fix(slack): support rich questions and complete review delivery (#17255)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Questions and review decisions must work in the conversation where a
task started.
> - Slack omitted question context and did not publish several review
kinds.
> - Some answers saved in Paperclip also lost their authorized
continuation or their final Slack reply.
> - A settled card and a successful run did not prove that the user
received the result.
> - This pull request preserves complete questions and follows the
existing answer and delivery receipts through continuation.
> - Users can read the request, submit an authorized decision, and
receive the resumed task's result in the same conversation.

## Linked Issues or Issue Description

Refs #17045 and #17218.

**What happened?**

Slack question cards could omit instructions and editable starting text.
Checkbox reviews, item verdicts, task suggestions, and connection
requests had no publication path. Complex question answers submitted in
Paperclip could fail continuation authorization. Several review
continuations completed without delivering their result to Slack.

**Expected behavior**

Show the actual question and context. Use native Slack controls when
they preserve the form contract. Otherwise provide an explicit Paperclip
review link. Persist one authorized response, resume through the
existing delivery path, settle the card, and deliver the useful result
to its originating conversation.

**Steps to reproduce**

1. Start a task in Slack and ask a text or choice question with
instructions and help text.
2. Submit native text and choice responses, then submit a complex form
through Paperclip.
3. Accept a checklist, submit item decisions, select suggested tasks, or
decline a connection request.
4. Inspect the saved answer, continuation run, original Slack card, and
final Slack reply independently.

## What Changed

- Preserve full prompts, context, descriptions, recommendations, help,
and editable starting text. Use direct buttons for short choices, inline
searchable selects for longer lists, and native checkboxes with explicit
submission for multiple choices.
- Add native custom-answer and validated-text modals, ordinary
confirmation buttons, checklist decisions, per-item verdicts with
reasons, suggested-task creation/dismissal, and connection decline. Keep
governed approvals, permission grants, and forms that cannot be
represented faithfully in the full Paperclip review surface.
- Keep Slack-specific canonical-validation feedback in its owning
platform module. Shared callbacks delegate without interpreting provider
presentation.
- Reuse the existing canonical interaction transactions, callback
receipts, publication queue, and continuation delivery. Share ordinary
confirmation handling across Telegram and Slack. Recheck current
authorization and commit response receipts atomically.
- Settle cards with the saved answer and remove stale controls. Ignore
passive Slack link callbacks so opening a task does not display a false
answer error.
- Validate exact multi-select receipt mappings during native
continuation. Recover automation-origin connection replies from their
published prompt after validating the durable connection receipt.
- Keep oversized multi-select handoffs free of unused native tokens, and
retain the complete Paperclip form for 101–128 choices plus Other. Make
the original-conversation audience explicit before submitting a Slack
modal.
- Add rollback, provider serialization, callback, continuation, and
negative authorization regressions. Update the connector playbook and
feature/access maps. No React or application UI changes are included.
- Add a durable Q01–Q11 qualification index and provider coverage
matrix. Require distinct functional, good-experience, and
best-available-control assessments; real unanswered/answering/settled
evidence; saved results, continuation and navigation proof; and retained
failures. Mark other providers unaudited rather than assuming Slack
parity.

## Verification

Candidate: `e0017d446b1016a38d65382366cd1408cce33039`. The
eleven-core-format live Slack gallery is pinned to
`c3d458b2a06b660448940fd8cf33c5906f0058d5`; subsequent boundary fixes
and the sharing notice have automated verification, not new live
screenshots.

- Real Slack UI testing covered all 11 formats: text, closed choice,
long single select, multiple choices, choices with a custom answer,
pattern-validated text, confirmation, checklist, item verdicts,
suggested tasks, and connection requests. Each has
unanswered/answering/answered screenshots as applicable, an inspected
saved result, one continuation, and an individual experience review in
the local HTML gallery.
- The dedicated private QA app/channel used signed callbacks to the
local candidate. A separately approved password-protected, read-only
preview proved connection-review, suggested-task review, and
created-task navigation. Anonymous access, writes, and credential routes
were denied. No OAuth grant was attempted.
- Real testing exposed and repaired a multi-select continuation failure
and a misleading error on link-button clicks. Failed attempts remain in
the evidence. The final navigation replay opened the exact pending
connection request and declined it in Slack without granting access.
Suggested-task creation produced the selected child with the correct
parent and description.
- Final review-fix verification: **32 form tests**, **28
provider/form-rendering tests**, **30 publication tests**, and **171
native continuation/authorization tests** passed. Earlier **3
atomic-resolution rollback**, **9 targeted
callback/publication/Telegram**, and **28 review-continuation** cases
passed. The final Slack/Teams modal subset also passed. The
automation-origin connection cases, 101/128 custom-choice cases, and
oversized multi-select continuation reproduced before their fixes and
passed afterward; failing logs remain retained. These counts describe
relevant runs, not a reliability percentage.
- CI on `b5885b85fd` exposed a test fixture that assumed every Slack
modal block was an input; the new sharing notice correctly renders a
non-input block. The fixture now selects input blocks safely. The exact
signed-modal correction/one-continuation test passed locally, together
with 14 Slack form/modal tests. The failing CI log and its specific
cause remain recorded.
- `pnpm -r typecheck` and `pnpm build` passed. Server typechecking was
repeated after the final source changes. Map and module-boundary checks
and `git diff --check` passed.
- The full `pnpm test:run` was attempted and stopped after repeated
embedded PostgreSQL semaphore exhaustion on this host. Its 1,395-test
chat suite found two stale native-control assertions; both were
corrected and re-tested in a focused run. Focused database suites used
separate disposable databases on existing local PostgreSQL. The full
suite is not claimed green; new-head CI must complete before merge.
- Final-head CI passed on `e0017d446b1016a38d65382366cd1408cce33039`:
all test/build jobs and required `ci / verify` and `ci / e2e` gates are
green
([run](https://github.com/paperclipai/paperclip/actions/runs/40115430194)).
Greptile and Ponytail both reviewed this exact head at 5/5, the security
scan passed, and all review threads are resolved.
- All three QA app callbacks were restored to staging. Both temporary
tunnels and local proxies were closed. The local endpoint was archived
and its local credential copies removed. The candidate app was stopped.

Limits: provider execution used a deterministic Claude protocol fixture,
not an LLM. This is local real-provider UX proof, not deployed staging
or broader Codie/Claude qualification. The public preview intentionally
blocked ancillary artifact routes, so its destination pages could show a
partial-history warning. The complete permission-grant flow and every
oversized/mixed-form branch were not driven manually. Earlier fixture,
test, and provider failures remain recorded.

## Risks

- New reply routes require durable origin proof. Incorrect receipt
matching could lose a reply or route it incorrectly. Tests cover
missing, forged, mismatched, and revoked authority.
- Governed forms keep their Paperclip resolution checks. This change
does not grant new approval authority to Slack.
- Existing completed review results can become deliverable through the
repaired publication path without another provider run.
- No schema, lockfile, workflow, public task-status model, or
runtime-instruction change is included. This branch is not deployed.

## Model Used

OpenAI Codex, GPT-6 family, with code execution and tool use. The exact
backend model ID and context-window size are not exposed in this
session.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either linked existing issues or described the issue in-PR
following the relevant issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links
- [x] My branch name describes the change and contains no internal
Paperclip ticket id
- [x] I have run focused tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green on the new head
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
on the new head
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip authored and GitHub committed 2026-10-24 10:29:15 -07:00
1 parent b7506671b9
commit 7ae81c9fa7
43 files changed
+2171 -416

No files matched your search

@@ -75,6 +75,23 @@ const ids = (value: unknown): string[] =>
? value.filter((id): id is string => typeof id === "string")
: [];
function completedMultiChoiceMatches(question: Record<string, unknown>, answer: Record<string, unknown>, payload: Record<string, unknown>): boolean {
const selected = ids(payload.selectionValues);
const answered = ids(answer.optionIds);
const mappings = Array.isArray(payload.selectionOptions) ? payload.selectionOptions.map(record) : [];
const options = Array.isArray(question.options) ? question.options.map(record) : [];
if (question.selectionMode !== "multi" || question.allowOther === true ||
!Array.isArray(payload.selectionValues) || selected.length !== payload.selectionValues.length ||
!Array.isArray(answer.optionIds) || answered.length !== answer.optionIds.length ||
new Set(selected).size !== selected.length || new Set(answered).size !== answered.length ||
mappings.length !== options.length || new Set(mappings.map(item => item.value)).size !== mappings.length ||
new Set(mappings.map(item => item.optionId)).size !== mappings.length ||
(question.required !== false && selected.length === 0) ||
selected.length !== answered.length ||
mappings.some(item => typeof item.value !== "string" || typeof item.optionId !== "string" || !options.some(option => option.id === item.optionId && option.freeText !== true))) return false;
return selected.every((value, index) => mappings.find(item => item.value === value)?.optionId === answered[index]);
}
function completedQuestionFormMatchesInteraction(
interaction: AskUserQuestionsInteraction,
action: typeof chatActions.$inferSelect,
@@ -159,7 +176,7 @@ function completedQuestionFormMatchesInteraction(
}
/**
* Resolve a durable provider answer or GitHub's authenticated Board fallback,
* Resolve a durable provider answer or an authenticated Board fallback,
* never a caller-supplied wake marker. This
* is routing/reading authority only: it never checks out a task or resolves a
* review. Callers retain their issue/run/actor and current destination checks.
@@ -620,8 +637,8 @@ async function resolveQuestionResponseChain(
sql`${chatActions.result}->>'interactionId' = ${interaction.id}`,
),
);
// GitHub has no executable question callback. Its published link leads to
// the ordinary authenticated Board answer route, whose pending→answered CAS
// GitHub and Slack forms without native controls use the ordinary
// authenticated Board answer route, whose pending→answered CAS
// creates the response delivery above atomically. Do not fabricate a provider
// action: bind that distinct receipt to the original linked person instead.
const boardQuery = tx
@@ -676,7 +693,7 @@ async function resolveQuestionResponseChain(
and(
eq(chatEndpoints.id, chatPublications.endpointId),
eq(chatEndpoints.companyId, chatPublications.companyId),
eq(chatEndpoints.provider, "github"),
eq(chatEndpoints.provider, provider),
),
)
.innerJoin(
@@ -709,7 +726,12 @@ async function resolveQuestionResponseChain(
),
),
);
const evidenceQuery = provider === "github" ? boardQuery : actionQuery;
// Slack native actions remain authoritative when present. The Board query
// excludes every native answer token, including unfinished ones; its result
// is re-read under the same identity and row locks below.
const boardAnswer = provider === "github" ||
(provider === "slack" && (await boardQuery).length === 1);
const evidenceQuery = boardAnswer ? boardQuery : actionQuery;
let expectedPrincipalId: string | null = null;
if (lockMode !== "read") {
// Identity changes take this advisory lock before their row lock. Resolve
@@ -773,7 +795,7 @@ async function resolveQuestionResponseChain(
const card = record(record(publication.payload).card);
const links = Array.isArray(card.actions) ? card.actions.map(record) : [];
if (
provider !== "github" ||
!boardAnswer ||
interaction.resolvedByRunId !== null ||
publication.payload.progressState !== "waiting_for_input" ||
card.kind !== "question" ||
@@ -781,12 +803,14 @@ async function resolveQuestionResponseChain(
links.some((link) => link.type !== "link") ||
!publication.publishedAt ||
publication.publishedAt > interaction.resolvedAt ||
typeof boardGeneration !== "number" ||
!Number.isSafeInteger(boardGeneration) ||
boardGeneration < 0 ||
boardRuntime.generation !== boardGeneration ||
typeof boardRuntime.credentialFingerprint !== "string" ||
!/^[a-f0-9]{64}$/.test(boardRuntime.credentialFingerprint)
(provider === "github" && (
typeof boardGeneration !== "number" ||
!Number.isSafeInteger(boardGeneration) ||
boardGeneration < 0 ||
boardRuntime.generation !== boardGeneration ||
typeof boardRuntime.credentialFingerprint !== "string" ||
!/^[a-f0-9]{64}$/.test(boardRuntime.credentialFingerprint)
))
)
return null;
} else if (action.kind === "question_answer") {
@@ -806,13 +830,16 @@ async function resolveQuestionResponseChain(
record(action.result).interactionStatus !== "answered" ||
!selectedAnswer ||
!selectedQuestion ||
selectedQuestion.selectionMode !== "single" ||
ids(selectedAnswer.optionIds).length !== 1 ||
ids(selectedAnswer.optionIds)[0] !== action.payload.optionId ||
!Array.isArray(selectedQuestion.options) ||
!selectedQuestion.options.some(
(option) => record(option).id === action.payload.optionId,
)
!Array.isArray(answers) || answers.length !== 1 ||
!Array.isArray(questions) || questions.length !== 1 ||
Boolean(selectedAnswer.otherText) ||
(Array.isArray(action.payload.selectionOptions)
? provider !== "slack" || !completedMultiChoiceMatches(selectedQuestion, selectedAnswer, action.payload)
: selectedQuestion.selectionMode !== "single" ||
ids(selectedAnswer.optionIds).length !== 1 ||
ids(selectedAnswer.optionIds)[0] !== action.payload.optionId ||
!selectedQuestion.options.some(option => record(option).id === action.payload.optionId))
)
return null;
} else if (action.kind === "photon_interaction") {
@@ -892,10 +919,12 @@ async function resolveQuestionResponseChain(
}
: {
boardResponse: {
schema: "paperclip.github_board_question_response.v1",
schema: `paperclip.${provider}_board_question_response.v1`,
principalId: inbound.principalId,
runtimeGeneration: boardGeneration,
credentialFingerprint: boardRuntime.credentialFingerprint,
...(provider === "github" ? {
runtimeGeneration: boardGeneration,
credentialFingerprint: boardRuntime.credentialFingerprint,
} : {}),
},
}),
publication: {
@@ -467,7 +467,7 @@ describe("native external-chat response wait", () => {
fixture: Awaited<ReturnType<typeof seedWaitTurn>>;
gate: Awaited<ReturnType<typeof seedPriorCompletionReview>>;
},
responseKind: "button" | "form" = "button",
responseKind: "button" | "form" | "multi" = "button",
) {
const fixture = target?.fixture ?? await seedWaitTurn(provider);
const gate = target?.gate ?? await seedPriorCompletionReview(fixture);
@@ -520,7 +520,7 @@ describe("native external-chat response wait", () => {
{
id: "color",
prompt: "Choose a color",
selectionMode: "single" as const,
selectionMode: responseKind === "multi" ? "multi" as const : "single" as const,
required: true,
allowOther: false,
options: [
@@ -545,7 +545,7 @@ describe("native external-chat response wait", () => {
}
: {
version: 1 as const,
answers: [{ questionId: "color", optionIds: ["cobalt"] }],
answers: [{ questionId: "color", optionIds: responseKind === "multi" ? ["cobalt", "amber"] : ["cobalt"] }],
};
await db.insert(heartbeatRuns).values({
id: sourceRunId,
@@ -641,7 +641,7 @@ describe("native external-chat response wait", () => {
interactionId,
publicationId,
questionId: "color",
optionId: "cobalt",
...(responseKind === "multi" ? { selectionOptions: [{ value: "opaque-cobalt", optionId: "cobalt" }, { value: "opaque-amber", optionId: "amber" }], selectionValues: ["opaque-cobalt", "opaque-amber"] } : { optionId: "cobalt" }),
},
result:
responseKind === "form"
@@ -700,8 +700,12 @@ describe("native external-chat response wait", () => {
};
}
async function seedGitHubBoardAnsweredTurn(withLink = true) {
const fixture = await seedWaitTurn("github");
async function seedBoardAnsweredTurn(withLink = true, provider: "github" | "slack" = "github", oversized = false) {
const fixture = await seedWaitTurn(provider);
if (provider === "slack") {
await db.update(chatEndpointResources).set({ type: "channel" }).where(eq(chatEndpointResources.id, fixture.resourceId));
await db.update(chatConversations).set({ isDirectMessage: false }).where(eq(chatConversations.id, fixture.conversationId));
}
const gate = await seedPriorCompletionReview(fixture);
const [current] = await db
.select()
@@ -756,12 +760,16 @@ describe("native external-chat response wait", () => {
{
id: "color",
prompt: "Choose a color",
selectionMode: "single",
// Multi-select plus a custom answer intentionally needs Board.
selectionMode: provider === "slack" ? "multi" : "single",
required: true,
allowOther: false,
allowOther: provider === "slack" && !oversized,
options: [
{ id: "cobalt", label: "Cobalt" },
{ id: "amber", label: "Amber" },
...(oversized ? Array.from({ length: 9 }, (_, index) => ({
id: `option-${index}`, label: `Option ${index}`, description: "Detail ".repeat(550),
})) : []),
],
},
],
@@ -779,7 +787,7 @@ describe("native external-chat response wait", () => {
.update(chatPublications)
.set({
state: "published",
providerMessageId: "github-question",
providerMessageId: `${provider}-question`,
publishedAt: new Date(),
})
.where(eq(chatPublications.idempotencyKey, publicationKey))
@@ -858,10 +866,24 @@ describe("native external-chat response wait", () => {
};
}
it.each([true, false])(
"attests a native GitHub question answered in Board without inventing a provider action (link: %s)",
async (withLink) => {
const fixture = await seedGitHubBoardAnsweredTurn(withLink);
it("resumes an oversized Slack multi-select answered through its Paperclip handoff", async () => {
const fixture = await seedBoardAnsweredTurn(true, "slack", true);
const [publication] = await db.select().from(chatPublications).where(eq(chatPublications.id, fixture.publicationId));
expect(publication!.payload.card?.actions).toEqual([
{ type: "link", label: "Open in Paperclip", url: expect.stringContaining(fixture.issueId) },
]);
expect(publication!.payload.card?.selection).toBeUndefined();
await expect(db.select().from(chatActions).where(eq(chatActions.companyId, fixture.companyId))).resolves.toEqual([]);
await attestAnswer(fixture);
const responses = await materializeExternalChatQuestionResponseInput({ db, binding: fixture, contextSnapshot: fixture.context });
expect(responses).toHaveLength(1);
expect(JSON.stringify(responses)).toContain("cobalt");
});
it.each((["github", "slack"] as const).flatMap(provider => [true, false].map(withLink => ({ provider, withLink }))))(
"attests a native $provider question answered in Board without inventing a provider action (link: $withLink)",
async ({ provider, withLink }) => {
const fixture = await seedBoardAnsweredTurn(withLink, provider);
await expect(
db
.select()
@@ -879,7 +901,7 @@ describe("native external-chat response wait", () => {
).not.toBeNull();
await attestAnswer(fixture);
expect(fixture.context.paperclipWake).toMatchObject({
externalChatProvider: "github",
externalChatProvider: provider,
});
await db
.update(heartbeatRuns)
@@ -923,7 +945,7 @@ describe("native external-chat response wait", () => {
},
);
it.each([
it.each((["github", "slack"] as const).flatMap(provider => ([
"different_user",
"viewer",
"membership_revoked",
@@ -938,10 +960,10 @@ describe("native external-chat response wait", () => {
"endpoint_paused",
"resource_revoked",
"answer_hash",
] as const)(
"rejects GitHub Board answer authority after %s",
async (change) => {
const fixture = await seedGitHubBoardAnsweredTurn();
] as const).filter(change => provider === "github" || (change !== "generation" && change !== "missing_runtime")).map(change => ({ provider, change }))))(
"rejects $provider Board answer authority after $change",
async ({ provider, change }) => {
const fixture = await seedBoardAnsweredTurn(true, provider);
if (change === "different_user") {
const otherUser = `other-${randomUUID()}`;
await db
@@ -1080,10 +1102,10 @@ describe("native external-chat response wait", () => {
},
);
it.each(["generation", "identity", "membership", "reach"] as const)(
"rechecks GitHub Board answer %s at publication after native completion",
async (change) => {
const fixture = await seedGitHubBoardAnsweredTurn();
it.each((["github", "slack"] as const).flatMap(provider => (["generation", "identity", "membership", "reach"] as const).filter(change => provider === "github" || change !== "generation").map(change => ({ provider, change }))))(
"rechecks $provider Board answer $change at publication after native completion",
async ({ provider, change }) => {
const fixture = await seedBoardAnsweredTurn(true, provider);
await attestAnswer(fixture);
const resultJson = await finishReviewResponse(fixture);
expect(
@@ -1203,7 +1225,7 @@ describe("native external-chat response wait", () => {
async function attestAnswer(
fixture:
| Awaited<ReturnType<typeof seedAnsweredChatTurn>>
| Awaited<ReturnType<typeof seedGitHubBoardAnsweredTurn>>,
| Awaited<ReturnType<typeof seedBoardAnsweredTurn>>,
) {
expect(
await attestReviewedExternalChatRun({
@@ -1240,13 +1262,13 @@ describe("native external-chat response wait", () => {
check: (input: {
fixture:
| Awaited<ReturnType<typeof seedAnsweredChatTurn>>
| Awaited<ReturnType<typeof seedGitHubBoardAnsweredTurn>>;
| Awaited<ReturnType<typeof seedBoardAnsweredTurn>>;
invoke: () => Promise<unknown>;
}) => Promise<void>,
) {
const fixture =
provider === "github"
? await seedGitHubBoardAnsweredTurn()
? await seedBoardAnsweredTurn()
: await seedAnsweredChatTurn(provider);
await attestAnswer(fixture);
const root = await mkdtemp(path.join(tmpdir(), "answered-chat-file-"));
@@ -1327,7 +1349,7 @@ describe("native external-chat response wait", () => {
const fixture =
source === "direct"
? await seedWaitTurn("github")
: await seedGitHubBoardAnsweredTurn();
: await seedBoardAnsweredTurn();
if (source === "direct") await seedPriorCompletionReview(fixture);
// A previous run's failure projects `error` onto the agent. The next
// already-claimed turn attests before execution-start changes it to
@@ -1444,6 +1466,16 @@ describe("native external-chat response wait", () => {
},
);
it.each(["valid", "tampered_selection", "revoked_identity"])("attests only the committed Slack multiple-choice response: %s", async condition => {
const fixture = await seedAnsweredChatTurn("slack", undefined, "multi");
if (condition === "tampered_selection") {
const [action] = await db.select().from(chatActions).where(eq(chatActions.id, fixture.actionId));
await db.update(chatActions).set({ payload: { ...action!.payload, selectionValues: ["opaque-amber", "opaque-cobalt"] } }).where(eq(chatActions.id, fixture.actionId));
}
if (condition === "revoked_identity") await db.update(chatIdentityLinks).set({ status: "revoked" }).where(eq(chatIdentityLinks.principalId, fixture.principalId));
expect(await attestReviewedExternalChatRun({ db, ...fixture, contextSnapshot: fixture.context })).toBe(condition === "valid");
});
it("attests a genuine Slack mixed-question modal answer for its native continuation", async () => {
const fixture = await seedAnsweredChatTurn("slack", undefined, "form");
await expect(