Skip to content
- Slack sends an event to
/api/webhooks/slack.
- Junior validates and routes the event.
- Thread work is enqueued to
junior-thread-message.
/api/queue/callback processes queued work.- Agent turn runs with configured tools, loaded skills, and capability gates.
- If sandbox traffic reaches a declared provider domain, the sandbox egress proxy lazily fetches requester-bound credentials and injects them at the host boundary.
- If OAuth is required, Junior sends the link privately to the requesting user and resumes the blocked request after the callback.
- Reply is posted back to the original Slack thread.
- Avoids long-running webhook request paths.
- Makes retries explicit and observable.
- Preserves thread execution invariants in background turns.
- Webhook ingress and queue callback are both required for production.
- Tool usage is turn-scoped; sandbox credential leases are requester-bound and minted lazily only after forwarded provider traffic needs them.
- Registered plugin providers determine which provider credentials can be injected for matching provider domains.
- Failure states are logged and surfaced for operator recovery.