fix(teams)!: harden Bot Connector transport

[NeoHsu]

Important

Stacked draft: logical base stack/teams-01a-fail-closed-dispatch is PR #1491. GitHub requires an upstream PR base to exist in openabdev/openab, so this draft temporarily targets main and may show preceding stack layers. Do not merge it until #1491 is merged and this branch is rebased onto current main; then review only its single incremental commit.

What problem does this solve?

Make Teams public-cloud Bot Connector transport fail closed, bounded, and safe against credential or endpoint disclosure.

Discord Discussion URL: https://discord.com/channels/1491295327620169908/1491365158868619404/1531339032527765655
Microsoft Teams roadmap discussion.

Review Contract

Goal

Make Teams public-cloud Bot Connector transport fail closed, bounded, and safe against credential or endpoint disclosure.

Non-goals

Sovereign-cloud endpoint profiles, Graph APIs, automatic ambiguous-write retries, and route persistence are not included.

Accepted Residual Risks

Only the Microsoft public-cloud Connector allowlist is accepted. Timeouts and ambiguous responses become Unknown and may leave the platform state uncertain; no blind retry is attempted.

Acceptance Criteria

Unsafe URLs and redirects are rejected before credential use; tokens, secrets, service URLs, and raw bodies are redacted; OAuth/JWKS requests are bounded; explicit HTTP outcomes are classified consistently; tests and compilation pass.

Follow-ups

Add reviewed sovereign-cloud profiles and broader endpoint policy only with authoritative Microsoft documentation and dedicated tests.

At a Glance

Authenticated Teams activity / operator target
                    │
                    ▼
            [this PR’s bounded layer]
                    │
                    ▼
          explicit outcome or fail-closed stop

Prior Art & Industry Research

OpenClaw: its Microsoft Teams extension separates access checks, Bot Framework route context, and outbound operations. For this slice the relevant comparison is Bot Framework service-URL validation, outbound transport, and credential isolation.

Hermes Agent: its Teams platform adapter keeps Teams-specific transport and message shaping behind a platform adapter. It does not provide OpenAB’s negotiated Core/Gateway outcome contract, so this PR keeps the useful adapter boundary but adds explicit fail-closed semantics.

Proposed Solution

• Harden Bot Connector URL validation, OAuth/JWKS caching, request bounds, redirects, and error redaction.
• Classify Connector responses into Delivered, Rejected, or Unknown.
• Serialize Gateway event failures without exposing sensitive transport details.

Why this approach?

A narrow public-cloud allowlist and explicit outcomes bound credential use and make ambiguous writes observable without creating duplicates.

Alternatives Considered

Accept arbitrary serviceUrl values (rejected: credential exfiltration risk) or retry every failure (rejected: duplicate activity risk).

Migration

This intentionally tightens previously permissive transport behavior. Existing Microsoft commercial/public-cloud deployments need no configuration change. Deployments using sovereign, private, proxy-rewritten, or otherwise non-allowlisted Connector endpoints must keep Teams disabled or defer this upgrade until a reviewed endpoint profile is available; do not bypass the URL policy.

Validation

cargo check -p openab-gateway --features teams