feat(teams): add metadata-first attachment ingress

[NeoHsu]

Important

Stacked draft: logical base stack/teams-07-progressive-response is PR #1499. GitHub requires an upstream PR base to exist in openabdev/openab, so this draft temporarily targets main and may show preceding stack layers. Do not merge it until #1499 is merged and this branch is rebased onto current main; then review only its single incremental commit.

What problem does this solve?

Allow trusted Teams turns to materialize bounded image and text attachments only after all admission gates pass.

Discord Discussion URL: https://discord.com/channels/1491295327620169908/1491365158868619404/1531339032527765655
Microsoft Teams roadmap discussion.

Review Contract

Goal

Allow trusted Teams turns to materialize bounded image and text attachments only after all admission gates pass.

Non-goals

Arbitrary binary files, Graph/RSC downloads, Office document parsing, outbound files, and default enablement are excluded.

Accepted Residual Risks

Some Teams client upload paths require a separately packaged manifest capability; unsupported or oversized attachments are represented as bounded rejected metadata rather than downloaded.

Acceptance Criteria

The feature is default off on both processes; metadata crosses first; denied events and recognized commands cause no download; auth never crosses into Core; redirects cannot forward Bot credentials cross-origin; budgets and single-use claims are enforced.

Follow-ups

Validate the separately packaged supportsFiles tenant path and add new file classes only with explicit media/security policy.

At a Glance

Authenticated Teams activity / operator target
                    │
                    ▼
            [this PR’s bounded layer]
                    │
                    ▼
          explicit outcome or fail-closed stop

Prior Art & Industry Research

OpenClaw: its Microsoft Teams extension separates access checks, Bot Framework route context, and outbound operations. For this slice the relevant comparison is authenticated inbound attachment handling and deferred media access.

Hermes Agent: its Teams platform adapter keeps Teams-specific transport and message shaping behind a platform adapter. It does not provide OpenAB’s negotiated Core/Gateway outcome contract, so this PR keeps the useful adapter boundary but adds explicit fail-closed semantics.

Proposed Solution

• Add default-off metadata-first Teams image and UTF-8 text attachment ingress.
• Defer download/materialization until Core trust and command admission complete.
• Enforce origin, redirect, type, count, and byte limits without exposing Microsoft credentials to Core.

Why this approach?

Metadata-first admission ensures Microsoft credentials and bytes stay outside Core until trust and command gates have completed.

Alternatives Considered

Download in Gateway before Core admission (rejected: untrusted resource use) or use Graph/RSC (rejected: expands permissions and secret scope).

Validation

• cargo check -p openab-core
• cargo check -p openab-gateway --features teams