reply
Answers in the thread
Direct answers for questions and context. Never creates a task, never asks for approval.
@tde what does the retry backoff look like in the sync worker?
SLACK
Mention @tde. Hardware you control does the work.
Two official Slack apps, one durable pipeline. TDE Assistant answers @tde mentions — and every change plan stops at a human gate. With Sync, that runs on your self-hosted TDE or a Machine you designate. With Enterprise, channel work runs on an Organization runtime included in the plan — always on, separate from every laptop. TDE Triage still reads your own noise locally and turns real demands into reviewable tasks.
- Sync or Enterprise
- Human gate on every change
- 0 bot tokens on your desktop
#eng-api · threadMOCKUP
FOUR ACTIONS
Every mention becomes exactly one thing.
Classification is a closed set of four literal policies. The Assistant never improvises a fifth behaviour.
read_only_run
Investigates, read-only
An async investigation on a harness — Claude, Codex, TDE or Ollama — forced read-only by the provider, with project-fenced connectors and zero secrets in the prompt. It posts the result; no task is created.
@tde why did the nightly build fail on the migration step?
clarify
Asks one question back
When the request is ambiguous, you get exactly one question back. Zero board mutation.
@tde can you improve the onboarding?
change
Plans, then waits for you
Creates or updates one task per thread with an explicit plan — and stays blocked until a human approves it.
@tde add rate limiting to the public API endpoints
FROM MENTION TO REPLY
One durable pipeline. Zero open ports.
A workspace admin installs TDE Assistant once from the public install link — no app to create, no secret to generate, no token to paste. Every @tde mention travels a signed, durable, idempotent path to a runtime that only ever dials out: your Sync host for personal use, or the Organization runtime when Enterprise is active.
No runtime online? The event waits durably — nothing is lost and nothing is guessed. Personal hosts reconnect with backoff; Enterprise Organization runtime is provisioned with the plan and stays on for channel work.
events.tde.sh → your machineLIVE PATH
@tde in a channel
Public and private channels where the bot was invited. Enterprise can map each channel to a project; DMs stay personal and never use the Organization runtime.
@tde
Signed event
Slack's Events API delivers to TDE's event service, which verifies the request signature before anything else runs.
x-slack-signature ✓
Durable queue
Every event is stored with a lease. A Slack redelivery gets the original answer back — never a duplicate task.
lease · redelivery-safe
Outbound WebSocket
Your Sync host or Organization runtime dials out to the router. It works behind NAT with zero open ports.
wss:// dial-out · NAT ok
Semantic classification
The message becomes exactly one of four actions: reply, read_only_run, clarify or change.
reply · read_only_run · clarify · change
Board
A change creates or updates one task per thread (TDE-N), with an explicit plan, blocked until a human approves — and stage updates can write back to the thread.
1 task / thread · human gate
Reply in the thread
The answer returns through the router. The bot token is encrypted on the server and never reaches any desktop.
AES-256-GCM · server-side
HUMAN GATE
The model never decides an approval.
Two ways to approve, one atomic gate. Both paths end at the same server-side check — inference is structurally locked out of the decision. On Enterprise, only configured approvers can pass the gate.
01
Buttons with an immutable binding
Approve plan and Reject are Block Kit buttons bound to a specific task_id and plan_id. A stale button can never approve a newer plan.
02
Written approval, parsed deterministically
Reply “approve” or “pode aprovar” in the same thread. A deterministic parser outside the inference path recognises approvals in English and Portuguese.
03
One task per thread
A change never fans out: it creates or updates a single task, with a plan of at most 8 steps, and waits.
Immutable binding
task_id: TDE-1873
plan_id: pl_09f2c4
Approve planReject
Phrases the parser accepts
“approve”“aprovar”“pode aprovar”“reject”“rejeitar”
Parsed by deterministic code, outside the model. The <@…> prefix is never stripped — a message aimed at a human never becomes a command.
THREADS ARE SESSIONS
Start in Slack. Continue in TDE.
Each Slack thread is a durable agent session on the runtime that owns it. Follow-ups in the thread don't need to repeat @tde — and you can pick up the same conversation in TDE's AI Chat when it runs on your Sync host.
01
One thread, one session
Thread context carries up to 30 messages; a session runs up to 30 turns.
02
Same conversation, both surfaces
Open the session in TDE AI Chat and keep going — same history, same agent, same machine.
03
Idempotent by construction
If Slack redelivers an event, it receives the original response — never a duplicate task.
TDE TRIAGE
Your own inbox, triaged on your own machine.
The second app is a local Bot. Every 15 minutes it polls your DMs, group messages and channels with your user token — stored in TDE's encrypted local vault, never on a server — and judges what is a real demand.
01
Local token, local vault
Your user token lives in ~/.tde/secrets.db, encrypted with a key held in your OS keyring. It never leaves the machine.
02
Demands become tasks
Real requests land in the Context stage of My Loop; new messages in the same thread become comments or notifications, never duplicate tasks.
03
Drafts, never posts
Triage never writes to Slack. The auto-provisioned slack-triage skill produces a draft reply for human review.
04
Hard budgets
50 messages per conversation and 10 AI calls per run — past that, a deterministic heuristic takes over. The first connection never triages channel backlog.
slack:C08…/1722Context
Customer asks how licensing works on air-gapped machines
✓ Draft ready for review — never auto-posted
TWO APPS, ONE OAUTH
Assistant and Triage, side by side.
Installing the Assistant in a workspace automatically backfills and links existing Triage identities — and vice versa. One OAuth covers both.
| Aspect | TDE Assistant | TDE Triage |
|---|---|---|
| Identity | Workspace bot app, installed once by an admin | Your own Slack user, connected via QR in TDE Browser |
| Token | Bot token encrypted on the server (AES-256-GCM); never reaches a desktop | User token in the encrypted local vault; never reaches a server |
| Runtime | Sync: your self-hosted TDE or chosen Machine. Enterprise: Organization runtime included with the plan | Local polling Bot, every 15 minutes |
| Trigger | @tde mention in a channel the bot was invited to; /tde tasks lists open cards | Cron; reads your own DMs, group messages and channels |
| Visible in Slack | Yes — replies in the thread as the bot | No — never posts, only drafts for your review |
SECURITY MODEL
Written for the paranoid reviewer.
The honest version, not the brochure version.
01
The bot token never ships
Encrypted server-side with AES-256-GCM and per-team AAD. No desktop ever holds it.
02
Signatures verified at the edge
Every event is validated against Slack's request signature before it touches the pipeline.
03
Project fence, always
Channel→project routing and MCP/sandbox fences keep each run inside one project. Relinking a channel never silently mixes two companies in one prompt.
04
Roles on Enterprise
Personal Sync still authorizes the linked user. Enterprise lets workspace members request; only configured approvers can approve mutations. DMs never use the Organization runtime.
05
Text is data, not instructions
Slack content is treated as data, an explicit anti-prompt-injection stance. The <@…> prefix is never stripped.
06
Read-only fails closed
Investigations run on harnesses forced read-only by the provider, with project-bound connectors and no secrets in the prompt.
07
One primary, fenced
Personal Sync keeps a single Assistant host. Enterprise Organization runtime owns org channel traffic — laptops on the same license do not compete for those events.
Do I need to create a Slack app?
No. TDE Assistant is a distributed app: a workspace admin installs it once from the public install link. You never create an app, generate a secret or paste a token — and installing doesn't require TDE Desktop or a license.
Sync or Enterprise — what runs @tde?
With Sync, @tde runs on your self-hosted TDE or a purchased Machine you set as Assistant host. With Enterprise, channel mentions run on an Organization runtime Machine included in the plan (always on). DMs stay personal and never use that runtime.
Can I DM the bot?
DMs stay on the personal Sync path when enabled for your account — they never route to the Organization runtime. Day-to-day team work is designed for channels where the bot is invited.
What about multiple machines?
Connect as many Sync devices as you like; one personal Assistant host is authoritative. Enterprise adds a separate Organization runtime for org channels — it does not replace your laptop fleet.
Is /tde tasks available?
Yes. In channels where the Assistant is installed, /tde tasks lists open Board cards for that channel. Stage transitions can also write back to the originating thread.
TDE FOR SLACK
Put a runtime you control behind your mentions.
Install TDE, connect Slack once, and every @tde becomes accountable work behind a human gate — on your Sync host or the Organization runtime included with Enterprise.