Epic: Chat bots (Teams, Slack, Discord, GitHub, Linear) #19

Goal

Answer questions where the team works, with cited sources, behind one adapter contract. Bots run inside waymark serve (#95), answer with each asker's permissions (#97) and use the optional LLM provider (#89); without an LLM they reply with the best sources.

Issues

Order: #101 (can start once #89 lands) → #102 (after epic #18's #93-#95 and #97) → #103-#107 in parallel.

Conventions for every issue

• Each platform uses its own "Waymark Bot" identity with write scopes; connector identities stay read-only (ADR-0002).
• Unlinked platform users are denied by default (bots.unlinkedUsers: "deny"); link with waymark user link <name> <platform> <id>.
• Acknowledge inside the platform deadline before any search/LLM work; verify every webhook signature on the raw body.
• Retrieved documents are untrusted data in prompts (OWASP LLM01); answers keep only source URLs.
• Fake platform seams in tests; one manual check per platform on an account the maintainer chooses (result in the PR, no content).
• New runtime dependencies allowed only where named: @slack/bolt (Slack bot: answer @mentions and DMs over Socket Mode (no public URL) #103), @microsoft/teams.apps (Microsoft Teams bot via the Teams SDK, hosted inside waymark serve #104).

Definition of done

• The same question asked in Slack, Teams, Discord, a GitHub issue and Linear returns the same cited sources for the same linked user.
• A user without access to a source never gets it cited in any bot.
• docs/bots.md covers setup per platform, linking users and privacy.

Evidence

• Slack Socket Mode: https://docs.slack.dev/apis/events-api/using-socket-mode ; Bolt for JS: https://docs.slack.dev/tools/bolt-js/
• Teams SDK: https://learn.microsoft.com/en-us/microsoftteams/platform/teams-sdk/ (Bot Framework SDK archived: https://github.com/microsoft/botbuilder-js)
• Discord Gateway (mentions and DMs without the privileged message-content intent): https://docs.discord.com/developers/events/gateway
• GitHub webhooks: https://docs.github.com/en/webhooks/webhook-events-and-payloads
• Linear agents: https://linear.app/developers/agents