@agfpd/iapeer 0.2.37 → 0.2.39

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.37",
+  "version": "0.2.39",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/index.ts

@@ -48,6 +48,7 @@ import { resolveCallerIdentity, resolveIdentity } from '../identity/index.ts'
 import { peerProfilePath } from '../storage/index.ts'
 import {
   isConformant,
+  migrateProfileRuntimeField,
   reconcileIndex,
   reindexFromLocals,
   validateProfileStandard,
@@ -554,7 +555,7 @@ const USAGE = `usage: iapeer <verb> [args]
   init [cwd] [--personality p] [--runtime r] [--description d]   onboard the CURRENT folder as a peer (identity + MCP + doctrine)
   create <personality> [--runtime r] [--path dir] [--bin abs]   create a peer anywhere (default ~/.iapeer/peers/<p>) + provision
   list [--json]                                                  registered peers + per-runtime liveness
-  verify [--json] [--fix]                                        profile-standard conformance + index↔local drift (--fix self-heals the index)
+  verify [--json] [--fix]                                        profile-standard conformance + index↔local drift (--fix self-heals the index + migrates legacy runtime→default_runtime in local profiles)
   stop <peer> [runtime] | --all                                  warm peer: kill the live session + set a durable stop-flag — the daemon will NOT wake it
                                                                  until \`start\`; always-on (notifier/telegram): launchctl bootout. --all = every registered peer
   start <peer> [runtime] | --all                                 warm peer: clear the stop-flag — wakeable again; does NOT launch a session (the daemon brings
@@ -886,12 +887,18 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
       }
       case 'verify': {
         // Profile conformance + index↔local self-heal reconciliation. Read-only by
-        // default; --fix self-heals the index (reindex from local profiles). A drift
-        // is a signal that the index self-heal lapsed — caught by construction here.
+        // default; --fix self-heals the index (reindex from local profiles) AND
+        // migrates conformant local profiles off the legacy `runtime` field shape
+        // (Phase 2 of the staged default_runtime story). A drift is a signal that
+        // the index self-heal lapsed — caught by construction here.
         const index = readPeersIndex({ env })
         let errors = 0
         let driftCount = 0
         const lines: string[] = []
+        // Conformant profiles still carrying the LEGACY runtime field shape (no
+        // default_runtime, or a diverged mirror) — candidates for the --fix data
+        // migration (Phase 2 of the staged default_runtime story).
+        const legacyRuntimeProfiles: Array<{ personality: string; cwd: string }> = []
         for (const peer of index.peers) {
           const path = peerProfilePath(peer.cwd)
           if (!existsSync(path)) {
@@ -916,6 +923,12 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           } else if (warns.length > 0 && flags.json !== true) {
             lines.push(`⚠ ${peer.personality}: ${warns.map(i => i.field).join(', ')}`)
           }
+          // Migration candidate: conformant, but the default_runtime warn fired
+          // (legacy-only field or diverged mirror). Errored profiles are NEVER
+          // rewritten — migration heals shape, it does not guess at broken data.
+          if (errs.length === 0 && warns.some(i => i.field === 'default_runtime')) {
+            legacyRuntimeProfiles.push({ personality: peer.personality, cwd: peer.cwd })
+          }
         }
         const reconcile = reconcileIndex({ env })
         for (const r of reconcile) {
@@ -932,10 +945,23 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           for (const l of lines) out(l + '\n')
           out(`\n${index.peers.length} peers · ${errors} error(s) · ${driftCount} index↔local drift(s)\n`)
         }
-        if (flags.fix === true && (driftCount > 0 || errors === 0)) {
-          const { healed, missing } = await reindexFromLocals({ env })
-          if (healed.length > 0) out(`self-healed index from local profiles:\n  ${healed.join('\n  ')}\n`)
-          if (missing.length > 0) errOut(`peers with no local profile (left untouched): ${missing.join(', ')}\n`)
+        if (flags.fix === true) {
+          // Phase-2 data migration (staged default_runtime story): rewrite conformant
+          // local profiles still on the legacy field shape — the writer now emits
+          // `default_runtime` + the in-sync legacy `runtime` mirror. Runs BEFORE the
+          // reindex so the healed index is projected from migrated locals.
+          const migrated: string[] = []
+          for (const p of legacyRuntimeProfiles) {
+            if (migrateProfileRuntimeField(p.cwd)) migrated.push(p.personality)
+          }
+          if (migrated.length > 0) {
+            out(`migrated runtime→default_runtime (legacy mirror kept): ${migrated.join(', ')}\n`)
+          }
+          if (driftCount > 0 || errors === 0) {
+            const { healed, missing } = await reindexFromLocals({ env })
+            if (healed.length > 0) out(`self-healed index from local profiles:\n  ${healed.join('\n  ')}\n`)
+            if (missing.length > 0) errOut(`peers with no local profile (left untouched): ${missing.join(', ')}\n`)
+          }
         }
         return errors > 0 || (driftCount > 0 && flags.fix !== true) ? 1 : 0
       }

package/src/identity/index.ts

@@ -292,6 +292,12 @@ export function writePeerProfileAtomic(cwd: string, profile: PeerProfileWrite):
   const merged: Record<string, unknown> = {
     ...existing,
     personality: profile.personality,
+    // Phase-2 write-flip (contract Идентичность, staged default_runtime migration):
+    // emit the contract field `default_runtime` AND keep the legacy `runtime` as an
+    // IN-SYNC MIRROR — readers that still read `runtime` only (IAP peers.ts,
+    // Spawned-Peer, external scripts) stay alive with zero blast radius. Phase 3
+    // (gated on every reader shipping dual-read) removes the mirror.
+    default_runtime: profile.runtime,
     runtime: profile.runtime,
     runtimes: profile.runtimes,
     description,

package/src/identity/profileStandard.test.ts

@@ -4,7 +4,8 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
-import { isConformant, reconcileIndex, reindexFromLocals, validateProfileStandard } from './profileStandard.ts'
+import { isConformant, migrateProfileRuntimeField, reconcileIndex, reindexFromLocals, validateProfileStandard } from './profileStandard.ts'
+import { readFileSync } from 'fs'
 import { readPeersIndex } from '../registry/index.ts'
 
 describe('validateProfileStandard', () => {
@@ -28,6 +29,47 @@ describe('validateProfileStandard', () => {
     expect(issues.find(i => i.field === 'default_runtime')?.severity).toBe('warn')
   })
 
+  test('default_runtime + in-sync legacy mirror (Phase-2 write shape) → NO issues', () => {
+    const issues = validateProfileStandard(
+      { personality: 'boris', default_runtime: 'claude', runtime: 'claude', runtimes: ['claude'], description: 'PM', intelligence: 'artificial' },
+      cwd,
+    )
+    expect(issues).toEqual([])
+  })
+
+  test('DIVERGED legacy mirror → WARN on default_runtime, still conformant', () => {
+    const issues = validateProfileStandard(
+      { personality: 'boris', default_runtime: 'codex', runtime: 'claude', runtimes: ['codex', 'claude'], description: '', intelligence: 'artificial' },
+      cwd,
+    )
+    expect(isConformant(issues)).toBe(true)
+    const warn = issues.find(i => i.field === 'default_runtime')
+    expect(warn?.severity).toBe('warn')
+    expect(warn?.message).toContain('diverged')
+  })
+
+  test('aliases misfiled in interfaces.telegram → WARN (owner migration to expansion.aliases pending)', () => {
+    const issues = validateProfileStandard(
+      {
+        personality: 'boris', default_runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial',
+        interfaces: { telegram: { bot: 'k', bot_username: 'x_bot', aliases: { '/alias-new': 'txt' } } },
+      },
+      cwd,
+    )
+    expect(isConformant(issues)).toBe(true)
+    expect(issues.some(i => i.field === 'interfaces.telegram.aliases' && i.severity === 'warn')).toBe(true)
+    // passport-only telegram section → silent
+    const clean = validateProfileStandard(
+      {
+        personality: 'boris', default_runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial',
+        interfaces: { telegram: { bot: 'k', bot_username: 'x_bot' } },
+        expansion: { aliases: { '/alias-new': 'txt' } },
+      },
+      cwd,
+    )
+    expect(clean).toEqual([])
+  })
+
   test('top-level aliases → WARN (owner migration pending), still conformant', () => {
     const issues = validateProfileStandard(
       { personality: 'boris', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial', aliases: { '/new': 'x' } },
@@ -113,4 +155,50 @@ describe('reconcileIndex / reindexFromLocals (self-heal)', () => {
     // after the heal, reconcile is clean
     expect(reconcileIndex({ env: process.env }).find(e => e.personality === 'boris')?.drift).toEqual([])
   })
+
+  test('reindex writes the Phase-2 disk shape: default_runtime + in-sync legacy mirror', async () => {
+    await reindexFromLocals({ env: process.env })
+    const disk = JSON.parse(readFileSync(join(root, 'peers-profiles.json'), 'utf8'))
+    expect(disk.peers[0].default_runtime).toBe('claude')
+    expect(disk.peers[0].runtime).toBe('claude') // legacy mirror until Phase 3
+  })
+
+  test('migrateProfileRuntimeField: legacy-only profile → rewritten with default_runtime + mirror, owner fields preserved, idempotent', () => {
+    const profilePath = join(borisCwd, '.iapeer', 'peer-profile.json')
+    // enrich the legacy profile with owner-section + lifecycle fields that MUST survive
+    writeFileSync(
+      profilePath,
+      JSON.stringify({
+        personality: 'boris', runtime: 'claude', runtimes: ['claude'], description: 'd', intelligence: 'human',
+        initial_prompt: 'boot', wake_policy: 'ephemeral',
+        interfaces: { telegram: { bot: 'k' } },
+        expansion: { aliases: { '/alias-new': 'txt' } },
+        notifier: { triggers: [] },
+      }),
+    )
+    expect(migrateProfileRuntimeField(borisCwd)).toBe(true)
+    const after = JSON.parse(readFileSync(profilePath, 'utf8'))
+    expect(after.default_runtime).toBe('claude')
+    expect(after.runtime).toBe('claude') // in-sync legacy mirror
+    expect(after.intelligence).toBe('human') // legacy vocab preserved VERBATIM (no silent migration)
+    expect(after.initial_prompt).toBe('boot')
+    expect(after.wake_policy).toBe('ephemeral')
+    expect(after.interfaces).toEqual({ telegram: { bot: 'k' } })
+    expect(after.expansion).toEqual({ aliases: { '/alias-new': 'txt' } })
+    expect(after.notifier).toEqual({ triggers: [] })
+    // idempotent: already in shape → untouched
+    expect(migrateProfileRuntimeField(borisCwd)).toBe(false)
+  })
+
+  test('migrateProfileRuntimeField: DIVERGED mirror heals to default_runtime (the contract side wins)', () => {
+    const profilePath = join(borisCwd, '.iapeer', 'peer-profile.json')
+    writeFileSync(
+      profilePath,
+      JSON.stringify({ personality: 'boris', default_runtime: 'codex', runtime: 'claude', runtimes: ['codex', 'claude'], description: '', intelligence: 'artificial' }),
+    )
+    expect(migrateProfileRuntimeField(borisCwd)).toBe(true)
+    const after = JSON.parse(readFileSync(profilePath, 'utf8'))
+    expect(after.default_runtime).toBe('codex')
+    expect(after.runtime).toBe('codex') // mirror re-synced to the governing field
+  })
 })

package/src/identity/profileStandard.ts

@@ -8,16 +8,20 @@
 //     ORDER = preference, first = primary), description, intelligence ∈
 //     {artificial|natural|absent}. Optional lifecycle: initial_prompt, wake_policy.
 //   • OWNER sections (validated only as well-typed, NEVER restructured here): interfaces
-//     (telegram/capability passport), aliases (legacy persistent-peer → contract
-//     relocates to interfaces.telegram.aliases, telegram-runtime owns the migration),
-//     notifier (notifier-runtime), <plugin> sections — each plugin writes only its own
-//     field via atomic merge.
+//     (telegram/capability passport — PASSPORT ONLY: aliases are misfiled there and the
+//     contract relocates them to `expansion.aliases`, the runtime-agnostic plugin-config
+//     section owned by the chat-runtime — telegram-runtime today, future discord/matrix
+//     read the SAME section per the 25.05 expansion design), notifier (notifier-runtime),
+//     expansion (chat-runtime aliases), <plugin> sections — each plugin writes only its
+//     own field via atomic merge. Plugin-config sections are NOT projected into the
+//     registry index (private config is read from the LOCAL profile by its owner).
 //
 // peers-profiles.json is a regenerable self-heal PROJECTION of the local profiles —
 // projectProfileToRecord builds the record the index SHOULD hold; verify compares the
 // live index against it, reindex rewrites it. The index is never the source of truth.
 
 import { basename } from 'path'
+import { existsSync, readFileSync } from 'fs'
 import { isRuntime, normalizeIntelligenceValue, normalizeNameCandidate } from '../core/constants.ts'
 import {
   clampDescription,
@@ -26,7 +30,8 @@ import {
   type PeerRecord,
   type PeersUpdateOptions,
 } from '../registry/index.ts'
-import { readPeerProfile } from './index.ts'
+import { peerProfilePath } from '../storage/index.ts'
+import { readPeerProfile, writePeerProfileAtomic } from './index.ts'
 
 export type IssueSeverity = 'error' | 'warn'
 export interface ProfileIssue {
@@ -60,12 +65,21 @@ export function validateProfileStandard(raw: unknown, cwd: string): ProfileIssue
     })
   }
 
-  // default_runtime (contract) / runtime (legacy, staged migration).
+  // default_runtime (contract) / runtime (legacy, staged migration). Since the Phase-2
+  // write-flip the writer emits BOTH (legacy `runtime` as an in-sync mirror); a profile
+  // carrying only the legacy name, or a DIVERGED mirror (a legacy writer updated
+  // `runtime` behind the contract field — dual-read ignores it), is a migration WARN.
   const dr = obj.default_runtime ?? obj.runtime
   if (!isRuntime(dr)) {
     issues.push({ severity: 'error', field: 'default_runtime', message: `must be a valid runtime id, got "${String(dr ?? '')}"` })
   } else if (obj.default_runtime === undefined) {
     issues.push({ severity: 'warn', field: 'default_runtime', message: 'legacy field name `runtime` — standard is `default_runtime` (staged migration)' })
+  } else if (obj.runtime !== undefined && obj.runtime !== obj.default_runtime) {
+    issues.push({
+      severity: 'warn',
+      field: 'default_runtime',
+      message: `legacy mirror \`runtime\`="${String(obj.runtime)}" diverged from default_runtime="${String(obj.default_runtime)}" — default_runtime governs; re-run \`iapeer verify --fix\` to re-sync the mirror`,
+    })
   }
 
   // runtimes[] — array of valid runtime ids that includes the default_runtime.
@@ -106,14 +120,35 @@ export function validateProfileStandard(raw: unknown, cwd: string): ProfileIssue
   if (obj.interfaces !== undefined && (typeof obj.interfaces !== 'object' || obj.interfaces === null || Array.isArray(obj.interfaces))) {
     issues.push({ severity: 'error', field: 'interfaces', message: 'must be a JSON object' })
   }
-  // Legacy top-level aliases — contract relocates to interfaces.telegram.aliases with
-  // the /alias-* namespace (clean slash-keys are reserved for the control layer).
-  // telegram-runtime owns that migration; flagged, not an error.
+  // Legacy top-level aliases — contract relocates to the `expansion.aliases` plugin-
+  // config section with the /alias-* namespace (clean slash-keys are reserved for the
+  // control layer). telegram-runtime owns that migration; flagged, not an error.
   if (obj.aliases !== undefined) {
     issues.push({
       severity: 'warn',
       field: 'aliases',
-      message: 'legacy top-level `aliases` — contract relocates to interfaces.telegram.aliases (/alias-* namespace); telegram-runtime migration pending',
+      message: 'legacy top-level `aliases` — contract relocates to expansion.aliases (/alias-* namespace); owner migration pending',
+    })
+  }
+  // aliases misfiled in the PASSPORT (interfaces.telegram) — the 07.06 interim home.
+  // Taxonomy revision (11.06, Артур): aliases are PRIVATE plugin config (one reader,
+  // the chat-runtime at expansion), not a public passport attribute — the contract
+  // relocates them to the runtime-agnostic `expansion.aliases` section (25.05 замысел:
+  // future discord/matrix runtimes read the SAME aliases). Transition observability:
+  // this warn goes silent once the owner migration moves the data.
+  const interfacesObj =
+    obj.interfaces && typeof obj.interfaces === 'object' && !Array.isArray(obj.interfaces)
+      ? (obj.interfaces as Record<string, unknown>)
+      : undefined
+  const telegramSection =
+    interfacesObj?.telegram && typeof interfacesObj.telegram === 'object' && !Array.isArray(interfacesObj.telegram)
+      ? (interfacesObj.telegram as Record<string, unknown>)
+      : undefined
+  if (telegramSection?.aliases !== undefined) {
+    issues.push({
+      severity: 'warn',
+      field: 'interfaces.telegram.aliases',
+      message: 'aliases are plugin config, not passport — contract relocates to expansion.aliases; owner migration pending',
     })
   }
 
@@ -125,6 +160,38 @@ export function isConformant(issues: readonly ProfileIssue[]): boolean {
   return !issues.some(i => i.severity === 'error')
 }
 
+/**
+ * Phase-2 DATA migration of the staged default_runtime story: rewrite the LOCAL
+ * profile at `cwd` so it carries the contract field `default_runtime` with the legacy
+ * `runtime` kept as an in-sync mirror (writePeerProfileAtomic emits both since the
+ * write-flip). Heals BOTH legacy shapes: a profile with only `runtime`, and a DIVERGED
+ * mirror — the rewrite goes through readPeerProfile's dual-read, so default_runtime
+ * wins divergence (the contract: default_runtime governs the primary). Owner sections
+ * (interfaces / notifier / expansion / …), initial_prompt, wake_policy and the raw
+ * legacy intelligence vocab are preserved verbatim by the H1 merge-write. Returns true
+ * when the file was rewritten; false when already in shape, absent, or unparseable
+ * (verify reports those as errors — migration never guesses).
+ */
+export function migrateProfileRuntimeField(cwd: string): boolean {
+  const path = peerProfilePath(cwd)
+  if (!existsSync(path)) return false
+  let raw: unknown
+  try {
+    raw = JSON.parse(readFileSync(path, 'utf8'))
+  } catch {
+    return false
+  }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return false
+  const obj = raw as Record<string, unknown>
+  const inShape =
+    isRuntime(obj.default_runtime) && (obj.runtime === undefined || obj.runtime === obj.default_runtime)
+  if (inShape) return false
+  const profile = readPeerProfile(cwd)
+  if (!profile) return false
+  writePeerProfileAtomic(cwd, profile)
+  return true
+}
+
 /**
  * The PeerRecord the index SHOULD hold for the peer at `cwd`, projected from its LOCAL
  * profile (the self-heal source of truth) — readPeerProfile already self-heals the

package/src/lifecycle/lifecycle.test.ts

@@ -290,7 +290,11 @@ describe('wakeOrSpawn H4 refusal', () => {
 // ─────────────────────────────────────────────────────────────────────────────
 
 describe('wakeOrSpawn live-session fast path', () => {
-  test('READY with taskDelivered:false — the winning wake delivered only ITS envelope', async () => {
+  // Live tmux required (spawns a real session). Skipped where tmux is absent — a
+  // clean CI runner has none; the foundation's preversion gate runs it locally
+  // (this machine has tmux), so the release path keeps the coverage.
+  const tmuxAvailable = spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0
+  test.if(tmuxAvailable)('READY with taskDelivered:false — the winning wake delivered only ITS envelope', async () => {
     const root = mkdtempSync(join(tmpdir(), 'iapeer-fpl-root-'))
     const laDir = mkdtempSync(join(tmpdir(), 'iapeer-fpl-la-')) // empty → not launchd-managed
     const sockDir = join(root, 'socks')

package/src/registry/index.ts

@@ -159,7 +159,8 @@ function normalizePeer(raw: unknown): PeerRecord {
     )
   }
   // default_runtime is the contract field; `runtime` is legacy. Dual-read accepts
-  // both during the staged migration (write still emits `runtime` until Phase 2).
+  // both during the staged migration; when both are present default_runtime WINS
+  // (the write emits default_runtime + the legacy mirror since Phase 2).
   const defaultRuntime = obj.default_runtime ?? obj.runtime
   if (!isRuntime(defaultRuntime)) {
     throw new IapError(
@@ -314,9 +315,21 @@ function writePeersIndexAtomic(paths: PeersPaths, index: PeersIndex): void {
   // Persist the RAW intelligence verbatim (legacy-safe round-trip) and DROP the
   // intelligenceRaw shadow field from the on-disk shape — the file carries the
   // legacy vocab the live IAP reads, never the foundation's in-memory normalization.
+  // Phase-2 write-flip (staged default_runtime migration): the disk shape carries the
+  // contract field `default_runtime` PLUS the legacy `runtime` as an in-sync mirror,
+  // so not-yet-dual-read readers keep working. Phase 3 removes the mirror.
   const peersForDisk = [...index.peers]
     .sort((a, b) => a.personality.localeCompare(b.personality))
-    .map(({ intelligenceRaw, ...peer }) => ({ ...peer, intelligence: intelligenceRaw ?? peer.intelligence }))
+    .map(peer => ({
+      personality: peer.personality,
+      default_runtime: peer.runtime,
+      runtime: peer.runtime,
+      runtimes: peer.runtimes,
+      description: peer.description,
+      intelligence: peer.intelligenceRaw ?? peer.intelligence,
+      cwd: peer.cwd,
+      ...(peer.interfaces ? { interfaces: peer.interfaces } : {}),
+    }))
   const normalized = { version: PEERS_SCHEMA_VERSION, peers: peersForDisk }
   writeFileSync(tmp, `${JSON.stringify(normalized, null, 2)}\n`, { mode: 0o600 })
   renameSync(tmp, paths.peersFile)

package/src/transport/index.ts

@@ -487,6 +487,46 @@ function validateAttachments(value: readonly string[] = []): Result<string[]> {
   return ok(out)
 }
 
+// ─── Telegram-domain sender policy (defect track 11.06, sanctioned by Артур) ─
+
+/** A SENDER face in the telegram domain: a non-empty interfaces.telegram.bot (the
+ *  bot machine-key) in the peer's registry passport. Deliberately bot-ONLY, not
+ *  bot|user_id — the bridge picks the SENDING bot from the sender's bot key
+ *  (owner fact, telegram-runtime сверка 11.06): a user_id grants a receive/operator
+ *  identity but no ability to send, so a user_id-only sender passing the guard
+ *  would still die at the bridge — a late asynchronous failure where the guard
+ *  exists to give a synchronous one. The guard passes exactly what the bridge can
+ *  deliver. */
+export function hasTelegramPresence(record: PeerRecord): boolean {
+  const tg = record.interfaces?.telegram
+  if (!tg || typeof tg !== 'object' || Array.isArray(tg)) return false
+  const t = tg as Record<string, unknown>
+  return typeof t.bot === 'string' && t.bot.trim() !== ''
+}
+
+/** Sender policy for the telegram domain: a peer with NO declared telegram presence
+ *  must not write into it — the recipient (a human in Telegram) would face a message
+ *  from a peer that has no telegram face (identity confusion: who writes, by what
+ *  right?). Bot channel = declared presence; no presence — no right to the domain.
+ *  Enforced at the ROUTER, not the bridge: the refusal is synchronous and lands in
+ *  the sender's tool result; a bridge-side check would fire AFTER the router's
+ *  ok:true — a false-OK + silent loss, the class this contract forbids. Applied to
+ *  the INTENDED channel (override / target default — before any wake side-effect,
+ *  since a wake delivers the envelope as the boot first-message) AND to the RESOLVED
+ *  channel at both delivery points (the only-live-session fallback can land on
+ *  telegram without either). */
+function telegramSenderGuard(
+  caller: ResolvedCaller,
+  targetRuntime: string,
+  targetPersonality: string,
+): Result<void> {
+  if (targetRuntime !== 'telegram') return ok(undefined)
+  if (hasTelegramPresence(caller.record)) return ok(undefined)
+  return err(
+    `telegram policy: sender "${caller.personality}" has no telegram face (no interfaces.telegram.bot in its passport) — message to "${targetPersonality}" NOT delivered; route via a telegram-faced peer (e.g. boris) or provision a bot for this sender`,
+  )
+}
+
 /**
  * Route a send from a request-resolved caller to a target peer and deliver it.
  *  hit (live)  → build envelope from the CALLER → deliverViaTmux → {woke:false}
@@ -529,6 +569,12 @@ export async function routeSend(
     return err(`peer "${personality}" is not in the iapeer peers index; message NOT delivered`)
   }
 
+  // Telegram sender policy — INTENDED channel (explicit override, or the target's
+  // default). Checked BEFORE any wake side-effect: a wake delivers the envelope as
+  // the boot first-message, past the resolved-target guards further down.
+  const intendedGuard = telegramSenderGuard(caller, runtime ?? peer.runtime, personality)
+  if (!intendedGuard.ok) return intendedGuard
+
   // Built once — it is both the live-delivery payload and, on a miss, the wake
   // first-message (the woken session receives it as its boot task).
   const envelope = buildEnvelope({
@@ -554,6 +600,10 @@ export async function routeSend(
   const target = resolvePeerDeliveryTarget(personality, runtime, peer)
   if (target.ok) {
     if (target.value.address === caller.address) return err('cannot send to self')
+    // Telegram sender policy — RESOLVED channel (the only-live-session fallback can
+    // land on telegram without an override and without telegram being the default).
+    const liveGuard = telegramSenderGuard(caller, target.value.runtime, personality)
+    if (!liveGuard.ok) return liveGuard
     // peer.cwd enables the Ф-B transcript-mtime liveness probe (busy-session case).
     const delivered = deliverViaTmux(target.value, envelope, peer.cwd)
     if (!delivered.ok) return delivered
@@ -581,6 +631,11 @@ export async function routeSend(
     return err(`woke "${personality}" but the session is not live (verify-before-act): ${live.error.message}`)
   }
   if (live.value.address === caller.address) return err('cannot send to self')
+  // Telegram sender policy — post-wake RESOLVED channel (airtight: a wake should
+  // never bring up a telegram session — they are launchd-held — but the policy is
+  // enforced on every delivery point, not on an assumption about the wake).
+  const postWakeGuard = telegramSenderGuard(caller, live.value.runtime, personality)
+  if (!postWakeGuard.ok) return postWakeGuard
   // taskDelivered:false — the wake took the idempotent live-session fast path (a
   // CONCURRENT sender's boot won the wake.lock and delivered only ITS envelope as
   // the boot first-message). OUR envelope was not delivered by anything yet —

package/src/transport/routesend-wake.test.ts

@@ -17,7 +17,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
 import { spawnSync } from 'child_process'
-import { routeSend, type WakeFn } from './index.ts'
+import { hasTelegramPresence, routeSend, type WakeFn } from './index.ts'
 import type { ResolvedCaller } from '../identity/index.ts'
 import type { PeerRecord } from '../registry/index.ts'
 
@@ -25,6 +25,13 @@ let root: string
 let sockDir: string
 const prevRoot = process.env.IAPEER_ROOT
 
+// These suites spawn a REAL tmux session (the live-delivery path). Skip where
+// tmux is absent — a clean CI runner has none, and an unguarded live-tmux test
+// is what kept main's CI red (fail: "tmux new-session failed: null"). The
+// foundation's preversion gate runs the full suite locally (this machine has
+// tmux), so the release path keeps the live coverage; CI gates the rest.
+const tmuxAvailable = spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0
+
 // Target peer: NON-TUI runtime (telegram) → the C-j delivery path lands into a
 // plain `cat` pane with no TUI prompt machinery; capture-pane then shows the
 // envelope text verbatim.
@@ -41,6 +48,10 @@ const callerRecord = {
   description: '',
   intelligence: 'artificial',
   cwd: '/tmp/boris',
+  // Telegram sender policy: the target of these suites is a telegram peer, so the
+  // caller must declare a telegram presence (the bot machine-key) — these suites
+  // double as the "bot-faced sender delivers as before" half of the policy criterion.
+  interfaces: { telegram: { bot: 'boris' } },
 } as unknown as PeerRecord
 const caller: ResolvedCaller = {
   personality: 'boris',
@@ -91,7 +102,7 @@ afterAll(() => {
   rmSync(root, { recursive: true, force: true })
 })
 
-describe('routeSend wake fast-path (concurrent-sender envelope loss)', () => {
+describe.if(tmuxAvailable)('routeSend wake fast-path (concurrent-sender envelope loss)', () => {
   test('taskDelivered:false → routeSend delivers the envelope itself via the live path', async () => {
     const marker = 'SECOND-SENDER-ENVELOPE-7741'
     // The loser-of-the-lock outcome: the session is up (the WINNING wake booted it),
@@ -145,7 +156,7 @@ describe('routeSend wake fast-path (concurrent-sender envelope loss)', () => {
 // one it woke with (defect 11.06: stale wake-time marker → false fresh).
 // ─────────────────────────────────────────────────────────────────────────────
 
-describe('routeSend noteLiveTopic seam (live-delivered topic)', () => {
+describe.if(tmuxAvailable)('routeSend noteLiveTopic seam (live-delivered topic)', () => {
   test('live hit with a topic → hook fired ONCE with the TARGET identity + topic', async () => {
     startTargetSession()
     const notes: Array<[string, string]> = []
@@ -206,3 +217,89 @@ describe('routeSend noteLiveTopic seam (live-delivered topic)', () => {
     killTargetSession()
   })
 })
+
+// ─── Telegram sender policy (defect track 11.06) ─────────────────────────────
+// A sender with NO declared telegram presence (interfaces.telegram.bot|user_id)
+// must get a SYNCHRONOUS refusal when the delivery channel is telegram — the
+// incident class: the bridge silently dropped such envelopes while the router
+// reported ok:true. The bot-faced "delivers as before" half of the criterion is
+// carried by the suites above (their caller declares interfaces.telegram.bot).
+
+const facelessCaller: ResolvedCaller = {
+  personality: 'ghost',
+  runtime: 'claude',
+  address: 'claude-ghost',
+  description: '',
+  intelligence: 'artificial',
+  cwd: '/tmp/ghost',
+  record: {
+    personality: 'ghost',
+    runtime: 'claude',
+    runtimes: ['claude'],
+    description: '',
+    intelligence: 'artificial',
+    cwd: '/tmp/ghost',
+  } as unknown as PeerRecord,
+}
+
+describe('telegram sender policy — hasTelegramPresence', () => {
+  const rec = (tg: unknown): PeerRecord =>
+    ({ personality: 'x', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial', cwd: '/tmp/x', ...(tg !== undefined ? { interfaces: { telegram: tg } } : {}) }) as unknown as PeerRecord
+  test('bot machine-key (agent peers) → sender face present', () => {
+    expect(hasTelegramPresence(rec({ bot: 'boris' }))).toBe(true)
+  })
+  test('user_id alone (natural peers — arthur) → NO sender face: the bridge sends FROM the bot key; user_id is a receive/operator identity (owner fact, bot-only predicate)', () => {
+    expect(hasTelegramPresence(rec({ user_id: '409502965' }))).toBe(false)
+    expect(hasTelegramPresence(rec({ user_id: 409502965 }))).toBe(false)
+  })
+  test('no interfaces / no telegram / empty bot → absent', () => {
+    expect(hasTelegramPresence(rec(undefined))).toBe(false)
+    expect(hasTelegramPresence(rec({}))).toBe(false)
+    expect(hasTelegramPresence(rec({ bot: '' }))).toBe(false)
+    expect(hasTelegramPresence(rec({ bot: '  ' }))).toBe(false)
+    expect(hasTelegramPresence(rec({ aliases: { '/alias-new': 'x' } }))).toBe(false)
+  })
+})
+
+describe('telegram sender policy — routeSend refusal', () => {
+  test('INTENDED channel (target default = telegram, peer offline): refused BEFORE the wake — wake never invoked', async () => {
+    let wakeCalled = false
+    const wake: WakeFn = async () => {
+      wakeCalled = true
+      return { status: 'READY', woke: true, runtime: 'telegram', taskDelivered: true }
+    }
+    const r = await routeSend(facelessCaller, { personality: TARGET, message: 'm' }, { wake })
+    expect(r.ok).toBe(false)
+    if (!r.ok) {
+      expect(r.error.message).toContain('telegram policy')
+      expect(r.error.message).toContain('"ghost"')
+      expect(r.error.message).toContain('NOT delivered')
+    }
+    expect(wakeCalled).toBe(false)
+  })
+
+  test('explicit runtime=telegram override: refused with the policy line, not "offline"', async () => {
+    const r = await routeSend(facelessCaller, { personality: TARGET, runtime: 'telegram', message: 'm' })
+    expect(r.ok).toBe(false)
+    if (!r.ok) expect(r.error.message).toContain('telegram policy')
+  })
+})
+
+describe.if(tmuxAvailable)('telegram sender policy — live telegram session', () => {
+  test('faceless sender + LIVE telegram target → refused, envelope NEVER reaches the pane', async () => {
+    startTargetSession()
+    const r = await routeSend(facelessCaller, { personality: TARGET, message: 'POLICY-MUST-BLOCK' })
+    expect(r.ok).toBe(false)
+    if (!r.ok) expect(r.error.message).toContain('telegram policy')
+    expect(capturePane()).not.toContain('POLICY-MUST-BLOCK')
+    killTargetSession()
+  })
+
+  test('bot-faced sender (boris) + LIVE telegram target → delivered as before', async () => {
+    startTargetSession()
+    const r = await routeSend(caller, { personality: TARGET, message: 'BOT-FACED-OK' })
+    expect(r.ok).toBe(true)
+    expect(capturePane()).toContain('BOT-FACED-OK')
+    killTargetSession()
+  })
+})