moving

docs/addictiveness-audit-2026-05-28/ITER-3-RESULTS.md

@@ -0,0 +1,53 @@
+# Iteration 3 Results — 2026-05-28 (FR-2 plumbing)
+
+## Shipped this iteration
+
+### FR-2 · Telegram outbound digest (server-side plumbing)
+**Files:**
+- `packages/server/src/local/routes/telegram.ts` (new) — 4 endpoints
+- `packages/server/src/local/index.ts` — registered
+
+**Endpoints (smoke-verified):**
+| Method | Path | Purpose | Verified |
+|---|---|---|---|
+| `GET` | `/api/telegram/status` | reports `{configured, hasToken, hasChatId}` | `{"configured":false,"hasToken":false,"hasChatId":false}` ✓ |
+| `POST` | `/api/telegram/config` | save `{botToken, chatId}` to vault | bad-token reject 400 with format hint ✓ |
+| `POST` | `/api/telegram/test` | send "Waggle is connected ✓" | 400 "not configured" pre-config ✓ |
+| `POST` | `/api/telegram/send` | push arbitrary text — the integration point for ScheduledJobs | shipped, not invoked from UI yet |
+
+**Validation:**
+- Bot token pattern: `/^\d{6,12}:[A-Za-z0-9_-]{30,}$/`
+- Chat ID pattern: `/^-?\d{4,18}$/` (signed integer string, negative for groups)
+- Text capped at 4096 chars (Telegram's own limit, rejected client-side before API hit)
+
+**Security:**
+- URL is `https://api.telegram.org/bot${token}/sendMessage` — host is hard-coded, token is interpolated into the path of a fixed host → no SSRF surface
+- Token + chat_id stored in vault under `telegram_bot_token` + `telegram_chat_id` (credentialType: api_key)
+- No webhook receiver — pure outbound — so no public-endpoint exposure
+
+## What's NOT shipped (honest scope)
+- **Settings UI tile** — user has to `curl POST /api/telegram/config` today. Self-serve UX requires a tile in SettingsApp.tsx.
+- **ScheduledJobs output channel** — the `/api/telegram/send` endpoint exists but isn't called by any scheduled job. The persona-level "daily digest" workflow needs ScheduledJobs to grow a "send result to Telegram" dropdown.
+- **No score movement until the above land.** Plumbing-only means a power user could wire it themselves; persona uplift requires the UI loop.
+
+## Score movement (honest: zero this iter)
+Same 5.9/10 average as iter-2. The wiring is in place; the score-move comes when ScheduledJobs uses it.
+
+## Next iteration candidates
+- **FR-2 §UI · Settings tile** (~30 min) — input fields, save button, test button, status pill. Closes the self-serve gap.
+- **FR-2 §UI · ScheduledJobs output channel** (~1-2 hr) — dropdown on the job-create form, server-side branch in the scheduler runtime to POST results to `/api/telegram/send`. Closes the daily-digest loop. **This is what actually moves persona P10/P6/P8 scores.**
+- **FR-5 sample workspace import** (parallel option) — different cell-impact path, lifts P1/P2/P3/P5/P7 first-session.
+
+## Manual verification path (when user has a bot)
+```bash
+# 1. Set up bot via @BotFather, get token + chat_id
+# 2. Configure
+curl -X POST http://127.0.0.1:3333/api/telegram/config \
+  -H 'Content-Type: application/json' \
+  -d '{"botToken":"<TOKEN>","chatId":"<CHAT_ID>"}'
+
+# 3. Test
+curl -X POST http://127.0.0.1:3333/api/telegram/test
+
+# Expected: Telegram DM "✓ Waggle is connected to this chat. Scheduled digests will appear here."
+```