From 697aa266e04ca94a1f53b9d8c4e923beb443c196 Mon Sep 17 00:00:00 2001 From: Goon Date: Fri, 29 May 2026 19:43:06 +0700 Subject: [PATCH] feat(channels): document context admin surface --- docs/23-ai-agent-permission-matrix.md | 15 +++++++++++++++ docs/project-changelog.md | 17 +++++++++++++++++ .../phase-01-research-and-contracts.md | 2 +- .../phase-02-read-only-context-surface.md | 2 +- .../phase-03-effective-capability-matrix.md | 2 +- .../phase-04-context-scoped-grants.md | 2 +- .../phase-05-context-scoped-credentials.md | 2 +- ...se-06-discord-enrichment-and-verification.md | 2 +- .../plan.md | 16 ++++++++-------- 9 files changed, 46 insertions(+), 14 deletions(-) diff --git a/docs/23-ai-agent-permission-matrix.md b/docs/23-ai-agent-permission-matrix.md index c3ef1d92..b64e734b 100644 --- a/docs/23-ai-agent-permission-matrix.md +++ b/docs/23-ai-agent-permission-matrix.md @@ -12,6 +12,7 @@ This matrix documents the effective authorization layers for agent actions acros | Agent config permissions | Agent config mutations from chat | `agent_config_permissions` | Matches by `agent_id`, `scope`, `config_type`, `user_id`, including wildcard rows. | | Workspace file boundary | Filesystem access | tool sandbox/boundary checks | Prevents path escape and unsupported writes. | | Context file boundary | Agent identity/context files | `ContextFileInterceptor` | Routes protected files to store and requires group writer permission in group contexts. | +| Channel context capabilities | MCP + Secure CLI tool execution | `mcp_context_*`, `secure_cli_context_*` | Effective precedence: user credentials > context credentials/grants > agent grants > global defaults. | ## Agent Config Permission Rows @@ -69,3 +70,17 @@ The Permissions tab should expose a full matrix editor: - Permission-store errors fail closed for group mutation boundaries. - Backend validation rejects unknown config types and permissions before writing rules. - Platform send permissions are still separate from GoClaw permissions; a channel adapter may reject delivery even when GoClaw allows the agent action. + +## Channel context capabilities + +Channel instances expose stored contexts in the dashboard and API. The base +context is the channel instance itself; group contexts come from stored channel +contacts. Capability rows combine MCP and Secure CLI visibility for that +context, including source, enabled state, tool allow/deny lists, and credential +presence. + +Context credential rows never return secret material. They only project +metadata such as `has_api_key`, `has_env`, `credential_source`, and key names +where available. Writes are tenant-admin gated, and runtime resolution carries +`ChannelContextScope` so grants and credentials are applied only to matching +channel/group scope. diff --git a/docs/project-changelog.md b/docs/project-changelog.md index 1027b40d..ba945abf 100644 --- a/docs/project-changelog.md +++ b/docs/project-changelog.md @@ -4,6 +4,23 @@ Significant changes, features, and fixes in reverse chronological order. --- +## 2026-05-29 + +### Channel context admin surface (issue #66) + +**New** + +- Added channel context APIs under `/v1/channels/instances/{id}/contexts` for stored channel/group contexts, members, and effective MCP/Secure CLI capability matrix. +- Added tenant-scoped context grants and context credentials for MCP servers and Secure CLI binaries, with PostgreSQL migration `000074` and SQLite schema version `43`. +- Runtime tool execution now carries `ChannelContextScope`; MCP and Secure CLI resolution apply context grants/credentials before user credential overrides. +- Web dashboard channel detail page now has a `Contexts` tab showing contexts, stored members, effective granted tools, and scoped credential presence without exposing secret values. + +**Security** + +- Context capability write APIs use tenant-admin checks. +- Credential APIs return presence/metadata only; raw MCP API keys, headers/env values, and Secure CLI env values are never serialized. +- MCP grant-check cache key includes channel scope so scoped grants do not leak across channel contexts. + ## 2026-05-28 ### CLI credential adapter framework + git adapter (issue #82) diff --git a/plans/260528-issue-66-channel-context-admin-surface/phase-01-research-and-contracts.md b/plans/260528-issue-66-channel-context-admin-surface/phase-01-research-and-contracts.md index 5cb688ef..e4ef343e 100644 --- a/plans/260528-issue-66-channel-context-admin-surface/phase-01-research-and-contracts.md +++ b/plans/260528-issue-66-channel-context-admin-surface/phase-01-research-and-contracts.md @@ -1,7 +1,7 @@ --- phase: 1 title: "Research and Contracts" -status: pending +status: complete effort: "M" --- diff --git a/plans/260528-issue-66-channel-context-admin-surface/phase-02-read-only-context-surface.md b/plans/260528-issue-66-channel-context-admin-surface/phase-02-read-only-context-surface.md index 2ba28a54..045d8099 100644 --- a/plans/260528-issue-66-channel-context-admin-surface/phase-02-read-only-context-surface.md +++ b/plans/260528-issue-66-channel-context-admin-surface/phase-02-read-only-context-surface.md @@ -1,7 +1,7 @@ --- phase: 2 title: "Read-only Context Surface" -status: pending +status: complete effort: "L" --- diff --git a/plans/260528-issue-66-channel-context-admin-surface/phase-03-effective-capability-matrix.md b/plans/260528-issue-66-channel-context-admin-surface/phase-03-effective-capability-matrix.md index 4492ccdb..8bede47d 100644 --- a/plans/260528-issue-66-channel-context-admin-surface/phase-03-effective-capability-matrix.md +++ b/plans/260528-issue-66-channel-context-admin-surface/phase-03-effective-capability-matrix.md @@ -1,7 +1,7 @@ --- phase: 3 title: "Effective Capability Matrix" -status: pending +status: complete effort: "L" --- diff --git a/plans/260528-issue-66-channel-context-admin-surface/phase-04-context-scoped-grants.md b/plans/260528-issue-66-channel-context-admin-surface/phase-04-context-scoped-grants.md index f4d6544f..c93941c2 100644 --- a/plans/260528-issue-66-channel-context-admin-surface/phase-04-context-scoped-grants.md +++ b/plans/260528-issue-66-channel-context-admin-surface/phase-04-context-scoped-grants.md @@ -1,7 +1,7 @@ --- phase: 4 title: "Context-scoped Grants" -status: pending +status: complete effort: "XL" --- diff --git a/plans/260528-issue-66-channel-context-admin-surface/phase-05-context-scoped-credentials.md b/plans/260528-issue-66-channel-context-admin-surface/phase-05-context-scoped-credentials.md index 3fec559a..b80696d9 100644 --- a/plans/260528-issue-66-channel-context-admin-surface/phase-05-context-scoped-credentials.md +++ b/plans/260528-issue-66-channel-context-admin-surface/phase-05-context-scoped-credentials.md @@ -1,7 +1,7 @@ --- phase: 5 title: "Context-scoped Credentials" -status: pending +status: complete effort: "XL" --- diff --git a/plans/260528-issue-66-channel-context-admin-surface/phase-06-discord-enrichment-and-verification.md b/plans/260528-issue-66-channel-context-admin-surface/phase-06-discord-enrichment-and-verification.md index d0d3ff8b..f3b4a910 100644 --- a/plans/260528-issue-66-channel-context-admin-surface/phase-06-discord-enrichment-and-verification.md +++ b/plans/260528-issue-66-channel-context-admin-surface/phase-06-discord-enrichment-and-verification.md @@ -1,7 +1,7 @@ --- phase: 6 title: "Discord Enrichment and Verification" -status: pending +status: complete effort: "M" --- diff --git a/plans/260528-issue-66-channel-context-admin-surface/plan.md b/plans/260528-issue-66-channel-context-admin-surface/plan.md index 35b8395d..2c70616b 100644 --- a/plans/260528-issue-66-channel-context-admin-surface/plan.md +++ b/plans/260528-issue-66-channel-context-admin-surface/plan.md @@ -1,7 +1,7 @@ --- title: "Issue 66 Channel Context Admin Surface" description: "Add channel details admin views for contexts, members, granted MCP/CLI capabilities, and scoped credential overrides." -status: pending +status: complete priority: P2 issue: 66 branch: "codex-issue-66-channel-details-admin-design" @@ -29,12 +29,12 @@ Out of scope for the first implementation pass: raw credential reveal, storing M | Phase | Name | Status | |-------|------|--------| -| 1 | [Research and Contracts](./phase-01-research-and-contracts.md) | Pending | -| 2 | [Read-only Context Surface](./phase-02-read-only-context-surface.md) | Pending | -| 3 | [Effective Capability Matrix](./phase-03-effective-capability-matrix.md) | Pending | -| 4 | [Context-scoped Grants](./phase-04-context-scoped-grants.md) | Pending | -| 5 | [Context-scoped Credentials](./phase-05-context-scoped-credentials.md) | Pending | -| 6 | [Discord Enrichment and Verification](./phase-06-discord-enrichment-and-verification.md) | Pending | +| 1 | [Research and Contracts](./phase-01-research-and-contracts.md) | Complete | +| 2 | [Read-only Context Surface](./phase-02-read-only-context-surface.md) | Complete | +| 3 | [Effective Capability Matrix](./phase-03-effective-capability-matrix.md) | Complete | +| 4 | [Context-scoped Grants](./phase-04-context-scoped-grants.md) | Complete | +| 5 | [Context-scoped Credentials](./phase-05-context-scoped-credentials.md) | Complete | +| 6 | [Discord Enrichment and Verification](./phase-06-discord-enrichment-and-verification.md) | Complete: live role/member enrichment remains gated behind Discord intent verification | ## Dependencies @@ -47,4 +47,4 @@ Out of scope for the first implementation pass: raw credential reveal, storing M ## Unresolved Questions -- Confirm whether Discord live role/member enrichment ships in v1 or stays documented after read-only context visibility. +None. Discord live role/member enrichment is intentionally not enabled until required intents and permissions are verified.