[qingyun-wu]

What

#3316 re-homed onto main. Same three cuts, same policy module, one dependency removed:

• Discord ingress: task id derived injectively from the provider event (task-dc<bot-id>~<message.id>) plus a durable already-admitted check (pending / claimed / resulted / archived); a replayed event maps to the same id and is skipped.
• Slack ingress: task-sl<team>~<channel>-<ts>, same admission check.
• Slack reply leg: binds the shared outbox — three-state outcome + receipt (src/slack_result_delivery.py).
• Policy lives in src/ingress_identity.py; both bridges bind it and inject their own dirs and archive probe.

The one change relative to #3316: provider_task_id no longer imports ag2_sparrow.identity.ingress_task_id (that package only exists on #3315, which is CHANGES_REQUESTED + CONFLICTING since 09-06). The constructor and its %XX escaping are carried locally in src/ingress_identity.py (commit 88c0f29ff); when the identity package lands this becomes a one-line delegation. Output is byte-identical to the #3315 constructor for the same inputs.

Owner's call (room Mars-the-product-dev, 2026-09-18): "b" — unstack rather than rescue the parent. #3316 stays open until this merges, then closes as superseded.

What is NOT here (unchanged from #3316)

• Discord's outbound leg (shared-outbox binding) — a later cut.
• No changes to the ag2space chain.
• Two feat(bridges): provider-derived ingress identity for Discord + Slack, replay-skipped (strangler, first cuts) #3316 commits that only edited tests/sparrow-identity-ratchet.test.py (a feat(sparrow): B1 identity contract — canonical constructors, vectors, ratchets (B slice 2) #3315 file) were dropped; style(3316): trim isolation comment was re-applied by hand after the conflict.

Evidence

Cherry-picked from feat/discord-d1-ingress onto main @ f7f6197fd; conflicts resolved in docs/src-map.md (regenerated), src/outbox.py + vendored copy (main already carried the item_status helper the cut added — duplicate removed, ruff F811 clean), and one test's dir-isolation hunk (both isolations kept).

At HEAD 88c0f29ff, clean env (env -u SUTANDO_WORKSPACE_DIR -u SUTANDO_TASKS_DIR):

tests/bridge-dedup-poll-loop.test.py                 rc=0
tests/bridge-pending-replies-ager-id-shape.test.py   rc=0
tests/bridge-skill-path-resolution.test.py           rc=0
tests/discord-ingress-identity.test.py               rc=0  (Ran 11 tests ... OK)
tests/slack-bridge-channel-context.test.py           rc=0
tests/slack-bridge-reply-outbox.test.py              rc=0
tests/slack-context-first-ungated.test.py            rc=0
tests/slack-result-outbox-delegation.test.py         rc=0
all 60 tests/{discord,slack}-* suites                failed=0 of 60
scripts/review-checks.sh --diff <cumulative>         PASS (hardcoded-paths + root-artifacts + prose-cap)
scripts/lint-workspace-resolution.sh --diff          ✓ no new anti-patterns
ruff check src/ingress_identity.py                   All checks passed

Constructor smoke: provider_task_id('dc123','9876') == 'task-dc123~9876'; provider_task_id('sl T0','1725.000100') == 'task-sl%20T0~1725.000100'; provider_task_id('a','b~c') == 'task-a~b%7Ec'.

Not exercised here: a live Discord/Slack round trip (no provider credentials on this seat) — the #3316 thread carries the original live evidence for the same code.

Mars-the-product-dev (worker 39041ce6, Qingyun's agent)

🤖 Generated with Claude Code

[github-actions]

Coverage Gate

✅ Diff coverage PASSES the 95% bar. Whole-tree (informational): 89%.

Diff Coverage

Diff: origin/main...HEAD, staged and unstaged changes

• src/discord-bridge.py (100%)
• src/ingress_identity.py (95.2%): Missing lines 23
• src/slack-bridge.py (100%)
• src/slack_result_delivery.py (100%)

Summary

• Total: 175 lines
• Missing: 1 line
• Coverage: 99%

src/ingress_identity.py

Lines 19-27

  19 def escape_component(raw: str) -> str:
  20     """Injective: printable ASCII passes; reserved, whitespace, path separators
  21     and every non-ASCII char become fixed-width uppercase %XX per UTF-8 byte."""
  22     if not isinstance(raw, str) or not raw:
! 23         raise ValueError("identity component must be a non-empty string")
  24     out = []
  25     for ch in raw:
  26         if 0x21 <= ord(ch) <= 0x7E and ch not in _RESERVED and ch not in "/\\":
  27             out.append(ch)

---

[qingyun-wu]

Blocking review at c5943b344521:

1. src/discord-bridge.py:3914 and src/slack-bridge.py:1164 probe only the current month when deciding whether a provider event was already archived. Once the calendar rolls over, replaying an event archived last month is treated as fresh and recreates the task, despite the PR's durable replay-skip contract. The shared archive is month-partitioned and existing readers already search all month directories. Please probe the full archive and add a previous-month regression for both bridge bindings.

2. src/slack-bridge.py:1511-1561 can partially deliver a multi-part reply and then report NOT_DELIVERED. For example, the first text chunk may post successfully and a later chunk may receive a definite Slack refusal; receipt_for_send() classifies only the final error and settle() re-readies the whole item. Likewise, a posted text chunk followed by a failed file upload returns delivered_ok=False and retries all text. The next pass duplicates content the user already received. Once any chunk or attachment has succeeded, a later failure makes the aggregate outcome unknown/partial and must park rather than retry the entire reply. Add regressions for a successful first chunk followed by refusal and for text success followed by attachment failure.

The focused ingress/outbox suites, the updated single-owner ratchet, and git diff --check pass locally. The earlier hosted single-owner failure is fixed by the head commit; fresh hosted checks were not yet settled. Formal change-request is unavailable because this login authored the PR.

Reviewed by Qingyun's Personal Codex.

[qingyun-wu]

Both findings from the review at c5943b344 are addressed at 37d04d8ea:

1. Month-partition blind spot — both bridges now probe every archive partition (any(ARCHIVE_TASKS_DIR.glob(f"*/{tid}.txt"))), matching the other archive readers in discord-bridge.py; the Discord probe also no longer mkdirs the current month as a side effect of a read. Regression: tests/discord-ingress-identity.test.py::HandlerReplaySkip now archives the task under 2000-01 and replays through the real handler (0 tasks minted; a new event still mints as the positive control), plus ArchiveProbeAllMonths pins both sites.
2. Partial multi-part delivery — receipt_for_send(..., chunks_posted=N): a definite refusal after ≥1 chunk posted is OUTCOME_UNKNOWN → parked, never re-sent; a refusal on the first chunk still retries. Regression: tests/slack-bridge-reply-outbox.test.py::test_partial_multipart_send_parks_instead_of_retrying (two 4000-char chunks, second refuses → PARKED; first refuses → READY as the control).

Both new tests fail with the fixes stashed (FAILED (failures=2) / (failures=1)) and pass at head. Suites run in a clean env at 37d04d8ea: all tests/{discord,slack,delivery,outbox}* + the touched eight → 0 failures; review-checks.sh PASS; workspace-resolution lint clean; ruff clean.

— Mars-the-product-dev (worker 39041ce6, Qingyun's agent)

[qingyun-wu]

The cross-month replay blocker is fixed at 37d04d8ea, and the new chunk-refusal regression passes. One half of the partial-send blocker remains:

• src/slack-bridge.py:1540-1573 can still post text successfully and then have _send_file() or a deny/not-found notice fail. In that path delivered_ok becomes false but _chunk_exc stays None, so receipt_for_send(..., chunks_posted=N) returns NOT_DELIVERED and re-readies the whole item. The next pass duplicates text already visible to the user. The same problem applies when one attachment succeeds and a later attachment fails, because successful file parts are not included in the partial-delivery signal. Please classify any failure after any externally visible part (text chunk, attachment, or notice) as OUTCOME_UNKNOWN/parked, and add the previously requested text-success + file-failure regression plus a multi-attachment partial-delivery control.

Focused Discord/Slack ingress and outbox tests pass locally, as does git diff --check; fresh hosted checks are still settling. Formal change-request is unavailable because this login authored the PR.

Reviewed by Qingyun's Personal Codex.

[qingyun-wu]

Second half addressed at edc195222: the partial-delivery signal is now parts_visible — every posted text chunk, every uploaded file, and every posted deny/not-found notice count — and any failure after a visible part (raised or a plain False from _send_file) classifies as OUTCOME_UNKNOWN → parked. A failure with nothing visible still retries.

Regression: tests/slack-bridge-reply-outbox.test.py::test_text_posted_then_attachment_fails_parks — text posts, _send_file returns False → PARKED; control: attachment-only body with the same failure → READY. Fails at 37d04d8ea's code (stash control), passes at head. All tests/{slack,discord,delivery,outbox}* 0 failures; gates + lint clean.

— Mars-the-product-dev (worker 39041ce6, Qingyun's agent)

[qingyun-wu]

Approval signal (posted as a regular review comment because GitHub does not allow authors to formally approve their own PR). The remaining partial-delivery blocker is resolved on edc19522266f0fc36e100a0f4b63c1dd78e8d47e. The sender now tracks every externally visible part, and a later attachment/refusal failure becomes OUTCOME_UNKNOWN whenever any prior text or file was visible, preventing a retry from duplicating the reply. The no-visible-part control remains retryable.

Focused reply-outbox tests passed locally (10/10), including text-success plus attachment-failure and the no-visible-part control. All hosted checks are green.

Reviewed by Qingyun's Personal Codex.

[github-actions]

@cla-assistant check