feat(slack-app): bind sandbox MCP identity to each message's actor

[VojtechBartos]

Problem

Stacked on #68894. With the queue workflow, teammates take turns talking to one running agent — but the sandbox's PostHog MCP token stays bound to whoever created the task. A teammate's followup mints insights and dashboards as the original mentioner:

 Alice: @PostHog investigate this     agent acts as Alice  ✓
 Bob:   also check the funnel         agent acts as Alice  ✗  (should be Bob)
 Alice: now add an insight            agent acts as Alice  ✓  (by luck)

Changes

Every message the queue workflow processes rebinds the sandbox's MCP identity to that message's actor before the message is delivered:

 SlackAppMentionWorkflow                    tasks layer
 ───────────────────────                    ─────────────────────────────────────
 msg = queue.pop(0)                         rebind_sandbox_identity_for_user(run, actor)
 msg.per_message_identity = True  ────►       │
 (stamped by the workflow itself:             ▼
  no dispatcher can forget it)              actor == sandbox's current identity?
                                              ├─ yes, token fresh → no-op (2 cache reads)
 forward activity:                            ├─ yes, token stale → rotate (same user)
   JWT minted for actor                       └─ no → IDENTITY TRANSITION:
   rebind (best-effort, never                     mint OAuth token FOR ACTOR,
    blocks the message)                           push configs into the live session
   send message                                   (send_refresh_session), record mark

The transition check is what makes ping-pong threads correct: after Bob's turn, Alice's next message is detected as a swap back and always refreshes — "actor == creator" alone is no proof the sandbox is currently authed as the creator.

How the sandbox's current identity is tracked — two self-expiring cache entries, keyed by sandbox id:

 posthog_ai:sandbox-mcp-identity:{sandbox_id}            → user id   (7d TTL)
 posthog_ai:sandbox-mcp-token-issued:{sandbox_id}:{uid}  → True      (3h TTL)

 run r1 ────────────────────────────────────────────────────────────►
 sandbox sb-1                    ✂ retry /      sandbox sb-2
 [marks: mcp=Bob]                  restore      [marks: ∅]
                                                 ∅ ⇒ boot state = creator ✓
        └─ orphaned; nothing reads them          (nothing to clear, ever)

Keying by sandbox means a replacement sandbox (fresh provision, snapshot restore, mid-run workflow retry) starts unmarked by construction — it boots with creator credentials and the cache agrees, with zero clearing code. Absence always means "assume boot state", so an evicted entry degrades to one extra refresh, never to wrong behavior.

Everything is gated to the queue workflow: the legacy per-message workflow leaves per_message_identity False and keeps creator-bound credentials exactly as today. Rebinds are best-effort by contract — a failure logs and the message still goes through under the previous identity.

How did you test this code?

Automated only; the two-user Slack thread verification is planned as part of the queue-workflow dev rollout (the identity transitions are fully visible in worker logs: refresh_mcp_identity_transition / refresh_mcp_delivered).

• test_send_followup_to_sandbox.py: identity transitions bypass the freshness rate limit; switching back to the creator refreshes (the ping-pong case); same-identity messages inside the window are no-ops; failed pushes don't record marks; no-config hosts don't re-mint per message.
• test_followup_forwarding.py: same-user and cross-user followups rebind to the right actor; test_legacy_dispatch_keeps_creator_identity pins the flag-off path byte-identical to master (creator JWT, zero rebind calls).
• Queue workflow tests (real Temporal server) assert every processed message arrives at activities with per_message_identity stamped True.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

Docs update

N/A, internal credential mechanics behind the queue-workflow flag.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Authored with Claude Code, starting from an unmerged June branch of Vojta's that re-authed MCP for cross-user followups; adapted so every message rebinds with the tasks layer detecting transitions (fixing ping-pong), and gated after review showed the shared activity would otherwise change legacy-workflow behavior. Three /simplify passes shaped the final form — the notable ones: identity marks re-keyed from run id to sandbox id (deleting all creation-path clearing code), cache-key composition moved inside the helpers after a hand-built key at one call site silently orphaned the boot-time rate-limit mark, and the per_message_identity stamp moved from the dispatch branch into the workflow loop so future dispatchers can't forget it. Split out of a combined MCP+GitHub PR; the GitHub/git-author half is stacked as #70024. Known boundaries, deliberate: identity lives in cache rather than TaskRun.state (eviction degrades safely to creator); web/PostHog-Code followups still rebind to the task creator — acceptable today because task control there is creator-only, and a named follow-up if web multiplayer opens up.

[trunk-io]

     

View Full Report ↗︎ ⋅ Docs

[github-actions]

🤖 CI report

ℹ️ ClickHouse migration SQL — 1 migration(s)

ClickHouse migration SQL per cloud environment

• unset
  • all

    DROP TABLE IF EXISTS property_values_mv

    CREATE MATERIALIZED VIEW IF NOT EXISTS property_values_mv
    TO property_values
    AS SELECT
        team_id,
        property_type,
        property_key,
        property_value,
        property_count,
        coalesce(_timestamp, now()) as last_seen
    FROM posthog_test.kafka_property_values

• US, EU
  • aux

    DROP TABLE IF EXISTS property_values_mv

    CREATE MATERIALIZED VIEW IF NOT EXISTS property_values_mv
    TO property_values
    AS SELECT
        team_id,
        property_type,
        property_key,
        property_value,
        property_count,
        coalesce(_timestamp, now()) as last_seen
    FROM posthog_test.kafka_property_values

• DEV
  • data

    DROP TABLE IF EXISTS property_values_mv

    CREATE MATERIALIZED VIEW IF NOT EXISTS property_values_mv
    TO property_values
    AS SELECT
        team_id,
        property_type,
        property_key,
        property_value,
        property_count,
        coalesce(_timestamp, now()) as last_seen
    FROM posthog_test.kafka_property_values

[VojtechBartos]

Closing as superseded. #66212 landed the actor bookkeeping this PR carried (run-state actor, actor-aware token minting, fail-closed Slack policy), and #70454 carries the remaining piece: making the live sandbox MCP session follow actor transitions.