, isFileFirstMode, getProjectPath, /api/v1/reload dev route, file-loader-driven platform connection seeding.

Kept (still used by SDK-embedded mode via GatewayConfig.agents): DeclaredAgentRegistry, InMemoryAgentStore, entryFromAgentConfig, buildRegistryMap (signature simplified to take only configAgents).

Behavior change: gateway boot throws a clear error if neither host stores nor SDK config.agents are provided.

c75f748 — Scope agent_secrets by organization_id

The agent_secrets table had a global (name) PK, so two orgs storing the same logical secret (e.g. ANTHROPIC_API_KEY) silently overwrote each other.

• Add organization_id column with PK (organization_id, name). Migration + embedded-schema patch for existing PGlite installs.
• Empty-string organization_id is the legacy/global bucket — used by system env-store and any pre-existing rows.
• PostgresSecretStore reads tryGetOrgId() from AsyncLocalStorage: per-org rows take precedence over global on read; writes go into the active org if context exists; deletes and lists scope to the active org.
• The secret://<name> URI scheme is unchanged — same URI, different value per org context.

ab742bc — Drop Slack Socket Mode entirely, stick to Chat SDK webhooks

WebSocket transports are less reliable than webhooks (reconnect drops, no retry semantics) and Slack's own docs steer production toward Events API. Socket Mode existed only to save local dev users from running a tunnel.

• Delete startSlackSocketMode, socketModeClients map, @slack/socket-mode from both owletto-backend and cli package.json.
• Remove the disconnect-all loop from stopLobuGateway.
• AGENTS.md: codify "one transport per platform — webhooks via the Chat SDK adapter; local dev for webhook-only platforms uses a tunnel."

Reverts the per-connection Socket Mode work in 7a751bd and 8646802.

Net effect

Read end-to-end, this PR:

• Removes the LOBU_LOCAL_BOOTSTRAP env-flag layer.
• Removes the gateway's boot-time lobu.toml reader and the in-memory parallel agent store wiring.
• Scopes agent_secrets per organization.
• Removes the entire Slack Socket Mode runtime dependency.
• Codifies "one transport per platform" as project policy in AGENTS.md.

Lines net: ~750 removed, ~130 added.

Test plan

• Repo-wide bun run typecheck passes.
• declared-agent-registry tests pass (5/5).
• lobu run on a fresh OWLETTO_DATA_DIR mints a bootstrap PAT without LOBU_LOCAL_BOOTSTRAP=true.
• lobu run on a data dir with existing users no longer mints a "Local Developer" user.
• scripts/e2e-lobu-apply.sh still passes end-to-end.
• agent_secrets migration applies cleanly to an existing PGlite install (embedded patch path).
• Setting ANTHROPIC_API_KEY in org A and a different value in org B no longer overwrites each other.
• Slack Events API webhook delivery still works (regression check post Socket Mode removal).

DB-backed integration tests in this branch fail in the sandbox due to no reachable Postgres — they need a real DB to verify.

https://claude.ai/code/session_01GTYRB28aN7dKNiM5vcUaBp

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Triage decision: needs-human

Reasons:

• PR is blocked (mergeStateStatus: BLOCKED) due to failing status checks
• check-drift workflow failed with FAILURE conclusion
• integration workflow still in progress

Next: Human review required to resolve the blocking status checks. Check the failing check-drift workflow and wait for integration tests to complete.

[buremba]

Pushed three fixup commits addressing the pi-cli review (#505 — earlier session findings):

• 3e8feb68 fix(secrets): SecretStoreRegistry cache org-aware — cache key is now ${orgId}|${ref}. Two orgs resolving the same secret:// ref no longer share a cached value. New regression test (secret-store.test.ts) uses an OrgAwareStore fake that mirrors PostgresSecretStore's per-org resolution.
• c7225230 fix(token-refresh): establish org context before refreshing OAuth tokens — scanAllOAuth() now INNER JOINs agents to yield (userId, agentId, orgId); runOnce and refreshForUserAgent wrap each refresh in orgContext.run({organizationId}, ...) so PostgresSecretStore.put() lands in the correct tenant bucket. refreshForUserAgent looks up the agent's org and skips when the row is gone (deleted agent). Test fixture seeds backing agents rows; new test for the orphan-skip path.
• 93ef406b chore: harden boundaries — PostgresSecretStore.put/delete now warn loudly when no org context is present (system env-store reaches here intentionally; tenant code paths are bugs). start-local.ts refuses to mint a bootstrap PAT unless dbUrl is loopback (defense against future ensureBootstrapPat reuse against a real DB before first signup). Migration 20260503000000_agent_secrets_org_scope.sql carries a rollout note explaining the non-atomic PK swap is safe for Lobu's single-process atomic-swap deployment but unsafe under rolling-deploy supervisors. Also drops the unused getDb import in lobu/gateway.ts left over from the Socket Mode removal.

Verification:

• bun run typecheck clean against the per-package packages/owletto-backend/tsconfig.json (which has noUnusedLocals: true — the root tsconfig excludes this package, so the prior PR check missed the unused import).
• bun test src/gateway/__tests__/ — 489 pass, 0 fail (489 / 1140 expects across 62 files).

Reviewers: the architectural direction of #505 is right (PG single source of truth + org-scoped secrets + webhook-only platforms); the issues fixed here were correctness gaps that would have shown up as cross-tenant data leaks once OAuth refresh started rotating tokens at scale.

[buremba]

Superseded by #516 — original branch was based pre-rename (#499), so a clean rebase wasn't viable. Cherry-picked the 7 substantive commits onto current main with paths rewritten to the renamed dirs. Skipped the two superseded Slack Socket Mode iterations (7a751bd and 8646802).