Registered under bridgeProviderName (default slack) so callers use core
SendMessageAction only. STAND-IN(core=QRun-IO/qqq#1194, removeBy=4.1.0-RC.8)
for output status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claim and lease with attempt rows; re-authorization as the owner at send time;
message-metadata reconcile of expired leases; 429 Retry-After without consuming
attempts; retries, dead letters, FAILED_AUTH with owner notification and alert;
threads, updates, rate limiter, workspace health. Two-tenant and token-leak tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Workspace and connection lookups run as the owner (createAutomatedSessionForUser)
so tenant and owner locks apply; conversations.members must include the owner;
bounded membership cache; only the chosen row's token is ever decrypted;
ownerless sends limited to registered channels with a matching tenant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Seven tables (workspace, connection, channel, user group, template, message,
attempt), enums, joins, child lists and Postgres DDL. Owner locks on
connection and message; the host tenant lock on workspace and inherited by
join; token fields PASSWORD, hidden, and DENY-locked for every user session.
Tests: validator, owner isolation, two-tenant isolation, token invisibility.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keys from named environment variables (current and previous), generic errors
with no cause, a canary test that a fake token never escapes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maes
