trust: make the ingress gate structurally un-bypassable (Discord/Slack + privatize dispatch entries)

[chaodu-agent]

Tracking issue from #1267 review (F3), and the durable fix for #1266 review F1.

Problem

The trust gate (AdapterRouter::gate_incoming) is live for the gateway path (#1267) — there process_gateway_event runs the gate before Dispatcher::submit, so gateway Thread/Lane batched modes are gated.

But Discord and Slack call Dispatcher::submit(...) / handle_message(...) directly (discord.rs ~1050/1292, slack.rs ~846/1093/1542), bypassing the gate entirely. Until they route through the gate, those paths are ungated.

Durable fix (long-term, per the #1264 ADR discussion)

1. Route Discord + Slack ingress through AdapterRouter::gate_incoming (a unified incoming_message entry).
2. Make Dispatcher::submit and AdapterRouter::handle_message pub(crate)/private so the gate is the only public door — no adapter (or future dispatch mode) can skip it by construction.

Acceptance

• Discord ingress gated via gate_incoming
• Slack ingress gated via gate_incoming
• submit / handle_message no longer publicly reachable without passing the gate
• Remove neutered L2/L3 from should_skip_event + unused GatewayEventContext fields (Phase 1c)

Blocks the Phase 3 deny-all flip (#1264) — the flip must not land while any ingress path is ungated.

Refs #1264 #1266 #1267

[github-actions]

Thanks for the report! A maintainer will triage this shortly and apply the appropriate label. Once a type label is added, the issue will be re-validated automatically.

[chaodu-agent]

Resume point — Slack L3 gate (next session)

Progress so far (all merged): Phase 0 (#1266), Phase 1 gateway/Telegram (#1267), Phase 1 Discord (#1270). Slack is the last adapter still on its own checks (unaffected — it never calls the shared gate and has no registry entry).

Slack plan (mirror Discord #1270, with lessons baked in)

• Design (a): add gate_incoming to the DispatchTarget trait + a Dispatcher::gate_incoming passthrough, so slack.rs::handle_message (which only has dispatcher, not the router) can call dispatcher.gate_incoming("slack", …).
• main.rs: register a "slack" TrustConfig entry — L2-open (allow_all_channels=true, allow_dm=true) + L3 mirroring resolve_allow_all([slack].allow_all_users, allowed_users) + allowed_users.
• slack.rs gate call at the dispatch point in handle_message, with:
  • bot-skip (the feat(trust): Phase 1 (discord) — L3 identity via shared gate [DRAFT: canary before merge] #1270 F1 lesson): if !is_bot_msg { … } — Slack bots are gated by trusted_bot_ids/bot handling, not the human L3 allowlist.
  • is_dm: channel_id.starts_with('D') (Slack IM channels).
• unit test: bot sender admitted under allow_all_users=false (mirror l3_gate_skips_bots_admits_humans).
• clippy + slack tests on macmini; canary on an idle/non-prod bot; draft PR until canary passes.

After Slack — the rest of this issue

• Phase 1c: make the gate authoritative + remove neutered should_skip_event L2/L3 + unused GatewayEventContext fields + scattered Discord/Slack user checks
• Privatize Dispatcher::submit / AdapterRouter::handle_message so the gate is un-bypassable by construction
• Only then Phase 3 deny-all flip (docs(adr): identity trust-none default & trust pyramid #1264) + migration/release note

Reminder: canary with allow_all_users=false (not just true) to exercise the deny + bot-bypass paths — the #1270 regression hid behind allow_all_users=true.

[chaodu-agent]

Also track — gateway/Telegram trust-field migration (GATEWAY_* → [platform])

Status: Telegram (and all gateway platforms) are already routed through the shared gate (#1267, merged) and behavior-preserving. But their trust config still comes from GATEWAY_* env, not per-platform sections.

• Move gateway-platform L3 (allowed_users/allow_all_users) + L2 (allowed_channels/allow_all_channels/allow_dm) from GATEWAY_* env into first-class [telegram]/[line]/[feishu]/[wecom]/[googlechat]/[teams] sections (extends feat(telegram): first-class [telegram] config section #1265's [telegram], which today has transport fields only). Depends on docs(adr): first-class per-platform configuration #1263.
• Wire allow_dm for real: derive is_dm at the gateway gate (currently hardcoded false; see gateway.rs TODO(phase-2)) so DMs use the allow_dm surface instead of being evaluated as channels.
• Keep GATEWAY_* env as fallback for backward compat (config-authoritative, matching feat(telegram): first-class [telegram] config section #1265's precedence).

Net remaining trust work order: Slack gate → gateway/Telegram trust-field migration + is_dm → Phase 1c (authoritative + remove scattered checks) → privatize dispatch entries → Phase 3 deny-flip.

[chaodu-agent]

Architecture decision: retire run_gateway_adapter (standalone gateway + WS)

Maintainer decision: the standalone gateway + WS path (run_gateway_adapter) will be retired; all deployments move to the embedded mode (process_gateway_event, already wired to the shared gate in #1267). emilie will be re-run on the new embedded approach.

Impact on remaining work here (all simplifications)

• Wire the WS path through the gate → delete run_gateway_adapter + its WS bridge instead
• should_skip_event's remaining L2/L3 (only the WS path still uses it) → remove entirely (the embedded path already delegates L2/L3 to the gate)
• Once emilie moves to embedded, Telegram is automatically converged onto the shared gate — no extra work
• Ends with a single gateway path, going through the same gate_incoming as Discord/Slack

Updated convergence order

1. Slack L3 gate (draft + canary)
2. Gateway-platform trust-field migration GATEWAY_* → [platform] + wire real is_dm/allow_dm
3. Delete run_gateway_adapter + WS bridge; remove should_skip_event's L2/L3
4. Privatize Dispatcher::submit / AdapterRouter::handle_message (single entry)
5. Phase 3: flip deny-all default + migration/release note

Note: emilie today (standalone/WS) still runs Telegram through the old should_skip_event (behavior-preserving, working) — it is not yet actually going through the shared gate; it converges once moved to embedded.

[chaodu-agent]

Architecture: OLD → NEW (trust gate convergence + run_gateway_adapter deprecation)

Reference diagram for this issue's end state.

🔶 OLD (original / partially still live)

 Discord    Slack      Telegram/LINE/Feishu/WeCom/GChat/Teams
   WS        WS                  webhook
   │         │                     │
   │         │            ┌────────────────────┐  cloudflared
   │         │            │ standalone          │
   │         │            │ openab-gateway      │  ← separate binary (to retire)
   │         │            └─────────┬───────────┘
   │         │                      │ WebSocket
   │         │                      ▼
   │         │            ┌────────────────────────┐
   │         │            │ run_gateway_adapter     │  ← old WS client path
   │         │            │  should_skip_event      │
   │         │            │  ❗ inline L2/L3         │
   │         │            └───────────┬────────────┘
   ▼         ▼                        ▼
┌────────┐┌────────┐  (every path does its own scattered L2/L3)
│discord ││ slack  │
│❗inline ││❗inline │
│ L2/L3  ││ L2/L3  │
└───┬────┘└───┬────┘             │
    ▼         ▼                  ▼
        dispatch (submit / handle_message) ─► ACP

Problem: 3+ ingress paths, each with its own L2/L3 (divergence/omission risk);
         standalone gateway = extra binary + WS + reconnect logic.

✅ NEW (target / after convergence)

 Discord    Slack     Telegram/LINE/Feishu/WeCom/GChat/Teams
   WS        WS                   webhook
   │         │                      ▼  (embedded — no standalone binary)
   │         │            ┌────────────────────────────┐
   │         │            │ process_gateway_event       │
   │         │            │ should_skip_event           │
   │         │            │  (bot + @mention only)       │
   │         │            └──────────────┬─────────────┘
   ▼         ▼                           │
┌────────┐┌────────┐  structural/trigger │
│discord ││ slack  │  filtering only     │
└───┬────┘└───┬────┘                     │
    └─────────┴───────────┬──────────────┘
                          ▼   ✅ single choke point
     ┌───────────────────────────────────────────────┐
     │  🔒 AdapterRouter::gate_incoming                │
     │     └ PlatformTrustConfigs[platform]            │
     │        L2 (scope) + L3 (identity); bots skipped │
     │     Decision: Allow / DenyScope / DenyIdentity   │
     └───────────────────────┬───────────────────────┘
                             │ Allow
                             ▼
          dispatch (submit / handle_message)  ← privatized,
                             │                   only reachable past the gate
                             ▼
                        ACP Session

✗ run_gateway_adapter deleted   ✗ standalone gateway binary retired
✗ per-adapter inline L2/L3 removed (Phase 1c)

Stage table

	OLD	NOW (mixed)	NEW (target)
Discord	inline L2/L3	✅ gated (L3) + own L2	gate L2+L3
Telegram/gateway (embedded)	—	✅ gated	gate L2+L3
Telegram (emilie, standalone/WS)	inline via run_gateway_adapter	still old (pending embedded)	→ embedded → gated
Slack	inline L2/L3	🔶 still inline	gate L3
run_gateway_adapter	primary path	still present	❌ deleted
standalone gateway binary	yes	yes (emilie)	❌ retired
dispatch entry	public / bypassable	public	privatized, single door
deny-all default	no	no	✅ Phase 3

One-liner: OLD = many ingress paths (incl. standalone gateway + WS) each with scattered L2/L3. NEW = all platforms → embedded → single gate_incoming → privatized dispatch; run_gateway_adapter + standalone binary retired; then flip deny-all.