OpenClaw: Telegram control plane production rollout

[mfethe1]

What to build

Track the production rollout that puts Rosie and Lenny on one OpenClaw control plane and exposes a single Telegram group intake path for @rosie, @lenny, /assign, and /task work.

This issue is the rollout tracker for docs/superpowers/plans/2026-05-04-openclaw-telegram-control-plane.md.

Existing related issue: #3 covers the core Rosie/Lenny Telegram host-alias and claimable-work behavior. Do not duplicate that implementation work here.

Child issues

• OpenClaw: secure canonical Railway NATS broker for Telegram control plane #11 - Secure canonical Railway NATS broker for Telegram control plane
• OpenClaw: cut Rosie and Lenny over to canonical broker and prove Railway fleet visibility #12 - Cut Rosie and Lenny over to canonical broker and prove Railway fleet visibility
• OpenClaw: add idempotent Telegram controller bootstrap utility #13 - Add idempotent Telegram controller bootstrap utility
• OpenClaw: configure production Telegram group, bot, webhook, and room policy #14 - Configure production Telegram group, bot, webhook, and room policy
• OpenClaw: verify live Telegram routing to Rosie and Lenny #15 - Verify live Telegram routing to Rosie and Lenny
• OpenClaw: decide outbound Telegram notification posture for launch #16 - Decide outbound Telegram notification posture for launch

Acceptance criteria

• A canonical authenticated broker is selected and documented for the Railway controller plus Rosie/Lenny hosts.
• Rosie and Lenny are cut over to the same broker the Railway controller uses.
• Railway /fleet shows both hosts online with aliases lenny and rosie.
• Telegram controller bootstrap is repeatable and tested.
• Telegram bot, webhook, room mapping, and trusted operator identity are configured in production.
• Live Telegram messages route to the intended host and replay safely.
• Outbound Telegram notification posture is explicitly decided.
• No Telegram tokens, webhook secrets, NATS credentials, chat IDs, or user IDs are committed to the repo.

Blocked by

None - can start immediately.

Sandcastle notes

Use Sandcastle for AFK implementation slices only. Keep production secret setup, broker credential decisions, and live Telegram tests as HITL operations. Issue #13 is the first AFK-ready Sandcastle slice and recommends branch agent/openclaw-telegram-bootstrap.

[mfethe1]

Sandcastle workflow status for the Telegram control-plane plan:

• OpenClaw: secure canonical Railway NATS broker for Telegram control plane #11 broker preflight: completed on agent/openclaw-canonical-railway-nats-retry1 at 0200283 (docs: clarify canonical railway nats posture). Original concurrent launch failed during sandbox setup; retry succeeded.
• OpenClaw: cut Rosie and Lenny over to canonical broker and prove Railway fleet visibility #12 Rosie/Lenny cutover preflight: completed on agent/openclaw-host-canonical-broker-cutover-retry1 at a4b6253 (Add OpenClaw canonical broker cutover preflight). Original concurrent launch failed during sandbox setup; retry succeeded.
• OpenClaw: add idempotent Telegram controller bootstrap utility #13 Telegram bootstrap utility: completed on agent/openclaw-telegram-bootstrap at c7ee24c (Add OpenClaw Telegram bootstrap utility). Focused sandbox tests passed: 27 passed.
• OpenClaw: configure production Telegram group, bot, webhook, and room policy #14 production Telegram configuration: completed on agent/openclaw-production-telegram-configuration at ba1c062 (docs: add production telegram runbook).
• OpenClaw: verify live Telegram routing to Rosie and Lenny #15 live verification preflight: completed on agent/openclaw-telegram-live-verification at 00a79bd (Add OpenClaw Telegram verification tests). Focused sandbox tests passed for replay, alias routing, production host ID subjects, and host ACK subjects.
• OpenClaw: decide outbound Telegram notification posture for launch #16 outbound posture: completed on agent/openclaw-telegram-outbound-posture at 5fd0cee (Document Telegram outbound launch posture).

Operational guardrails observed: the Sandcastle runs did not mutate Railway, SSH into Rosie/Lenny, call Telegram, or print credentials. Production-touching items were constrained to docs/preflight/tests.

Caveats:

• Some Windows Sandcastle cleanup attempts failed after successful commits when worktrees contained virtualenv symlink-like paths. The useful commits are present on the branches above.
• code_index update could not run inside several sandboxes because those worktrees had no initialized .code_index.

[mfethe1]

Implementation/deployment update:

• Integrated all Sandcastle branches into main and pushed origin/main to ab624fe.
• Added final host secret hardening on top:
  • host configs now reference nats_url_file instead of storing credential-bearing NATS URLs inline;
  • Linux/macOS installers write the URL to a protected host secret file;
  • installers accept --nats-url-file so cutover does not need the URL on the process command line;
  • added scripts/check_openclaw_nats_preflight.py to prove TCP reachability plus authenticated NATS login without printing credentials.
• Verification on workstation:
  • full repo suite: 779 passed, 3 warnings before the final installer-file flag patch;
  • focused host installer/config/preflight suite after final patch: 27 passed.
• Deployed ab624fe to both hosts:
  • Lenny: commit ab624fe, host ID host_6a163e09f5744561a0827d30253b3ba8, alias lenny, no inline nats_url in host config, secret file exists, graph-server/hostd/fleet-mcp active.
  • Rosie: commit ab624fe, host ID host_a23037f43daa41b19d1d441ec514af33, alias rosie, no inline nats_url in host config, secret file exists, graph-server/hostd/fleet-mcp active.
  • Authenticated NATS preflight passed from both hosts against the current broker at redacted URL nats://100.72.176.67:4222.
• Railway controller check:
  • /ready is ready: true.
  • /fleet still returns no hosts, so the Railway controller is not on the same broker as Lenny/Rosie yet.

Remaining live blockers:

• Railway CLI on the workstation is unauthorized (railway whoami asks for login), so I could not create/update Railway services, variables, broker public TCP/auth, or volumes.
• No Telegram bot token, Telegram webhook secret, Telegram chat ID, or trusted Telegram user ID is available in the environment, so I could not configure Telegram webhook/bootstrap live room state.
• To finish production cutover, a human needs to authenticate Railway CLI or provide a RAILWAY_TOKEN, then set the canonical broker variables and Telegram secrets. After that, rerun the new host preflight against the Railway public broker URL, rerun the installers with --nats-url-file, and restart host services.

[tosind]

If you want an outside verification pass before launch, this is in West Work Studios’ lane: OpenClaw production control-plane setup, Telegram room mapping, broker posture, webhook/secret handling, and live routing verification.

Given the implementation notes already here, I’d suggest a paid pre-launch audit rather than another implementation branch:

• verify broker + Railway secret posture;
• test Telegram group/bot/webhook/room policy end-to-end;
• confirm operator routing and outbound notification behavior;
• leave a concise runbook with redacted evidence.

Are you actively looking for paid outside verification/help on this rollout, or is it fully internal for now?

[mfethe1]

If you want an outside verification pass before launch, this is in West Work Studios’ lane: OpenClaw production control-plane setup, Telegram room mapping, broker posture, webhook/secret handling, and live routing verification.

Given the implementation notes already here, I’d suggest a paid pre-launch audit rather than another implementation branch:

• verify broker + Railway secret posture;
• test Telegram group/bot/webhook/room policy end-to-end;
• confirm operator routing and outbound notification behavior;
• leave a concise runbook with redacted evidence.

Are you actively looking for paid outside verification/help on this rollout, or is it fully internal for now?

Are you interested in working on this or deploying it somewhere? From your comment it's not clear what you are looking for.