waggle-os/docs/addictiveness-audit-2026-05-28/ITER-3-RESULTS.md

Iteration 3 Results — 2026-05-28 (FR-2 plumbing)

Shipped this iteration

FR-2 · Telegram outbound digest (server-side plumbing)

Files:

• packages/server/src/local/routes/telegram.ts (new) — 4 endpoints
• packages/server/src/local/index.ts — registered

Endpoints (smoke-verified):

Method	Path	Purpose	Verified
GET	/api/telegram/status	reports {configured, hasToken, hasChatId}	{"configured":false,"hasToken":false,"hasChatId":false} ✓
POST	/api/telegram/config	save {botToken, chatId} to vault	bad-token reject 400 with format hint ✓
POST	/api/telegram/test	send "Waggle is connected ✓"	400 "not configured" pre-config ✓
POST	/api/telegram/send	push arbitrary text — the integration point for ScheduledJobs	shipped, not invoked from UI yet

Validation:

• Bot token pattern: /^\d{6,12}:[A-Za-z0-9_-]{30,}$/
• Chat ID pattern: /^-?\d{4,18}$/ (signed integer string, negative for groups)
• Text capped at 4096 chars (Telegram's own limit, rejected client-side before API hit)

Security:

• URL is https://api.telegram.org/bot${token}/sendMessage — host is hard-coded, token is interpolated into the path of a fixed host → no SSRF surface
• Token + chat_id stored in vault under telegram_bot_token + telegram_chat_id (credentialType: api_key)
• No webhook receiver — pure outbound — so no public-endpoint exposure

What's NOT shipped (honest scope)

• Settings UI tile — user has to curl POST /api/telegram/config today. Self-serve UX requires a tile in SettingsApp.tsx.
• ScheduledJobs output channel — the /api/telegram/send endpoint exists but isn't called by any scheduled job. The persona-level "daily digest" workflow needs ScheduledJobs to grow a "send result to Telegram" dropdown.
• No score movement until the above land. Plumbing-only means a power user could wire it themselves; persona uplift requires the UI loop.

Score movement (honest: zero this iter)

Same 5.9/10 average as iter-2. The wiring is in place; the score-move comes when ScheduledJobs uses it.

Next iteration candidates

• FR-2 §UI · Settings tile (~30 min) — input fields, save button, test button, status pill. Closes the self-serve gap.
• FR-2 §UI · ScheduledJobs output channel (~1-2 hr) — dropdown on the job-create form, server-side branch in the scheduler runtime to POST results to /api/telegram/send. Closes the daily-digest loop. This is what actually moves persona P10/P6/P8 scores.
• FR-5 sample workspace import (parallel option) — different cell-impact path, lifts P1/P2/P3/P5/P7 first-session.

Manual verification path (when user has a bot)

# 1. Set up bot via @BotFather, get token + chat_id
# 2. Configure
curl -X POST http://127.0.0.1:3333/api/telegram/config \
  -H 'Content-Type: application/json' \
  -d '{"botToken":"<TOKEN>","chatId":"<CHAT_ID>"}'

# 3. Test
curl -X POST http://127.0.0.1:3333/api/telegram/test

# Expected: Telegram DM "✓ Waggle is connected to this chat. Scheduled digests will appear here."