@delorenj/pjangler 1.2.21 → 1.2.25

package/templates/hermes-agent/template/.scripts/20-runtime-repo.sh

@@ -1,147 +1,94 @@
 #!/usr/bin/env bash
-# Create the per-agent runtime GitHub repo, init from scaffold, submodule it.
+# Provision the per-agent, pure-local Hermes runtime without creating a Git
+# repository or a project submodule. Runtime durability belongs to Hindsight;
+# this directory may contain secrets and mutable agent state (PJAN-41).
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
-already_done 20-runtime-repo && { log "[20] runtime repo already set up — skipping"; exit 0; }
-[[ "${SKIP_RUNTIME_REPO:-0}" == "1" ]] && { log "[20] runtime repo — SKIPPED (SKIP_RUNTIME_REPO=1)"; mark_done 20-runtime-repo; exit 0; }
+already_done 20-runtime-repo && { log "[20] local runtime already set up — skipping"; exit 0; }
+[[ "${SKIP_RUNTIME_REPO:-0}" == "1" ]] && { log "[20] local runtime — SKIPPED (SKIP_RUNTIME_REPO=1)"; mark_done 20-runtime-repo; exit 0; }
 
 PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
 RUNTIME_LOCAL="$ROLE_DIR/runtime"
-GH_OWNER="${RUNTIME_REPO%%/*}"
-GH_NAME="${RUNTIME_REPO##*/}"
+PROJECT_PATH="$(project_repo_path)" || die "no project git root"
+REL_ROLE_PATH="$(realpath --relative-to="$PROJECT_PATH" "$ROLE_DIR")"
+REL_RUNTIME_PATH="${REL_ROLE_PATH}/runtime"
 
-log "[20] runtime repo: gh:$RUNTIME_REPO"
+log "[20] local runtime: $RUNTIME_LOCAL"
 
-# 1. Create the GitHub repo (private) if it doesn't exist
-if gh repo view "$RUNTIME_REPO" >/dev/null 2>&1; then
-  log "    GH repo exists; reusing"
-else
-  log "    creating GH repo (private)"
-  gh repo create "$RUNTIME_REPO" --private \
-    --description "Hermes runtime (HERMES_HOME) for $AGENT_ID — auto-checkpointed memory + state" \
-    --disable-issues --disable-wiki >/dev/null
+# Fail closed if an older installation still models runtime as a project
+# submodule. `pjangler migrate` performs the non-destructive index transition;
+# this provisioner never removes or rewrites an existing nested repository.
+if git -C "$PROJECT_PATH" ls-files --stage -- "$REL_RUNTIME_PATH" | grep -q '^160000 '; then
+  die "$REL_RUNTIME_PATH is still a tracked gitlink; run 'pjangler migrate' before provisioning"
+fi
+if [[ -f "$PROJECT_PATH/.gitmodules" ]] &&
+   git -C "$PROJECT_PATH" config -f .gitmodules --get-regexp '^submodule\..*\.path$' 2>/dev/null |
+     awk -v expected="$REL_RUNTIME_PATH" '$2 == expected { found=1 } END { exit !found }'; then
+  die "$REL_RUNTIME_PATH still has a stale .gitmodules mapping; run 'pjangler migrate' before provisioning"
 fi
 
-REMOTE_URL=$(gh repo view "$RUNTIME_REPO" --json sshUrl -q .sshUrl)
-
-# 2. Check if remote already has commits — if so, skip the scaffold push.
-#    This makes the step idempotent across failed-run retries.
-if git ls-remote --heads "$REMOTE_URL" 2>/dev/null | grep -q refs/heads; then
-  log "    remote already has commits — skipping scaffold push"
-  REMOTE_HAS_CONTENT=1
-else
-  REMOTE_HAS_CONTENT=0
+mkdir -p "$RUNTIME_LOCAL"
+if [[ -e "$RUNTIME_LOCAL/.git" ]]; then
+  warn "    existing nested runtime repository preserved; no fetch, commit, or push will be attempted"
 fi
 
-# 2a. Stage the runtime scaffold into a tmp dir (only if remote is empty)
-TMP=$(mktemp -d)
-log "    populating scaffold in $TMP"
+# Render the scaffold in a temporary directory, then copy only missing paths.
+# Existing memory, configuration, credentials, and sessions always win.
+TMP="$(mktemp -d)"
+cleanup() { rm -rf -- "$TMP"; }
+trap cleanup EXIT
 cp -a "$RUNTIME_SCAFFOLD_DIR/." "$TMP/"
-
-# Render scaffold templates with role-specific values
 python3 - "$TMP" "$AGENT_ID" "$REPO" "$ROLE" "$DISPLAY_NAME" <<'PYEOF'
-import sys, pathlib, re
+import pathlib
+import sys
+
 root, agent_id, repo, role, display = sys.argv[1:6]
 root = pathlib.Path(root)
 mapping = {
-    "{{agent_id}}": agent_id, "{{repo}}": repo, "{{role}}": role,
+    "{{agent_id}}": agent_id,
+    "{{repo}}": repo,
+    "{{role}}": role,
     "{{display_name}}": display,
 }
-for p in root.rglob("*"):
-    if p.is_file() and p.suffix in (".md", ".yaml", ".yml", ".sh", ".py", ".gitignore", ".gitattributes"):
+for path in root.rglob("*"):
+    if path.is_file() and path.suffix in (".md", ".yaml", ".yml", ".sh", ".py", ".gitignore", ".gitattributes"):
         try:
-            t = p.read_text()
-            for k, v in mapping.items(): t = t.replace(k, v)
-            p.write_text(t)
+            text = path.read_text()
+            for source, target in mapping.items():
+                text = text.replace(source, target)
+            path.write_text(text)
         except UnicodeDecodeError:
             pass
 PYEOF
+cp -an "$TMP/." "$RUNTIME_LOCAL/"
 
-# 3. Seed the runtime config from the canonical PM config — the fleet's single
-#    config source of truth (defaults to the global ~/.hermes/config.yaml). This
-#    is a provision-time snapshot; Hermes loads $HERMES_HOME/config.yaml directly
-#    (there is no live profile inheritance). Override via config.toml
-#    [fleet].canonical_pm_config to share one curated PM config across all repos.
+# Seed mutable identity/config only when no local value exists.
 CANONICAL_PM_CONFIG="$(config_get fleet.canonical_pm_config "$HOME/.hermes/config.yaml")"
-if [[ -f "$CANONICAL_PM_CONFIG" ]]; then
-  cp "$CANONICAL_PM_CONFIG" "$TMP/config.yaml"
-fi
-# Copy the project's SOUL.md as the canonical starting personality.
-cp "$ROLE_DIR/SOUL.md" "$TMP/SOUL.md"
-
-# 4. Git init + LFS + initial commit + push (skip if remote already has content)
-if [[ "$REMOTE_HAS_CONTENT" == "0" ]]; then
-  (
-    cd "$TMP"
-    git init -b main >/dev/null
-    git lfs install --local >/dev/null 2>&1 || warn "git-lfs not installed; sessions.db will commit as raw binary"
-    git lfs track "*.db" >/dev/null 2>&1 || true
-    git lfs track "*.sqlite" >/dev/null 2>&1 || true
-    git add -A
-    git -c commit.gpgsign=false commit -m "Initial scaffold for $AGENT_ID" >/dev/null
-    git remote add origin "$REMOTE_URL"
-    git push -u origin main 2>&1 | tail -3
-  )
-fi
-
-# 5. Submodule-add into the role dir
-PROJECT_PATH="$(project_repo_path)" || die "no project git root"
-# Compute relative path from the ROLE dir (which exists), then append /runtime
-REL_ROLE_PATH="$(realpath --relative-to="$PROJECT_PATH" "$ROLE_DIR")"
-REL_SUBMODULE_PATH="${REL_ROLE_PATH}/runtime"
-log "    adding submodule at $REL_SUBMODULE_PATH"
-
-# Idempotent: if the submodule is already registered, just update it.
-# This handles re-runs where the .done marker was cleared or copier
-# --overwrite regenerated the scripts.
-SUBMODULE_ALREADY_REGISTERED=0
-if git -C "$PROJECT_PATH" submodule status "$REL_SUBMODULE_PATH" >/dev/null 2>&1; then
-  SUBMODULE_ALREADY_REGISTERED=1
+if [[ -f "$CANONICAL_PM_CONFIG" && ! -e "$RUNTIME_LOCAL/config.yaml" ]]; then
+  cp "$CANONICAL_PM_CONFIG" "$RUNTIME_LOCAL/config.yaml"
 fi
-
-if [[ "$SUBMODULE_ALREADY_REGISTERED" == "1" ]]; then
-  log "    submodule already registered — updating"
-  (
-    cd "$PROJECT_PATH"
-    # If the local dir is missing (e.g. previous rm -rf), re-init it
-    if [[ ! -d "$REL_SUBMODULE_PATH/.git" ]]; then
-      git submodule update --init "$REL_SUBMODULE_PATH" 2>&1 | tail -3
-    fi
-  )
-else
-  # Clean any leftover untracked directory before adding
-  rm -rf "$RUNTIME_LOCAL"
-  (
-    cd "$PROJECT_PATH"
-    # -f forces the add even if a repo .gitignore matches the runtime path
-    # (e.g. a stray `runtime/` rule). The runtime is a tracked submodule gitlink,
-    # never ignored content, so forcing past .gitignore is always correct here.
-    git submodule add -f "$REMOTE_URL" "$REL_SUBMODULE_PATH" 2>&1 | tail -3
-  )
+if [[ ! -e "$RUNTIME_LOCAL/SOUL.md" ]]; then
+  cp "$ROLE_DIR/SOUL.md" "$RUNTIME_LOCAL/SOUL.md"
 fi
 
-# 6. Fold the staging profile state into the runtime, then symlink the profile
-# name AT the runtime. HERMES_HOME is the runtime submodule, but the profile
-# symlink is LOAD-BEARING: hermes resolves agents launched as
-# `hermes --profile <name>` through ~/.hermes/profiles/<name> (and recreates it
-# as a fresh standalone dir if it's missing, disconnecting the agent from its
-# runtime), so that name MUST resolve to the runtime.
-PROFILE_HOME="$HOME/.hermes/profiles/$PROFILE_NAME"
+# Fold the two supported staging-profile files into the runtime without
+# deleting unknown profile content. Unknown content blocks the symlink so an
+# operator can reconcile it explicitly instead of losing state.
 if [[ -d "$PROFILE_HOME" && ! -L "$PROFILE_HOME" ]]; then
-  log "    migrating staging profile state into the runtime submodule"
-  # OAuth provider credentials are fleet-shared via HERMES_OAUTH_FILE, so do not
-  # clone auth.json/auth.lock into each runtime.
-  for f in .env config.yaml; do
-    [[ -f "$PROFILE_HOME/$f" && ! -e "$RUNTIME_LOCAL/$f" ]] && cp "$PROFILE_HOME/$f" "$RUNTIME_LOCAL/$f"
+  log "    migrating supported staging profile state into the local runtime"
+  for file_name in .env config.yaml; do
+    [[ -f "$PROFILE_HOME/$file_name" && ! -e "$RUNTIME_LOCAL/$file_name" ]] && cp "$PROFILE_HOME/$file_name" "$RUNTIME_LOCAL/$file_name"
+    [[ -f "$PROFILE_HOME/$file_name" ]] && rm -f -- "$PROFILE_HOME/$file_name"
   done
-  rm -rf "$PROFILE_HOME"
+  if ! rmdir "$PROFILE_HOME" 2>/dev/null; then
+    die "staging profile contains unrecognized state and was preserved: $PROFILE_HOME"
+  fi
 fi
 ln -sfn "$RUNTIME_LOCAL" "$PROFILE_HOME"
 log "    profile symlink $PROFILE_HOME -> $RUNTIME_LOCAL"
 
-# Apply the one genuine per-repo config delta directly to the runtime config.
 env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set terminal.cwd "$PROJECT_PATH" >/dev/null 2>&1 || true
 
 if [[ "$ROLE" == "pm" ]]; then
@@ -164,25 +111,4 @@ if [[ "$ROLE" == "pm" ]]; then
   fi
 fi
 
-if [[ "$ROLE" == "pm" ]]; then
-  VOXXY_PLUGIN_DIR="${VOXXY_PLUGIN_DIR:-$(config_get fleet.voxxy_plugin_dir "$HOME/code/voxxy/plugins/tts/voxxy")}"
-  if [[ -d "$VOXXY_PLUGIN_DIR" ]]; then
-    mkdir -p "$RUNTIME_LOCAL/plugins/tts"
-    ln -sfn "$VOXXY_PLUGIN_DIR" "$RUNTIME_LOCAL/plugins/tts/voxxy"
-    log "    linked Voxxy plugin into runtime"
-  else
-    warn "    Voxxy plugin dir missing: $VOXXY_PLUGIN_DIR"
-  fi
-
-  if [[ -x "$HERMES_BIN" ]]; then
-    env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set plugins.enabled.0 tts/voxxy >/dev/null 2>&1 || true
-    env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set tts.provider voxxy >/dev/null 2>&1 || true
-    env HERMES_HOME="$RUNTIME_LOCAL" "$HERMES_BIN" config set tts.voice rick >/dev/null 2>&1 || true
-    log "    set PM runtime TTS provider -> voxxy"
-  else
-    warn "    Hermes bin missing; skipped PM Voxxy config"
-  fi
-fi
-
-rm -rf "$TMP"
 mark_done 20-runtime-repo

package/templates/hermes-agent/template/.scripts/30-telegram.sh

@@ -1,18 +1,64 @@
 #!/usr/bin/env bash
 # Capture a BotFather token and wire it into the runtime profile.
+#
+# Telegram credentials are invocation-only inputs. Capture them before _lib.sh
+# sources fleet.env so a token parked in shared fleet state can never provision
+# or be silently reused by a profile. The non-secret allow-list may be shared.
+INVOCATION_TELEGRAM_BOT_TOKEN="${TELEGRAM_BOT_TOKEN-}"
+INVOCATION_TELEGRAM_ALLOWED_USERS="${TELEGRAM_ALLOWED_USERS-}"
+
 # shellcheck source=_lib.sh
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
+TELEGRAM_BOT_TOKEN="$INVOCATION_TELEGRAM_BOT_TOKEN"
+if [[ -n "$INVOCATION_TELEGRAM_ALLOWED_USERS" ]]; then
+  TELEGRAM_ALLOWED_USERS="$INVOCATION_TELEGRAM_ALLOWED_USERS"
+else
+  TELEGRAM_ALLOWED_USERS="${TELEGRAM_ALLOWED_USERS-}"
+fi
+unset INVOCATION_TELEGRAM_BOT_TOKEN INVOCATION_TELEGRAM_ALLOWED_USERS
+
+telegram_yaml_update() {
+  python3 - "$ROLE_YAML" "$@" <<'PYEOF'
+import json
+import pathlib
+import re
+import sys
+
+path = pathlib.Path(sys.argv[1])
+updates = dict(zip(sys.argv[2::2], sys.argv[3::2]))
+text = path.read_text(encoding="utf-8")
+match = re.search(r"(?ms)^telegram:\s*\n(?P<body>(?:^[ \t]+.*\n?)*)", text)
+if not match:
+    raise SystemExit(f"telegram metadata block missing from {path}")
+body = match.group("body")
+for key, value in updates.items():
+    replacement = f"  {key}: {json.dumps(value)}"
+    body, count = re.subn(
+        rf"(?m)^\s+{re.escape(key)}:\s*.*$", lambda _: replacement, body, count=1
+    )
+    if count == 0:
+        if body and not body.endswith("\n"):
+            body += "\n"
+        body += replacement + "\n"
+path.write_text(text[: match.start("body")] + body + text[match.end("body") :], encoding="utf-8")
+PYEOF
+}
+
 already_done 30-telegram && { log "[30] telegram already wired — skipping"; exit 0; }
 
 if [[ "${SKIP_TELEGRAM:-0}" == "1" ]]; then
+  telegram_yaml_update provisioning_status disabled
   log "[30] telegram — SKIPPED (SKIP_TELEGRAM=1)"
   mark_done 30-telegram
   exit 0
 fi
 
 RUNTIME="$ROLE_DIR/runtime"
+ENVF="$RUNTIME/.env"
+mkdir -p "$RUNTIME"
+[[ ! -L "$ENVF" ]] || die "refusing to write Telegram credentials through symlink: $ENVF"
 
 cat >&2 <<EOF
 
@@ -28,14 +74,15 @@ cat >&2 <<EOF
 
 EOF
 
-if [[ -z "${TELEGRAM_BOT_TOKEN:-}" ]]; then
+if [[ -z "${TELEGRAM_BOT_TOKEN:-}" && -t 0 ]]; then
   read -r -s -p "Paste the bot token for @$BOT_HANDLE (or empty to skip): " TELEGRAM_BOT_TOKEN
   echo >&2
 fi
 
 if [[ -z "${TELEGRAM_BOT_TOKEN:-}" ]]; then
+  telegram_yaml_update provisioning_status deferred
   warn "    no token provided; Telegram step deferred"
-  warn "    re-run later:  cd $ROLE_DIR && SKIP_TELEGRAM=0 ./.scripts/30-telegram.sh"
+  warn "    re-run later with a profile-dedicated TELEGRAM_BOT_TOKEN invocation"
   exit 0
 fi
 
@@ -44,37 +91,244 @@ if [[ ! "$TELEGRAM_BOT_TOKEN" =~ ^[0-9]+:.+ ]]; then
   die "token doesn't look like a Telegram bot token"
 fi
 log "    verifying token..."
-info=$(curl -sS "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/getMe")
-echo "$info" | grep -q '"ok":true' || die "Telegram rejected the token: $info"
-bot_username=$(echo "$info" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['username'])")
-bot_id=$(echo "$info"       | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['id'])")
+info=$(curl -fsS "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/getMe") \
+  || die "Telegram getMe request failed"
+identity=$(printf '%s' "$info" | python3 -c '
+import json, sys
+try:
+    data = json.load(sys.stdin)
+except Exception:
+    raise SystemExit("Telegram getMe returned an invalid response")
+result = data.get("result") or {}
+if not data.get("ok") or not result.get("id") or not result.get("username"):
+    raise SystemExit("Telegram rejected the bot token or omitted identity fields")
+print("{}\t{}".format(
+    result.get("id"), str(result.get("username")).replace(chr(9), " ").replace(chr(10), " ")
+))
+') || die "Telegram bot identity verification failed"
+IFS=$'\t' read -r bot_id bot_username <<< "$identity"
 log "    verified: @$bot_username (id=$bot_id)"
 
-# Resolve operator's allowed user id
+# Resolve operator's allowed user id before taking the fleet claim lock.
 if [[ -z "${TELEGRAM_ALLOWED_USERS:-}" && -f "$HOME/.hermes/.env" ]]; then
   TELEGRAM_ALLOWED_USERS=$(grep -E '^[[:space:]]*#?[[:space:]]*TELEGRAM_ALLOWED_USERS=' "$HOME/.hermes/.env" \
     | tail -1 | sed -E 's/^[[:space:]]*#?[[:space:]]*TELEGRAM_ALLOWED_USERS=//; s/^"//; s/"$//')
 fi
-if [[ -z "${TELEGRAM_ALLOWED_USERS:-}" ]]; then
+if [[ -z "${TELEGRAM_ALLOWED_USERS:-}" && -t 0 ]]; then
   read -r -p "Your Telegram user id (allow-list for this bot): " TELEGRAM_ALLOWED_USERS
 fi
+if [[ -z "${TELEGRAM_ALLOWED_USERS:-}" ]]; then
+  warn "    Telegram is wired but denies all inbound users until TELEGRAM_ALLOWED_USERS is set"
+fi
 
-# Write into runtime/.env (this is HERMES_HOME for the agent)
-ENVF="$RUNTIME/.env"
-python3 - "$ENVF" "$TELEGRAM_BOT_TOKEN" "$TELEGRAM_ALLOWED_USERS" <<'PYEOF'
-import sys, pathlib, re
-path, token, allowed = sys.argv[1:4]
-p = pathlib.Path(path); p.parent.mkdir(parents=True, exist_ok=True)
-text = p.read_text() if p.exists() else ""
-for var in ("TELEGRAM_BOT_TOKEN","TELEGRAM_ALLOWED_USERS"):
-    text = re.sub(rf"(?m)^\s*#?\s*{var}=.*\n", "", text)
-text = text.rstrip() + "\n" + f'TELEGRAM_BOT_TOKEN="{token}"\nTELEGRAM_ALLOWED_USERS="{allowed}"\n'
-p.write_text(text)
+# Reject token reuse, token rotation onto an identity owned by another agent,
+# and credentials parked in shared fleet/root env files. The scan, durable
+# identity claim, and profile credential write share one fleet-wide flock.
+export TELEGRAM_BOT_TOKEN TELEGRAM_ALLOWED_USERS
+fleet_lock_acquire
+trap 'fleet_lock_release' EXIT
+python3 - "$REGISTRY_FILE" "$FLEET_ENV" "$ENVF" "$AGENT_ID" "$bot_id" \
+  "$ROLE_DIR" "$PROFILE_NAME" "$bot_username" <<'PYEOF'
+import errno
+import os
+import pathlib
+import re
+import sys
+import tempfile
+try:
+    import yaml  # type: ignore
+except ImportError:
+    raise SystemExit("PyYAML is required for Telegram fleet claims")
+
+(
+    registry_path,
+    fleet_path,
+    target_path,
+    agent_id,
+    bot_id,
+    role_dir,
+    profile_name,
+    bot_username,
+) = sys.argv[1:]
+token = os.environ["TELEGRAM_BOT_TOKEN"]
+target = pathlib.Path(target_path).resolve(strict=False)
+
+def env_token(path):
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeError):
+        return None
+    match = re.search(
+        r"(?m)^\s*(?:export\s+)?TELEGRAM_BOT_TOKEN\s*=\s*(.*)$", text
+    )
+    if not match:
+        return None
+    value = match.group(1).strip()
+    if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+        value = value[1:-1]
+    return value
+
+owners = [("shared fleet environment", pathlib.Path(fleet_path))]
+registry = pathlib.Path(registry_path)
+if registry.is_symlink():
+    raise SystemExit(f"refusing to update registry symlink: {registry}")
+data = {"schema_version": 1, "agents": {}}
+if registry.is_file():
+    try:
+        data = yaml.safe_load(registry.read_text(encoding="utf-8")) or data
+    except Exception as exc:
+        raise SystemExit(f"cannot safely inspect Telegram ownership registry: {type(exc).__name__}")
+if not isinstance(data, dict) or not isinstance(data.get("agents", {}), dict):
+    raise SystemExit("cannot safely inspect Telegram ownership registry: invalid agents mapping")
+agents = data.setdefault("agents", {})
+for other_id, entry in agents.items():
+    if other_id == agent_id or not isinstance(entry, dict):
+        continue
+    telegram = entry.get("telegram") or {}
+    if isinstance(telegram, dict) and str(telegram.get("bot_id") or "") == bot_id:
+        raise SystemExit(f"Telegram bot identity is already assigned to agent {other_id}")
+    other_role_dir = entry.get("role_dir")
+    if other_role_dir:
+        owners.append((f"agent {other_id}", pathlib.Path(str(other_role_dir)) / "runtime" / ".env"))
+
+home_value = os.environ.get("HOME", "")
+if home_value:
+    home = pathlib.Path(home_value)
+    owners.append(("shared Hermes root", home / ".hermes" / ".env"))
+    profiles = home / ".hermes" / "profiles"
+    if profiles.is_dir():
+        for profile in profiles.iterdir():
+            owners.append((f"profile {profile.name}", profile / ".env"))
+
+seen = set()
+for owner, path in owners:
+    resolved = path.resolve(strict=False)
+    if resolved == target or resolved in seen:
+        continue
+    seen.add(resolved)
+    if env_token(path) == token:
+        raise SystemExit(f"Telegram bot token is already assigned to {owner}")
+
+claim = agents.setdefault(agent_id, {})
+if not isinstance(claim, dict):
+    raise SystemExit(f"registry entry for {agent_id} is not a mapping")
+claim["role_dir"] = role_dir
+claim["profile_name"] = profile_name
+claim["telegram"] = {
+    "provisioning_status": "verified",
+    "bot_username": bot_username,
+    "bot_id": bot_id,
+}
+registry.parent.mkdir(parents=True, exist_ok=True)
+rendered = yaml.safe_dump(data, sort_keys=False)
+
+def fsync_parent(target):
+    unsupported = {errno.EINVAL, getattr(errno, "ENOTSUP", errno.EINVAL), errno.ENOSYS}
+    flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
+    try:
+        directory_fd = os.open(target.parent, flags)
+    except OSError as exc:
+        if exc.errno in unsupported:
+            return
+        raise
+    try:
+        try:
+            os.fsync(directory_fd)
+        except OSError as exc:
+            if exc.errno not in unsupported:
+                raise
+    finally:
+        os.close(directory_fd)
+
+fd, temporary = tempfile.mkstemp(prefix=f".{registry.name}.telegram-", dir=registry.parent)
+try:
+    os.fchmod(fd, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        handle.write(rendered)
+        handle.flush()
+        os.fsync(handle.fileno())
+    os.replace(temporary, registry)
+    os.chmod(registry, 0o600)
+    fsync_parent(registry)
+except BaseException:
+    try:
+        os.unlink(temporary)
+    except FileNotFoundError:
+        pass
+    raise
 PYEOF
-chmod 600 "$ENVF"
 
-# Update role.yaml with the real bot username (in case it differs from the slug)
-yaml_set telegram.bot_username "$bot_username"
+# Atomically replace only Telegram fields in the profile-local runtime file.
+export TELEGRAM_ALLOWED_USERS
+python3 - "$ENVF" <<'PYEOF'
+import errno
+import json
+import os
+import pathlib
+import re
+import sys
+import tempfile
+
+path = pathlib.Path(sys.argv[1])
+if path.is_symlink():
+    raise SystemExit(f"refusing to write Telegram credentials through symlink: {path}")
+path.parent.mkdir(parents=True, exist_ok=True)
+text = path.read_text(encoding="utf-8") if path.exists() else ""
+for key in ("TELEGRAM_BOT_TOKEN", "TELEGRAM_ALLOWED_USERS"):
+    text = re.sub(rf"(?m)^\s*(?:export\s+)?#?\s*{key}\s*=.*(?:\n|$)", "", text)
+text = text.rstrip("\n")
+if text:
+    text += "\n"
+text += "".join(
+    f"{key}={json.dumps(os.environ.get(key, ''))}\n"
+    for key in ("TELEGRAM_BOT_TOKEN", "TELEGRAM_ALLOWED_USERS")
+)
+
+def fsync_parent(target):
+    unsupported = {errno.EINVAL, getattr(errno, "ENOTSUP", errno.EINVAL), errno.ENOSYS}
+    flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
+    try:
+        directory_fd = os.open(target.parent, flags)
+    except OSError as exc:
+        if exc.errno in unsupported:
+            return
+        raise
+    try:
+        try:
+            os.fsync(directory_fd)
+        except OSError as exc:
+            if exc.errno not in unsupported:
+                raise
+    finally:
+        os.close(directory_fd)
+
+fd, temporary = tempfile.mkstemp(prefix=".env.telegram-", dir=path.parent)
+try:
+    os.fchmod(fd, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        handle.write(text)
+        handle.flush()
+        os.fsync(handle.fileno())
+    os.replace(temporary, path)
+    os.chmod(path, 0o600)
+    fsync_parent(path)
+except BaseException:
+    try:
+        os.unlink(temporary)
+    except FileNotFoundError:
+        pass
+    raise
+PYEOF
+unset TELEGRAM_BOT_TOKEN
+
+# Record the verified identity, never the token.
+telegram_yaml_update \
+  provisioning_status verified \
+  bot_username "$bot_username" \
+  bot_id "$bot_id"
+
+fleet_lock_release
+trap - EXIT
 
 # Enable telegram toolset for the profile
 env HERMES_HOME="$RUNTIME" "$HERMES_BIN" tools enable telegram hermes-telegram 2>/dev/null \