feat(reborn): project Slack ingress from extension state

[serrrfirat]

Summary

• declare Slack host-ingress in the bundled Slack extension manifest and register the host-ingress host API contract for manifest restore
• import legacy [slack] config into a host-owned Slack extension installation/settings/secrets bridge
• project the Slack events route from enabled extension state, including secret-store-backed ingress and egress credentials; use it in serve generic mode and support extension-only events route startup

Stacked on #5072.

Tests

• cargo test -p ironclaw_host_runtime default_host_api_contracts_discover_host_ingress_manifest
• cargo test -p ironclaw_reborn_composition --features slack-v2-host-beta extension_projected_host_ingress_dispatches_signed_event_callback
• cargo test -p ironclaw_reborn_composition --features slack-v2-host-beta slack_host_state_mount_view_grants_delete_only_to_slack_state_roots
• cargo check -p ironclaw_reborn_cli --features slack-v2-host-beta

[railway-app]

🚅 Deployed to the ironclaw-pr-5093 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	✅ Success (View Logs)	Web	Jun 19, 2026 at 5:08 pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• staging
• reborn-integration

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c4345978-8623-43cd-beb6-d28bf8474b12

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces support for projecting Slack events webhook routes from enabled extension states in generic host-ingress mode. It adds the ironclaw_host_ingress_registry contract, implements a filesystem-backed store for Slack extension settings, and integrates the secret store to dynamically resolve credentials. The feedback suggests optimizing performance by using serde_json::to_vec instead of serde_json::to_vec_pretty for settings serialization, and passing the secret store by reference rather than cloning its Arc in helper functions.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Using serde_json::to_vec_pretty adds unnecessary whitespace and formatting overhead for settings that are stored and read programmatically. Using serde_json::to_vec is more efficient in terms of both serialization performance and storage footprint.

Suggested change

	let body =
	serde_json::to_vec_pretty(&StoredSlackExtensionInstallationSettings::from(settings))
	.map_err(|error| Error::Invalid {
	reason: format!("Slack extension settings could not be serialized: {error}"),
	})?;
	let body =
	serde_json::to_vec(&StoredSlackExtensionInstallationSettings::from(settings))
	.map_err(|error| Error::Invalid {
	reason: format!("Slack extension settings could not be serialized: {error}"),
	})?;

[gemini-code-assist]

The read_secret_string helper function takes secret_store by value as Arc<dyn SecretStore>. Since it only needs to call methods on the store, passing it by reference as &dyn SecretStore is more idiomatic and avoids unnecessary Arc cloning.

Suggested change

	async fn read_secret_string(
	secret_store: Arc<dyn SecretStore>,
	scope: &ResourceScope,
	handle: &SecretHandle,
	) -> Result<SecretString, SlackHostBetaBuildError> {
	let lease = secret_store.lease_once(scope, handle).await?;
	Ok(secret_store.consume(scope, lease.id).await?)
	}
	async fn read_secret_string(
	secret_store: &dyn SecretStore,
	scope: &ResourceScope,
	handle: &SecretHandle,
	) -> Result<SecretString, SlackHostBetaBuildError> {
	let lease = secret_store.lease_once(scope, handle).await?;
	Ok(secret_store.consume(scope, lease.id).await?)
	}

[gemini-code-assist]

If read_secret_string is updated to take &dyn SecretStore by reference, we can avoid cloning the Arc here by passing secret_store.as_ref() directly.

Suggested change

	let bot_token =
	read_secret_string(Arc::clone(&secret_store), &secret_scope, &bot_secret_handle)
	.await?;
	let bot_token =
	read_secret_string(secret_store.as_ref(), &secret_scope, &bot_secret_handle)
	.await?;

[ilblackdragon]

Review — closing as superseded

Reviewed as part of a parallel pass over the earliest open Reborn ingress stack (#5072 → #5093 → #5100 → #5107).

Verdict: REQUEST CHANGES → closing. The mechanism (project the Slack Events route from enabled extension installation state, secret-store-backed signing/bot credentials, legacy-config→extension import bridge) is genuinely novel — but its entire substrate is unlanded and main took a competing design.

Supersession / blocking facts (verified against live main):

• ironclaw_host_ingress_registry, HostIngressRouteDeclaration, slack_host_ingress.rs, and the bundled Slack manifest's [host_ingress.events] section do not exist on main — they come from base feat(reborn): generic host-ingress for Slack (gated, default legacy) + e2e parity proof #5072, which also never merged. This PR cannot compile against main.
• Main mounts the Slack events route directly from [slack] config (build_slack_host_beta_runtime_mounts in serve.rs), not from extension state, and has since grown a commands route + pairing/single-flight hardening ([codex] Harden Slack pairing activation flows #5362, fix(slack): single-flight gate delivery per run_id (resolution-ack fanout) #4843) that this branch predates. This is a rewrite, not a rebase (~252 commits behind).

Substantive findings (worth carrying forward even though closing):

1. Important — config kill-switch gap. With [slack].enabled=false, resolve_slack_config_for_serve returns None, but if a prior run imported+enabled the durable Slack extension, serve still takes the extension-projection branch and the webhook stays mounted. Import unconditionally sets Enabled with no reconcile/disable path. Any re-derivation must add teardown or gate the projection behind explicit opt-in.
2. Important — placeholder signing secret as trust boundary. The projected inner runner uses SecretString::from("host-ingress-preverified"); real HMAC is delegated to the outer mount. Safe as composed, but a magic "auth already happened" sentinel is a latent foot-gun — prefer a typed pre-verified-ingress runner variant that structurally cannot HMAC-accept.
3. Low — secret scope relies on owner-scope keying (secret_scope() mints a fresh InvocationId per call); works only because the filesystem store ignores invocation_id. Would break under a store that keys by full scope. Thread a stable scope or document the dependency.
4. Praise — map_secret_store_credential_error is leak-safe; persistence hygiene (deny_unknown_fields, trim-validation, base64-url id encoding, typed-ID revalidation) is solid; the projection test is non-vacuous (asserts dispatch + forgery-401 + zero stored messages).

Closing in favor of a single fresh PR that re-derives manifest-projected ingress atop main's current ironclaw_host_api::ingress contract, with the kill-switch and credential-binding seams wired fail-closed from the start. Before that lands, the team's open question — does main still want extension-state projection at all, given it already ships the direct-[slack]-config path? — should be settled; the replacement PR will make that concrete.

[ilblackdragon]

Closing as superseded by main's independently-evolved ingress design (ironclaw_host_api::ingress from #3683 + the product_adapters/telegram_v2_adapter stack). See the review comment above. The one still-valuable idea — manifest-projected ingress descriptor + generic serve plan — is being re-derived fresh atop current main in a replacement PR rather than rebasing this ~250-commit-stale, 4-deep stack.