Journal capture wired at every gateway anchor (inbound pre-enrichment,
queued sends, outbound terminal states, streaming, edits, suppressions
with policy reasons, one wrapper around the callback handler) — 123
tests including fail-open. New @joelclaw/digest assembles the contract
digest from fixtures with pending-until-receipt controls; nothing sent
live. signal/reminder durable function: idempotent on action ID,
re-inspects the source before re-delivery, suppresses if resolved.
Steps: journal-capture-anchors, digest-service-fixture-prototype,
snooze-reminder-function (.brain/projects/telegram-signal-system/)
Scoped users.d policy (admin/writer/reader identities), hash-only
secrets, Flagg-local SSH tunnel plist, config templates, and the
runbook with verification + rollback. Verified against a disposable
ClickHouse 24.12 with positive and negative grant probes. Live apply
requires Joel present.
Step: .brain/projects/telegram-signal-system/clickhouse-access-control.svx
Every conversational/notification send now routes through the policy
(deliver/investigate/digest/suppress) after resolveSendInput(), with
companion enforcement in media and streaming sends. Specialized UI
bypasses are typed grep-able markers. Side-effect handlers fail-safe
with error receipts; every decision emits body-free
telegram.policy.decided with flowId, disposition, reason. verify-voice
fixture lands in an investigating lifecycle actor, never Telegram.
Step: .brain/projects/telegram-signal-system/wire-outbound-policy-into-gateway.svx
Opaque act:<uuid> callback IDs with a Redis-backed registry (buttons
stay pending until mutation receipts), per-item capability computation,
fixture adapter for the digest prototype, Front archive as the first
real conditional-Done adapter. Lockfile picks up the three new
workspace packages (xstate v5 for @joelclaw/signal).
Step: .brain/projects/telegram-signal-system/build-action-registry-source-adapters.svx
TelegramOutboundPolicy pure decision function (deliver/investigate/
digest/suppress; unclassifiable defaults to investigate) and the signal
lifecycle machine with investigation budgets, dedup, cancellation, and
the settled escalation gate. verify-voice fixture proves probe failures
land in investigating, never delivered.
Step: .brain/projects/telegram-signal-system/build-signal-lifecycle-machine.svx
Typed lifecycle events with deterministic IDs, explicit admin-gated
migrations (ReplacingMergeTree, no TTL), INSERT-only writer with 0600
outbox fallback, audit/trace query client. Steering fix: floor stat
timestamps in the outbox lease sweep (sub-ms stat vs integer Date.now()
made same-millisecond claims unrecoverable).
Step: .brain/projects/telegram-signal-system/build-message-journal-package.svx
Three producers now route through gateway/send.message with explicit
producer attribution and keyboards intact; sendTelegramDirect deleted
(formatting helpers retained). Queue drain renders format: html so
formatting survives the transport change. Zero direct Bot API callers
remain under packages/system-bus.
Step: .brain/projects/telegram-signal-system/migrate-bypass-producers.svx
Joel confirmed the finish line and all recommendations 2026-07-15.
Working brief + 11 step files; wave 1 (journal package, lifecycle
machine, action registry, bypass-producer migration) launched.
Synthesized from the handoff charter plus three read-only research
passes (producer inventory, ClickHouse journal design, action-adapter
capability map). Finish line still awaits Joel's confirmation.
pane/schedule.requested contract, sleepUntil function with cancellation
waitForEvent race, Redis pending registry, joelclaw wake CLI. Emits
pane.schedule.due to the gateway with late flag past 5min. Worker-built,
steering-verified: tsc green, tests green, live enqueue+cancel receipts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Joel's calls at charter: inngest has scheduled jobs (the clock), panes
fire into the observer family session. Bus-side build fired.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Worker drops Mux/Garage/joelclaw-api leases for the video path (wzrrd
owns upload and durable state); host registry asserts only the thin
publish function; joelclaw video trace accepts wzrrd slugs and points
at wzrrd video trace for cloud history.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Joel Hooks