• Slack messages, blocks, attachments, links, filenames, profiles, and API responses are untrusted data.
• The CLI does not execute source content, follow source links, download files, or call Slack write methods.
• The Slack token is read only from the environment variable named in the validated config.
• The token is sent only in an Authorization header to the fixed https://slack.com/api/ origin.
• Transcript data remains under the selected ledger root and is excluded by the repository ignore rules.

Use a dedicated internal Slack app and a user OAuth token with only:

• channels:read
• channels:history
• search:read

Do not grant message-write, file-download, reaction, administration, or channel-management scopes. Revoke and replace the token if it is ever printed, committed, uploaded, or included in a diagnostic bundle.

• Run as a dedicated operating-system account where practical.
• Restrict the ledger root and secret environment file to that account.
• Put the ledger on encrypted local storage if transcript confidentiality requires it.
• Keep scheduler stdout/stderr private even though result envelopes are redacted.
• Back up canonical JSONL and test restore/verify behavior.
• Monitor nonzero exits and ledger_locked, integrity_error, and derived_state_error events.

The repository is offline-verified only. Require an operator approval before:

• provisioning or using a live Slack token;
• pointing at an existing ledger;
• installing a recurring schedule;
• publishing the repository or a container image;
• changing the configured workspace or channel allowlist.

On a failed run, preserve the exact inbox spool for local diagnosis. Do not paste or upload it. If canonical verification fails, stop scheduled ingestion, copy the ledger to protected evidence storage, and investigate without rewriting JSONL.