merge: align Slack Access with base modes and independent options

Signed-off-by: Tiberiu Socaci <tsocaci@makeitfuture.com>

Author: tbiyss

AGENTS.md

@@ -1,7 +1,7 @@
 # ChannelGate — AGENTS.md
 
-Canonical instruction file. `CLAUDE.md`, `GEMINI.md`, `HERMES.md` are symlinks to this file —
-edit here only.
+Canonical instruction file for Codex and contributors. `CLAUDE.md` symlinks to this file
+for Claude Code — edit here only.
 
 ## What this is
 
@@ -81,10 +81,11 @@ post/edit Slack message in the thread
   (gateway control MCP + dual Composio identities; Skills/Toolbox use channel→user→org). Slack
   beyond the gateway's own bot tools is the **Composio** Slack toolkit — there is no separate hosted
   Slack MCP.
-- `src/gateway/modes.js` — the read/bash/auto/admin mode → tool-permission mapping (read = read-only
-  tools, bash = shell + file writes, auto = permission prompts auto-approved, admin =
-  `--dangerously-skip-permissions` for an admin author). A mode is a TOOL preset; none of them
-  changes what the channel's container mounts.
+- `src/gateway/modes.js` — three base modes: Read-only, Worker (shell + file writes), and Admin
+  (Worker for members; `--dangerously-skip-permissions` only for trusted admin authors). Auto and
+  Lean are independent options. Auto approves tool requests for both roles; Lean removes optional
+  skills/connectors, but admins in Admin mode retain full context. A mode is a TOOL preset; runtime
+  mount policy remains separately defined by the container backend.
 - `src/runtimes/` — WHERE an engine process runs: the `RuntimeBackend` contract (`contract.js`),
   `resolve.js` (the one place that builds the RuntimeTarget a turn, a background job and the memory
   reviewer all receive — each resolves at its OWN spawn), and `container/` — the rootless Podman

CHANGELOG.md

@@ -18,11 +18,20 @@ product overview.
 
 ## Unreleased
 
-- Add a manager/admin-only Access page to Slack channel settings for mode, Full access, Lean,
+- Add a manager/admin-only Access page to Slack channel settings for base mode (including Admin), Auto, Lean,
   network, use/manage policy, and named guest/manager lists. Recheck live membership and current
   roles on save; immediately acknowledge submissions while validation runs. Admin-author-only
   engine bypass and existing ordinary-tab access remain unchanged.
 
+- Channels: use Read-only, Worker, and Admin as the three base modes, with independent Auto and
+  Lean side toggles in channel, DM, and template editors. Slack Settings can now select Admin
+  for authorized admins. Admin gives other members Worker plus their selected options; Auto
+  approves tools for both roles, while Lean applies only to non-admins in an Admin channel.
+  Existing Full access records now get the promised Worker fallback.
+
+- Repository cleanup: remove unused Gemini/Hermes instruction aliases and the superseded working
+  audit. Keep canonical agent instructions, project records and active release acceptance gates.
+
 - Settings: replace the Testing with AI checkbox list with a compact searchable user selector,
   removable selection chips, keyboard navigation and a bounded results list that fits narrow screens.
 

FEATURES.md

@@ -58,8 +58,8 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks.
   never has to carry a per-author sentence, and a channel with no Composio gets no line at all.
   → TEST-PLAN: Composio identity and connection discovery.
 
-- **Focused conversation settings:** Access presents Read-only, Worker, and Autonomous as the
-  primary modes, with Full access and Lean as clearly separated special-mode boxes; Custom is no
+- **Focused conversation settings:** Access presents Read-only, Worker, and Admin as the
+  base modes, with Auto and Lean as independent options; Custom is no
   longer offered. MCP Connections, Cloud MCP, Environment tokens, and Skills are separate first-class
   channel pages rather than nested beneath Tools; enabled skills sort first and the channel-level
   Grant Tier switch is gone.
@@ -79,7 +79,7 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks.
   status. Secrets can be edited in every channel mode, including through `/secrets`; file-edit
   permissions and the separate `/model` command policy are unchanged.
   **Access** is a fifth tab, visible only to current admins/channel managers. They can edit the
-  base mode, Full access, Lean, network, use/manage policy and named guest/manager lists. Selecting
+  base mode (including Admin/full access), Auto, Lean, network, use/manage policy and named guest/manager lists. Selecting
   Full access does not grant anyone an administrator role; bypass still requires an admin author.
   Saves acknowledge immediately with a progress view, validate named users against live human
   channel membership, re-check management and roles at the write boundary, and audit policy changes.
@@ -1235,7 +1235,7 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks.
   work folder, clean workspace and artifact dir mounted), while memory-off and the MCP allowlist are
   unchanged. Per-conversation gated folder: filesystem sandbox confined to the folder, persistent memory
   off, MCP allowlist. → TEST-PLAN: Security (confinement, allowlist, memory).
-- **2026-07 full-codebase review remediation** (from `IMPROVEMENTS.md`): engine children run with a
+- **2026-07 full-codebase review remediation**: engine children run with a
   minimal allowlisted env (`src/engines/child-env.js` — Slack tokens / approval secret never reach
   sandboxed processes; daemon-IPC creds ride a 0600 `internal-auth.json`); MCP tokens off argv
   (0600 temp file written only at spawn); admin UI binds loopback by default with a no-password
@@ -1352,40 +1352,31 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks.
   Customized/restored via the **`get_gateway_guide`** (anyone) / **`update_gateway_guide`** /
   **`reset_gateway_guide`** (admins) gateway MCP tools — per-file or whole-guide restore-to-default.
   → TEST-PLAN: Gateway-usage skill.
-- **Retired 2026-09-03 (Linux + containers only):** the OS-sandbox half of this bullet — the four modes stay as TOOL-permission presets (read =
-  read-only tools, bash = shell + file writes, auto = prompts auto-approved, admin =
-  `--dangerously-skip-permissions` for an admin author), and none of them changes what the channel's
-  container can see. Four channel **modes** (set with `/mode`): `read` (Read/Glob/Grep only, every
-  other tool asks for approval — the shell is named in the lockdown's `permissions.ask`, not merely
-  left out of `permissions.allow`: Claude Code answers a simple command whose argv head is on its
-  own built-in read-only list (`id`, `cat`, `head`, `strings`, …) BEFORE consulting
-  `--permission-prompt-tool`, so omission alone let a read-mode turn run `id -un` with no approval
-  card; an `ask` rule outranks that layer and routes every command — simple or compound — to the
-  approval card), `bash` (Bash + file writes, sandboxed to the folder), `auto`
-  (autonomous — permission prompts auto-approve, still fully sandboxed), and `admin` (full tools,
-  sandbox off — requires an **admin author** as well). `admin` is org-admin-only to select; the safe
-  modes honor the channel's "who can manage" policy. The **admin-run settings variant** — the file
-  handed only to an admin author's escalated turn in an admin-mode channel — grants the shell tools
-  outright and carries no `ask` rule at all: that turn spawns with
-  `--dangerously-skip-permissions`, so the rule widens nothing, and inheriting read mode's
-  `ask: ["Bash"]` instead made Claude Code deny a bare `pwd` and demote the whole turn to read-only
-  (the `full` profile sets `adminMode` alone, never `allowBash`). The SHARED file of the same
-  channel is unchanged — a non-admin author there still routes every command to the approval card.
-  → TEST-PLAN: Modes & approvals.
+- **Three base modes with independent options:** Read-only, Worker, and Admin. Read-only
+  routes edits and commands to approval; Worker grants commands and file writes inside the channel
+  container. Admin grants Worker to non-admin members and the permission bypass only to trusted
+  admin authors. The shared settings file always disables bypass, even when it grants Worker tools.
+  **Auto** and **Lean** are independent side toggles: Auto approves tool requests for every admitted
+  member; Lean removes optional skills and connectors. In Admin mode, Lean applies to non-admins,
+  while admins retain their configured tools and context. Changing Worker ↔ Admin preserves both
+  toggles. Choosing Read-only clears Auto; enabling Auto on Read-only selects Worker. Existing Full
+  access records gain the documented Worker fallback; existing Auto and Lean flags are preserved.
+  Network remains a separate setting. → TEST-PLAN: Base modes and independent options.
 - Read mode's filesystem contract is engine-neutral: ordinary runs get bounded gateway MCP tools
   to list, read, and literal-search the effective channel workdir. They realpath-check every target,
   refuse traversal and escaping symlinks, cap file/search output, and expose no write or shell
   operation. Claude may keep using its native Read/Glob/Grep; Codex uses these tools when its
   read-only permission profile intentionally withholds command execution. → TEST-PLAN: Engines.
-- **Capability profiles** (admin UI, one dropdown instead of a grid of toggles): **Read-only** /
-  **Worker** / **Autonomous** / **Full access** / **Lean** — each with example help text — expand to
-  the underlying `adminMode`/`allowBash`/`autoMode`/`cleanMode` flags; **Custom…** unlocks the flags
-  for hand-editing. Legacy channels derive their profile from existing flags (no DB migration). The
-  network toggle + the rarely-touched knobs (memory, nudges, refuse-org-tokens, work-dir, engine/
-  model/effort) live under an **Advanced** disclosure. → TEST-PLAN: channel access model.
+- The web channel editor, custom DMs, and default templates share the three-mode picker and
+  side toggles. The Slack reply's **Settings** button exposes Read-only/Worker/Admin plus Auto/Lean
+  on its manager/admin-only Access tab for channels. DMs retain Runtime mode controls with
+  Admin selection restricted to admins. Every click rechecks user
+  authorization and channel membership, and every change is audited. `/mode read|worker|admin` changes the
+  base while preserving applicable options (`bash` remains a compatibility alias). Legacy run-API
+  presets remain accepted with their existing capability-reduction boundary.
 - **Two-axis access model** (per channel, both editable in the admin UI): **Who can use** (`meta.access`:
   Approved members / Admins only / Locked) and **Who can manage** (`meta.manageAccess`: Org admins only /
-  Channel members / Custom + `meta.managers[]`). The Slack Access page delegates channel mode, Full access, Lean, network and use/manage policy to
+  Channel members / Custom + `meta.managers[]`). The Slack Access page delegates channel mode (including Admin), Auto, Lean, network and use/manage policy to
   current managers. Work-dir stays org-admin-only. The gateway control MCP (`requireManage` vs
   `requireAdmin`) and in-thread `/mode` command retain their narrower admin checks; default `admins` means relaxing it is strictly opt-in. Settings →
   **Reset all channels' access to default** (confirm-gated, audit-logged) restores use/manage to defaults

GEMINI.md

@@ -178,7 +178,7 @@ white-label — are described at
 | [SECURITY.md](./SECURITY.md) | Reporting a vulnerability, and the dependency-advisory policy |
 
 > Agent/contributor instructions live in **[AGENTS.md](./AGENTS.md)** (the canonical context
-> file; `CLAUDE.md` / `GEMINI.md` / `HERMES.md` symlink to it). Shipped features are in
+> file for Codex and contributors; `CLAUDE.md` symlinks to it for Claude Code). Shipped features are in
 > **[FEATURES.md](./FEATURES.md)**, the build roadmap is maintained privately, and the
 > regression in **[TEST-PLAN.md](./TEST-PLAN.md)**.
 

HERMES.md

@@ -3,6 +3,33 @@
 Cumulative functional + security regression. Extended per slice. Run top-to-bottom for a full
 pass. Many checks are manual (require a real Slack workspace + an authenticated `claude` CLI).
 
+## Base modes and independent options (2026-09-08)
+
+- Automated: `modes`, `channel-settings-modal`, `mode-command-audit`, `folders-settings`,
+  `folders-generator-paths`, `run-grant-isolation`, `runtime-integration-surfaces`, and `run-api`
+  cover legacy flag interpretation, three base selections, toggle persistence, admin-only selection,
+  untrusted-author boundaries, per-run settings, and engine-independent settings rendering.
+- UI acceptance (engine-independent): in the web channel editor and DM/template editor, select
+  Worker, check Auto and Lean, then select Admin. Exactly three base choices appear, with both
+  options still checked. Save/reopen and verify all flags. Select Read-only: Auto clears, Lean
+  stays. Enable Auto: Worker is selected. At wide widths options sit beside the base choices;
+  narrow screens stack without overflow.
+- Slack Settings acceptance (engine-independent): as an admin fixture actor open a recent reply's
+  Settings → Access button, choose Admin, and toggle Auto/Lean independently. Reopen and verify persistence
+  and the `slack-settings` audit event. A member-manager sees all three modes and both options; ordinary members do not see Access.
+  Forged legacy Runtime mode actions and revoked authorization/membership grants are rejected.
+  DMs keep Runtime mode controls with Admin restricted to admin authors.
+- Runtime acceptance (Claude AND Codex): in an isolated fixture set Admin + Auto + Lean. As the
+  approved non-admin fixture actor ask "Create mode-check.txt containing MODE_OK, read it back,
+  and reply with its contents." Pass only with matching saved bytes, no approval click/card,
+  `autoMode=true`, `clean=true`, and `dangerouslySkip=false`. Repeat as an admin fixture actor:
+  matching file, no approval click/card, `clean=false`, `dangerouslySkip=true`. Check run-private
+  MCP/skill artifacts to distinguish Lean from a model merely claiming it ran bare. Restore the
+  fixture configuration. A direct harness run establishes runtime behavior, not Slack delivery.
+- Legacy acceptance: start with `profile=full`, `adminMode=true`, `allowBash=false`, Auto off.
+  An ordinary member can edit and run shell commands as Worker; their bypass remains disabled.
+  Existing `profile=auto` and `profile=lean` records retain their respective modifiers on reopen.
+
 ## Release readiness remediation (2026-09-07)
 
 The source changes address audit findings 1–4, 6, 7 and 9–17. Findings 5 and 8 (retiring the
@@ -144,7 +171,7 @@ Automated: `test/channel-memory.test.js`, `test/memory-search.test.js`,
       in every channel mode regardless of manager policy.
 - [x] Automated Access: ordinary authorized users cannot see/forge the fifth tab; admins,
       approved members under Members policy and named managers under Custom policy can edit it.
-      DMs keep four tabs. Independent base-mode/Full-access/Lean/network flags round-trip; preset
+      DMs keep four tabs. Independent base-mode/Auto/Lean/network flags round-trip; preset
       flags and stored profile agree. Unknown fields cannot change workDir, credentials or roles.
       Real store saves preserve unrelated settings and audit only policy. Departed actors,
       outsiders/bots in named lists, revoked channel grants and global role revocation during the
@@ -153,20 +180,20 @@ Automated: `test/channel-memory.test.js`, `test/memory-search.test.js`,
       `access-settings-qa`, join an admin actor, an approved member, a named external guest, and
       the bot. Start with Worker, network/Full access/Lean off, Approved use, Admins manage, and
       no explicit grants. From a fresh reply open Settings as each actor. Only admin sees Access.
-      Change manage to Members; approved actor now sees Access, guest does not. Save Autonomous,
-      Full access, Lean, network, named guest, and Custom management with the approved actor
+      Change manage to Members; approved actor now sees Access, guest does not. Save Admin mode,
+      Auto, Lean, network, named guest, and Custom management with the approved actor
       named. Reopen Slack and web settings: all values agree; unrelated model/tokens are unchanged;
       audit identifies actor/channel and contains no secrets. Clear special flags/lists and save:
       all clear. Try a bot and a user outside the channel: save fails without changing metadata.
       Revoke management or remove the actor with the editor open: old submit fails. Delay Slack
       membership responses beyond three seconds: immediate progress view, then one final result;
       no Slack timeout or double save. Restore/delete fixture. Pending live execution.
 - [ ] Live Access Claude and Codex (one run each in disposable channel `access-settings-qa`):
-      select engine explicitly, Worker base, Full access on, Lean/network off, Members management.
+      select engine explicitly, Admin mode, Auto/Lean/network off, Members management.
       As approved non-admin, prompt “Create access-proof.txt containing access proof and report
       whether permission bypass is active.” As admin, repeat with a different filename. Pass when
       per-run launch evidence has bypass only for the admin author and both runs stay in their
-      declared container mounts. Enable Lean and start a fresh thread: “List the connectors and
+      declared container mounts. As the non-admin actor, enable Lean and start a fresh thread: “List the connectors and
       skills available in this run.” Pass when runtime evidence shows the lean tool/skill policy.
       Toggle network and ask “Is network use allowed here?”; compare the answer and launch policy
       to the stored setting (advisory network is not an egress isolation claim). Restore fixture
@@ -3556,7 +3583,7 @@ are the v0.8 production deployment gate and are executed in the QA loop that fol
       `curl https://api.github.com/` returns HTTP 200 while an unlisted domain stays blocked
       (QA case DRV-04; before the codex-userns block both reset with curl exit 56).
 
-## Review remediation (2026-07, IMPROVEMENTS.md)
+## Review remediation (2026-07)
 Unit layer first: `npm test` (node:test over `test/`) must pass — it pins the pure helpers
 (escaping, chunking, queue, TTL set, child-env, containment, backoff, slugify, cron catch-up).
 Manual checks for the daemon-level behavior: