opentag

# OpenTag ## Supported route ```text Slack Source App -> self-hosted Control Plane -> paired local Runner -> ACP Agent in one local checkout -> GitHub Project Target/publication -> truthful result in the originating Slack thread ``` Slack is the only Source App. GitHub is the Project Target and publication/evidence provider. The Control Plane owns Slack ingress, custody, and projection; the Runner owns local execution. ## Load the needed reference - Compose deployment, Slack bootstrap, TLS, or pairing authority: `references/control-plane.md` - Slack app URLs, events, scopes, channel binding, or missing mentions: `references/slack-setup.md` - GitHub target, local checkout, publication, or readback: `references/github-setup.md` - Codex or another supported ACP executor: `references/codex-runner.md` - Any failed readiness, pairing, Run, or delivery step: `references/troubleshooting.md` Load only the references whose branch applies. ## Guardrails - Pair only with the exact HTTPS Control Plane origin the user operates or explicitly trusts. - Keep Slack signing and bot secrets in Control Plane secret files. Its `.env` contains only their host-side file paths and non-secret Slack identifiers. - Enter the bootstrap pairing authority and GitHub token through local secret input. Keep them out of chat, command arguments, logs, screenshots, and git. - The ACP Agent edits only the assigned local checkout. OpenTag performs Slack delivery and GitHub publi...