fix(msteams): a proactive send keeps the buttons its result carries (#330)

Crew finding F6 from the #327 review, the one with a user-visible
consequence.

The courier rendered through `text_reply_message`, which drops every
interactive component. This feature exists to deliver a FINISHED
long-running operation back to the conversation that started it, and the
archetypal such result asks for approval — so the approval prompt
arrived as prose with nothing to click. The captured activity before the
fix, in full:

    {"conversation":{"id":"a:conv-1"},"from":{"id":"28:bot-1"},
     "recipient":{"id":"29:1abc"},
     "text":"The migration finished. Approve the cutover?",
     "textFormat":"plain","type":"message"}

The button is simply gone. A render error was worse still: the literal
text `(no content)`, posted with `result: ok`.

It now uses `build_reply_body` — the inbound reply path's own renderer.
That also closes the security half of the finding: `render_card_content`
binds each control's correlation token to (tenant, recipient), so a
proactively delivered card is a capability for its recipient rather than
for whoever can see it (#250/#287). The recipient is the stored
`user_id`.

Red first: `a_proactive_send_delivers_the_buttons_the_result_carries`
sends a result carrying an approval button and asserts the captured
activity contains it, carries a correlation token (`ct` — proof it went
through the SIGNING path rather than being rendered as decoration), and
never contains `(no content)`.

cargo test --workspace --no-fail-fast: 925 passed, 0 failed.

Author: jrosskopf

crates/triton-adapters-http/src/identity.rs

@@ -247,6 +247,7 @@ fn forwarded_email_principal(email: &str) -> Principal {
         raw_token: String::new(),
         trace_id: uuid::Uuid::new_v4().to_string(),
         sender_ref: None,
+        conversation_ref: None,
     }
 }
 
@@ -303,6 +304,7 @@ fn verify_dev_or_reject(token: &str, expected: &str) -> Result<Principal, Triton
         raw_token: token.into(),
         trace_id: uuid::Uuid::new_v4().to_string(),
         sender_ref: None,
+        conversation_ref: None,
     })
 }
 

crates/triton-adapters-http/src/rest.rs

@@ -1063,6 +1063,7 @@ mod trace_scope_tests {
             raw_token: String::new(),
             trace_id: "t".into(),
             sender_ref: None,
+            conversation_ref: None,
         }
     }
 

crates/triton-chat-discord/src/gateway.rs

@@ -436,6 +436,7 @@ impl DiscordGatewayAdapter {
             raw_token: String::new(),
             trace_id: uuid::Uuid::new_v4().to_string(),
             sender_ref: None,
+            conversation_ref: None,
         };
         let principal_for_post = principal.clone();
         let (tool, args) = route_command(content, &self.inbound_tool);

crates/triton-chat-discord/src/lib.rs

@@ -625,6 +625,7 @@ async fn handle_message_component(
         raw_token: String::new(),
         trace_id: uuid::Uuid::new_v4().to_string(),
         sender_ref: None,
+        conversation_ref: None,
     };
     let principal_for_post = principal.clone();
 
@@ -859,6 +860,7 @@ async fn handle_application_command(
         raw_token: String::new(),
         trace_id: uuid::Uuid::new_v4().to_string(),
         sender_ref: None,
+        conversation_ref: None,
     };
     let principal_for_post = principal.clone();
 
@@ -1185,6 +1187,7 @@ async fn handle_modal_submit(
         raw_token: String::new(),
         trace_id: uuid::Uuid::new_v4().to_string(),
         sender_ref: None,
+        conversation_ref: None,
     };
     let principal_for_post = principal.clone();
 

crates/triton-chat-googlechat/src/lib.rs

@@ -621,6 +621,7 @@ async fn serve_dashboard_png(
             raw_token: String::new(),
             trace_id: uuid::Uuid::new_v4().to_string(),
             sender_ref: None,
+            conversation_ref: None,
         };
         return match adapter
             .dispatcher
@@ -1271,6 +1272,7 @@ async fn handle_webhook(
         trace_id: uuid::Uuid::new_v4().to_string(),
         // #250: only under `upstream` — see Principal::sender_ref.
         sender_ref: identity_was_resolved_upstream.then(|| sender_name.to_string()),
+        conversation_ref: None,
     };
     let principal_for_post = principal.clone();
 

crates/triton-chat-identity/src/lib.rs

@@ -290,6 +290,7 @@ impl UpstreamResolver {
             // — so the resolver dispatch is auditable against the id it
             // was asked about, not only against the answer it gave.
             sender_ref: Some(sender_key.to_string()),
+            conversation_ref: None,
         };
         let args = serde_json::json!({ "platform": self.platform, "sender": sender_key });
         let dispatch = dispatcher

crates/triton-chat-msteams/src/lib.rs

@@ -1282,6 +1282,7 @@ fn make_principal(sub: &str, scopes: &[String], tenant: &str) -> Principal {
         raw_token: String::new(),
         trace_id: uuid::Uuid::new_v4().to_string(),
         sender_ref: None,
+        conversation_ref: None,
     }
 }
 
@@ -1328,9 +1329,9 @@ async fn dispatch_message(
             pick: None,
             conversation_ref: Some(conversation_reference_json(
                 verified.reply_base(),
-                activity,
                 &conversation_id,
                 &recipient_id,
+                &sender.from_id,
                 &sender.tenant,
             )),
         };
@@ -1649,9 +1650,9 @@ async fn handle_callback(
             .unwrap_or_default();
         let conversation_ref = Some(conversation_reference_json(
             verified.reply_base(),
-            activity,
             &conversation_id,
             &bot_id,
+            &sender.from_id,
             &sender.tenant,
         ));
         let key = triton_chat_routing::ConvKey::msteams(conversation_id, "", sender.sub.clone());
@@ -1822,7 +1823,18 @@ async fn dispatch_and_post_reply(
     // helper is here for when `upstream` lands, where the resolver
     // replaces the asserted identity and the raw id becomes the only
     // way to tell an impersonation from the victim's own session.
-    let principal = make_principal(&sender.sub, &sender.scopes, &sender.tenant);
+    let mut principal = make_principal(&sender.sub, &sender.scopes, &sender.tenant);
+    // T3 (async-ops): carry the Teams conversationReference into the agent's
+    // turn so a tool like `start_operation` can persist it and deliver a result
+    // back to this conversation later (the in-process embedded dispatch passes
+    // the Principal straight to the tool).
+    principal.conversation_ref = Some(conversation_reference_json(
+        verified.reply_base(),
+        conversation_id,
+        recipient_id,
+        &sender.from_id,
+        &sender.tenant,
+    ));
     let principal_for_post = principal.clone();
     // Direct render_report (the "Open report:" Execute): the chart URL
     // is minted from the INVOKED args — the result carries only a PNG.
@@ -2778,16 +2790,11 @@ const OUTBOUND_TOOL: &str = "outbound";
 /// `recipient`); `service_url` is the JWT-derived trusted reply base.
 fn conversation_reference_json(
     service_url: &str,
-    activity: &Activity,
     conversation_id: &str,
     bot_id: &str,
+    user_id: &str,
     tenant: &str,
 ) -> Value {
-    let user_id = activity
-        .from
-        .as_ref()
-        .map(|f| f.id.clone())
-        .unwrap_or_default();
     json!({
         // Self-describing: the delivery side (the agent's outbound-callback
         // receiver) routes to the matching triton adapter by this channel.
@@ -2929,13 +2936,33 @@ impl OutboundCourier for MsTeamsAdapter {
         // without them (crew review of #327).
         self.authorize(req, principal).await?;
         let r = Self::parse_outbound_reference(req)?;
-        let rendered = text_reply_message(&req.result);
-        let body = surface_mapper::build_activity_body(
+        // The SAME renderer the inbound reply path uses, not
+        // `text_reply_message`.
+        //
+        // This feature exists to deliver a FINISHED long-running operation
+        // back to the conversation that started it, and the archetypal
+        // such result asks for approval. `text_reply_message` drops every
+        // interactive component, so that prompt arrived as prose with
+        // nothing to click — and a render error became the literal text
+        // `(no content)` posted with `result: ok` (crew review of #327).
+        //
+        // `build_reply_body` also binds each control's correlation token
+        // to (tenant, recipient), which is what stops a proactively
+        // delivered card being a capability for whoever can see it
+        // (#250/#287). The recipient here is the stored `user_id`.
+        let chrome = fetch_chrome(self, principal).await;
+        let body = build_reply_body(
+            self,
             &r.bot_id,
             &r.conversation_id,
             &r.user_id,
-            &rendered,
-        );
+            &req.result,
+            None,
+            principal,
+            &chrome,
+            &r.tenant_id,
+        )
+        .await;
         let started = std::time::Instant::now();
         let outcome = post_activity_to(self, &r.service_url, &r.conversation_id, &body).await;
         let latency_ms = started.elapsed().as_millis() as u64;
@@ -3122,20 +3149,13 @@ mod tests {
     /// serviceUrl + tenant round-trip. This is the reference the host persists.
     #[test]
     fn conversation_reference_is_flattened_for_the_courier() {
-        let activity: Activity = serde_json::from_value(json!({
-            "type": "message",
-            "from": { "id": "29:user-alice" },
-            "conversation": { "id": "a:conv-1" },
-            "recipient": { "id": "28:bot-1" },
-            "text": "hi",
-        }))
-        .expect("activity");
-
+        // The caller flattens the inbound Activity: recipient (bot) → bot_id,
+        // from (user) → user_id.
         let r = conversation_reference_json(
             "https://smba.trafficmanager.net/emea/",
-            &activity,
             "a:conv-1",
             "28:bot-1",
+            "29:user-alice",
             "tenant-acme",
         );
         assert_eq!(r["channel"], "msteams");

crates/triton-chat-signal/src/lib.rs

@@ -386,6 +386,7 @@ impl SignalAdapter {
             raw_token: String::new(),
             trace_id: uuid::Uuid::new_v4().to_string(),
             sender_ref: None,
+            conversation_ref: None,
         };
         let (tool_name, args) = route_command(body, &self.inbound_tool);
         let principal_for_post = principal.clone();

crates/triton-chat-telegram/src/lib.rs

@@ -991,6 +991,7 @@ async fn process_update(adapter: Arc<TelegramAdapter>, update: TelegramUpdate) -
         trace_id: uuid::Uuid::new_v4().to_string(),
         // #250: only under `upstream` — see Principal::sender_ref.
         sender_ref: identity_was_resolved_upstream.then(|| sender_key.to_string()),
+        conversation_ref: None,
     };
 
     let chat_id = message.chat.id;
@@ -1253,6 +1254,7 @@ async fn handle_form_outcome(
                 trace_id: uuid::Uuid::new_v4().to_string(),
                 // #250: see Principal::sender_ref.
                 sender_ref: identity_was_resolved_upstream.then(|| sender_key.to_string()),
+                conversation_ref: None,
             };
             let principal_for_post = principal.clone();
             dispatch_and_render(
@@ -1515,6 +1517,7 @@ async fn handle_callback_query(
         trace_id: uuid::Uuid::new_v4().to_string(),
         // #250: only under `upstream` — see Principal::sender_ref.
         sender_ref: identity_was_resolved_upstream.then(|| sender_key.to_string()),
+        conversation_ref: None,
     };
 
     // For private chats the post-back chat_id equals `from.id`;

crates/triton-chat-twilio/src/rcs.rs

@@ -358,6 +358,7 @@ async fn process_message(
         raw_token: String::new(),
         trace_id: uuid::Uuid::new_v4().to_string(),
         sender_ref: None,
+        conversation_ref: None,
     };
 
     let (tool_name, args) = route_command(text, &adapter.inbound_tool);