P1: Make Slack first-class for portable governed agent harnesses

[jusso-dev]

Mission

Make Slack a first-class product surface for every Muster agent, while also exposing a portable governed agent-harness contract for Hermes, MCP clients, CLIs and custom tools.

Slack is the primary end-user experience: native installation, agent selection, DMs, mentions, assistant threads, progress, typed results, approvals and administration. The generic harness is the reusable foundation beneath it.

The harness must preserve Muster's authoritative identity, tenant scope, capabilities, approvals, evidence, audit and runtime limits. It is an invocation surface, not a prompt or secret export.

First-class Slack experience

• Native Slack app installation using organisation-scoped OAuth, encrypted token storage, uninstall/revocation handling and an admin-visible connection health page.
• Support Slack AI assistant threads where available, plus DMs, @mention in approved channels, message shortcuts and a /muster entry point.
• Let administrators expose selected agents to Slack, choose a default agent, configure per-channel agent allowlists and decide whether an agent may read bounded thread/channel context.
• Let users explicitly select or switch agents in a thread. The bot must always show which agent is active.
• Acknowledge Slack events and interactions immediately; enqueue all agent work outside the request handler.
• Stream bounded status into the same thread using Slack assistant status APIs where available, with a durable fallback that updates one progress message without flooding the channel.
• Render typed results with Block Kit summaries, evidence links, confidence, gaps, recommended next steps and buttons for governed follow-up actions. Preserve the full typed result in Muster.
• Render approval cards in-thread, but accept a decision only after mapping the Slack user to an authoritative Muster actor with the required capability. Distinct-human approval rules remain enforced.
• Support cancel, retry, view in Muster, link task/case/investigation and continue in a room.
• Handle Slack retries, rate limits, message edits/deletes, app uninstall, lost permissions and adapter restart without duplicate agent runs or duplicate channel replies.
• Provide useful Slack-specific admin diagnostics: scopes, event subscriptions, channel access, identity mapping, last delivery, rate limits, failures and reconnect status.

Portable agent harness

• Publish an organisation-scoped manifest for every active agent with stable key/version, description, supported invocation modes, typed input/output contracts, required capabilities, approval behaviour and lifecycle state.
• Provide an authenticated invocation API with synchronous acknowledgement plus asynchronous progress, cancellation and typed results.
• Support idempotency keys, correlation/trace IDs, optional room/task/investigation/case context and durable reconnect after caller restart.
• Provide first-party adapters for:
  • Slack as the complete reference product experience.
  • Hermes and other MCP clients.
  • CLI and generic HTTP/webhook consumers.
• Keep channel rendering in adapters while PostgreSQL remains authoritative for runs, evidence, messages, tasks, approvals and audit.

Security and governance

• Authenticate callers and map every external workspace/user to one organisation and Muster actor/service identity.
• Scope every manifest, invocation, run, result, callback, channel mapping, message, task, evidence and audit query by organisation.
• Re-evaluate server-side capabilities at invocation and before every external action; never trust adapter-supplied capabilities.
• Keep secrets, system prompts and connector credentials out of manifests, Slack metadata, adapter payloads and model prompts.
• Treat Slack, Hermes and webhook content as untrusted evidence, never agent instructions.
• Preserve existing approval records for dangerous actions. No adapter can bypass policy.
• Verify Slack request signatures and replay windows for HTTP Events API. Support Socket Mode for non-public deployments, with explicit acknowledgement of every envelope.
• Use least-privilege Slack scopes, channel allowlists and bounded context retrieval.
• Enforce rate, concurrency, runtime, token and cost budgets per organisation, agent, workspace and caller.
• Honour kill switches, exposure disablement and capability revocation before queued or in-flight external actions.

Operability

• Durable inbox idempotency and outbox delivery for Slack events, progress, results and callbacks.
• Retry-safe deliveries with dead-letter visibility and no duplicate external messages/actions.
• Metrics for invocations, latency, failures, cancellations, approvals, budget exhaustion, Slack API rate limits and adapter health without high-cardinality or secret labels.
• Versioned harness contracts and backwards-compatible manifest negotiation.

Acceptance criteria

• An administrator can install Muster in Slack, map the workspace to one Muster organisation and verify connection/scopes without exposing tokens.
• An administrator can enable/disable individual agents in Slack and set channel/DM policies without changing agent definitions.
• A user can invoke Jessie and at least one non-hunt agent from a Slack DM and approved channel mention.
• Slack keeps one agent run in one thread: immediate acknowledgement, bounded progress, typed Block Kit result and durable resume after adapter restart.
• Users can see and switch the active agent explicitly.
• Approval-required work displays in Slack but stays pending until a distinct authorised human approves it. Unmapped or underprivileged Slack users cannot approve.
• The same Slack event or harness idempotency key produces one authoritative run and one visible result delivery.
• Cancellation from Slack or Muster converges on one cancelled run.
• Hermes can discover and invoke Jessie plus one non-hunt agent through the portable MCP/harness adapter.
• Cross-tenant manifest, run, result, Slack workspace, callback and approval access is denied.
• Disabling exposure, revoking capability, uninstalling Slack or activating an agent kill switch blocks later execution and external actions.
• No manifest, Slack response or adapter payload exposes system prompts, secrets or raw restricted training evidence.

Verification

• Contract tests for manifest discovery, version negotiation, typed invocation and typed result envelopes.
• Slack OAuth install/uninstall, scope and token-rotation tests.
• Slack signature, timestamp, retry header, duplicate event, Socket Mode acknowledgement and rate-limit tests.
• DM, app_mention, assistant thread, shortcut, slash command, agent switch, progress update, cancellation and Block Kit interaction tests.
• Tenant/capability/approval boundary, replay, kill-switch and mid-run revocation tests.
• Hostile Slack/Hermes/webhook prompt-injection fixtures.
• Worker restart and Slack reconnect proof with exactly one visible result.
• End-to-end Slack invocation of Jessie and another agent using synthetic data.
• End-to-end Hermes invocation of the same agents through the shared harness.
• Homelab Slack proof with audit-chain verification and no secret leakage.

Dependencies and sequencing

Build on the governed agent runtime, typed structured outputs, outbox, approvals and connector boundaries. Complete after the ordered issue #21 implementation work and before issue #32 final improvement/polish, so Slack usability and documentation are included in the final sweep.