# EKKA Slack app manifest
#
# Paste this at https://api.slack.com/apps → Create New App → From a manifest.
# Full instructions: https://docs.ekka.ai/connect-slack/
#
# You are creating this app in YOUR OWN workspace. The bot token it produces
# stays on your machine, in your Enclave's encrypted vault.

display_information:
  name: EKKA
  description: Governed AI agents that read and post in Slack, with a signed receipt for every action.
  background_color: "#1b3d75"
  long_description: >-
    EKKA runs AI agents against your own systems under permissions you grant
    explicitly, and produces a signed, verifiable receipt for every action they
    take. This app gives an EKKA agent a bot token for your workspace so it can
    read channels and post messages. The token is stored in your Enclave's
    encrypted vault on your own machine and is never sent to EKKA. Which agent
    may use it, and which channels it may reach, are decided by grants you
    control and can revoke at any time.


    Rename this app and swap its icon if you would rather it looked like your
    own tool. Nothing in EKKA depends on either. Powered by EKKA (ekka.ai)

features:
  bot_user:
    # Lowercase, digits, `-`, `_` and `.` only. Slack rejects anything else here.
    display_name: ekka
    always_online: false

oauth_config:
  scopes:
    bot:
      # EXACTLY the four operations EKKA's Slack catalog entry declares, and
      # nothing else. A scope you do not need is a permission somebody has to
      # justify later, and Slack names the missing one for you if you get it
      # wrong: a call without its scope answers ok=false with `missing_scope`.
      - chat:write # postMessage    → chat.postMessage
      - channels:read # listChannels   → conversations.list
      - channels:history # channelHistory → conversations.history
      - users:read # listUsers      → users.list

      # OPTIONAL, and left out on purpose. Add one only when you want what it
      # buys, then reinstall the app to apply it:
      #
      #   groups:read      list private channels too
      #   groups:history   read history in private channels too
      #   chat:write.public
      #                    post to a PUBLIC channel without inviting the bot
      #                    first. Without it, invite the bot to the channel.
      #
      # Private channels always require inviting the bot, whatever the scopes.

settings:
  org_deploy_enabled: false
  socket_mode_enabled: false
  # MUST STAY FALSE. Rotation makes the bot token expire, and EKKA's API gate
  # holds a static credential, so a rotated token would start failing with no
  # signal other than calls that used to work and no longer do.
  token_rotation_enabled: false
