umbrella: config-first parity — every platform section resolves config → env → default for ALL fields

[chaodu-agent]

Note

✅ COMPLETE (2026-07-13). All six platform sections shipped (#1381–#1385), docs landed, config-supplied L1 secrets feed the #1373 startup warning (test-pinned per platform), and the conformance guard (#1387) prevents env-first regression workspace-wide. The invariant holds everywhere: [section] config → PLATFORM_* env → default, config always wins.

Summary

Guarantee every platform has a complete first-class config section ([telegram], [line], [feishu], [googlechat], [wecom], [teams]) covering all of its settings — credentials, connection, and behavior — with the invariant:

Resolution order: [section] config value → PLATFORM_* env var → default. Config always wins; env is a fallback only. Never consult env without checking the section first.

Today only the trust fields (allow_all_users / allowed_users, from #1356's Phase 1 PRs) follow this. Platform credentials and connection settings are still env-only for five of six platforms.

Parity Status (updated 2026-07-13 — ALL PLATFORMS DONE 🎉)

Platform	Section	Config-first today	Env-only remaining
Telegram	[telegram]	✅ ALL fields (resolve() → ResolvedTelegram, bridged via apply_telegram_config)	— (reference pattern)
LINE	[line]	✅ ALL fields (#1381)	—
Feishu	[feishu]	✅ ALL 21 fields (#1385) + joined the per-platform trust registry	—
WeCom	[wecom]	✅ ALL fields (#1382)	—
Google Chat	[googlechat]	✅ ALL fields (#1383, incl. from_parts DRY refactor)	—
MS Teams	[teams]	✅ ALL fields (#1384)	—

Reference Pattern (Telegram — already compliant)

1. Core TelegramConfig with all fields Option<T> + resolve() applying config → TELEGRAM_* env → default per field (empty-string ${} expansion treated as unset)
2. Bridge struct (GatewayTelegramConfig) keeps openab-gateway free of an openab-core dependency
3. AppState::apply_telegram_config() overrides env-derived state after from_env
4. Env-only deployments keep working (fallback), config-only deployments work, mixed works — config wins per-field

Per-Platform Sub-Issues

Platform	Sub-issue	Scope
LINE	#1376	channel_secret, channel_access_token, webhook_path
Feishu	#1377	full [feishu] section (21 env vars; coordinate with #1357)
WeCom	#1378	credentials + connection (graduates from shared PlatformTrustConfig)
Google Chat	#1379	credentials + connection (same graduation)
MS Teams	#1380	credentials + connection (same graduation)

Shared Work

• Conformance guard (test(gateway): config-first conformance guard (#1375) #1387): workspace-wide source-scan test (openab-gateway/tests/config_first_conformance.rs) asserting every platform env var referenced in gateway/core/binary is in the canonical section-field mapping — negative-tested in all three locations; runs in the normal cargo test flow
• Docs: config-reference gains the full field tables per platform; per-platform docs show [section] as primary and env as fallback (feat(line): full [line] section — credentials + connection config-first #1381–feat(feishu): full [feishu] section — all settings config-first #1385)
• Config-supplied L1 secrets (line.channel_secret, feishu.encrypt_key, googlechat.audience) feed the feat(gateway): warn when webhook L1 auth is unenforceable (#1356 Phase 1) #1373 startup warning — each apply_*_config runs before warn_unenforceable_l1, test-pinned per platform (feat(line): full [line] section — credentials + connection config-first #1381, feat(googlechat): full [googlechat] section — credentials + connection config-first #1383, feat(feishu): full [feishu] section — all settings config-first #1385)

Refs

• Umbrella: umbrella: Phase 1 trust migration — per-platform [section] for all adapters #1356 (trust-field slices: feat(telegram): add allow_all_users/allowed_users to [telegram] config #1297, feat(trust): Phase 1 (slack) — L3 identity via shared gate #1363, feat(line): first-class [line] trust section (Phase 1) #1365, feat(trust): [wecom]/[googlechat]/[teams] first-class trust sections (Phase 1) #1366)
• Reference implementation: TelegramConfig::resolve() / apply_telegram_config (feat(telegram): add allow_all_users/allowed_users to [telegram] config #1297)
• Feishu section: feat(feishu): migrate Feishu trust config to first-class [feishu] section (Phase 1) #1357