The Slack integration
On 2026-07-12 this operator’s Slack workspace got the Claude-in-Slack integration — executed on a personal claude.ai org (Max 20x), which means the legacy per-user path: the app answers as the operator’s own account, powered by that account’s personal connectors. The live bot said it itself, verbatim: “Using the legacy Claude in Slack bot. Ask your Claude workspace owner to enable Claude Tag.” Full Claude Tag (channel agent identity, Access bundles, spend limits) stays gated on a Team/Enterprise org — the roadmap below is honest about that line.
The architecture, as it actually runs
Solid nodes/edges: live-verified 2026-07-12 (evidence lines in the manifest). Dashed: blocked — Claude Tag on the Team-plan gate, cloudflare MCPs ×3 on an operator-only sign-in. Two GitHub apps on purpose, never collapsed: the Claude GitHub App (code path, all repos) and GitHub’s Slack notification app (A01BP7R4KNY, scoped to one repo). Status totals from the manifest: 7 connected_personal · 2 connected · 1 blocked_on_team_plan · 3 blocked_on_operator_signin · 11 runbook_only (24 rows).
Checklist — shipped vs. left on the table
Shipped (evidence-backed)
- ✓Claude for Slack app installed, personal account auto-linked (legacy per-user mode)smoke test in #subagentjobs returned a real summary prefixed “Using the legacy Claude in Slack bot…”
- ✓Routing Mode set to Code + Chat; Model Opus (app Home tab)zoomed screenshot of the selected radio, 2026-07-12
- ✓GitHub app for Slack (A01BP7R4KNY): GitHub-side app installed, scoped to subagentjobs only“✅ Subscribed to opencoworkers/subagentjobs — issues, pulls, commits, releases, deployments”
- ✓Claude GitHub App verified on the org — no change neededgh api: installation 139154836, repository_selection=all
- ✓Connectors added: notion, stripe (read-only, test sandbox), vercel, subagentapi.com/mcp“Connected to …” toasts + tool discovery (Get API Catalog)
- ✓Pre-existing connectors verified, not duplicated: google ×3, atlassian rovo, slack, github integrationconnectors panel inventory, 2026-07-12
- ✓Durable layer: 24-row typed manifest + status-check gate, subagentcowork.com/claude-tag-deployment, 2 identity rows, contract, memory v3, handoffcurl 200 + D1 SELECTs after apply
- ✓bigquery.md mirror gap closed — live guide fetched and mirrored verbatim, DocEntry + hashes regenerated, manifest row flippedOODA run 2026-07-12: gen-hashes 53 entries/0 missing; status-check 24 rows/0 failures; routed to claude-sonnet-5
- ✓Datadog wiring de-risked to one OAuth: official remote MCP endpoint verified (mcp.datadoghq.com/api/unstable/mcp-server/mcp, preview) + live claude.com/connectors/datadog listing; runbook written (datadog-wiring.md)OODA run 2026-07-12: unauthenticated probe 401 Unauthorized + RFC 9728 oauth-protected-resource doc; routed to claude-sonnet-5
- ✓DM re-test executed — verified negative: the legacy bot answered neither DM (15:33, 18:45); channel mentions are the working path, Home-tab New chat is the documented DM alternativeOODA run 2026-07-12: two unanswered sends in D0BF5V3ET29, read back via the Slack connector
Not implemented (each with its gate)
- □Claude Tag proper: workspace pairing (@Claude connect), Access bundles, channel agent identity, spend limitgate: Team/Enterprise org
- □Domains-tab zero-credential allowlist of family hosts (planned; personal orgs have no bundles)gate: Team/Enterprise org
- □Per-channel scopes, shared channel memory, routines/channel watching, plugins from a skills repogate: Team/Enterprise org
- □Cloudflare MCP reconnects ×3 (ai_gateway, container, workers_builds)gate: operator sign-in
- □Per-connector fresh-chat verification pass (DM half is closed as a verified negative; the in-app-directory Datadog check rides along)gate: operator-interactive
- □Datadog OAuth click-through (endpoint + directory listing verified; note the us5-site endpoint form is undocumented — flagged in the runbook) and 9 more runbook_only servicesgate: operator OAuth
- □Dedicated per-service accounts (claude@… pattern) — only meaningful once bundles existgate: Team/Enterprise org
Roadmap — P0 / P1 / P2
cwc-product-management’s feature-spec tiers: P0 = the problem isn’t solved without it and nothing blocks it; P1 = gated on the Team/Enterprise decision (an operator purchase, not engineering); P2 = explicitly deferred, written down now.
P0 — unblockable now
no plan change needed; do next
- Operator signs in to dash.cloudflare.com → reconnect the 3 Cloudflare MCPs
- Fresh-chat verification pass per connector (DM half closed 2026-07-12 as a verified negative — channel mentions are the working path)
- Datadog: one OAuth via the in-app directory or the verified endpoint — runbook at claude-tag-slack-runbook/datadog-wiring.md
- Done 2026-07-12 (this lane's fourth item): bigquery.md backfilled, hashes + manifest + TOML flipped
P1 — gated on Team/Enterprise
the moment a Team org exists, run the skill's Team-plan sequence
- Pair the workspace: install link → @Claude connect → pairing code → admin-settings
- First Access bundle + dedicated service accounts per connected tool
- Domains-tab allowlist for the fleet's public APIs (zero-secret)
- Spend limit + usage balance; GitHub repos step per bundle
- Channel agent identity goes live → flip the seeded service_account identity row
P2 — post-Tag maturity
explicitly deferred; written down so nothing is rediscovered
- Routines + channel watching (proactivity); shared channel memory
- Per-channel scopes for elevated credentials; restrict-access governance (members, DM policy)
- Remaining runbook_only connectors: asana, gitlab, gong, hubspot, linear, pagerduty, salesforce, sentry, snowflake
- Per-connection audit-log verification cadence (test-it.md discipline)
Fact-check — the plan’s claims vs. observed reality
The session plan file drove this integration. Its claims were re-checked against what execution actually observed — six needed correcting, three held. The corrections are kept here deliberately: a plan that records where it was wrong is worth more than one that quietly rewrites itself.
| plan claimed | execution observed | |
|---|---|---|
| Plan: workspace is “brand-new and empty — one channel, no Claude app, no GitHub app installed” | Live Slack UI showed 5 channels, 10 pre-installed apps, and a prior 2026-07-05 Claude install (the MCP channel search had returned false empties) | corrected |
| Plan: mcp.stripe.com / mcp.vercel.com “connection failed — my recalled hostnames are wrong or stale — do NOT bake them” | Vendor docs confirmed exactly those hosts as the official endpoints; both OAuth’d successfully — the curl failures were false negatives, and the plan’s verify-at-execution instruction is what caught it | corrected |
| Plan: run /github subscribe in #all-opencoworkers | Executed in #subagentjobs — the operator’s prepared channel holding the 2026-07-05 connector-guide paste | corrected |
| Plan: the app prompts to link the claude.ai account “on first DM” | The account auto-linked during install — the Home tab already showed “✅ Connected to Claude” before any DM | corrected |
| Plan: Phase 3 installs the Claude GitHub App and grants subagentjobs | Already installed (139154836) with repository_selection=all — verified via gh api; zero changes made | corrected |
| Plan: verify each connector in a fresh chat, then re-verify from a Slack DM | NOT completed — the DM test got no reply in-session; carried as the P0 verification pass instead of being claimed done | corrected |
| Plan: legacy per-user path is the executable model on a personal org; Claude Tag is Team-gated | Held exactly — the live bot said “Using the legacy Claude in Slack bot. Ask your Claude workspace owner to enable Claude Tag.” and admin-settings said “Claude Tag is set up from a Claude Team or Enterprise workspace.” | held |
| Plan: treat subagentapi.com/mcp as an experiment — claude.ai may require SSE the endpoint deliberately 405s | Held with a good outcome — the connector worked; claude.ai discovered the real Get API Catalog tool over plain streamable HTTP POST | held |
| Plan: migration numbers 0004/0007 — “do not assume; verify by ls” | Numbers held after verification (0004_seed_slack_surface_identities.sql, 0007_seed_claude_tag_integration.sql); filenames differ from the plan’s sketch names — the verify-first instruction did its job | held |
P0 progress run slack-blockers-2026-07-12: decomposed into 15 task/subtask rows in
fact_ooda_tasks (durable-store migration 011, redis scratch keys for the fast path), authoring work
dispatched with no model param so the zero-token PreToolUse router resolved both agents to
claude-sonnet-5 (telemetry: route:queue → agent_dispatch_events). Outcomes above marked
“OODA run 2026-07-12”.
Snapshot sources: plugins/cwc-operations/skills/claude-tag-slack-runbook/claude-tag-connectors.toml
(the typed manifest, 2026-07-12) and the session plan file, cross-read at bake time. Live siblings:
subagentcowork.com/claude-tag-deployment (per-connector status table),
subagentidentities.com (the DM/channel identity duality),
subagentcontracts.com (ctr_claude_tag_integration, closes by human approval,
connector by connector). This page is a dated snapshot — it cannot observe claude.ai or Slack
state live, and says so rather than pretending.