channel-bot

Register a Telegram bot using the CLI command `channel-add-bot` with the platform, name, token, and access mode such as jwt_linked. The token is sealed through the vault and bound to the organization, then inbound messages route through the shared agent pipeline.

Use polling for development since the adapter long-polls without needing a public URL. Use webhooks in production where the platform POSTs to a route, and always verify the signature or secret before processing, HMAC for Telegram and signing secret for Slack.

No, a bot serves exactly one agent, enforced by the uq_exposure_bot constraint in migration 0018. Binding a second agent is refused by both the service layer and the database, so @slug acts as an alias for that single agent.

An unlinked identity is refused rather than run with no role, because running without a role would be an unauthenticated execution. Mentions always run as the sender, never as the bot, to prevent the channel from becoming a privilege-escalation path.

Implement a new adapter in services/channels against base.py, wire it into router.py without forking the agent pipeline, and add a signature-verified webhook route or polling entrypoint. Reuse the existing conversation/session model and the supervise_stream reconnect loop.