feat: IM user mapping + base_id fix + executive SOUL template

IM User Mapping (SSM-backed):
- Backend: CRUD endpoints for /bindings/user-mappings (SSM read/write)
- Creating a mapping also writes SSM position for the tenant_id
- Frontend: new 'IM User Mappings' tab in Bindings page with
  add/delete UI, employee selector, channel picker

Agent Container fixes:
- server.py: fixed base_id extraction for 2-part tenant_ids
  (unknown__1484960930608578580 now correctly extracts 1484960930608578580
  instead of 'unknown')
- server.py: SSM user-mapping lookup tries multiple key formats
  (channel__userId, userId, full tenant_id)
- server.py: usage tracking reads resolved base_id from /tmp/base_tenant_id

New SOUL template:
- pos-exec (Senior Executive): full tool access except finance/HR data
  restrictions. For demo of role-based data scoping.

Author: JiaDe

enterprise/admin-console/server/main.py

@@ -609,9 +609,118 @@ def get_bindings(authorization: str = Header(default="")):
 def create_binding(body: dict):
     body.setdefault("status", "active")
     body.setdefault("createdAt", datetime.now(timezone.utc).isoformat())
+    # If channel user ID provided, write SSM mapping
+    channel_user_id = body.get("channelUserId", "")
+    channel = body.get("channel", "")
+    employee_id = body.get("employeeId", "")
+    if channel_user_id and channel and employee_id:
+        _write_user_mapping(channel, channel_user_id, employee_id)
     return db.create_binding(body)
 
 
+# =========================================================================
+# IM User → Employee Mapping (SSM-backed)
+# =========================================================================
+
+import boto3 as _boto3_main
+
+def _ssm_client():
+    return _boto3_main.client("ssm", region_name=os.environ.get("SSM_REGION", os.environ.get("AWS_REGION", "us-east-1")))
+
+def _mapping_prefix():
+    stack = os.environ.get("STACK_NAME", "openclaw-multitenancy")
+    return f"/openclaw/{stack}/user-mapping/"
+
+def _write_user_mapping(channel: str, channel_user_id: str, employee_id: str):
+    """Write SSM mapping: channel__user_id → employee_id"""
+    key = f"{channel}__{channel_user_id}"
+    path = f"{_mapping_prefix()}{key}"
+    try:
+        _ssm_client().put_parameter(Name=path, Value=employee_id, Type="String", Overwrite=True)
+    except Exception as e:
+        print(f"[user-mapping] SSM write failed: {e}")
+
+def _read_user_mapping(channel: str, channel_user_id: str) -> str:
+    """Read SSM mapping: channel__user_id → employee_id"""
+    key = f"{channel}__{channel_user_id}"
+    path = f"{_mapping_prefix()}{key}"
+    try:
+        resp = _ssm_client().get_parameter(Name=path)
+        return resp["Parameter"]["Value"]
+    except Exception:
+        return ""
+
+def _list_user_mappings() -> list:
+    """List all user mappings from SSM."""
+    prefix = _mapping_prefix()
+    try:
+        ssm = _ssm_client()
+        mappings = []
+        params = {"Path": prefix, "Recursive": True, "MaxResults": 50}
+        while True:
+            resp = ssm.get_parameters_by_path(**params)
+            for p in resp.get("Parameters", []):
+                name = p["Name"].replace(prefix, "")
+                parts = name.split("__", 1)
+                if len(parts) == 2:
+                    mappings.append({
+                        "channel": parts[0],
+                        "channelUserId": parts[1],
+                        "employeeId": p["Value"],
+                        "ssmPath": p["Name"],
+                    })
+            token = resp.get("NextToken")
+            if not token:
+                break
+            params["NextToken"] = token
+        return mappings
+    except Exception as e:
+        print(f"[user-mapping] SSM list failed: {e}")
+        return []
+
+@app.get("/api/v1/bindings/user-mappings")
+def get_user_mappings():
+    """List all IM user → employee mappings from SSM."""
+    return _list_user_mappings()
+
+class UserMappingRequest(BaseModel):
+    channel: str       # discord, telegram, slack, whatsapp
+    channelUserId: str  # platform-specific user ID
+    employeeId: str     # emp-carol, emp-w5, etc.
+
+@app.post("/api/v1/bindings/user-mappings")
+def create_user_mapping(body: UserMappingRequest):
+    """Create or update an IM user → employee mapping in SSM."""
+    _write_user_mapping(body.channel, body.channelUserId, body.employeeId)
+    # Also write position mapping for the tenant_id that H2 Proxy derives
+    emp = next((e for e in db.get_employees() if e["id"] == body.employeeId), None)
+    if emp:
+        pos_id = emp.get("positionId", "")
+        if pos_id:
+            # Write position for various tenant_id formats the proxy might derive
+            stack = os.environ.get("STACK_NAME", "openclaw-multitenancy")
+            ssm = _ssm_client()
+            for tenant_key in [body.employeeId, f"{body.channel}__{body.channelUserId}"]:
+                try:
+                    ssm.put_parameter(
+                        Name=f"/openclaw/{stack}/tenants/{tenant_key}/position",
+                        Value=pos_id, Type="String", Overwrite=True)
+                except Exception:
+                    pass
+    return {"saved": True, "channel": body.channel, "channelUserId": body.channelUserId, "employeeId": body.employeeId}
+
+@app.delete("/api/v1/bindings/user-mappings")
+def delete_user_mapping(channel: str, channelUserId: str):
+    """Delete an IM user → employee mapping from SSM."""
+    key = f"{channel}__{channelUserId}"
+    path = f"{_mapping_prefix()}{key}"
+    try:
+        _ssm_client().delete_parameter(Name=path)
+        return {"deleted": True}
+    except Exception as e:
+        raise HTTPException(500, str(e))
+
+
 # =========================================================================
 # Routing Rules — determines how messages are routed to agents
 # =========================================================================

enterprise/admin-console/server/soul-templates/positions/pos-exec/SOUL.md

@@ -0,0 +1,36 @@
+# Senior Executive — Digital Employee
+
+You are a Senior Executive at ACME Corp. You are a high-level decision maker with broad access to company operations.
+
+## Your Role
+- Strategic planning and business analysis
+- Cross-department coordination
+- Technology evaluation and architecture review
+- Team management and project oversight
+- Client engagement and partnership development
+
+## Personality
+- Direct, decisive, and results-oriented
+- You think strategically but can dive into technical details when needed
+- You communicate clearly and concisely
+- You respect data and evidence-based decisions
+
+## Tool Permissions
+You have access to: web_search, jina-reader, deep-research, shell, browser, file, file_write, code_execution, github-pr, excel-gen, crm-query, email-send, calendar-check, s3-files, notion-sync
+
+## Data Access Restrictions
+**CRITICAL: You MUST NOT access or discuss:**
+- Financial reports, budgets, revenue data, or any content from /finance/** paths
+- HR records, salary information, employee personal data, or any content from /hr/** paths
+- If asked about financial or HR data, explain that your role does not have access to these sensitive areas and suggest contacting the Finance or HR department directly.
+
+## Knowledge Scope
+You have access to: company-policies/, arch-standards/, runbooks/, case-studies/, customer-playbooks/
+You do NOT have access to: financial-reports/, hr-policies/, contract-templates/
+
+## Core Competencies
+- AWS architecture and cloud strategy
+- Agile/Scrum project management
+- Business case development and ROI analysis
+- Technical due diligence
+- Cross-functional team leadership

enterprise/admin-console/src/hooks/useApi.ts

@@ -469,3 +469,37 @@ export function useRoutingRules() {
     queryFn: () => api.get('/routing/rules'),
   });
 }
+
+// === IM User Mappings ===
+
+export interface UserMapping {
+  channel: string;
+  channelUserId: string;
+  employeeId: string;
+  ssmPath?: string;
+}
+
+export function useUserMappings() {
+  return useQuery<UserMapping[]>({
+    queryKey: ['user-mappings'],
+    queryFn: () => api.get('/bindings/user-mappings'),
+  });
+}
+
+export function useCreateUserMapping() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: (data: { channel: string; channelUserId: string; employeeId: string }) =>
+      api.post<{ saved: boolean }>('/bindings/user-mappings', data),
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['user-mappings'] }),
+  });
+}
+
+export function useDeleteUserMapping() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: (data: { channel: string; channelUserId: string }) =>
+      api.del<{ deleted: boolean }>(`/bindings/user-mappings?channel=${data.channel}&channelUserId=${data.channelUserId}`),
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['user-mappings'] }),
+  });
+}

enterprise/admin-console/src/pages/Bindings.tsx

@@ -1,7 +1,7 @@
 import { useState } from 'react';
-import { Link2, Plus, Users, User, GitBranch } from 'lucide-react';
+import { Link2, Plus, Users, User, GitBranch, Smartphone, Trash2 } from 'lucide-react';
 import { Card, StatCard, Badge, Button, PageHeader, Table, Modal, Select, Tabs, StatusDot } from '../components/ui';
-import { useBindings, useEmployees, useAgents, usePositions, useCreateBinding, useBulkProvision, useRoutingRules } from '../hooks/useApi';
+import { useBindings, useEmployees, useAgents, usePositions, useCreateBinding, useBulkProvision, useRoutingRules, useUserMappings, useCreateUserMapping, useDeleteUserMapping } from '../hooks/useApi';
 import { CHANNEL_LABELS } from '../types';
 import type { Binding, ChannelType } from '../types';
 
@@ -13,8 +13,15 @@ export default function Bindings() {
   const createBinding = useCreateBinding();
   const bulkProvision = useBulkProvision();
   const { data: routingRules = [] } = useRoutingRules();
+  const { data: userMappings = [] } = useUserMappings();
+  const createUserMapping = useCreateUserMapping();
+  const deleteUserMapping = useDeleteUserMapping();
   const [showCreate, setShowCreate] = useState(false);
   const [showBulk, setShowBulk] = useState(false);
+  const [showMapping, setShowMapping] = useState(false);
+  const [mapChannel, setMapChannel] = useState('discord');
+  const [mapUserId, setMapUserId] = useState('');
+  const [mapEmpId, setMapEmpId] = useState('');
   const [bulkPos, setBulkPos] = useState('');
   const [bulkChannel, setBulkChannel] = useState('slack');
   const [bulkResult, setBulkResult] = useState<any>(null);
@@ -80,6 +87,7 @@ export default function Bindings() {
             { id: 'shared', label: 'N:1 Shared', count: shared.length },
             { id: 'multi', label: '1:N Multi-Agent', count: multi.length },
             { id: 'routing', label: 'Routing Rules', count: routingRules.length },
+            { id: 'mappings', label: 'IM User Mappings', count: userMappings.length },
           ]}
           activeTab={activeTab}
           onChange={setActiveTab}
@@ -108,6 +116,36 @@ export default function Bindings() {
                 data={routingRules}
               />
             </div>
+          ) : activeTab === 'mappings' ? (
+            <div>
+              <div className="flex items-center justify-between mb-4">
+                <p className="text-sm text-text-secondary">Map IM platform user IDs to employee IDs. This tells the system which employee is behind each Discord/Telegram/Slack/WhatsApp account.</p>
+                <Button variant="primary" onClick={() => setShowMapping(true)}><Smartphone size={14} className="mr-1" /> Add Mapping</Button>
+              </div>
+              {userMappings.length === 0 ? (
+                <div className="text-center py-8 text-text-muted">
+                  <Smartphone size={32} className="mx-auto mb-2 opacity-50" />
+                  <p className="text-sm">No IM user mappings configured yet.</p>
+                  <p className="text-xs mt-1">Add mappings so the system knows which employee is behind each IM account.</p>
+                </div>
+              ) : (
+                <Table
+                  columns={[
+                    { key: 'channel', label: 'Channel', render: (r: typeof userMappings[0]) => <Badge color="info">{r.channel}</Badge> },
+                    { key: 'channelUserId', label: 'Platform User ID', render: (r: typeof userMappings[0]) => <code className="text-xs bg-dark-bg px-2 py-0.5 rounded">{r.channelUserId}</code> },
+                    { key: 'employeeId', label: 'Employee', render: (r: typeof userMappings[0]) => {
+                      const emp = EMPLOYEES.find(e => e.id === r.employeeId);
+                      return <span className="font-medium">{emp?.name || r.employeeId}</span>;
+                    }},
+                    { key: 'actions', label: '', render: (r: typeof userMappings[0]) => (
+                      <button onClick={() => deleteUserMapping.mutate({ channel: r.channel, channelUserId: r.channelUserId })}
+                        className="text-text-muted hover:text-danger transition-colors"><Trash2 size={14} /></button>
+                    )},
+                  ]}
+                  data={userMappings}
+                />
+              )}
+            </div>
           ) : (
             <Table columns={columns} data={tabData[activeTab] || []} />
           )}
@@ -242,6 +280,40 @@ export default function Bindings() {
           </div>
         )}
       </Modal>
+
+      {/* IM User Mapping Modal */}
+      <Modal
+        open={showMapping} onClose={() => { setShowMapping(false); setMapChannel('discord'); setMapUserId(''); setMapEmpId(''); }}
+        title="Add IM User Mapping"
+        footer={<div className="flex justify-end gap-3">
+          <Button variant="default" onClick={() => setShowMapping(false)}>Cancel</Button>
+          <Button variant="primary" disabled={!mapUserId || !mapEmpId || createUserMapping.isPending} onClick={() => {
+            createUserMapping.mutate({ channel: mapChannel, channelUserId: mapUserId, employeeId: mapEmpId }, {
+              onSuccess: () => { setShowMapping(false); setMapChannel('discord'); setMapUserId(''); setMapEmpId(''); },
+            });
+          }}>{createUserMapping.isPending ? 'Saving...' : 'Save Mapping'}</Button>
+        </div>}
+      >
+        <div className="space-y-4">
+          <p className="text-sm text-text-secondary">Map an IM platform user ID to an employee. This tells the system which employee is behind each IM account, so their agent gets the correct SOUL identity and permissions.</p>
+          <Select label="IM Channel" value={mapChannel} onChange={setMapChannel} options={[
+            { label: 'Discord', value: 'discord' },
+            { label: 'Telegram', value: 'telegram' },
+            { label: 'Slack', value: 'slack' },
+            { label: 'WhatsApp', value: 'whatsapp' },
+          ]} />
+          <div>
+            <label className="block text-xs font-medium text-text-secondary mb-1">Platform User ID</label>
+            <input value={mapUserId} onChange={e => setMapUserId(e.target.value)}
+              placeholder="e.g. 1460888812426363004 (Discord) or 987654321 (Telegram)"
+              className="w-full rounded-lg border border-dark-border bg-dark-bg px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-primary focus:outline-none" />
+            <p className="text-xs text-text-muted mt-1">Find this in the IM platform's user profile or from the pairing log.</p>
+          </div>
+          <Select label="Employee" value={mapEmpId} onChange={setMapEmpId}
+            options={EMPLOYEES.map(e => ({ label: `${e.name} (${e.positionName})`, value: e.id }))}
+            placeholder="Select employee" />
+        </div>
+      </Modal>
     </div>
   );
 }

enterprise/agent-container/server.py

@@ -136,12 +136,44 @@ def _ensure_workspace_assembled(tenant_id: str) -> None:
         logger.info("First invocation for tenant %s — assembling workspace", tenant_id)
 
         # Extract base employee ID for S3 paths
+        # Tenant ID formats:
+        #   port__emp-carol__bbee1f93  → base = emp-carol (Portal, 3 parts)
+        #   tg__emp-w5__a1b2c3d4      → base = emp-w5 (Telegram, 3 parts)
+        #   unknown__1484960930608578580 → base = 1484960930608578580 (Discord via H2 Proxy, 2 parts)
+        #   actions__a                 → base = a (H2 Proxy fallback, 2 parts)
+        #   emp-carol                  → base = emp-carol (direct)
         base_id = tenant_id
         parts = tenant_id.split("__")
         if len(parts) >= 3:
+            # channel__user_id__hash → take user_id (middle)
             base_id = parts[1]
-        elif len(parts) == 2 and len(parts[1]) > 10:
-            base_id = parts[0]
+        elif len(parts) == 2:
+            # channel__user_id → take user_id (second part, the actual identifier)
+            base_id = parts[1]
+
+        # Check SSM user-mapping for IM channel user IDs
+        # e.g., discord__1460888812426363004 → emp-carol
+        if not base_id.startswith("emp-"):
+            try:
+                import boto3 as _b3_mapping
+                ssm = _b3_mapping.client("ssm", region_name=AWS_REGION_RUNTIME)
+                # Try multiple mapping key formats
+                mapping_keys = [
+                    f"{parts[0]}__{base_id}" if len(parts) >= 2 else base_id,  # channel__userId
+                    base_id,  # just userId
+                    tenant_id,  # full tenant_id
+                ]
+                for mapping_key in mapping_keys:
+                    try:
+                        resp = ssm.get_parameter(Name=f"/openclaw/{STACK_NAME}/user-mapping/{mapping_key}")
+                        resolved = resp["Parameter"]["Value"]
+                        logger.info("SSM user-mapping resolved: %s → %s", mapping_key, resolved)
+                        base_id = resolved
+                        break
+                    except Exception:
+                        pass
+            except Exception as e:
+                logger.warning("SSM user-mapping lookup failed: %s", e)
 
         # 1. Sync tenant's personal workspace from S3 using BASE ID
         s3_base = f"s3://{S3_BUCKET}/{base_id}"
@@ -480,6 +512,16 @@ def _handle_invocation(self, tenant_id: str, message: str, payload: dict):
             parts = tenant_id.split("__")
             if len(parts) >= 3:
                 base_id = parts[1]
+            elif len(parts) == 2:
+                base_id = parts[1]
+            # Use resolved base_id from workspace assembly if available
+            try:
+                with open("/tmp/base_tenant_id") as f:
+                    resolved = f.read().strip()
+                    if resolved and resolved != "unknown":
+                        base_id = resolved
+            except Exception:
+                pass
             threading.Thread(
                 target=_write_usage_to_dynamodb,
                 args=(tenant_id, base_id, usage, model, duration_ms),

enterprise/patch_proxy_debug.py

@@ -0,0 +1,19 @@
+"""Patch bedrock_proxy_h2.js to add debug logging for message extraction."""
+import sys
+
+path = "/home/ubuntu/bedrock_proxy_h2.js"
+with open(path) as f:
+    code = f.read()
+
+old = "log(`Request: ${path}"
+new = """log(`DEBUG-SYS: ${JSON.stringify((parsed.system||[]).map(s=>typeof s==='string'?s:s.text||'')).slice(0,500)}`);
+      log(`DEBUG-MSG: ${userText.slice(0,300)}`);
+      log(`Request: ${path}"""
+
+if old in code:
+    code = code.replace(old, new, 1)
+    with open(path, 'w') as f:
+        f.write(code)
+    print("PATCHED OK")
+else:
+    print("Pattern not found — already patched or file changed")