tg-noise-audit.md

12,852 bytes · modified 2026-09-12 21:45

Telegram Noise Audit — M2 — 2026-09-12

Read-only audit. Nothing sent, nothing patched. Scope: M2 local only (~/bin, ~/.aios/state,

~/AI_OS/ops/scripts, ~/AI_OS/ops/launchagents + ~/Library/LaunchAgents, ~/AI_OS/skills/*/scripts,

~/AI_OS/agents). .bak-* files excluded from counts (dead weight, not live code paths).

0. How the intended system works

• ~/bin/tg — the canonical helper. Takes --class <name>, defaults to manual. Checks

${AIOS_TG_MUTE:-$HOME/.aios/state/tg-mute.conf} with grep -qxF "$TG_CLASS" "$mute"; a match

suppresses the send (logs to ~/.aios/state/tg-muted.log) and exits 0 before touching the

network. Sanitizes to plain text via tg-sanitize.py, never sets parse_mode.

• ~/AI_OS/ops/scripts/send-tg.sh — a second, independent helper (relay-first, direct-API

fallback) used by agent scripts. It re-implements the same class/mute gate (tg_class_gate(),

lines 20-27) before either send path runs. Correct, but it is a second copy of the logic, not a

call into tg itself.

• ~/.aios/state/tg-mute.conf:

  watcher
  heartbeat
  progress

Both gates above grep -qxF this file. The mute mechanism itself works for any caller that

(a) goes through tg or send-tg.sh, and (b) passes the correct --class.

• ~/AI_OS/ops/scripts/tg-publish.sh — the packet channel. Gates: HTML-only for review artifacts

(rejects .md/.txt), SHA-256 dedup (24h), title validation, mobile parse-before-paint budget,

live-link probe, and (new 2026-09-12) HTML→PDF render so nothing unopenable ships. This is the

correct path for anything that should "open on the phone" and it enforces that well.

1. Answer to "is the mute conf effective?" — PARTIALLY, NOT COMPREHENSIVELY

The conf line-matching and both gate implementations are correct and verified working. But the

mute conf only protects traffic that **voluntarily routes through tg or send-tg.sh AND self-labels

correctly**. Two independent leaks bypass it entirely, both currently live:

1. Direct curl to api.telegram.org — 13 scripts do this (list below). None of them can be

muted by editing tg-mute.conf; the file is never read.

2. Unclassed calls through tg/send-tg.sh — TG_CLASS defaults to manual, which is never

muted. a0-inbox-watcher.sh and cleif-a6-orchestrator.sh call tg/send-tg.sh with no

--class for content that is functionally progress/status chatter, so it always reaches the

phone regardless of the mute list.

3. telegram-alert-lib.sh — a third, fully independent send path (own cooldown/repeat-cap

guard, aios_telegram_send_guarded()) with no concept of classes or the mute conf at all.

Sourced by 9 scripts.

So: editing tg-mute.conf today changes behavior only for nano-dispatch-watch.sh's two lines

(classed progress/alert — the one fully-correct example in the fleet) and any future caller

that copies that pattern. It does nothing for the other ~20 sender call-sites.

2. Every caller found (file:line, class, schedule)

Through tg / send-tg.sh (mute-conf-aware)

Direct curl/requests.post to api.telegram.org (mute conf NEVER consulted)

Sourcing telegram-alert-lib.sh (inherits the no-class, direct-curl behavior above)

ops/bin/notify, ops/scripts/mini-claude-tab-autopilot.sh, ops/scripts/heartbeat-notify.sh,

ops/scripts/claude-capacity-watcher.sh, ops/scripts/license-check.sh,

ops/scripts/auto-model-guard.sh, ops/scripts/mission-control.sh — none currently in a

LaunchAgent plist or running process on M2 (checked launchctl list + ps aux), so dormant unless

run by hand. heartbeat-notify.sh and claude-capacity-watcher.sh are exactly the name-pattern

Sean flagged ("heartbeat", "watcher") and would bypass the mute conf entirely the moment either is

re-enabled.

.md/.txt path or "saved to …" as the payload itself

• news-digest.py — literal .md path in the message body (see above).
• a0-inbox-watcher.sh:75 — summary="$summary"$'\n'"• ${subj:-$f}": when an inbox note has no

subject: frontmatter line, the message falls back to the bare .md filename.

• No sender was found that sends only a bare path with nothing else openable, but two live,

scheduled senders embed one inside an otherwise-fine message.

Bypasses tg via direct curl (ignore mute conf) — consolidated

13 files: news-digest.py, claude-inbox-executor.sh, email_triage.py, telegram-alert-lib.sh,

watchkeeper.sh, watchkeeper-dispatch.sh, claude-session-close.sh, fleet-status.sh,

screen-preview.sh, dual-host-sync.sh, telegram-autopilot-control-daemon.sh,

cleif-a6-orchestrator.sh (partial), sally_relay.py.

"watcher"/"heartbeat"/"digest"/"staleness" named + scheduled

• nano-dispatch-watch.sh — scheduled (1200s) — correctly classed, not an offender.
• news-digest.py — scheduled (2x/day) — offender (HTML + path payload).
• heartbeat-notify.sh, claude-capacity-watcher.sh — named matches, not currently scheduled.
• lane-staleness-digest.sh — exists, no Telegram send found in it (grep clean) and not scheduled;

false lead, ignore.

• a0-steer-listener — LaunchAgent present and loaded (pid 16260 in launchctl list) but no

telegram string match; out of scope for this audit.

3. Counts

• Files with a live Telegram send code path (excluding .bak-*): ~23

(3 via tg/send-tg.sh, 13 via direct curl, 7 more via sourcing telegram-alert-lib.sh)

• Unclassified (no class concept at all, or defaults to always-send manual): ~20

(13 direct-curl + 7 lib-based; a0-inbox-watcher.sh and cleif-a6-orchestrator.sh also

effectively unclassed since they never pass --class)

• Correctly classed and muted today: 1 (nano-dispatch-watch.sh)
• Direct-curl-to-bot-API (fully invisible to mute conf): 13 files
• .md/.txt path or bare "saved to" payload: 2 live senders (news-digest.py,

a0-inbox-watcher.sh fallback case)

• Reachable from a LaunchAgent on M2 right now (launchctl list confirmed): 4 senders

(a0-inbox-watcher.sh 300s, claude-inbox-executor.sh 300s, nano-dispatch-watch.sh 1200s,

news-digest.py 2x/day)

4. Top 5 offenders (file:line)

1. ops/scripts/news-digest.py:593 — scheduled 2x/day, parse_mode=HTML (plaintext-rule

violation) AND ships a bare .md path as part of the payload. Worst of the set: hits three

separate rules at once (HTML, unclassed/uncontrolled, path-as-payload).

2. ops/scripts/claude-inbox-executor.sh:203 (telegram_notify) — scheduled every 300s, direct

curl, zero class awareness; "Starting task" sends are pure progress chatter with no way to mute

without editing the script.

3. ops/scripts/telegram-alert-lib.sh:219 — shared library with its own independent guard/cooldown

system, completely outside the class/mute contract; 9 scripts source it, 2 of which

(heartbeat-notify.sh, claude-capacity-watcher.sh) are named exactly what Sean asked to stop

seeing, dormant only because nothing currently schedules them.

4. ops/scripts/a0-inbox-watcher.sh:84 — scheduled every 300s via send-tg.sh --msg with no

--class; always-sends by default, and falls back to a bare .md filename in the body when a

note lacks frontmatter (line 75).

5. ops/scripts/email_triage/email_triage.py:409 — direct curl, parse_mode=HTML; not currently

scheduled, but it's A8's own triage output path and the next thing wired to a cron/LaunchAgent

would ship HTML-formatted text straight past tg's sanitizer.

5. Proposed patch list (NOT applied — awaiting Sean's GO)

6. Open questions for Sean

• claude-session-close.sh looks orphaned (not called by the live Stop hook). Confirm it's dead

before anyone deletes it — it may still be invoked by a device other than M2.

• sally_relay.py is a second bot (Sally) with its own token, entirely outside the tg/mute-conf

system by design. Worth deciding whether Sally should ever inherit class discipline, or stays

separate on purpose.

SAVE-STATE-2026-09-12-A3.md

5,508 bytes · modified 2026-09-12 21:29

SAVE STATE — A3 session, 2026-09-12 ~00:00 PT (M2)

Resume from here. Everything below is verified with a command unless marked PENDING.

Done this session

1. skills/computer-use/ built and live on M2 + Nano (23 files md5-identical). Router v1, predict.mjs, ICM v2 all resolve it; icm/blocks-lint.py clean on 101 blocks. Memory reference_computer_use_skill. Summary: https://claude.ai/code/artifact/7802b182-6fd8-4e3e-bd0f-b43431a58d93

2. Handoff audit (Sean's ask). Five cards were handed M2→Nano 23:23–23:44 PT:

Receivers deliver via tg-publish = HTML attachment (unopenable on iOS, B65) — coordinator relays each as an Artifact link; 2 TG messages sent so far (links 1-3, then 4-5), 1 reserved for scanbot.

Root cause of the three stalls: the per-handoff runner copy shipped by handoff.sh (stdin < resume-runner.sh → /tmp/aios-resume-runner-<TS>-<slug>.sh) arrived syntax-broken at the --disallowedTools line; nano-run reported __NANO_RUN_DONE__ exit=2. The canonical runner on Nano is intact (bash -n OK) — relaunched with it via pool.sh run.

3. HTML-summary rule encoded (Sean 09-12: every finished task sends an HTML summary to Telegram, whoever finishes it): added to ops/scripts/handoff/handoff.sh card template, resume-runner.sh receiver tail, and the three staged cards on Nano. Delivery form = hosted link (Artifact), never an HTML attachment (B65); tg-publish --no-send ledgers each file.

4. One tg --class done sent with the three links + relaunch status.

CLOSED 2026-09-12 00:25 PT — all 5 handoffs DONE on Nano, all delivered as hosted links (3 TG messages)

Receiver monitor ran to completion and timed out cleanly; no receiver is still running (pool.sh status nano = idle).

PENDING

• ~~Mini sync~~ DONE 00:40 PT, brokered Nano→Mini over LAN (/tmp/mini-broker-sync.sh on Nano; gates: block-id subset + pre-edit hashes; 32 files md5-identical; Mini now 110 blocks). Mini's tailnet key is still expired — re-auth is Sean's.
• Telegram-minimized goal (Sean 00:35 PT): done pings OK, no watcher noise, outputs only as HTML links / PDF / files that open. Outbound fix DONE 21:35 PT: ops/scripts/tg-publish.sh now renders any .html input to PDF with headless Chrome (isolated temp profile, exits when the PDF is complete, ~8 s), sends the PDF (sent: attached-pdf), keeps the HTML staged, ledgers the PDF path; falls back to the old attachment with a loud warning if the render fails. Backups tg-publish.sh.bak-2026091*. Pushed to Nano + Mini. First real send = ingress-proof PDF (Sean's "starting point"). Receivers' SUMMARY-<slug>.html deliveries now open on the phone without a coordinator relay. Inbound: poller owner is still Sean's pick (ingress proof, artifact 8117ae06).
• handoff.sh runner-shipping defect (line ~155–157) — not fixed; next handoff will stall the same way unless it ships the runner with tar or pool.sh run uses the canonical path. Owner: whoever next touches handoff.sh.

Sean decisions open

• Bootstrap Nano com.aios.overnight-council.plist + unload M2's copy.
• GO to gc-safe-delete comms/outputs/seanvargas@100.116.58.44I_OS/ on Nano (928 K, lossless dup).
• Block numbers B88 / B95 / B96 each shared by two records — renumber or accept full-id citation.

Pointers

• Summaries + this file: comms/outputs/2026-09-12-handoff-summaries/ (synced Nano)
• Skill: skills/computer-use/SKILL.md · laws references/LAWS.md · preflight scripts/preflight.sh
• Cards: nano:~/AI_OS/comms/inbox/task-20260912T06.md · packets comms/handoffs/20260912T06