umbrella: Phase 1 trust migration — per-platform [section] for all adapters

[chaodu-agent]

Summary

Track the migration of all platform trust configurations from legacy env vars / shared gateway config to first-class per-platform [section] entries in config.toml, as defined in the identity-trust-none ADR (#1291, docs/adr/identity-trust-none.md).

Goal

Each platform gets its own config section with allowed_users, allow_all_users, and platform-specific trust extensions. The shared PlatformTrustConfigs registry routes trust decisions per-platform. Legacy env vars are deprecated → error → removed across Phase 1/2/3.

Current Registry State (verified against src/main.rs on main, updated 2026-07-12 after #1363/#1365/#1366)

The PlatformTrustConfigs registry (crates/openab-core/src/trust.rs) is wired in src/main.rs:

• Uniform seed: all six gateway platforms are first seeded from the shared GATEWAY_ALLOW_ALL_USERS / GATEWAY_ALLOWED_USERS env vars — now only a fallback; per-platform sections override it.
• Per-platform overrides in place: [discord] (feat(trust): Phase 1 (discord) — L3 identity via shared gate [DRAFT: canary before merge] #1270), [telegram] (feat(telegram): add allow_all_users/allowed_users to [telegram] config #1297), [slack] (feat(trust): Phase 1 (slack) — L3 identity via shared gate #1363 — registry entry + redundant-but-matching gate_incoming in the adapter), [line] (feat(line): first-class [line] trust section (Phase 1) #1365), [wecom]/[googlechat]/[teams] (feat(trust): [wecom]/[googlechat]/[teams] first-class trust sections (Phase 1) #1366, shared PlatformTrustConfig + platform_trust_override helper). Each of line/wecom/googlechat/teams logs a Phase 1 deprecation warning when it is active but still trust-driven by the legacy GATEWAY_* env.
• Feishu on uniform seed — resolved by feat(feishu): full [feishu] section — all settings config-first #1385: [feishu] joined the per-platform registry override. All 8 platforms now have per-platform trust config. The remaining Feishu item is the gateway-crate double-gate elimination (feat(feishu): migrate Feishu trust config to first-class [feishu] section (Phase 1) #1357).
• Mode scoping caveat resolved by feat(gateway)!: route standalone WS path through the shared trust gate #1391: per-platform sections now apply in BOTH modes — the WS path consults the shared registry with precedence GATEWAY_* env < [gateway] < [<platform>].

Platform Migration Status

Platform	Current State	Remaining Work	Sub-issue	Status
Discord	[discord] section wired into registry (L3)	—	#1270	✅ Done
Telegram	[telegram] section wired into registry	Group policy	#1362	⚠️ Partial
Slack	[slack] wired into registry + shared gate (#1363)	Enterprise Grid workspace_users	#1361	⚠️ Partial
LINE	[line] section + registry override + deprecation warn (#1365)	Group policy + Reply-API deny-echo	#1355	⚠️ Partial
Feishu	Full [feishu] section + per-platform registry override (#1385 — last platform off the uniform seed)	Eliminate gateway-side double-gate	#1357	⚠️ Partial
WeCom	[wecom] section + registry override + deprecation warn (#1366)	trusted_bot_ids / is_bot derivation	#1358	⚠️ Partial
Google Chat	[googlechat] section + registry override + deprecation warn (#1366)	is_bot derivation + deny-echo	#1359	⚠️ Partial
MS Teams	[teams] section + registry override + deprecation warn (#1366)	trusted_bot_ids / is_bot + deny-echo	#1360	⚠️ Partial

Shared Work (applies to all platforms)

• Implement Receiver → Trust Gate → Handler split (generic run_platform pipeline)
• Phase 1c prerequisite (feat(gateway)!: route standalone WS path through the shared trust gate #1391): standalone WS path routed through the shared gate via the extracted gate_gateway_event helper (deny-echo included, gate before slash handling); registry seeded from [gateway] with precedence env < [gateway] < [<platform>]; WS filter neutered to structural gating; six doc callouts rewritten. BC documented: platform section now wins over [gateway] on the WS path
• Wire PlatformTrustConfigs from config.toml per-platform sections (replacing the uniform GATEWAY_* seed) — complete for all 8 platforms (feat(trust): Phase 1 (discord) — L3 identity via shared gate [DRAFT: canary before merge] #1270, feat(telegram): add allow_all_users/allowed_users to [telegram] config #1297, feat(trust): Phase 1 (slack) — L3 identity via shared gate #1363, feat(line): first-class [line] trust section (Phase 1) #1365, feat(trust): [wecom]/[googlechat]/[teams] first-class trust sections (Phase 1) #1366, feat(feishu): full [feishu] section — all settings config-first #1385)
• Group-policy design (shared): design the open/members group trust policy once — covering "unknown" sender handling, [[<platform>.groups]] per-group overrides, and @mention pre-filtering — then implement per platform. One design feeds both the LINE follow-up (feat(line): migrate LINE trust config to first-class [line] section (Phase 1) #1355, where the trust-level matrix is already drafted) and Telegram (feat(telegram): enhance [telegram] trust config with group policy (Phase 1) #1362); doing them independently risks two divergent policy models
• Unified feishu webhook mount inconsistency (found during feat(gateway): warn when webhook L1 auth is unenforceable (#1356 Phase 1) #1373 round-3 self-review): the unified binary mounts /webhook/feishu unconditionally and never spawns the Websocket client, while the standalone gateway mounts the route only in Webhook connection mode. Deployments relying on Feishu-side webhook delivery with FEISHU_CONNECTION_MODE unset (default: websocket) work only because of this mount — align the binaries (mount by mode + spawn WS client in unified, or deprecate) with its own migration path
• Config-first parity for ALL platform fields (umbrella: config-first parity — every platform section resolves config → env → default for ALL fields #1375 — CLOSED ✅): platform matrix complete (feat(line): full [line] section — credentials + connection config-first #1381–feat(feishu): full [feishu] section — all settings config-first #1385) + workspace-wide conformance guard (test(gateway): config-first conformance guard (#1375) #1387)
• Config-only activation parity (canyugs: fix(wecom): enable config-only unified startup #1389 WeCom ✅, fix(googlechat): enable config-only startup #1390 Google Chat ✅ — the latter made the shared predicate has_unified_platform(cfg) config-aware): remaining [line]/[feishu]/[teams] arms are still env-signaled — extend the predicate per platform, and make the per-platform trust-override activity signals (currently env-keyed, e.g. WECOM_CORP_ID) config-aware so the Phase-1 deprecation warning fires for config-only deployments too
• Reserved platform validation (reject "cron" / "internal" / "openab-" from external Receivers)
• InboundEvent.platform lowercase invariant enforced at construction
• L1 optionality audit — done in feat(gateway): warn when webhook L1 auth is unenforceable (#1356 Phase 1) #1373: AppState::warn_unenforceable_l1 emits one loud startup warning per active platform whose L1 secret is missing (telegram/line/googlechat/feishu; feishu keyed on actual webhook-route exposure — Websocket mode is exempt). WeCom/Teams exempt by construction (secret mandatory, every request verified). Phase 1 warn-only per DoD
• L1 Phase 2 escalation needs an explicit opt-out: legitimate no-L1 deployments exist (endpoint not publicly reachable, secret-path URLs per Telegram's own docs, outer-infra verification) and OpenAB cannot detect them from inside the process. When Phase 2 turns the warning into a startup error, ship a deliberate escape hatch (e.g. allow_unverified_webhooks = true) so those deployments can explicitly acknowledge the posture instead of being broken
• Deprecation warnings for legacy env vars (Phase 1) — line/wecom/googlechat/teams warn when active but still driven by GATEWAY_* env (feat(line): first-class [line] trust section (Phase 1) #1365, feat(trust): [wecom]/[googlechat]/[teams] first-class trust sections (Phase 1) #1366); feishu pending (feat(feishu): migrate Feishu trust config to first-class [feishu] section (Phase 1) #1357)
• Startup error for legacy env vars without explicit opt-in (Phase 2)
• Remove legacy env vars (Phase 3)

Refs

• feat(channels): default trust-none policy with UID echo for all channel adapters #1262 (original tracking issue)
• docs(adr): identity trust-none default & trust pyramid #1264 (ADR v1, merged)
• docs(adr): revise identity-trust-none — three-layer architecture #1291 (ADR v2 — three-layer architecture, docs/adr/identity-trust-none.md)
• feat(trust): Phase 1 (discord) — L3 identity via shared gate [DRAFT: canary before merge] #1270 (Phase 1 Discord — done)
• feat(trust): gateway echo-on-deny (Phase 2) + trust-none default (Phase 3) #1273 (Phase 2 echo + Phase 3 deny-all default — done)
• feat(telegram): add allow_all_users/allowed_users to [telegram] config #1297 (Telegram allow_all_users — partial)

Note

Sub-issues #1355, #1357–#1362 are linked as native GitHub sub-issues of this umbrella (see the sub-issue tracker above the description).

[github-actions]

Thanks for the report! A maintainer will triage this shortly and apply the appropriate label. Once a type label is added, the issue will be re-validated automatically.