Skip to content

Mattermost Acceptance Record

This record accompanies the specification and feature map. Evidence is scoped to the tested version and environment. Local tests, controlled protocol fixtures, real-server checks and user acceptance are distinct; none alone proves a release ready on every platform.

The connector arrived through PR #103. Its original acceptance record at ea00093b preserves the complete development chronology, initial failures, reruns and contributor-reported Linux/Windows checks. Private server details, credentials and raw session evidence do not belong in this repository.

September 15 integration findings

Two independent probes of the merged code found issues not caught by the earlier green checks:

  • Status hidden by a dirty draft: editing the URL or token during a management request invalidated the whole subsequent status/configuration refresh. The running connector could be presented as stopped, with no Stop button. The existing delayed-operation test matrix was strengthened to assert authoritative status as well as draft preservation: six cases failed before the correction.
  • Socket fixture accepted too early: the daemon HTTP fixture made its listener nonblocking before accepting a just-connected client. Twenty isolated runs reproduced WouldBlock. The fixture now accepts while blocking and makes only the accepted stream nonblocking, retaining coverage of the production reader's mode normalization and fragmented HTTP handling. Twenty repeat checks then passed.

The UI fix separates current status ownership from draft hydration. It adds no polling or persistent state. The socket correction changes the fixture, not the production transport. An isolated browser verified start, stop, remove and save while editing, including mobile layout; no real Mattermost server or model was called.

A subsequent language audit found 306 source lines containing Chinese outside locale files. Comments, diagnostics and ordinary test descriptions are standardized to English, along with the new public documents. Fourteen deliberate multilingual body/filename fixture lines remain to exercise Unicode transport. Existing locale files are unchanged.

Verification of the complete source correction passed on Linux: Web static/type checks, all 1,632 Web tests and production build; Rust formatting, strict workspace/all-target Clippy and full workspace/all-target tests. The tooling suite's 120 tests and Ruff passed before the language-only source cleanup; no tooling implementation changed afterward. Isolated browser checks cover actual buttons and draft preservation, not live Bot delivery. Native Windows/macOS and real-server acceptance were not rerun.

The native 0.4.40 Linux package also built successfully. The archive's executable matches the release binary, and the prepared embedded Web assets match the current Web build. This is build evidence, not deployment or live-service acceptance.

The documentation build initially detected source-relative links that resolve in the repository but fail on the published site. Those now use pinned GitHub URLs, and adjacent Markdown references are separated correctly. All 29 pinned source targets and the new cross-document anchors were checked. The failed build remains part of the integration evidence; dead-link checks were not disabled.

Follow-up attachment integrity correction

A subsequent review reproduced complete HTTP responses whose body length disagreed with file metadata. Staging now compares the actual byte count with a known metadata size before returning the upload. A mismatch drops the temporary upload and prevents message submission. Unknown metadata sizes remain supported.

The existing multi-file failure regression now covers metadata larger and smaller than the downloaded body, including cleanup and absence of ledger submission. All 62 offline Mattermost tests and strict Web-crate Clippy passed; three live tests remained ignored. The accompanying workspace and Presentation corrections passed all 1,638 Web tests, static checks and isolated Chrome checks. The Linux package was rebuilt and its binary and prepared assets verified. These focused checks do not replace the earlier full-workspace evidence or establish live-server or native Windows/macOS acceptance.

Acceptance matrix

Identifiers are retained from the original feature comparison. The historical evidence column summarizes the contributor's earlier records; it does not claim that those live scenarios were rerun during integration.

IDRequired behaviorHistorical evidence and limits
T01Native source organization, helpers, visibility, errors, tests and dependenciesSource review against Slack, Telegram and Discord; necessary shared changes documented
T02Web/CLI configuration, references, drafts, validation, status, themes, narrow layout and localesAutomated and real-browser checks; user confirmation separately in T20
T03Real startup validation; explicit auth/TLS/proxy errors; redaction; recoveryReal HTTPS/WSS and invalid-token checks; controlled WS auth, proxy/NO_PROXY and TLS failures
T04Start/stop/status/config/unset/logs and enabled restore; no Actor stop or old-ledger replayLive configuration/lifecycle checks; nonempty logs and follow-mode checks
T05Pairing, approval, rejection, expiry, revocation and unsubscribe; no unauthorized file downloadReal Web/CLI pairing; 600-second expiry and aliases; fixture checks for unauthorized files and exact threads
T06Public/private channels, DMs, permitted group DMs and threads; correct routing and authorizationFive real target types reported; channels/threads authorized separately; shared Group context stated
T07Default/specific Actors and aliases; no extra recipients from body mentionsLive addressing and unknown-target checks; controlled unrelated/Bot/duplicate filtering
T08Commands and aliases through a real Mattermost client@Bot-prefixed subscribe, unsubscribe, send, pause/resume, help/status and all verbose forms; bare slash interception documented
T09Independent per-target subscriptions and shared Group outputReal multi-target pause/resume, verbose and status checks; no claim of private DM sessions
T10Public visibility, sender fallback, Markdown, links and code; no loopsShared privacy/filter assertions and real formatting checks; private terminal content excluded
T11Per-target progressive output; complete-final dedupe; fallback after failuresReal main-timeline/thread editing; controlled failed creation/editing, long previews and fallback
T12Unicode-safe long text and code, fully reconstructibleReal multilingual/emoji chunks and a 22,158-character code/link body; controlled fallback cases
T13Two-way text/files/images/PDF/audio/video and attachment-only messagesReal transport of synthetic TXT/PNG/PDF/WAV/WebM files with hash checks; not content-understanding evidence
T14Size, ownership, length, path, redirect and upload failuresReal oversize rejection; controlled unknown length, ownership, redirects, paths, cross-Group Blobs and HTTP 403
T15Stable source IDs, dedupe, Bot/system/edit filtering; no wait for model completionSource correlation and shared client-ID assertions; controlled repeated/edited/Bot posts
T16Own-Bot processing reactions, correlated completion/failure and cleanupReal reactions; controlled event association, expiry and HTTP 403 without losing message text
T17Ledger lag, disconnects, rate limits, auth failures and restart boundariesShared lag recovery and real restart boundaries; controlled WS/429/401/403 and lost POST responses without duplicate creation
T18Multi-target Group behavior and separate Bots for separate GroupsReal multiple targets; two simulated Bots for Group isolation, not a second real-Bot deployment
T19Existing Rust/Web/build/package paths, with evidence for each mapped featureVersion-specific workspace, frontend and package records; no separate connector package
T20User configures through Web and tests addressing, files, threads, streams and commandsContributor recorded explicit user acceptance on September 8, 2026; not fresh acceptance of this integration

Historical findings and later corrections

These summaries preserve the useful evidence without treating every review round as a separate current specification. Exact versions, commands and original failure logs are indexed in the archived record.

  • File references: an Actor returned refs instead of using file delivery. No file reached Mattermost in that attempt. It remains an Actor tool-use failure; the connector was not changed to convert references into attachments.
  • LOG01 → LOG03/LOG05: an oversize file produced status and user feedback but no readable Group log. The combined CLI path lacked a tracing subscriber. Native Group logging plus stderr corrected that gap; a new oversize upload verified the real log path, and follow mode later showed new records once. Rotation, redaction and write-failure checks remain controlled tests, not real disk-failure evidence.
  • FILE02 / NET02: controlled 403 metadata/body failures left no Blob. A server that received a complete POST and lost its response did not receive an automatic duplicate create.
  • V01: a real human-origin request missed during a short disconnect was recovered and produced an Actor reply. Revoking access before recovery prevented a later replayed request from reaching the Actor. These were finite Linux live scenarios within the server cache window, not Windows evidence or guarantees after restart/cache expiry.
  • Reviews 1–6: address validation, bare-mention filtering, draft preservation, identity serialization, runtime error ownership, native connection recovery, unknown-submit feedback, lookup authorization and heartbeat write deadlines were corrected. Platform fixtures and live protocol checks are recorded separately.
  • Review 7: staged multi-file download/validation and cancellation cleanup were checked without deleting shared Blobs. Saving files and submitting a ledger event still do not form one atomic transaction.
  • Reviews 8–10: cross-platform startup result ownership, repeated lookup/control/failure feedback, delayed stop/config replacement, upload metadata and safe recovery cursor retention received regressions.
  • Reviews 11–13: pre-allocation startup/restore windows, equal-config request revisions, long final streams and platform-visit ownership were checked at actual entry points.
  • Reviews 14–15: initial hydration, edits during management, daemon IPC delegation and browser request ordering were checked. These earlier draft assertions did not catch the status-refresh omission found during integration.
  • Review 16: failure after worker installation now removes and stops only that generation. Stop/remove errors remain visible, and Weixin-specific management flows participate in Mattermost ordering.
  • Review 17: the existing Group sweep now removes revisions for deleted Groups that never had workers. Legacy-only management continuations were explicitly deferred; see the scope boundary.

Historical full checks also recorded intermittent terminal WebSocket shutdown and voice test-server startup failures. Unchanged focused and full reruns passed, but those records did not establish a root cause. They must not be rewritten as an initially clean run or as proven platform fixes.

Regression entry points

Use isolated CCCC_HOME directories, synthetic credentials and controlled platform fixtures. Do not use a developer's running services for these checks.

AreaEntry points and assertions
Core state and CLIim_state normalization, URL validation, credential aliases and CLI argument translation
Daemon managementops::im::tests: real HTTP delegation, fragmented reads, unavailable/rejected Web and stale ownership
Runtime lifecycleim_runtime, routes::im: generation/revision handoff, failed final commit, restore and deleted-Group cleanup
Inboundmattermost, mattermost_inbound, inbound_attachments: exact authorization, identity failures, control replay, staged files and safe submission outcomes
OutboundMattermost protocol fixtures: actual post edits, chunk reconstruction, attachment metadata, per-target dedupe and reaction failures
NetworkControlled REST/WS: TLS/proxy parity, sequence replay, missing hello, gaps, cache loss, auth rejection, heartbeat write timeout and queue backpressure
WebSettingsModal.mattermost.test.tsx, IMBridgeTab.revoke.test.tsx, IM API/config tests: status and drafts, failures, Group/platform visits, unmounts and request ordering
Real browserDelay actual request boundaries; check status/buttons, preserved input, narrow layout, keyboard/focus and visible errors
Release preparationWeb check/test/build, Rust fmt/Clippy/workspace tests, tooling and package build

Three live Mattermost tests remain explicitly ignored by default. They require an authorized test site/channel and credential file, leave synthetic posts, and are not part of ordinary offline regression. Enabling them is not implied by running the repository gate.

Completion criteria

A passing mock proves the exercised behavior, not the entire live integration. Real API acceptance requires a dedicated Bot, exact approved targets and separate authorization to send messages. Claims about native Windows/macOS behavior require those platforms.

Before publishing, tie CI and acceptance to the actual candidate commit. Do not carry earlier test counts forward as current evidence, report a build as deployed, or label an excluded legacy issue fixed.

Released under the Apache-2.0 License.