A sequence of upstream fixes across identity, allowlists, progressive replies, deterministic human actions, and recovery after partial delivery.
Relevant to: AI platform and Microsoft Teams integration teams
Public open-source work contributed by a Digital Meld co-founder and accepted upstream. Source links go to the merged pull requests and their regression coverage.
Situation
Several failures sat at the Microsoft Teams delivery boundary. Valid events could be rejected when Microsoft identity formats did not align. Long replies could duplicate text after a mid-stream failure. Pairing notifications and Adaptive Card actions could lose the context required to complete a human-controlled step.
Constraints
Delivery sequence
Each upstream patch isolated one failure boundary, encoded the expected deterministic behavior, added regression coverage, and went through maintainer review before merge.
01
The allowlist path was followed from Microsoft Graph startup resolution to Bot Framework runtime events. The fix normalized the stored team key to the conversation identifier Teams actually supplies, with bounded fallback behavior when channel lookup fails.
02
Webhook validation retained issuer, signing-key, and audience checks while adding a strict Entra fallback for supported service tokens instead of weakening authentication to make valid events pass.
03
Progressive delivery became configurable, and the reply controller began carrying failure state plus streamed length so a fallback sends only the undelivered suffix after partial delivery.
04
Conversation references are stored before pairing returns, and Adaptive Card Action.Submit payloads enter an explicit handler instead of disappearing from the workflow.
Proof
Merged OpenClaw pull request #41838 documents the Graph and Bot Framework identifier mismatch, the bounded fallback, and six focused allowlist tests.
Boundary: Public upstream source. Tenant and client identifiers are not reproduced on this page.
View sourceMerged pull request #56631 adds a strict Entra service-token path while retaining issuer, JWKS, audience, and service URL checks, with focused authorization tests.
Boundary: Public upstream source; no token, tenant, or production traffic is included.
View sourceMerged pull request #56134 wires Teams block-streaming configuration through validation and dispatch, backed by the public targeted test run recorded in the PR.
Boundary: Public upstream source and synthetic tests only.
View sourceMerged pull request #59297 records the partial-stream failure mode and tests fallback delivery of only the remaining suffix.
Boundary: Public upstream source and synthetic response fixtures only.
View sourceMerged pull request #60431 adds an explicit handler and regression test for Adaptive Card Action.Submit activities that were previously dropped.
Boundary: Public upstream source and synthetic action payloads only.
View sourceMerged pull request #60432 stores the conversation reference before the pairing return path and verifies that behavior with a focused authorization test.
Boundary: Public upstream source and synthetic pairing fixtures only.
View sourceDecisions
Allowlist policy should compare the identifier present in the runtime event. Normalizing during resolution keeps the authorization check deterministic without widening the allowed set.
Supporting Entra-signed service tokens still requires verified issuers, signing keys, audience, and tenant context. A permissive fallback would solve delivery by weakening the trust boundary.
A fallback can only avoid duplicate user-visible output if it knows whether the stream failed and how much content was already delivered.
Pairing and card actions are explicit user events. Persisting their context and handling their payload directly keeps a human-controlled step inspectable and repeatable.
Verification
The merged patch covers conversation-ID resolution, team-only entries, missing General channels, and channel API failures.
Basis: Review the implementation and six focused tests linked from upstream pull request #41838 and its merge commit.
The merged patch covers the legacy Bot Framework path, strict Entra fallback, and all-validation-failed behavior.
Basis: Review the two targeted test files and 10-test result recorded in upstream pull request #56631.
Schema acceptance and dispatcher option mapping are covered for enabled, disabled, and unset configuration.
Basis: Review the public configuration and dispatcher tests plus the 438-test Teams extension run recorded in pull request #56134.
Regression cases cover partial delivery, failure before any delivery, and successful stream completion without duplicate fallback output.
Basis: Review the reply-stream controller tests and merged implementation in pull request #59297.
Focused tests cover Adaptive Card submission forwarding and conversation-reference persistence during pairing.
Basis: Review the public tests and merged implementations in pull requests #60431 and #60432.
Result
Basis: Direct review of merged pull request #41838, its focused regression tests, and upstream merge state.
This proves the implementation and regression contract, not every possible Microsoft tenant topology.
Basis: Direct review of merged pull request #56631 and its targeted issuer, JWKS, audience, and failure-path tests.
No token acceptance rate or production security outcome is claimed.
Basis: Direct review of the state-carrying implementation and synthetic regression cases in merged pull request #59297.
The result is a source-and-test observation, not a measured production reliability percentage.
Basis: Direct review of merged pull requests #60431 and #60432 and their focused tests.
Upstream merge shows maintainer acceptance; it does not by itself establish a service-level or business outcome.
Next step
We will tell you whether it belongs in Scope, Build, Operate, Transform, or nowhere in our delivery model.