[Birfy]

Written-by: Dev
Fixes #1315
Owner: Dev
Reviewer: Reviewer
Tip SHA: dc7d719
Branch: dev/1315-core-host-docs (from main 2c02cd15, the merge of #1307 — core/package.json = 0.2.11)

Reproduce

docs/subsystems/core-host.md is the page arch-docs treats as architecture truth (AGENTS.md:258), and two paragraphs on it still describe the Feishu tree as it was before the connector row (#1303). On main 2c02cd15:

$ grep -nE "kind: 'sender'|feishu\.enabled|FEISHU_APP_ID" docs/subsystems/core-host.md
405: … Its definition carries `kind: 'sender'`, which the view reports and the client reads instead of hard-coding an id. …
407: … off unless `feishu.enabled` is true (an off connector dials nothing) … `FEISHU_APP_ID` + `FEISHU_APP_SECRET` are read as one credential through the same `rt.secretValue` …

Three claims, each false on this tree: the definition is kind: 'channel' (core/src/host/connectors.js:501); nothing reads a feishu.enabled key, the gate is enabled: () => feishuRecord()?.mode === 'app' && appOf() !== undefined (:573); and the App ID lives in the connector record (:841), paired with FEISHU_APP_SECRET by appCredentials() (core/src/host/feishu-inbound.js:57-63). The paragraph at :409 already states the shipped shape, so the page contradicted itself two paragraphs above it.

What changed

One file, docs/subsystems/core-host.md, +2/−2 — two paragraph lines. No code, no test, no generated file, no changelog fragment.

• :405 — phase 1 is past tense ("started as the first sender connector"), and the definition sentence now says it is a channel: the view reports the kind, the client reads it, and the channel kind is what makes the row offer Choose Bots and reconcile() open the socket, while "webhook mode is the same row with nothing to dial". The half that is still true stays: connector-access.js's CONNECTOR_IDS does not list feishu.
• :407 — the switch is the record (mode: 'app' with both halves saved, "no config switch of its own"); the gate is feishu.ownerOpenId plus the record's allowed guest list, ending "an empty open_id never compares equal to an unset owner"; and the last sentence now says FEISHU_APP_SECRET is the only half read through rt.secretValue, with the App ID in the connector record.
• Everything else in both paragraphs is untouched: the webhook's connect-then-prove, the 512-id ring entering only after deliver returned, one socket per connector, rt.feishuTransport re-read on every start, the answer leaving through the feishu plugin, the deadlines and the retry policy.

What I ran

In a local tree at the pushed tip's exact tree (git rev-parse HEAD^{tree} = the tip's tree; the changed blob is c97e977fdc1f3dad84264828e74b2b81a618a558):

$ node core/scripts/check-arch-docs.mjs
arch-docs: OK (1 changed file(s))
$ node .github/scripts/check-mojibake.mjs --check
mojibake: ok — 0 occurrences of U+FFFD in 1140 text file(s) (22 skipped as binary …)
$ git diff --stat origin/main...HEAD
 docs/subsystems/core-host.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
$ git diff --name-only origin/main...HEAD
docs/subsystems/core-host.md

Red without the source change

Take the page back to main's two lines and the same grep returns the two hits above (three token occurrences: kind: 'sender', feishu.enabled, FEISHU_APP_ID); on this tip it returns nothing and exits 1. That grep is the acceptance Triage wrote ("the page contains none of kind: 'sender', feishu.enabled, FEISHU_APP_ID"), and its opposite — the five facts that must survive — is still on the page: ownerOpenId, allowed, the 512-id ring, rt.feishuTransport, the feishu plugin.

Not run

• The core suite and the three plugin suites: this diff touches no code, no test and no generated file, so the tip's tests-ok and Node 24 runs are the whole-suite evidence; running them locally would re-measure an unchanged tree.
• npm run verify: it would run oxlint, build-client --check, ds-bot-patches check and the suites over that same unchanged tree.

Risk

Docs only. arch-docs cannot go red for this diff — the page's owned_paths is core/src/host/ and no owned file changed — and the change cannot reach the runtime, core/client.js, the ds-bot mirrors or a release. The one way to break it is a malformed Markdown line, which mojibake and the page's own shape cover.

Checkpoint

{
  "pr": 1323,
  "claim": "Dev",
  "issue": 1315,
  "summary": "Two paragraphs of docs/subsystems/core-host.md still described the pre-row Feishu: the sender kind, a feishu.enabled switch, and the app pair read as one secret. Phase 1 is past tense now, the definition is the channel the row needs, the switch is app mode on the record, and only the App Secret is read through rt.secretValue. What is still true is kept: ownerOpenId plus the allowed guest list, the 512-id ring entering after deliver returned, one socket per connector, rt.feishuTransport re-read at every start, and the feishu plugin exit.",
  "files": [
    "docs/subsystems/core-host.md"
  ],
  "checks": {
    "ran": "node core/scripts/check-arch-docs.mjs → OK (1 changed file); node .github/scripts/check-mojibake.mjs --check → ok, 0 occurrences in 1140 files; git diff --stat origin/main...HEAD → 1 file, +2/−2",
    "result": "green",
    "at": "dc7d719eb758da07f9d0ea8b51603131db019ba6"
  },
  "next": "none — ready for review"
}

[Birfy]

Body corrected at the same tip dc7d719eb758da07f9d0ea8b51603131db019ba6: the checkpoint block is 1071 characters and its summary is 542, so the 691-character refusal the guard reported was reading the body as first created. node .github/scripts/enqueue-rules.mjs's checkpointReasons(body, { pr: 1323, files: ["docs/subsystems/core-host.md"] }) returns [] locally; this comment is what makes the guard read the body again.

CI on this tip: tests-ok 121992522858 success, Node 24 121991995332 success, package 121991995598, merge-gate 121991995942, judge 121991998256, plugins ×3, agent-audience ×3, risk tier 121991994846, reviewed tip (report only) 121991996543 — all completed success.

[Birfy]

Verdict: PASS at dc7d719
Written-by: Reviewer2
Attestation: dc7d719 role=Reviewer2

Ran:

• node get.mjs /repos/ThinkFlowLab/FlyBot/pulls/1323 · /issues/1323/comments · /pulls/1323/files · /commits/dc7d719e…/check-runs · /compare/2c02cd15…dc7d719e (03:32:16Z; head dc7d719e, mergeable_state: clean, labels agent-pr, 1 comment, no Verdict:)
• node get.mjs /repos/ThinkFlowLab/FlyBot/check-runs/121992055325 → the enqueue-guard run reads completed success, decision enqueue #1323: no hold and the gate passes, no PASS needed: computed tier T0; a fresh commits/dc7d719e…/check-runs at 03:33:41Z gives 15 runs, 15 completed, 15 success (the guard flipped from failure after the body was shortened; tests-ok 03:30:28Z, Node 24 03:30:22Z, package 03:28:59Z)
• node get.mjs …/contents/docs/subsystems/core-host.md?ref=2c02cd15 → main blob 3ab41541…; grep -nE "kind: 'sender'|feishu\.enabled|FEISHU_APP_ID" on main → lines 405 and 407 (the three tokens); the same grep on the tip file → exit 1, zero hits
• a line-by-line diff of main's blob against the tip file → both 531 lines, differing line numbers 405 and 407 only; :409 (the paragraph that already said channel) untouched; U+FFFD 0; backticks balanced on both changed lines
• node tar.mjs dc7d719e… pr.tgz && tar xzf → the tip tree, then the code reads below (sed -n, grep -n) in that tree
• core/src/host/connectors.js: :501 kind: 'channel', :573 enabled: () => feishuRecord()?.mode === 'app' && appOf() !== undefined, :765 … { kind: c.def.kind } (the view), :701 if (def.kind === 'channel') return reconcileChannel(c, force, token), and reconcileChannel's webhook branch returns before feishuInbound.start() while app mode dials (:662-697) — "webhook mode is the same row with nothing to dial"; :841 writes { …previous, mode: 'app', appId, … } into the record
• core/src/host/feishu-inbound.js: :57 appCredentials(record, secretValue) takes record?.appId plus secretValue?.('FEISHU_APP_SECRET') (:56 APP_SECRET_SECRET) — only the secret goes through rt.secretValue; :119-135 builds the gate as owner ∪ record allowed, both filtered to non-empty ids; :173 refuses anyone else; :19 DEDUPE_RING = 512
• core/src/host/connector-access.js:29 → export const CONNECTOR_IDS = [GITHUB, COMPOSIO] (feishu absent, so the sentence kept at :405 is still true)
• core/src/client/connectors.js: :167 sender = kind === 'sender', :171 channel = kind === 'channel', :209-224 per-Bot switch + Choose Bots decided from kind/mode, no feishu id hard-coded in the row logic
• grep -rn "feishu?.enabled|feishu\.enabled" core/src core/client.js core/dev → nothing; the only config.feishu read left is :574 ownerOpenId (plus the api origin) — "no config switch of its own" holds
• node .github/scripts/check-mojibake.mjs --check in the tip tree → mojibake: ok — 0 occurrences of U+FFFD in 1140 text file(s) (22 skipped as binary …), exactly the line the body reports
• arch-docs: not runnable here (no git; the script's assertBaseRef needs origin/main). Judged from its code instead: filesNeedDocs (core/scripts/check-arch-docs.mjs:115-129) fails only when a changed file matches an owned_paths prefix while that page did not change. This page owns core/index.js, core/src/host/, core/src/shared/, core/web-search.js and four core/test/* files; the single changed path is docs/subsystems/core-host.md, which matches none of them, so missing is empty. It is also exercised in CI: core/scripts/lint.mjs:26 spawns it and exits with its status, and the ubuntu-latest · Node 24 job runs npm run lint in core and is green on this sha.

What I checked:

• Two checks. Head is still dc7d719eb758da07f9d0ea8b51603131db019ba6, mergeable_state: clean, and the sha carries no Verdict: — its only comment (6433059364, author-side, 03:32:09Z) explains the guard re-reading the corrected body and is not a verdict, so it is excluded from this conclusion.
• Preconditions. --name-only is one file, docs/subsystems/core-host.md; no core/package.json, no core/package-lock.json, no patches/ds-bot/0007-version-and-tooling.patch, no patches/ds-bot/** at all (so the mirror rule is vacuous here, and I am not reading a missing mirror as a defect), changelog.d/ and CHANGELOG.md not in the diff.
• The diff is the two lines it says. One hunk, +2/−2, get_files patch shows only :405 and :407 as -/+ pairs with the other seven lines as context; a full line diff against main's blob confirms 405 and 407 are the only differing lines and :409 is byte-identical. Nothing else rides along.
• Each new sentence against the code. :405 phase 1 is past tense ("started as the first sender connector (Feishu connector, phase 1: this instance posts into one Feishu group #1263), and its webhook mode still is one") and the definition is "a channel today, not a sender (Feishu connector, phase 2: a message in Feishu starts a turn here (inbound over the long connection) #1266, below)"; :407's switch is app mode on the record plus a pair appOf() can assemble, "no config switch of its own"; the owner gate is split into feishu.ownerOpenId and the record's allowed; only FEISHU_APP_SECRET is read through rt.secretValue and the App ID rides in the record. Every one of those maps to a line quoted above, and the view's missing/set reporting plus the half-saved pair dialling nothing (appCredentials returning undefined) is what :407 claims.
• The five facts survive verbatim. feishu.ownerOpenId (1), a bounded ring of 512 event_ids entering only after deliver (1), rt.feishuTransport re-read on every start (1), the feishu plugin exit and allowed guest list (11 mentions) are all still on the page, and nothing in the two replaced lines drops them.
• Body checkpoint matches the tree. files: ["docs/subsystems/core-host.md"], checks.at: dc7d719e…, checks.ran = arch-docs + mojibake + git diff --stat — the file list and +2/−2 match the real compare, and the mojibake line reproduces exactly here; the arch-docs claim is judged above rather than taken on faith.

Non-blocking:

• "the channel kind is what makes the row offer Choose Bots" reads one step broad. Choose Bots is channel in app mode, not channel as such: core/src/client/connectors.js:209-224 sets perBot = !sender && (!channel || connector.mode === 'app'), so a webhook-only channel hides the switch. The next clause ("webhook mode is the same row with nothing to dial") scopes the socket, not the switch; adding "in app mode" would make :405 exact. The following paragraph at :409 already draws the mode split, so a reader is not misled far.
• Pre-existing, untouched, same page: the :409 paragraph says the record keeps "app_id"; the record key is appId (connectors.js:841), while app_id is the wire field (:342, :425, :832). That line is outside this diff and I am not asking for it here.
• The page still prints "Two paragraphs" of phase history rather than one shape, and the diff only corrects the two; the mode split lives in :409, which is now consistent with it. No action needed.