feat(extension-runtime): P6 — extraction completion: config/connect UI, frontend, CLI, migrations (runtime PR 7/8)

[BenKurrek]

P6 — extraction completion: generic config/connect, channel hosts, frontend, migrations (Workstream G + H)

Sixth PR of the extension-runtime train (design: docs/reborn/extension-runtime/). Base: nea25/14-delivery (P5). This branch's first commit merges origin/nea25/12-auth-engine (P3) — P6 depends on both the auth engine and the delivery coordinator, so the P3 sibling rides along (adjacent-line union conflicts only).

What this builds (the extraction: slack becomes data, the host becomes the product)

S1 — generic [channel.config]: durable per-installation config (wire-compat installation-store extension) + ChannelConfigService (manifest-validated saves; secrets at the channel-egress scope under manifest handle names — SecretStoreChannelEgressCredentials resolves with no bridges; §6.5 auto deactivate→reactivate on config edits) + the setup wire's fields slot finally populated + ExtensionConfigure unstubbed.
S2 — generic channel host assembly (extension_host/channel_host.rs): snapshot-reconciled per-extension registration — dynamic ingress secrets, manifest-derived evidence mints (hmac_sha256/shared_secret_header), per-extension workflows (durable ledgers at generic roots), run-delivery observers over the coordinator; SnapshotWatch::subscribe; managed vs lane-owned registry entries.
S3 — generic identity/connect: ONE vendor-blind post-OAuth identity hook (recipe-extracted OAuthProviderIdentity claims validated against [channel.config] scoping values via a claim-suffix convention; installation-scoped provider ids byte-identical so existing bindings survive), generic ChannelConnectionFacade, removable_channel_cleanup_for_summary vendor-blind.
S5 — frontend: slack-setup-panel/channel-picker/apis deleted (+tests); every slack branch in shared components genericized (post-OAuth auto-activate from wire state; strategy-driven connect sections; display names from wire data); 42 slack i18n keys deleted across 11 locales; the frontend source-scan test now PINS the absence of concrete package-id conditions.
S6 — the cutover + deletion: slack manifest completes [channel.config] (incl. JSON-valued allowed-channels/subject-routes); auth client credentials config-backed; H.3/H.4 load-time folds (setup record → config + manifest-handle secrets; identities/DM-targets → generic roots with keys rewritten to durable installation ids; routes → config values; idempotent, malformed-skip, sanctioned module); generic inbound actor resolution via identity bindings (unbound fail closed); generic shared-channel admission (*_allowed_channels/*_subject_routes convention, managed subjects user:{ext}-channel:{sha16}, unrouted shared conversations FAIL CLOSED); generic DM-target provisioning/cleanup (canonical payload); the 24→25-scenario slack e2e suite PORTED to pin the generic assembly; MIG-5 alias in a sanctioned generic legacy-alias home; generic outbound-target provider (PreferenceTargetCodec gains the encode half + a DM-actor accessor; vendor impls live in the adapter crate) and generic triggered-run-delivery hook (single slot, routes by extension id). Then the demolition: composition/src/slack/** deleted (60 files, +406/−18,360), serve_slack.rs, SlackSection/SlackChannelRouteSection, setup service, bot-token bridges, and the Slack WebUI admin routes gone; the slack-v2-host-beta feature deleted everywhere; Slack's adapter+classifier+codec supplied by the CLI binary through the new RebornBuildInput::with_channel_extension_bindings input seam (Slack is WASM-runtime, so it cannot ride the native-factory path Telegram uses); ironclaw_slack_v2_adapter removed from composition [dependencies] (dev-dep stays, sanctioned DEL-7 test linkage). Both TEMPORARY_EXCEPTIONS entries removed; check-generic-without-concrete.sh (DEL-9, the deletion test) passes with zero skips over all 63 generic crates.
S8 — e2e: one Python scenario (test_reborn_slack_channel_e2e.py, passing in ~9s on the standard binary) — install → [channel.config] configure via the generic setup POST → real recipe OAuth connect (fake oauth.v2.access) → credential-gated activate → signed DM on the production ingress route → coordinated reply on the fake's wire → MIG-5 alias round-trip → remove → subsequent event 404s. Enabled by a new env-gated, fail-closed, test-only vendor-egress rewrite seam (ironclaw_network::test_rewrite, applied post-policy at ONE construction seam; refuses release builds; inert without the env var). H.5 pinned by boot_hydration_activates_enabled_and_skips_disabled_installations; the live-QA script's slack leg ported onto the generic setup API.

Owner calls / deltas to review (autonomous, flagged per mission rules)

1. S1: config saves merge-upsert; blank secret submissions are no-ops; unchanged saves skip reactivation; reactivation failure → 409, value stays; pre-install field_status renders empty.
2. S2: generic inbound actors initially resolved to the operator; S6.3 replaced this with identity-binding resolution (unbound → BindingRequired). Installation id = extension id for production registrations. IngressVerificationRecipe::None → no registration (fail-closed 5xx).
3. S3: identity scoping uses a *_team_id/*_enterprise_id/*_app_id claim-suffix convention over [channel.config]; missing scoping config fails closed (mirrors old no-setup behavior).
4. S5: the slack admin allowed-channels UI was deleted, not rebuilt — allowed channels are [channel.config] values now. Wire gaps flagged (no display_name on connection requirements; no per-surface state enums on the wire yet; affordances derive from existing fields).
5. H.3: divergent-scope legacy secrets skip-fold with a log (re-entry via configure). Identity fold rewrites binding keys to the durable installation id. H.4b: slack's conversation + idempotency trees are NOT migrated — a sanctioned legacy-root table keeps them readable permanently (LLM data is never deleted; idempotency reset risks duplicate replays).
6. S6.5: managed subjects hash the durable installation id (never-bound folded channels re-derive); spaceless allowed channels now admit (empty space segment — no slack delta, new capability for spaceless vendors). DM-target payload is canonical (space_id/conversation_id), not vendor-opaque.
7. Retired-identity migration now seeds the unified slack manifest under ALL feature sets.
8. S6d flags: stored beta preference binding-refs with retired installation ids stay resolvable (resolve never validates the installation segment; ownership is proven against caller-scoped state; regression-pinned incl. tampered-actor and unrouted-conversation fail-closed arms). Old [slack] config sections now hard-fail parse (rejects_retired_slack_section) — accepted beta posture; shipped docker config templates cleaned. Pre-OAuth setup-save auto-activation died with the lane — slack activates through the standard credential-gated lifecycle. Triggered-hook routing: the stored preference target picks the extension (final_reply→approval→auth→progress); a single codec-bearing extension routes by parity; ambiguous → Failed recorded. tests/integration/triggered_delivery_outcome.rs deleted (it proved the retired lane factory; the generic equivalents are named in the checklist).
9. Composition base dep now carries ironclaw_product_workflow/storage (the ungated assembly needs the durable ledger surface; storage only adds ironclaw_filesystem).
10. Newly documented pre-existing flake: gate_prompt_is_posted_exactly_once_when_approval_ack_races_live_delivery_loop (2/10 solo at P5 baseline; fix(slack): single-flight gate delivery per run_id (resolution-ack fanout) #4843 single-flight) — separate fix task.
11. SANCTIONED_PATHS +2: channel_state_folds.rs, legacy_ingress_aliases.rs (migrations/aliases name what they fold/forward).
12. Coverage floor: this PR swaps large covered slack trees for heavily-tested generic code; if the CI ratchet flags it, same-PR floor recapture per the documented workflow.

Checklist

docs/reborn/extension-runtime/checklist.md: 12 rows ticked with named evidence in the close-out sweep (DEL-6, DEL-9, UI-3/4/5/6, MIG-3/4/6, LIFE-18, TOOL-4, TOOL-8 — on top of the earlier P6 ticks for DEL-1/3/7, MIG-2/5, ING-12) and 24 rows honestly annotated, notably: DEL-2 (owner call — the vendor glue folded INTO ironclaw_slack_v2_adapter, making it the de-facto extension crate; the pure crate rename is deferred to P7), DEL-8 (allowlist shrunk by ~50 this PR, ~200 entries remain → empty at P7), UI-1/2 + AUTH-9 (need per-surface state enums on the wire — flagged as a wire gap, not invented ad hoc), AUTH-14/TOOL-5 (blocked-slack-tool harness leg), AUTH-15/MIG-7 (Postgres flavors), REL rows (release-commit items).

Known follow-ups / pre-existing

• Newly documented pre-existing flake: gate_prompt_is_posted_exactly_once_when_approval_ack_races_live_delivery_loop (2/10 solo at the P5 baseline; fix(slack): single-flight gate delivery per run_id (resolution-ack fanout) #4843 single-flight) — separate fix task.
• The stack-wide libsql-only clippy-lane break (red since P2, a latent merge-queue breaker) was fixed on nea25/11 and merged up through every train branch as part of this work.
• Pre-existing --all-features CLI postgres-governor env-test failures (fail at base) untouched.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 53465877-d6ce-4eaa-a29b-3ca3e27529f7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces a recipe-driven authentication engine, centralizing OAuth2 and API key handling to replace per-vendor implementations. It includes a proactive keepalive sweep for idle credentials, dynamic client registration (DCR) for vendors without static credentials, and improved safety measures for egress policies and secret handling. My review identified three critical issues: a vulnerable domain validation logic in DCR, a cancellation hazard in the keepalive sweep that could lead to credential loss, and a silent conflict in resource indicator resolution for shared vendors.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The naive registrable domain extraction using labels.len() - 2 is vulnerable to domain-hijacking and bypass attacks when dealing with multi-label public suffixes (such as .co.uk, .com.cn, or .github.io).

For example, if the resource is https://mcp.notion.co.uk and the issuer is https://attacker.co.uk, both will resolve to co.uk as their registrable domain under this logic. Consequently, validate_issuer_related_to_resource will incorrectly permit the attacker's issuer to register clients for the Notion resource.

To resolve this securely, use a robust public suffix list library (such as the addr or publicsuffix crate) to correctly resolve registrable domains.

[gemini-code-assist]

Racing refresh_account against cancel.cancelled() using tokio::select! introduces a severe cancellation hazard.

If the keepalive sweep is cancelled (e.g., during shutdown) after the vendor's token endpoint has processed the refresh request and rotated the refresh token, but before the new token pair is successfully persisted to the secret store, the rotated refresh token will be permanently lost. Since most OAuth providers immediately invalidate the old refresh token upon rotation, this will permanently break the user's credential, requiring manual re-authorization.

To prevent this, check for cancellation between account refreshes (at the start of each loop iteration) rather than racing the active refresh future itself.

        if cancel.is_cancelled() {
            tracing::debug!("keepalive sweep: cancelled mid-sweep; stopping");
            break;
        }
        let outcome = deps.refresh.refresh_account(request).await;

[gemini-code-assist]

Silently discarding mismatched token_exchange_resource values for shared vendors can lead to incorrect resource indicators being sent during token exchange.

If two extensions share a vendor but define different mcp.server URLs, the second extension's token_exchange_resource will be silently ignored. When the second extension later triggers a flow, the token exchange will carry the first extension's resource indicator, causing authentication or authorization failures at the vendor.

We should validate that both resource indicators match, and raise a conflict if they differ.

                    if let (Some(existing_res), Some(incoming_res)) = (&existing.token_exchange_resource, &resource) {
                        if existing_res != incoming_res {
                            return Err(VendorRecipeConflict {
                                vendor,
                                first_extension: first_extension.clone(),
                                second_extension: extension_id.clone(),
                            });
                        }
                    } else if existing.token_exchange_resource.is_none() {
                        existing.token_exchange_resource = resource.clone();
                    }