[Feature] Face-to-face group: Bots join one room by entering the same 6-digit number #83

Designed by FlyBot-designer with Danyang in the FlyBot room, 2026-10-15. Related: #50 (room membership), #51 (cross-owner routing), #5 (social).

Goal

Let people who are physically together (or on a call) put their Bots into one group by each typing the same 6-digit number on their own Bot, like WeChat "face-to-face group". There is no host and no friend request needed.

Flow

1. A user types a 6-digit number on their Bot. If no pending room exists for that number, the system opens a candidate room that lasts 10 minutes.
2. Anyone who types the same number within those 10 minutes joins that room directly, with no preview and no confirmation (decision by Danyang: having the code is enough). Right after joining they see the full member list (<Bot name> · <owner>'s Bot), and the page shows who is in the room in real time.
3. The room becomes a normal group when the 10 minutes end or when any member taps "Start chat". The number is then void and nobody else can join. All members are equal; there is no owner.

Rules

• Max 8 Bots per room. One owner may bring several Bots.
• A number maps to at most one candidate room at a time. If one is already open, a late joiner is simply added to it; there is no "is this your group?" prompt. At 8 Bots the number is refused; no second room is opened automatically. (Later: optional location/nearby filter to reduce accidental collisions.)
• Joining by number grants membership of that one room only. It does not create friendships and does not expose the member's other Bots.
• Unpublished Bots may join this one room. When one joins, the room gets a system message saying so ("'s Bot joined; not published, available to this room only"). This does not conflict with [Team] Gate cross-owner agent routes by per-Bot grants (default deny; superseded the publication gate) #51: access is scoped to the room and ends when the room closes.
• Member display, attribution and history window follow [Team] Add human and Chief membership to native rooms #50: new members only see messages from their join point.
• Bot replies in the room go through each owner's existing approval rules; with auto-approve off they are held until the owner approves.
• Because nothing is previewed before joining, the safeguards are after the fact: the member list is shown immediately on joining, every member can leave with one action, and the room gets a system message "'s Bot joined" for every join.

Security (must be addressed in the design)

6 digits is a small space. Needed: per-IP and per-account rate limits on number attempts, a lockout after repeated wrong/unknown attempts, number entry only creates or joins a room (it never reveals room contents before joining), no reuse of a number while a candidate room for it is open, audit trail of who joined and when, and a way for any member to leave and for the system to close the room early. Member names shown after joining and in system messages come from published records only, with peer-controlled strings sanitized (see #75). The 8-Bot cap and the one-candidate-room-per-number rule are enforced server-side.

Out of scope

Location/nearby matching, QR codes, persistent rooms beyond normal groups, cross-owner task execution.

Acceptance

• Two or three people on separate FlyBot instances enter the same number and end up in the same room with correct Bot · owner display.
• Entering a valid number joins the room directly; the member list appears immediately and a "joined" system message is posted.
• Number expires after 10 minutes or on "Start chat"; later attempts fail.
• The 9th Bot is refused and no second room is created; brute-force attempts are rate limited and tested.
• Non-members cannot read or post; joined members only see messages after joining.
• Unpublished Bots are not visible outside the room.

Delivery

One focused implementation PR (design doc first if the matching service needs a Bot Social server change). Depends on #50. Keep team mode disabled until its authorization gates pass.