Roll out and cut over the Telegram conversational MVP

[alexeygrigorev]

Roll out and cut over the Telegram conversational MVP

Status: in progress — automated repair accepted; HUMAN rollout pending
Tags: enhancement, assistant, backend, infra, testing, P1
Parent: #122
Depends on: #126/#127 automated slices on main; Gate A effective apply before
any new app deployment; corrected #131 review/integration/effective Gate B apply
before #128 commit/push
Blocks: Closing #122
Architecture: _docs/CONVERSATIONAL_AGENT_PLUGIN_ARCHITECTURE.md

Current review state

The frozen candidate at base
f08cfc750cebc601db8b71024168741f8ef4aadb is not accepted. Keep it
uncommitted and use it as the rework starting point.

Binding blockers:

• Assistant review:
  Roll out and cut over the Telegram conversational MVP #128 (comment)
• Architect review:
  Roll out and cut over the Telegram conversational MVP #128 (comment)

The six-control rollout, proposal/execution boundaries, legacy cutover,
readiness shape, redaction, and most of the frozen infrastructure graph passed
specialist review. Rework is deliberately limited to truthful heartbeat
monitoring, bounded ingress-off maintenance I/O, deterministic proofs, and the
resulting #131 graph/IAM correction.

Do not commit, merge, push, deploy, retrieve secrets, call Telegram/providers,
or apply AWS while these gates are open.

Product scope

Ship one private-Telegram conversational rollout for the two implemented
proposal capabilities:

• todo: propose, revise, explicitly approve, and create one actor-owned todo;
• Typefully: confirm typed public source, propose/revise, explicitly approve,
  and create one unscheduled/unpublished/unshared saved draft.

#126 continues to own todo/coordinator/outbox semantics. #127 continues to own
Typefully source, approval, account, request, result, and reconciliation
semantics. #128 owns only rollout integration, dark maintenance, readiness,
telemetry, deployment wiring, staged HUMAN verification, and switch rollback.

Exactly six deploy-owned controls

Expose exactly:

Telegram ingress: off | on
execution leasing: off | on
enabled plugins: none | todo | typefully | todo,typefully
Typefully external execution: off | on
voice: off | on
photo: off | on

One immutable strict snapshot accepts only canonical lowercase values and a
sorted unique plugin subset. All code, SAM, and workflow defaults are off.
Reject missing, whitespace-bearing, duplicate, unknown, retired, or
contradictory controls.

Derived behavior remains:

• runtime availability and result delivery follow Telegram ingress;
• todo visibility follows the todo plugin;
• todo dispatch requires execution plus todo;
• Typefully visibility follows the typefully plugin;
• Typefully dispatch requires execution, typefully, and Typefully external;
• voice/photo require ingress plus their individual switch.

Gates run before proposal approval, before lease, and after lease/before
dispatch. Disabling a capability preserves durable state, never interrupts an
already dispatched effect, and never makes an unknown effect retryable.
Typefully preview with external execution off permits revise/cancel/discard but
has no active approval or queue path.

Required rework 1 — truthful heartbeat monitoring

Keep the existing three fixed-key readiness heartbeat rows and the existing
three metric/alarm names. Treat the metric values as scheduled pulse-presence
signals; readiness continues to calculate stored heartbeat age separately.

Use this minimal design:

1. Add one rate(2 minutes) scheduled event to
   ConversationalExecutionWorkerFunction, enabled only by
   ConversationalExecutionIsEnabled, with a distinct fixed action such as
   conversational-execution-health-pulse.
2. The worker handler recognizes that action before stream/recovery work. It
   writes only the fixed execution_worker heartbeat and emits exactly
   ExecutionWorkerHeartbeatAgeSeconds = 0; it does not query/lease/recover an
   attempt, call a provider, retrieve a provider secret, or inspect queue
   traffic.
3. The existing recovery schedule remains rate(2 minutes) and emits exactly
   RecoveryHeartbeatAgeSeconds = 0 only after its scheduled invocation reaches
   the successful pulse point. Idle recovery is healthy.
4. The existing result-dispatcher schedule remains rate(1 minute) and emits
   exactly ResultDispatcherHeartbeatAgeSeconds = 0 after a successful
   bounded run. An empty outbox is healthy.
5. Only these three heartbeat alarms change to
   TreatMissingData: breaching. Retain Maximum, threshold > 300, 5-minute
   periods, two evaluation periods, and two datapoints to alarm. Successful
   fixed-zero pulses remain non-breaching; two missing periods can page a
   stopped schedule/function.
6. All other 14 alarms retain TreatMissingData: notBreaching. Disabled
   execution/ingress conditions still remove their heartbeat alarm and disable
   the related schedules, so an intentionally disabled component cannot page.

Do not add metric math, a monitoring Lambda, a fourth heartbeat alarm, another
metric namespace, or queue-traffic heuristics.

The new SAM schedule event will produce an additional EventBridge rule and
Lambda permission in the transformed template. Freeze their exact logical IDs,
condition/state, target, input, and function ownership. Gate A's accepted
deploy role already covers stack-prefixed EventBridge rule lifecycle/tagging
and worker Lambda Add/RemovePermission; do not add those actions to #131's
observability policy. #131 must add structural coverage proving that reuse.

Required rework 2 — bounded ingress-off maintenance

After webhook authentication but before JSON parsing:

• measure the raw update in UTF-8 bytes using the same 256 KiB maximum as
  the enabled adapter;
• reject an oversized update with 413;
• attempt no Telegram reply, conversation/model/media/plugin/domain/provider
  work, and do not parse the oversized body.

Every ingress-off maintenance or private-chat-redirect sendMessage attempt
must:

• use one fixed deadline no greater than 5 seconds through an AbortSignal;
• make at most one attempt and never retry an unknown send outcome;
• swallow timeout/network failure into the normal safe Telegram webhook
  acknowledgement so Telegram is not invited to repeat a possibly delivered
  reply;
• log only an allowlisted fixed event/error code, never token, URL, chat/update
  content, body, header, or stack trace.

Add deterministic tests with a non-returning fetch that observes abort within
the configured deadline and an oversized update that receives 413 with zero
reply/downstream calls. Retain positive proofs for authentication, private
maintenance, directed-group redirect, and at most one fixed reply.

Permanent Telegram and safety behavior

The legacy mutating Telegram fallback remains removed/unreachable. In all
states:

• /todo and /social are static guidance and never write directly;
• /podcast states that podcast creation is outside this MVP;
• /start, /help, /status, session controls, private identity, directed
  group redirect, unsupported-document failure, and reviewed media behavior
  remain as accepted;
• ingress off authenticates and performs only the bounded maintenance behavior
  above;
• rollback never restores a legacy handler or polling.

Readiness remains admin-only, exact-read/query-bounded, scan-free,
mutation-free, provider/secret-free, and redacted. Telemetry remains
fixed-cardinality and recursively safe.

Frozen application graph after rework

Refreeze from fresh source/build/transforms. The intended observability family
remains:

• one ConversationalRolloutAlarmTopic, encrypted with alias/aws/sns, ARN
  output only, no stack subscription/topic policy/contact;
• exactly three new 30-day retained custom log groups wired with
  LoggingConfig;
• exactly 17 named alarms and one topic action;
• the three heartbeat alarms use TreatMissingData: breaching; the other 14
  use notBreaching;
• no dashboard, composite, anomaly, canary, metric/filter/subscription, or
  additional observability resource.

The intended schedule family is:

• existing execution recovery schedule;
• new execution worker health-pulse schedule;
• existing result dispatcher schedule;
• their exact SAM-generated EventBridge rules and Lambda permissions.

The replacement #128 source and transforms, not the old #131 fixture, are
authoritative.

Acceptance criteria

• One immutable snapshot exposes exactly six controls, rejects invalid
  combinations, and keeps all defaults off.
• Plugin/external gates and durable todo/Typefully behavior retain the
  accepted Ship approved conversational todo creation #126/Ship approved Typefully saved-draft creation #127 boundaries.
• Legacy direct task/social/podcast/fallback mutation is unreachable and
  slash compatibility remains static.
• Ingress-off authenticates, enforces a 256 KiB pre-parse byte limit, and
  performs only one deadline-bounded maintenance/redirect attempt.
• Maintenance timeout/abort returns safely without retry, downstream work,
  or sensitive logging.
• Worker health has an execution-conditioned two-minute no-op pulse
  independent of stream/queue traffic.
• Recovery and dispatcher use their existing schedules as idle-safe
  successful pulse sources.
• Successful pulses emit fixed zero; the three heartbeat alarms alone use
  missing-as-breaching; disabled components do not alarm.
• Deterministic tests prove healthy/idle, one-period gap, stopped/two-period
  missing, disabled, handler-error, and no-work states for all three
  components.
• Readiness stays fixed-key/bounded/redacted and reports disabled
  components as not_applicable.
• Telemetry remains fixed-cardinality and drops unsafe values without
  breaking business behavior.
• Fresh transforms contain one topic, three retained groups, 17 corrected
  alarms, the new worker pulse rule/permission, existing schedules, and no
  prohibited family.
• Corrected Allow OIDC deployment of Telegram rollout alarms and notifications #131 exactly matches the replacement graph and provides only
  proven tag-on-create plus existing lifecycle permission.
• The Playwright global setup passes these six explicit canonical dark values
  to its spawned test server, independent of the parent environment:
  CONVERSATIONAL_TELEGRAM_INGRESS_ENABLED=false,
  CONVERSATIONAL_EXECUTION_ENABLED=false,
  CONVERSATIONAL_ENABLED_PLUGINS=none,
  CONVERSATIONAL_TYPEFULLY_EXTERNAL_EXECUTION_ENABLED=false,
  CONVERSATIONAL_TELEGRAM_VOICE_ENABLED=false, and
  CONVERSATIONAL_TELEGRAM_PHOTO_ENABLED=false.
• Playwright readiness probes GET /api/health and resolves only on HTTP
  200; connection errors, timeouts, and every non-200 response remain
  unready until the bounded startup timeout fails clearly.
• An automated regression unsets all six controls in the parent process,
  starts the E2E server through the real bootstrap, and proves the child is
  healthy with the six dark defaults rather than inherited ambient values.
• CI=true npm --prefix backend run test:e2e completes the full suite with
  exit code 0; retries must not mask a server-startup/configuration failure.
• Production fail-closed validation is unchanged: missing, malformed, or
  contradictory rollout controls still fail outside the test-only E2E
  bootstrap, with no fallback defaults added to production handler/runtime
  parsing.
• Gate A and corrected Gate B are effectively applied before Roll out and cut over the Telegram conversational MVP #128
  commit/merge/push.
• [HUMAN] One webhook/no poller, confirmed out-of-band subscription, dark
  maintenance, staged todo/media/Typefully behavior, alarm canaries, and
  reverse rollback pass with sanitized evidence.

Required automated verification

Run and record exact exit codes/counts:

npm --prefix backend test
npm --prefix backend run typecheck
npm --prefix backend run build
npm --prefix backend run test:telegram-transaction
npm --prefix backend run test:execution-transaction
npm --prefix backend run test:todo-transaction
npm --prefix backend run test:typefully-transaction
uv run --with pytest python -m pytest -q tests/infra
make sam-validate
AWS_CONFIG_FILE=.tmp/aws-empty/config \
AWS_SHARED_CREDENTIALS_FILE=.tmp/aws-empty/credentials \
AWS_EC2_METADATA_DISABLED=true \
AWS_DEFAULT_REGION=eu-west-1 \
sam validate --lint --template-file infra/template.full.yaml
make sam-build
git diff --check

Also require:

• focused handler tests for the worker pulse, recovery pulse, dispatcher pulse,
  256 KiB boundary, oversized rejection, abort deadline, zero retries, and zero
  downstream work;
• parsed alarm tests proving exactly 3 breaching heartbeat alarms and 14
  notBreaching alarms;
• fresh isolated dark/execution/ingress/voice/photo/Typefully-external
  transforms and exact schedule/rule/permission inventory;
• repeated deterministic graph generation and public-safe sentinel scans;
• Assistant and Architect re-review, then independent Tester and PM acceptance.

The repair requires the focused unset-parent bootstrap/readiness regression and
CI=true npm --prefix backend run test:e2e. Screenshots remain unnecessary
because no frontend surface changes. No real Telegram/provider/AWS action is an
agent test.

Sequencing

1. SWE fixes the uncommitted Roll out and cut over the Telegram conversational MVP #128 candidate and posts a new fingerprint.
2. Assistant and Architect re-review the replacement behavior and graph.
3. Tester and PM review the replacement candidate.
4. Fresh transforms freeze the exact corrected graph.
5. Allow OIDC deployment of Telegram rollout alarms and notifications #131 SWE corrects IAM/fixture/tests against that graph; IAM/security Tester
   and PM accept it.
6. Integrate corrected Allow OIDC deployment of Telegram rollout alarms and notifications #131 into aws-infra/main; a credentialed operator
   applies Gate A/Gate B and verifies effective permissions.
7. Only then commit accepted Roll out and cut over the Telegram conversational MVP #128 with Refs #128, merge/push main, and let
   normal CI perform the all-off dark deployment.
8. Add human, run staged HUMAN canaries/reverse rollback, and close Roll out and cut over the Telegram conversational MVP #128 only
   after live gates pass. Close Epic: Deliver a Telegram-first conversational agent MVP #122 last.

Out of scope

Groups/shared context beyond redirect, web conversation/approval, memory,
scheduling/publishing, podcast/SOP mutation, new plugins, generic uploads,
second proposal/execution paths, extra observability families, provider
fallback, secret UI/plaintext credentials, manual app deployment/Lambda patch,
polling, queue purge, destructive state changes, and edits to source repos from
the #128 worktree.

[alexeygrigorev]

GROOMED

This rollout issue is implementation-ready after #126 and #127 close.

Key product decisions:

• Keep controls deploy-owned and small: Telegram ingress, global execution leasing, enabled-plugin allowlist, Typefully external dispatch, and independent voice/photo switches. Fresh-stack defaults are off.
• Disabling a scope stops new work without deleting state, interrupting an executing call, making unknown work retryable, or reviving expired approval.
• Legacy /todo, /social, /podcast, direct-task, premature Typefully, and podcast-job writes become static guidance or unreachable and are never restored during rollback.
• Production uses only pre-created Secrets Manager references passed through OIDC/SAM. Deploy validation never retrieves or prints key values.
• Add a redacted admin readiness view, fixed low-cardinality EMF metrics, 30-day log retention, encrypted SNS alarm topic, and exact low-volume alarm thresholds for uncertain execution, DLQ/recovery, provider/media, cleanup, and failed-safe events.
• Rollout is dark deploy, text/todo canary, voice/photo canaries, Typefully preview then external-dispatch canary, compatibility verification, and On-Call observation.
• Rollback is an OIDC configuration update. It never manually patches Lambda, purges durable state, or restores unsafe legacy routes.
• Automated tests cover the full flag matrix, kill-switch races, legacy nonmutation, podcast singleton, secrets/OIDC, telemetry/redaction, alarms, staged enablement, and rollback. Real Telegram/provider writes remain explicit HUMAN gates.
• On-Call evidence requirements are in the issue and exclude secrets/private operational content.

Post-MVP groups, uploads, web, SOP/podcast mutation, workflows, memory, scheduling/publishing, and dynamic plugins remain excluded.

[alexeygrigorev]

PRE-IMPLEMENTATION ARCHITECT/ON-CALL REVIEW

Readiness verdict: BLOCKED for implementation assignment and BLOCKED for rollout. The groomed rollout design is sound, but its code dependencies are not yet shipped and the live deploy role is still behind the accepted source. A small additional OIDC capability review will also be required for #128's alarms/topic.

Current dependency and deployment truth

• Build the static plugin runtime and z.ai conversational adapter #125 is the last successfully deployed conversational slice. It is deployed fail-closed: conversational runtime off, no z.ai secret reference configured, and no production plugin.
• The Consolidate private Telegram identity, text, voice, and photo input #121 push passed tests/build/SAM but its app deployment failed while creating Add transactional approval and durable execution recovery #124's ConversationalExecutionFailureQueue: the OIDC role lacked sqs:CreateQueue. CloudFormation reached UPDATE_ROLLBACK_COMPLETE, so Consolidate private Telegram identity, text, voice, and photo input #121 identity/media and Add transactional approval and durable execution recovery #124 worker/stream/recovery/queue are not production-verified.
• Ship approved conversational todo creation #126 has Assistant Engineer and Tester passes, but the corrected default-off dispatcher schedule is still uncommitted/unpushed and needs final Ship approved conversational todo creation #126 PM acceptance before commit/push. Ship approved Typefully saved-draft creation #127 must reuse Ship approved conversational todo creation #126's coordinator/outbox and has not been implemented.
• Accepted aws-infra commits Repair DataOps OIDC SES configuration-set tag-on-create permission #129 9b5b888 and Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 2a1b95f are integrated in DataTalksClub/aws-infra source, preserving the earlier Add transactional approval and durable execution recovery #124 PR Import DTC Operations content directory #18 capability, but the dataops-github-actions stack has not been credentialedly applied. Source integration alone changes no AWS permissions.
• Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 do not cover Roll out and cut over the Telegram conversational MVP #128's new AWS::CloudWatch::Alarm and AWS::SNS::Topic lifecycle. The reviewed 2a1b95f deploy policy has no CloudWatch-alarm or SNS lifecycle actions. Freeze the final Roll out and cut over the Telegram conversational MVP #128 alarm/topic/log graph, then create a separate narrowly scoped shared-infra/OIDC issue. Prefer an encrypted topic using the AWS-managed SNS key to avoid adding a new KMS lifecycle unless a distinct customer-managed key is explicitly required. Do not append this to the nearly full inline policy or broaden Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130.

A credentialed operator should apply the current combined aws-infra stack before the next app deployment and verify terminal stack status plus live managed-policy attachments. Then rerun a default-off app deployment to close the existing #121/#124 denial before stacking the #128 alarm/topic permission change.

Ownership boundary: #127 versus #128

#127 owns all Typefully capability semantics:

• typed public-source consent before model egress;
• exact proposal/schema/account authorization and account-config digest;
• worker-only token and logical-to-numeric social-set mappings;
• one unscheduled/unpublished create request;
• operator_reconciliation_only, ambiguous-outcome handling, private result URL/outbox payload, and no blind retry;
• removal of provider-write ability from the old social assistant/API paths.

#128 must not reimplement or weaken those controls. It owns only rollout integration: the canonical flag snapshot, deploy preflight, static Telegram /social compatibility reply, readiness/telemetry/alarms, staged enablement, smoke evidence, and switch-based rollback.

Likewise, #126 owns todo proposal/execution and the durable owner-private result outbox/dispatcher. #128 owns enabling and observing it, not a second todo writer or delivery path.

The #127 PM comment's phrase requiring #126 to be “closed” conflicts with #126's intentional open HUMAN sandbox gate and creates a cycle with #128. The practical dependency is: #126's automated slice must be accepted, committed, merged, and pushed with the coordinator/outbox present; #126 may remain open with human until #128's text+todo canary supplies its live evidence. Then #127 implementation may begin.

Canonical switch decisions

Keep exactly the six groomed operator controls:

Telegram ingress
execution leasing
allowed plugins: todo,typefully
Typefully external execution
voice
photo

Existing CONVERSATIONAL_AGENT_ENABLED, CONVERSATIONAL_TODO_PLUGIN_ENABLED, CONVERSATIONAL_TODO_EXECUTOR_ENABLED, and CONVERSATIONAL_RESULT_DELIVERY_ENABLED must not remain independent rollout knobs. Derive their behavior from one validated immutable snapshot:

• agent/runtime availability = Telegram ingress for this Telegram-only MVP;
• todo catalog = todo in the allowlist;
• todo dispatch = execution on + todo allowed;
• Typefully proposal visibility = typefully allowed;
• Typefully dispatch = execution on + typefully allowed + external execution on;
• result dispatcher = Telegram ingress, not execution, so disabling new leases still permits a result from an already executing attempt to be delivered; ingress-off preserves the outbox without sending;
• media = ingress on + its individual media flag.

Reject contradictory states rather than guessing: media on with ingress off; external Typefully on without Typefully allowed/execution; unknown/duplicate plugin IDs; invalid booleans. The Telegram secret is required even in dark mode because the webhook must still authenticate and may send bounded maintenance guidance. Other provider references may be absent only while their capability is disabled.

Worker/Stream/recovery invocations may remain installed while execution is off, but must check the frozen snapshot before leasing. Plugin/external disablement must be checked before lease/dispatch, not after consuming approval or creating provider intent.

Legacy cutover must happen in the dark deploy

The current code sends CONVERSATIONAL_TELEGRAM_ENABLED != true to handleLegacyTelegramWebhook, where /social can call Typefully and /podcast can create an assistant job. That is the opposite of the required rollback contract.

Remove/make unreachable those mutations before the first dark deployment. Ingress-off must authenticate, return safe maintenance behavior, and perform no intake/conversation/model/media/plugin/domain write. /todo, /social, and /podcast must be static non-mutating compatibility responses in every flag state. The later “compatibility cutover” stage is verification of permanent removal and final help copy, not the moment old writes are disabled. No rollback may restore the legacy handler.

Webhook/polling singleton gate

The DataOps assistants/podcast copy is deliberately non-polling, but the legacy source system ../podcast-assistant/main.py still contains a run_polling entrypoint. #128 must not modify that source repo, but a HUMAN cutover check must prove no deployed legacy podcast process is running with the shared bot token.

Before canary:

• verify exactly one Telegram webhook targets the DataOps endpoint with the expected secret-token contract;
• verify no getUpdates/polling consumer and no second webhook registrar uses this bot;
• do not start the legacy podcast process or give it the shared token;
• inspect webhook pending/error state using a secret-aware private procedure without posting token, URL-secret, chat ID, or payload details publicly;
• do not use delete-webhook/polling as rollback. Rollback leaves the authenticated DataOps webhook in maintenance mode.

Monitoring/readiness gaps to close

Use fixed singleton heartbeat rows or equivalent exact-key state for worker, recovery, and result dispatcher freshness. The readiness endpoint should use exact reads only, report disabled components as not_applicable rather than stale, and never call a provider or scan queues/tables.

The current metric list does not explicitly cover the #126 owner-private result outbox/dispatcher. Add the minimum fixed metrics:

• ResultDeliverySucceeded;
• ResultDeliveryFailed;
• ResultDeliveryOutcomeUnknown;
• ResultDeliveryOldestPendingAgeSeconds.

Alarm on any result-delivery unknown and on oldest pending age over five minutes; otherwise an execution can succeed while Telegram delivery silently stalls. Keep IDs and private edit URLs out of dimensions/logs. Also alarm on the native failure-queue visible count and verify the out-of-band SNS subscription is actually confirmed; an un-subscribed green topic is not operational paging.

For voice/photo, retain #121's finally cleanup and bounded symlink-safe warm-container reaper. Canary evidence should use safe cleanup outcome/metric counts—not file paths or derived text—and should include an injected automated cleanup failure proving the alarm before real media is enabled. A media-off request must fail before download or provider-secret lookup.

Be careful adding explicit 30-day log groups for already deployed Lambdas: CloudFormation cannot adopt an automatically created group by simply declaring the same name. Use new non-conflicting stack-owned log-group names wired through Lambda logging configuration (or an explicitly reviewed import plan), and keep them inside the exact existing/new OIDC ARN families.

Staged configuration and live matrix

Use one OIDC stack update per stage; never patch Lambda environment variables manually.

Stage	Ingress	Execution	Plugins	Typefully external	Voice	Photo
Dark	off	off	none	off	off	off
Text + todo	on	on	todo	off	off	off
Voice canary	on	on	todo	off	on	off
Photo canary	on	on	todo	off	on	on
Typefully preview	on	on	todo,typefully	off	as accepted	as accepted
Typefully effect	on	on	todo,typefully	on	as accepted	as accepted

For Typefully preview-only, create/revise the proposal and then cancel it; do not approve while external execution is off, otherwise a durable queued canary could dispatch later when the gate opens. Enable the external switch only after #127's private account mapping, typed-public source grant, and reconciliation runbook gates are accepted.

One sanitized HUMAN run can satisfy the child issues without duplicating provider effects:

1. dark deployment/readiness, unrelated portal/API smoke, authenticated maintenance, zero associated secret/provider/domain calls;
2. real numeric Telegram binding plus linked, unlinked, disabled/revoked, and directed-group checks;
3. text/session commands and z.ai glm-5.2 smoke with redacted logs;
4. revised todo, duplicate approval, exactly one actor-owned task, result outbox delivery, /todo nonmutation;
5. voice use/correct/discard and voice-off zero-download/call;
6. photo use/correct/discard and photo-off zero-download/call;
7. Typefully preview/cancel, then one accepted public-source effect, private result, unscheduled/unpublished verification, /social nonmutation, and accepted ambiguous reconciliation without replay;
8. /podcast, help/status, unsupported input, webhook singleton, queue/heartbeat/alarm checks;
9. reverse-order rollback: Typefully external, Typefully allowlist, photo, voice, todo allowlist, execution, ingress—proving queued/outbox state survives and no expired presentation revives.

Closure sequence

1. Finish Ship approved conversational todo creation #126 PM re-review, commit/push its accepted automated slice, and add/retain human; do not wait for its live todo gate to start Ship approved Typefully saved-draft creation #127.
2. Implement/review/ship Ship approved Typefully saved-draft creation #127 default-off. Keep Ship approved Typefully saved-draft creation #127 open with human for account/effect/reconciliation gates.
3. Implement Roll out and cut over the Telegram conversational MVP #128 against the final Ship approved conversational todo creation #126/Ship approved Typefully saved-draft creation #127 names and frozen resource graph.
4. Apply and verify the already integrated Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 shared-role source. Complete the separate exact Roll out and cut over the Telegram conversational MVP #128 alarm/topic OIDC extension and credentialed apply before dark deploy.
5. Dark deploy through normal DataOps CI/OIDC, then On-Call verifies Consolidate private Telegram identity, text, voice, and photo input #121 identity/media resources, Add transactional approval and durable execution recovery #124 worker/queue/recovery, Ship approved conversational todo creation #126 dispatcher default-off, Roll out and cut over the Telegram conversational MVP #128 readiness/logs/alarms, and unchanged unrelated APIs.
6. Execute the staged HUMAN matrix. Cross-post only sanitized results to Consolidate private Telegram identity, text, voice, and photo input #121/Add transactional approval and durable execution recovery #124/Build the static plugin runtime and z.ai conversational adapter #125/Ship approved conversational todo creation #126/Ship approved Typefully saved-draft creation #127/Roll out and cut over the Telegram conversational MVP #128 and close each child only when its own human criteria pass. Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 remain open until their applied live resources/policies and default-off behavior are verified; their closure is not a prerequisite to begin canary once the required effective permissions are proven.
7. Close Roll out and cut over the Telegram conversational MVP #128 only after rollback and observation pass; close parent Epic: Deliver a Telegram-first conversational agent MVP #122 last.

No app/provider/AWS mutation, secret retrieval, Telegram call, file edit, issue-body edit, commit, or push was performed in this review.

[alexeygrigorev]

PM REGROOMED

Re-groomed against the full issue history, current architecture/state, and the Architect/On-Call review.

Readiness: BLOCKED for implementation and rollout.

Implementation blockers:

• Ship approved conversational todo creation #126 automated slice must receive final PM acceptance and be committed/merged/pushed; its HUMAN canary may remain open.
• Ship approved Typefully saved-draft creation #127 automated default-off Typefully slice must then ship while reusing Ship approved conversational todo creation #126's coordinator/outbox.

Rollout blockers:

• A credentialed operator must apply the accepted combined Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 GitHub Actions role source, then rerun the current default-off application deployment and prove that the prior SQS denial is gone.
• After Ship approved conversational todo creation #126, Ship approved Typefully saved-draft creation #127, and the final Roll out and cut over the Telegram conversational MVP #128 implementation graph are frozen, file a separate raw needs grooming shared-infra issue containing the exact CloudWatch alarm, SNS topic/subscription, and stack-owned log-group resources. That issue must complete the normal process and be credentialedly applied before Roll out and cut over the Telegram conversational MVP #128's dark deployment.

Binding rollout decisions now captured in the issue:

• exactly six canonical switches; legacy independent flags are derived/removed, and result delivery follows ingress rather than execution;
• the legacy mutating handler is removed before dark deploy, so ingress-off never falls back to it;
• a HUMAN singleton gate proves one webhook owner and no polling/second registrar, including the old podcast poller boundary;
• fixed worker/recovery/result-dispatcher heartbeats and exact readiness states;
• result success/failure/unknown/oldest-pending telemetry, native DLQ alarm, confirmed SNS subscription, safe voice/photo failure dimensions, and custom 30-day stack-owned log groups using alias/aws/sns;
• one staged six-switch matrix from dark through Typefully effect, with Typefully preview create/revise/cancel before external execution;
• one consolidated HUMAN smoke and reverse-order switch rollback run;
• Ship approved Typefully saved-draft creation #127 retains all Typefully semantics; Roll out and cut over the Telegram conversational MVP #128 owns rollout integration only.

Closure order is: ship #126 automated slice → ship #127 automated slice → implement #128 → apply current role and prove default-off deploy → freeze/file/ship/apply exact #128 infra → dark deploy → run HUMAN matrix → close #128 → close parent #122 when all children are complete.

Issue: #128
Architect/On-Call review: #128 (comment)