name: OpenClaw Release Telegram QA

run-name: ${{ github.event_name == 'workflow_dispatch' && format('OpenClaw Release Telegram QA {0}', inputs.dispatch_id) || 'OpenClaw Release Telegram QA' }}

on:
  # Transitional compatibility for supported release refs whose parent still calls @main.
  # Current main dispatches this workflow so qa-live-shared secrets stay in this run.
  workflow_call:
    inputs:
      expected_trusted_workflow_sha:
        description: Resolved main SHA authorized for this trusted workflow
        required: true
        type: string
      target_ref:
        description: Trusted release ref whose exact candidate SHA should be validated
        required: true
        type: string
      target_sha:
        description: Exact full candidate commit SHA
        required: true
        type: string
    secrets:
      OPENCLAW_QA_CONVEX_SECRET_CI:
        description: Credential-lease coordinator secret supplied by qa-live-shared
        required: false
      OPENCLAW_QA_CONVEX_SITE_URL:
        description: Credential-lease coordinator URL supplied by qa-live-shared
        required: false
  workflow_dispatch:
    inputs:
      dispatch_id:
        description: Unique parent release-check dispatch identifier
        required: true
        type: string
      expected_trusted_workflow_sha:
        description: Resolved main SHA authorized for this trusted workflow
        required: true
        type: string
      target_ref:
        description: Trusted release ref whose exact candidate SHA should be validated
        required: true
        type: string
      target_sha:
        description: Exact full candidate commit SHA
        required: true
        type: string

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  NODE_VERSION: "24.15.0"
  OPENCLAW_BUILD_PRIVATE_QA: "1"
  OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1"

jobs:
  trusted_identity:
    name: Resolve trusted dispatched workflow identity
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
      id-token: write
    outputs:
      status: ${{ steps.record_status.outputs.status }}
      workflow_ref: ${{ steps.identity.outputs.workflow_ref }}
      workflow_repository: ${{ steps.identity.outputs.workflow_repository }}
      workflow_sha: ${{ steps.identity.outputs.workflow_sha }}
    steps:
      - name: Verify dispatched-main identity
        id: identity
        env:
          CALLER_WORKFLOW_REF: ${{ github.workflow_ref }}
          CALLER_WORKFLOW_SHA: ${{ github.workflow_sha }}
          EXPECTED_TRUSTED_WORKFLOW_SHA: ${{ inputs.expected_trusted_workflow_sha }}
          JOB_CONTEXT: ${{ toJSON(job) }}
          TARGET_REF: ${{ inputs.target_ref }}
          TARGET_SHA: ${{ inputs.target_sha }}
          WORKFLOW_REF: ${{ github.workflow_ref }}
          WORKFLOW_SHA: ${{ github.workflow_sha }}
        shell: bash
        run: |
          set -euo pipefail

          expected_repository="openclaw/openclaw"
          expected_ref="${expected_repository}/.github/workflows/openclaw-release-telegram-qa.yml@refs/heads/main"
          if [[ "$GITHUB_REPOSITORY" != "$expected_repository" ||
                ! "$EXPECTED_TRUSTED_WORKFLOW_SHA" =~ ^[a-f0-9]{40}$ ||
                ! "$TARGET_SHA" =~ ^[a-f0-9]{40}$ ||
                -z "${TARGET_REF// }" ]]; then
            echo "Telegram QA identity or target is malformed." >&2
            exit 1
          fi
          INVOCATION_MODE=reusable
          if [[ "$WORKFLOW_REF" == "$expected_ref" ]]; then
            INVOCATION_MODE=dispatch
            [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" &&
               "$GITHUB_REF" == "refs/heads/main" &&
               "$GITHUB_SHA" == "$EXPECTED_TRUSTED_WORKFLOW_SHA" &&
               "$WORKFLOW_SHA" == "$EXPECTED_TRUSTED_WORKFLOW_SHA" ]]
          fi
          export INVOCATION_MODE

          oidc_json="$(
            curl --fail --silent --show-error \
              -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
              "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=openclaw-release-telegram-qa"
          )"
          oidc_token="$(jq -er '.value' <<<"$oidc_json")"
          EXPECTED_WORKFLOW_REF="$expected_ref" OIDC_TOKEN="$oidc_token" \
            node --input-type=module <<'NODE'
          import { appendFileSync } from "node:fs";

          const payloadPart = process.env.OIDC_TOKEN?.split(".")[1];
          if (!payloadPart) {
            throw new Error("OIDC token is malformed");
          }
          const payload = JSON.parse(
            Buffer.from(payloadPart.replace(/-/g, "+").replace(/_/g, "/"), "base64url").toString(
              "utf8",
            ),
          );
          const expectedTrustedWorkflowSha = process.env.EXPECTED_TRUSTED_WORKFLOW_SHA;
          const eventName = process.env.GITHUB_EVENT_NAME;
          const expected = {
            aud: "openclaw-release-telegram-qa",
            event_name: eventName,
            iss: "https://token.actions.githubusercontent.com",
            ref: process.env.GITHUB_REF,
            repository: process.env.GITHUB_REPOSITORY,
            runner_environment: "github-hosted",
            sha: process.env.GITHUB_SHA,
            workflow_ref: process.env.CALLER_WORKFLOW_REF,
            workflow_sha: process.env.CALLER_WORKFLOW_SHA,
          };
          for (const [key, value] of Object.entries(expected)) {
            if (payload[key] !== value) {
              throw new Error(`OIDC ${key} mismatch`);
            }
          }
          if (process.env.INVOCATION_MODE === "reusable") {
            const job = JSON.parse(process.env.JOB_CONTEXT ?? "{}");
            const reusableExpected = {
              job_workflow_ref: process.env.EXPECTED_WORKFLOW_REF,
              job_workflow_sha: expectedTrustedWorkflowSha,
            };
            for (const [key, value] of Object.entries(reusableExpected)) {
              if (payload[key] !== value) {
                throw new Error(`OIDC ${key} mismatch`);
              }
            }
            if (
              job.workflow_ref !== reusableExpected.job_workflow_ref ||
              job.workflow_repository !== payload.repository ||
              job.workflow_sha !== expectedTrustedWorkflowSha
            ) {
              throw new Error("job context reusable workflow identity mismatch");
            }
          } else if (
            payload.workflow_ref !== process.env.EXPECTED_WORKFLOW_REF ||
            payload.workflow_sha !== expectedTrustedWorkflowSha
          ) {
            throw new Error("OIDC dispatched workflow identity mismatch");
          }
          appendFileSync(
            process.env.GITHUB_OUTPUT,
            [
              `workflow_ref=${process.env.EXPECTED_WORKFLOW_REF}`,
              `workflow_repository=${payload.repository}`,
              `workflow_sha=${expectedTrustedWorkflowSha}`,
              "",
            ].join("\n"),
          );
          NODE

      - name: Record identity status
        id: record_status
        if: always()
        env:
          IDENTITY_OUTCOME: ${{ steps.identity.outcome }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$IDENTITY_OUTCOME" == "success" ]]; then
            echo "status=success" >>"$GITHUB_OUTPUT"
          else
            echo "status=failure" >>"$GITHUB_OUTPUT"
          fi

  build_candidate:
    name: Build secretless Telegram candidate
    needs: trusted_identity
    if: always()
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      actions: read
      contents: read
      pull-requests: read
    outputs:
      archive_name: ${{ steps.archive.outputs.archive_name }}
      archive_sha256: ${{ steps.archive.outputs.archive_sha256 }}
      artifact_digest: ${{ steps.upload.outputs.artifact-digest }}
      artifact_id: ${{ steps.upload.outputs.artifact-id }}
      candidate_tree: ${{ steps.archive.outputs.candidate_tree }}
      candidate_version: ${{ steps.archive.outputs.candidate_version }}
      manifest_sha256: ${{ steps.archive.outputs.manifest_sha256 }}
      status: ${{ steps.record_status.outputs.status }}
    steps:
      - name: Require trusted dispatched workflow identity
        id: require_identity
        env:
          IDENTITY_STATUS: ${{ needs.trusted_identity.outputs.status }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$IDENTITY_STATUS" == "success" ]]

      - name: Checkout trusted Telegram QA bootstrap
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          repository: ${{ needs.trusted_identity.outputs.workflow_repository }}
          ref: ${{ needs.trusted_identity.outputs.workflow_sha }}
          fetch-depth: 1
          persist-credentials: false

      - name: Verify trusted bootstrap SHA
        env:
          EXPECTED_SHA: ${{ needs.trusted_identity.outputs.workflow_sha }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$(git rev-parse HEAD)" == "$EXPECTED_SHA" ]]

      - name: Setup candidate build toolchain
        uses: ./.github/actions/setup-node-env
        with:
          node-version: ${{ env.NODE_VERSION }}
          install-bun: "true"
          install-deps: "false"
          use-actions-cache: "false"

      - name: Checkout candidate runtime
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: ${{ inputs.target_sha }}
          fetch-depth: 1
          path: .candidate
          persist-credentials: false

      - name: Verify candidate checkout SHA
        id: verify_candidate
        env:
          EXPECTED_SHA: ${{ inputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$(git -C .candidate rev-parse HEAD)" == "$EXPECTED_SHA" ]]

      - name: Validate candidate release provenance
        id: provenance
        env:
          GH_TOKEN: ${{ github.token }}
          TARGET_REF: ${{ inputs.target_ref }}
          TARGET_SHA: ${{ inputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail

          candidate_sha="$(git -C .candidate rev-parse HEAD)"
          [[ "$candidate_sha" == "$TARGET_SHA" ]]
          pr_head_count="$(
            gh api \
              -H "Accept: application/vnd.github+json" \
              "repos/${GITHUB_REPOSITORY}/commits/${candidate_sha}/pulls" \
              --jq '[.[] | select(.state == "open" and .head.repo.full_name == "'"${GITHUB_REPOSITORY}"'" and .head.sha == "'"${candidate_sha}"'")] | length'
          )"
          if [[ "$pr_head_count" != "0" ]]; then
            echo "Telegram candidate ${candidate_sha} is an open same-repository PR head." >&2
            exit 1
          fi

          compare_status="$(
            gh api \
              "repos/${GITHUB_REPOSITORY}/compare/${candidate_sha}...main" \
              --jq '.status'
          )"
          trusted_reason=""
          trusted_release_branch=""
          if [[ "$compare_status" == "ahead" || "$compare_status" == "identical" ]]; then
            trusted_reason="main-ancestor"
          else
            normalized_ref="${TARGET_REF#refs/heads/}"
            if [[ "$normalized_ref" =~ ^(release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*|extended-stable/[0-9]{4}\.[1-9][0-9]*\.33)$ ]]; then
              branch_sha="$(
                git -C .candidate ls-remote --exit-code --refs origin \
                  "refs/heads/${normalized_ref}" |
                  awk 'NR == 1 { print $1 } END { if (NR != 1) exit 1 }'
              )"
              [[ "$branch_sha" == "$candidate_sha" ]]
              trusted_reason="release-branch-head"
              trusted_release_branch="$normalized_ref"
            elif [[ "$TARGET_REF" =~ ^refs/tags/v ]] || [[ "$TARGET_REF" =~ ^v ]]; then
              normalized_tag="${TARGET_REF#refs/tags/}"
              tag_refs="$(
                git -C .candidate ls-remote --exit-code origin \
                  "refs/tags/${normalized_tag}" "refs/tags/${normalized_tag}^{}"
              )"
              awk -v sha="$candidate_sha" '$1 == sha { found = 1 } END { exit(found ? 0 : 1) }' \
                <<<"$tag_refs"
              trusted_reason="release-tag"
            elif [[ "$TARGET_REF" =~ ^[a-f0-9]{40}$ && "$TARGET_REF" == "$candidate_sha" ]]; then
              matching_release_branches="$(
                gh api --paginate \
                  "repos/${GITHUB_REPOSITORY}/commits/${candidate_sha}/branches-where-head" \
                  --jq '.[].name' |
                  awk '$0 ~ /^release\/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$/ ||
                       $0 ~ /^extended-stable\/[0-9]{4}\.[1-9][0-9]*\.33$/ { print }'
              )"
              if [[ "$(wc -l <<<"$matching_release_branches" | tr -d ' ')" == "1" && -n "$matching_release_branches" ]]; then
                trusted_reason="release-branch-head"
                trusted_release_branch="$matching_release_branches"
              else
                matching_release_tags="$(
                  git -C .candidate ls-remote origin 'refs/tags/v*' |
                    awk -v sha="$candidate_sha" '$1 == sha { sub(/\^\{\}$/, "", $2); print $2 }' |
                    sort -u
                )"
                if [[ -n "$matching_release_tags" ]]; then
                  trusted_reason="release-tag"
                fi
              fi
            fi
          fi
          if [[ -z "$trusted_reason" ]]; then
            echo "Telegram candidate ${candidate_sha} is not trusted release provenance." >&2
            exit 1
          fi

          if [[ "$trusted_reason" != "main-ancestor" ]]; then
            repository_owner="${GITHUB_REPOSITORY%%/*}"
            repository_name="${GITHUB_REPOSITORY#*/}"
            signature_json="$(
              gh api graphql \
                -f query='query($owner:String!,$name:String!,$oid:GitObjectID!){repository(owner:$owner,name:$name){object(oid:$oid){... on Commit{oid signature{isValid state signer{login}} associatedPullRequests(first:10){nodes{state baseRefName baseRepository{nameWithOwner} mergeCommit{oid} mergedBy{login}}}}}}}' \
                -f owner="$repository_owner" \
                -f name="$repository_name" \
                -f oid="$candidate_sha"
            )"
            signature_status="$(
              jq -er \
                --arg sha "$candidate_sha" \
                '.data.repository.object |
                 select(.oid == $sha) |
                 if .signature == null then "missing"
                 elif .signature.isValid == true and .signature.state == "VALID" and
                   (.signature.signer.login // "") != "" then "valid"
                 else "invalid"
                 end' \
                <<<"$signature_json"
            )"
            if [[ "$signature_status" == "invalid" ]]; then
              echo "Release candidate ${candidate_sha} has an invalid commit signature." >&2
              exit 1
            fi
            signer="$(jq -r '.data.repository.object.signature.signer.login // ""' <<<"$signature_json")"
            permission_actor="$signer"
            if [[ "$signature_status" == "missing" || "$signer" == "web-flow" ]]; then
              if [[ "$trusted_reason" != "release-branch-head" || -z "$trusted_release_branch" ]]; then
                echo "Unsigned or GitHub web-flow candidates require an exact release branch head." >&2
                exit 1
              fi
              permission_actor="$(
                jq -er \
                  --arg base "$trusted_release_branch" \
                  --arg repo "$GITHUB_REPOSITORY" \
                  --arg sha "$candidate_sha" \
                  '[.data.repository.object.associatedPullRequests.nodes[] |
                    select(.state == "MERGED" and .baseRefName == $base and
                      .baseRepository.nameWithOwner == $repo and .mergeCommit.oid == $sha) |
                    .mergedBy.login] | unique | select(length == 1) | .[0]' \
                  <<<"$signature_json"
              )"
            fi
            role_name="$(
              gh api \
                "repos/${GITHUB_REPOSITORY}/collaborators/${permission_actor}/permission" \
                --jq '.role_name'
            )"
            if [[ "$role_name" != "admin" && "$role_name" != "maintain" ]]; then
              echo "Release candidate actor ${permission_actor} lacks maintain/admin access." >&2
              exit 1
            fi
          fi
          echo "Telegram candidate trust reason: ${trusted_reason}"

      - name: Install candidate dependencies without runner credentials
        id: install_candidate
        shell: bash
        run: |
          set -euo pipefail
          candidate_home="${RUNNER_TEMP}/openclaw-telegram-candidate-home"
          mkdir -p "$candidate_home"
          env -i \
            CI=true \
            COREPACK_HOME="${candidate_home}/.cache/corepack" \
            HOME="$candidate_home" \
            LANG=C.UTF-8 \
            NPM_CONFIG_USERCONFIG=/dev/null \
            PATH="$PATH" \
            RUNNER_TEMP="$RUNNER_TEMP" \
            pnpm --dir .candidate install \
              --store-dir "$RUNNER_TEMP/openclaw-telegram-candidate-pnpm-store" \
              --prefer-offline \
              --frozen-lockfile \
              --ignore-scripts=false \
              --config.engine-strict=false \
              --config.enable-pre-post-scripts=true \
              --config.package-import-method=copy \
              --config.side-effects-cache=true

      - name: Build candidate runtime without runner credentials
        id: build_candidate
        shell: bash
        run: |
          set -euo pipefail
          candidate_home="${RUNNER_TEMP}/openclaw-telegram-candidate-home"
          env -i \
            CI=true \
            COREPACK_HOME="${candidate_home}/.cache/corepack" \
            HOME="$candidate_home" \
            LANG=C.UTF-8 \
            NODE_OPTIONS=--max-old-space-size=8192 \
            NPM_CONFIG_USERCONFIG=/dev/null \
            PATH="$PATH" \
            RUNNER_TEMP="$RUNNER_TEMP" \
            pnpm --dir .candidate exec node scripts/build-all.mjs qaRuntime

      - name: Move built candidate outside trusted workspace
        id: move_candidate
        env:
          EXPECTED_SHA: ${{ inputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail
          candidate_root="${RUNNER_TEMP}/openclaw-telegram-candidate-build"
          candidate_sha="$(git -C .candidate rev-parse HEAD)"
          candidate_tree="$(git -C .candidate rev-parse 'HEAD^{tree}')"
          tracked_status="$(git -C .candidate status --porcelain --untracked-files=no)"
          if [[ "$candidate_sha" != "$EXPECTED_SHA" || -n "$tracked_status" ]]; then
            echo "Candidate build did not preserve the exact clean target." >&2
            exit 1
          fi
          rm -rf "$candidate_root"
          mv .candidate "$candidate_root"
          {
            echo "candidate_root=$candidate_root"
            echo "candidate_tree=$candidate_tree"
          } >>"$GITHUB_OUTPUT"

      - name: Restore trusted Telegram QA bootstrap
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          repository: ${{ needs.trusted_identity.outputs.workflow_repository }}
          ref: ${{ needs.trusted_identity.outputs.workflow_sha }}
          clean: true
          fetch-depth: 1
          persist-credentials: false

      - name: Archive bounded candidate tree
        id: archive
        env:
          CALLED_WORKFLOW_SHA: ${{ needs.trusted_identity.outputs.workflow_sha }}
          CANDIDATE_ROOT: ${{ steps.move_candidate.outputs.candidate_root }}
          CANDIDATE_TREE: ${{ steps.move_candidate.outputs.candidate_tree }}
          TARGET_SHA: ${{ inputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$(git rev-parse HEAD)" == "$CALLED_WORKFLOW_SHA" ]]
          [[ -d "$CANDIDATE_ROOT/node_modules" && -f "$CANDIDATE_ROOT/dist/index.js" ]]

          bundle_root="${RUNNER_TEMP}/openclaw-telegram-candidate-bundle"
          archive_root="openclaw-telegram-candidate"
          candidate_root="${bundle_root}/${archive_root}"
          manifest_path="${bundle_root}/manifest.json"
          rm -rf "$bundle_root"
          mkdir -p "$bundle_root"
          mv "$CANDIDATE_ROOT" "$candidate_root"
          rm -rf "$candidate_root/.git"
          candidate_version="$(jq -er '.version' "$candidate_root/package.json")"

          python3 scripts/release-telegram-candidate-archive.py validate-tree "$candidate_root"

          node_version="$(node --version)"
          pnpm_version="$(pnpm --version)"
          jq -n \
            --arg archiveRoot "$archive_root" \
            --arg buildCommand "node scripts/build-all.mjs qaRuntime" \
            --arg candidateSha "$TARGET_SHA" \
            --arg candidateTree "$CANDIDATE_TREE" \
            --arg nodeVersion "$node_version" \
            --arg pnpmVersion "$pnpm_version" \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg sourceJob "build_candidate" \
            --arg workflowSha "$CALLED_WORKFLOW_SHA" \
            '{
              version: 1,
              repository: $repository,
              workflowSha: $workflowSha,
              candidateSha: $candidateSha,
              candidateTree: $candidateTree,
              archiveRoot: $archiveRoot,
              nodeVersion: $nodeVersion,
              pnpmVersion: $pnpmVersion,
              buildCommand: $buildCommand,
              sourceJob: $sourceJob
            }' >"$manifest_path"

          archive_name="release-telegram-candidate-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${TARGET_SHA}.tar.zst"
          archive_path="${RUNNER_TEMP}/${archive_name}"
          LC_ALL=C tar \
            --create \
            --format=posix \
            --sort=name \
            --one-file-system \
            --numeric-owner \
            --owner=0 \
            --group=0 \
            --no-xattrs \
            --no-acls \
            --pax-option=delete=atime,delete=ctime \
            -C "$bundle_root" \
            manifest.json \
            "$archive_root" |
            zstd -T0 -3 -q -o "$archive_path"

          {
            echo "archive_name=$archive_name"
            echo "archive_path=$archive_path"
            echo "archive_sha256=$(sha256sum "$archive_path" | awk '{print $1}')"
            echo "candidate_tree=$CANDIDATE_TREE"
            echo "candidate_version=$candidate_version"
            echo "manifest_sha256=$(sha256sum "$manifest_path" | awk '{print $1}')"
          } >>"$GITHUB_OUTPUT"

      - name: Upload raw candidate archive
        id: upload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ steps.archive.outputs.archive_name }}
          path: ${{ steps.archive.outputs.archive_path }}
          archive: false
          retention-days: 14
          if-no-files-found: error

      - name: Verify uploaded archive digest
        id: verify_upload
        env:
          ACTUAL_DIGEST: ${{ steps.upload.outputs.artifact-digest }}
          EXPECTED_DIGEST: ${{ steps.archive.outputs.archive_sha256 }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$ACTUAL_DIGEST" == "$EXPECTED_DIGEST" ]]

      - name: Record candidate build status
        id: record_status
        if: always()
        env:
          OUTCOMES: >-
            ${{ steps.require_identity.outcome }}
            ${{ steps.verify_candidate.outcome }}
            ${{ steps.provenance.outcome }}
            ${{ steps.install_candidate.outcome }}
            ${{ steps.build_candidate.outcome }}
            ${{ steps.move_candidate.outcome }}
            ${{ steps.archive.outcome }}
            ${{ steps.upload.outcome }}
            ${{ steps.verify_upload.outcome }}
        shell: bash
        run: |
          set -euo pipefail
          status=success
          for outcome in $OUTCOMES; do
            [[ "$outcome" == "success" ]] || status=failure
          done
          echo "status=$status" >>"$GITHUB_OUTPUT"

  attest_candidate:
    name: Attest verified Telegram candidate
    needs: [trusted_identity, build_candidate]
    if: always()
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      actions: read
      attestations: write
      contents: read
      id-token: write
    outputs:
      status: ${{ steps.record_status.outputs.status }}
    steps:
      - name: Require successful candidate build
        id: require_build
        env:
          BUILD_STATUS: ${{ needs.build_candidate.outputs.status }}
          IDENTITY_STATUS: ${{ needs.trusted_identity.outputs.status }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$IDENTITY_STATUS" == "success" && "$BUILD_STATUS" == "success" ]]

      - name: Checkout trusted Telegram QA verifier
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          repository: ${{ needs.trusted_identity.outputs.workflow_repository }}
          ref: ${{ needs.trusted_identity.outputs.workflow_sha }}
          fetch-depth: 1
          persist-credentials: false

      - name: Validate candidate artifact metadata
        id: metadata
        env:
          ARCHIVE_NAME: ${{ needs.build_candidate.outputs.archive_name }}
          ARTIFACT_DIGEST: ${{ needs.build_candidate.outputs.artifact_digest }}
          ARTIFACT_ID: ${{ needs.build_candidate.outputs.artifact_id }}
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ && "$ARTIFACT_DIGEST" =~ ^[a-f0-9]{64}$ ]]
          artifact_json="$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")"
          jq -e \
            --arg digest "sha256:${ARTIFACT_DIGEST}" \
            --argjson id "$ARTIFACT_ID" \
            --argjson runId "$GITHUB_RUN_ID" \
            --arg name "$ARCHIVE_NAME" \
            --arg repositoryId "$GITHUB_REPOSITORY_ID" \
            --arg sourceSha "$GITHUB_SHA" \
            '
              .id == $id and
              .name == $name and
              .expired == false and
              .digest == $digest and
              .workflow_run.id == $runId and
              .workflow_run.head_sha == $sourceSha and
              (.workflow_run.repository_id | tostring) == $repositoryId and
              (.workflow_run.head_repository_id | tostring) == $repositoryId
            ' <<<"$artifact_json" >/dev/null
          run_json="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}")"
          jq -e \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --argjson runId "$GITHUB_RUN_ID" \
            --arg sourceSha "$GITHUB_SHA" \
            '
              .id == $runId and
              .run_attempt == $runAttempt and
              .head_sha == $sourceSha
            ' <<<"$run_json" >/dev/null

      - name: Download raw candidate archive
        id: download
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          artifact-ids: ${{ needs.build_candidate.outputs.artifact_id }}
          path: ${{ runner.temp }}/openclaw-telegram-attestor-download
          skip-decompress: true
          digest-mismatch: error

      - name: Bounded extract and validate candidate
        id: verify_candidate
        env:
          ARCHIVE_NAME: ${{ needs.build_candidate.outputs.archive_name }}
          ARCHIVE_SHA256: ${{ needs.build_candidate.outputs.archive_sha256 }}
          CANDIDATE_TREE: ${{ needs.build_candidate.outputs.candidate_tree }}
          MANIFEST_SHA256: ${{ needs.build_candidate.outputs.manifest_sha256 }}
          TARGET_SHA: ${{ inputs.target_sha }}
          WORKFLOW_SHA: ${{ needs.trusted_identity.outputs.workflow_sha }}
        shell: bash
        run: |
          set -euo pipefail
          download_dir="${RUNNER_TEMP}/openclaw-telegram-attestor-download"
          archive_path="${download_dir}/${ARCHIVE_NAME}"
          extract_root="${RUNNER_TEMP}/openclaw-telegram-attestor-extract"
          candidate_root="${extract_root}/openclaw-telegram-candidate"
          [[ "$(sha256sum "$archive_path" | awk '{print $1}')" == "$ARCHIVE_SHA256" ]]
          rm -rf "$extract_root"
          python3 scripts/release-telegram-candidate-archive.py extract-zstd \
            "$archive_path" \
            "$extract_root" \
            --allowed-root openclaw-telegram-candidate

          manifest_path="${extract_root}/manifest.json"
          [[ "$(sha256sum "$manifest_path" | awk '{print $1}')" == "$MANIFEST_SHA256" ]]
          jq -e \
            --arg candidateSha "$TARGET_SHA" \
            --arg candidateTree "$CANDIDATE_TREE" \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg workflowSha "$WORKFLOW_SHA" \
            '
              .version == 1 and
              .repository == $repository and
              .workflowSha == $workflowSha and
              .candidateSha == $candidateSha and
              .candidateTree == $candidateTree and
              .archiveRoot == "openclaw-telegram-candidate" and
              .buildCommand == "node scripts/build-all.mjs qaRuntime" and
              .sourceJob == "build_candidate"
            ' "$manifest_path" >/dev/null
          [[ -d "$candidate_root/node_modules" && -f "$candidate_root/dist/index.js" ]]
          echo "archive_path=$archive_path" >>"$GITHUB_OUTPUT"

      - name: Checkout independent candidate source
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: ${{ inputs.target_sha }}
          fetch-depth: 1
          path: .candidate-source
          persist-credentials: false

      - name: Compare candidate tracked source and tree
        id: compare_source
        env:
          CANDIDATE_ROOT: ${{ runner.temp }}/openclaw-telegram-attestor-extract/openclaw-telegram-candidate
          CANDIDATE_TREE: ${{ needs.build_candidate.outputs.candidate_tree }}
          TARGET_SHA: ${{ inputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$(git -C .candidate-source rev-parse HEAD)" == "$TARGET_SHA" ]]
          [[ "$(git -C .candidate-source rev-parse 'HEAD^{tree}')" == "$CANDIDATE_TREE" ]]
          SOURCE_ROOT="$GITHUB_WORKSPACE/.candidate-source" node --input-type=module <<'NODE'
          import { execFileSync } from "node:child_process";
          import { lstatSync, readFileSync, readlinkSync } from "node:fs";
          import { join } from "node:path";

          const sourceRoot = process.env.SOURCE_ROOT;
          const candidateRoot = process.env.CANDIDATE_ROOT;
          // Node defaults to 1 MiB, smaller than this repo's tracked-file index output.
          const trackedFileOutput = execFileSync(
            "git",
            ["-C", sourceRoot, "ls-files", "-s", "-z"],
            { maxBuffer: 16 * 1024 * 1024 },
          );
          const records = trackedFileOutput
            .toString("utf8")
            .split("\0")
            .filter(Boolean);
          for (const record of records) {
            const tab = record.indexOf("\t");
            const [mode] = record.slice(0, tab).split(" ");
            const relativePath = record.slice(tab + 1);
            const sourcePath = join(sourceRoot, relativePath);
            const candidatePath = join(candidateRoot, relativePath);
            const sourceStat = lstatSync(sourcePath);
            const candidateStat = lstatSync(candidatePath);
            if (mode === "120000") {
              if (
                !sourceStat.isSymbolicLink() ||
                !candidateStat.isSymbolicLink() ||
                readlinkSync(sourcePath) !== readlinkSync(candidatePath)
              ) {
                throw new Error(`tracked symlink mismatch: ${relativePath}`);
              }
              continue;
            }
            if (!sourceStat.isFile() || !candidateStat.isFile()) {
              throw new Error(`tracked file type mismatch: ${relativePath}`);
            }
            if (!readFileSync(sourcePath).equals(readFileSync(candidatePath))) {
              throw new Error(`tracked file content mismatch: ${relativePath}`);
            }
            const expectedExecutable = mode === "100755";
            const actualExecutable = (candidateStat.mode & 0o111) !== 0;
            if (expectedExecutable !== actualExecutable) {
              throw new Error(`tracked executable mode mismatch: ${relativePath}`);
            }
          }
          NODE

      - name: Attest exact candidate archive bytes
        id: attest
        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
        with:
          subject-path: ${{ steps.verify_candidate.outputs.archive_path }}

      - name: Record candidate attestation status
        id: record_status
        if: always()
        env:
          OUTCOMES: >-
            ${{ steps.require_build.outcome }}
            ${{ steps.metadata.outcome }}
            ${{ steps.download.outcome }}
            ${{ steps.verify_candidate.outcome }}
            ${{ steps.compare_source.outcome }}
            ${{ steps.attest.outcome }}
        shell: bash
        run: |
          set -euo pipefail
          status=success
          for outcome in $OUTCOMES; do
            [[ "$outcome" == "success" ]] || status=failure
          done
          echo "status=$status" >>"$GITHUB_OUTPUT"

  run_telegram:
    name: Run isolated Telegram candidate
    needs: [trusted_identity, build_candidate, attest_candidate]
    if: always()
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    environment: qa-live-shared
    permissions:
      actions: read
      attestations: read
      contents: read
      pull-requests: read
    outputs:
      evidence_artifact_digest: ${{ steps.upload_evidence.outputs.artifact-digest }}
      evidence_artifact_id: ${{ steps.upload_evidence.outputs.artifact-id }}
      evidence_artifact_name: ${{ steps.create_sut.outputs.evidence_artifact_name }}
      status: ${{ steps.record_status.outputs.status }}
    steps:
      - name: Require verified candidate attestation
        id: require_attestation
        env:
          ATTESTATION_STATUS: ${{ needs.attest_candidate.outputs.status }}
          BUILD_STATUS: ${{ needs.build_candidate.outputs.status }}
          IDENTITY_STATUS: ${{ needs.trusted_identity.outputs.status }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$IDENTITY_STATUS" == "success" &&
             "$BUILD_STATUS" == "success" &&
             "$ATTESTATION_STATUS" == "success" ]]

      - name: Checkout trusted Telegram QA harness
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          repository: ${{ needs.trusted_identity.outputs.workflow_repository }}
          ref: ${{ needs.trusted_identity.outputs.workflow_sha }}
          fetch-depth: 1
          persist-credentials: false

      - name: Setup trusted harness Node environment
        uses: ./.github/actions/setup-node-env
        with:
          node-version: ${{ env.NODE_VERSION }}
          install-bun: "true"
          install-deps: "true"
          use-actions-cache: "false"

      - name: Build trusted QA harness
        id: build_harness
        env:
          NODE_OPTIONS: --max-old-space-size=8192
        run: node scripts/build-all.mjs qaRuntime

      - name: Validate candidate artifact metadata
        id: metadata
        env:
          ARCHIVE_NAME: ${{ needs.build_candidate.outputs.archive_name }}
          ARTIFACT_DIGEST: ${{ needs.build_candidate.outputs.artifact_digest }}
          ARTIFACT_ID: ${{ needs.build_candidate.outputs.artifact_id }}
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ && "$ARTIFACT_DIGEST" =~ ^[a-f0-9]{64}$ ]]
          artifact_json="$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")"
          jq -e \
            --arg digest "sha256:${ARTIFACT_DIGEST}" \
            --argjson id "$ARTIFACT_ID" \
            --argjson runId "$GITHUB_RUN_ID" \
            --arg name "$ARCHIVE_NAME" \
            --arg repositoryId "$GITHUB_REPOSITORY_ID" \
            --arg sourceSha "$GITHUB_SHA" \
            '
              .id == $id and
              .name == $name and
              .expired == false and
              .digest == $digest and
              .workflow_run.id == $runId and
              .workflow_run.head_sha == $sourceSha and
              (.workflow_run.repository_id | tostring) == $repositoryId and
              (.workflow_run.head_repository_id | tostring) == $repositoryId
            ' <<<"$artifact_json" >/dev/null
          run_json="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}")"
          jq -e \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --argjson runId "$GITHUB_RUN_ID" \
            --arg sourceSha "$GITHUB_SHA" \
            '
              .id == $runId and
              .run_attempt == $runAttempt and
              .head_sha == $sourceSha
            ' <<<"$run_json" >/dev/null

      - name: Download raw candidate archive
        id: download
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          artifact-ids: ${{ needs.build_candidate.outputs.artifact_id }}
          path: ${{ runner.temp }}/openclaw-telegram-executor-download
          skip-decompress: true
          digest-mismatch: error

      - name: Verify attestation and bounded extract
        id: extract_candidate
        env:
          ARCHIVE_NAME: ${{ needs.build_candidate.outputs.archive_name }}
          ARCHIVE_SHA256: ${{ needs.build_candidate.outputs.archive_sha256 }}
          CALLED_WORKFLOW_SHA: ${{ needs.trusted_identity.outputs.workflow_sha }}
          CANDIDATE_TREE: ${{ needs.build_candidate.outputs.candidate_tree }}
          GH_TOKEN: ${{ github.token }}
          TARGET_SHA: ${{ inputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail
          download_dir="${RUNNER_TEMP}/openclaw-telegram-executor-download"
          archive_path="${download_dir}/${ARCHIVE_NAME}"
          extract_root="${RUNNER_TEMP}/openclaw-telegram-executor-extract"
          candidate_root="${extract_root}/openclaw-telegram-candidate"
          [[ "$(sha256sum "$archive_path" | awk '{print $1}')" == "$ARCHIVE_SHA256" ]]

          gh attestation verify "$archive_path" \
            --repo "$GITHUB_REPOSITORY" \
            --cert-identity "https://github.com/openclaw/openclaw/.github/workflows/openclaw-release-telegram-qa.yml@refs/heads/main" \
            --signer-digest "$CALLED_WORKFLOW_SHA" \
            --source-ref "$GITHUB_REF" \
            --source-digest "$GITHUB_SHA" \
            --predicate-type "https://slsa.dev/provenance/v1" \
            --deny-self-hosted-runners >/dev/null

          rm -rf "$extract_root"
          python3 scripts/release-telegram-candidate-archive.py extract-zstd \
            "$archive_path" \
            "$extract_root" \
            --allowed-root openclaw-telegram-candidate
          jq -e \
            --arg candidateSha "$TARGET_SHA" \
            --arg candidateTree "$CANDIDATE_TREE" \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg workflowSha "$CALLED_WORKFLOW_SHA" \
            '
              .version == 1 and
              .repository == $repository and
              .workflowSha == $workflowSha and
              .candidateSha == $candidateSha and
              .candidateTree == $candidateTree and
              .archiveRoot == "openclaw-telegram-candidate" and
              .sourceJob == "build_candidate"
            ' "${extract_root}/manifest.json" >/dev/null
          [[ -d "$candidate_root/node_modules" && -f "$candidate_root/dist/index.js" ]]
          sudo chown root:root "$extract_root"
          sudo chmod 0711 "$extract_root"
          echo "candidate_root=$candidate_root" >>"$GITHUB_OUTPUT"

      - name: Revalidate candidate release provenance
        id: revalidate_provenance
        env:
          GH_TOKEN: ${{ github.token }}
          TARGET_REF: ${{ inputs.target_ref }}
          TARGET_SHA: ${{ inputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail

          candidate_sha="$TARGET_SHA"
          pr_head_count="$(
            gh api \
              -H "Accept: application/vnd.github+json" \
              "repos/${GITHUB_REPOSITORY}/commits/${candidate_sha}/pulls" \
              --jq '[.[] | select(.state == "open" and .head.repo.full_name == "'"${GITHUB_REPOSITORY}"'" and .head.sha == "'"${candidate_sha}"'")] | length'
          )"
          [[ "$pr_head_count" == "0" ]]

          compare_status="$(
            gh api \
              "repos/${GITHUB_REPOSITORY}/compare/${candidate_sha}...main" \
              --jq '.status'
          )"
          trusted_reason=""
          trusted_release_branch=""
          if [[ "$compare_status" == "ahead" || "$compare_status" == "identical" ]]; then
            trusted_reason="main-ancestor"
          else
            normalized_ref="${TARGET_REF#refs/heads/}"
            if [[ "$normalized_ref" =~ ^(release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*|extended-stable/[0-9]{4}\.[1-9][0-9]*\.33)$ ]]; then
              branch_sha="$(
                git ls-remote --exit-code --refs origin "refs/heads/${normalized_ref}" |
                  awk 'NR == 1 { print $1 } END { if (NR != 1) exit 1 }'
              )"
              [[ "$branch_sha" == "$candidate_sha" ]]
              trusted_reason="release-branch-head"
              trusted_release_branch="$normalized_ref"
            elif [[ "$TARGET_REF" =~ ^refs/tags/v ]] || [[ "$TARGET_REF" =~ ^v ]]; then
              normalized_tag="${TARGET_REF#refs/tags/}"
              tag_refs="$(
                git ls-remote --exit-code origin \
                  "refs/tags/${normalized_tag}" "refs/tags/${normalized_tag}^{}"
              )"
              awk -v sha="$candidate_sha" '$1 == sha { found = 1 } END { exit(found ? 0 : 1) }' \
                <<<"$tag_refs"
              trusted_reason="release-tag"
            elif [[ "$TARGET_REF" =~ ^[a-f0-9]{40}$ && "$TARGET_REF" == "$candidate_sha" ]]; then
              matching_release_branches="$(
                gh api --paginate \
                  "repos/${GITHUB_REPOSITORY}/commits/${candidate_sha}/branches-where-head" \
                  --jq '.[].name' |
                  awk '$0 ~ /^release\/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$/ ||
                       $0 ~ /^extended-stable\/[0-9]{4}\.[1-9][0-9]*\.33$/ { print }'
              )"
              if [[ "$(wc -l <<<"$matching_release_branches" | tr -d ' ')" == "1" && -n "$matching_release_branches" ]]; then
                trusted_reason="release-branch-head"
                trusted_release_branch="$matching_release_branches"
              else
                matching_release_tags="$(
                  git ls-remote origin 'refs/tags/v*' |
                    awk -v sha="$candidate_sha" '$1 == sha { sub(/\^\{\}$/, "", $2); print $2 }' |
                    sort -u
                )"
                if [[ -n "$matching_release_tags" ]]; then
                  trusted_reason="release-tag"
                fi
              fi
            fi
          fi
          [[ -n "$trusted_reason" ]]

          if [[ "$trusted_reason" != "main-ancestor" ]]; then
            repository_owner="${GITHUB_REPOSITORY%%/*}"
            repository_name="${GITHUB_REPOSITORY#*/}"
            signature_json="$(
              gh api graphql \
                -f query='query($owner:String!,$name:String!,$oid:GitObjectID!){repository(owner:$owner,name:$name){object(oid:$oid){... on Commit{oid signature{isValid state signer{login}} associatedPullRequests(first:10){nodes{state baseRefName baseRepository{nameWithOwner} mergeCommit{oid} mergedBy{login}}}}}}}' \
                -f owner="$repository_owner" \
                -f name="$repository_name" \
                -f oid="$candidate_sha"
            )"
            signature_status="$(
              jq -er \
                --arg sha "$candidate_sha" \
                '.data.repository.object |
                 select(.oid == $sha) |
                 if .signature == null then "missing"
                 elif .signature.isValid == true and .signature.state == "VALID" and
                   (.signature.signer.login // "") != "" then "valid"
                 else "invalid"
                 end' \
                <<<"$signature_json"
            )"
            if [[ "$signature_status" == "invalid" ]]; then
              echo "Release candidate ${candidate_sha} has an invalid commit signature." >&2
              exit 1
            fi
            signer="$(jq -r '.data.repository.object.signature.signer.login // ""' <<<"$signature_json")"
            permission_actor="$signer"
            if [[ "$signature_status" == "missing" || "$signer" == "web-flow" ]]; then
              if [[ "$trusted_reason" != "release-branch-head" || -z "$trusted_release_branch" ]]; then
                echo "Unsigned or GitHub web-flow candidates require an exact release branch head." >&2
                exit 1
              fi
              permission_actor="$(
                jq -er \
                  --arg base "$trusted_release_branch" \
                  --arg repo "$GITHUB_REPOSITORY" \
                  --arg sha "$candidate_sha" \
                  '[.data.repository.object.associatedPullRequests.nodes[] |
                    select(.state == "MERGED" and .baseRefName == $base and
                      .baseRepository.nameWithOwner == $repo and .mergeCommit.oid == $sha) |
                    .mergedBy.login] | unique | select(length == 1) | .[0]' \
                  <<<"$signature_json"
              )"
            fi
            role_name="$(
              gh api \
                "repos/${GITHUB_REPOSITORY}/collaborators/${permission_actor}/permission" \
                --jq '.role_name'
            )"
            [[ "$role_name" == "admin" || "$role_name" == "maintain" ]]
          fi

      - name: Create isolated Telegram SUT identity and launcher
        id: create_sut
        env:
          CALLED_WORKFLOW_SHA: ${{ needs.trusted_identity.outputs.workflow_sha }}
          CANDIDATE_ARCHIVE_NAME: ${{ needs.build_candidate.outputs.archive_name }}
          CANDIDATE_ARCHIVE_SHA256: ${{ needs.build_candidate.outputs.archive_sha256 }}
          CANDIDATE_ARTIFACT_DIGEST: ${{ needs.build_candidate.outputs.artifact_digest }}
          CANDIDATE_ARTIFACT_ID: ${{ needs.build_candidate.outputs.artifact_id }}
          CANDIDATE_VERSION: ${{ needs.build_candidate.outputs.candidate_version }}
          CANDIDATE_ROOT: ${{ steps.extract_candidate.outputs.candidate_root }}
          TARGET_SHA: ${{ inputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail
          sut_user="ocqatg${GITHUB_RUN_ID}${GITHUB_RUN_ATTEMPT}"
          candidate_extract_root="$(dirname "$CANDIDATE_ROOT")"
          candidate_runtime_root="/opt/openclaw-telegram-sut-candidate-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          runtime_root="/var/lib/openclaw-telegram-sut-runtime-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          node_bin="${runtime_root}/node"
          launcher="/usr/local/bin/openclaw-telegram-sut-launcher"
          config="/etc/openclaw-telegram-sut.conf"
          preload="${runtime_root}/openclaw-telegram-preentry.mjs"
          runner_uid="$(id -u)"
          runner_gid="$(id -g)"
          runner_home="$(realpath -e "$HOME")"
          runner_temp="$(realpath -e "$RUNNER_TEMP")"
          source_node_bin="$(realpath -e "$(command -v node)")"
          [[ "$candidate_extract_root" == "${RUNNER_TEMP}/openclaw-telegram-executor-extract" ]]
          case "$runner_temp/" in
            "$runner_home"/*) ;;
            *) echo "GitHub runner temp must be contained by runner home." >&2; exit 1 ;;
          esac
          [[ ! -e "$candidate_runtime_root" && ! -e "$runtime_root" ]]

          sudo useradd \
            --system \
            --user-group \
            --no-create-home \
            --home-dir /nonexistent \
            --shell /usr/sbin/nologin \
            "$sut_user"
          sudo passwd --lock "$sut_user" >/dev/null
          sut_uid="$(id -u "$sut_user")"
          sut_gid="$(id -g "$sut_user")"

          sudo mv "$CANDIDATE_ROOT" "$candidate_runtime_root"
          CANDIDATE_ROOT="$candidate_runtime_root"
          sudo install -d -o root -g root -m 0755 "$runtime_root"
          sudo install -o root -g root -m 0555 "$source_node_bin" "$node_bin"
          [[ "$(stat -c '%F:%a:%u:%g' "$node_bin")" == "regular file:555:0:0" ]]
          "$node_bin" --version >/dev/null
          sudo install -d -o "$runner_uid" -g "$runner_gid" -m 0711 "$runtime_root/tmp"
          # Frozen candidates prefer /tmp/openclaw before TMPDIR. Make that shared path
          # unavailable to the runner so they use the isolated runtime fallback instead.
          sudo rm -rf -- /tmp/openclaw
          sudo install -d -o root -g root -m 0700 /tmp/openclaw
          sudo install \
            -d \
            -o "$runner_uid" \
            -g "$runner_gid" \
            -m 0711 \
            "${runtime_root}/tmp/openclaw-${runner_uid}"
          sudo chown -R root:root "$CANDIDATE_ROOT"
          sudo chmod -R go-w "$CANDIDATE_ROOT"
          sudo chmod -R a+rX "$CANDIDATE_ROOT"
          evidence_relative=".trusted-qa-evidence/release-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          evidence_root="${CANDIDATE_ROOT}/${evidence_relative}"
          boundary_evidence_dir="${evidence_root}/process-boundary"
          evidence_artifact_name="release-qa-live-telegram-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${TARGET_SHA}"
          sudo install -d -o "$runner_uid" -g "$runner_gid" -m 0700 "$evidence_root"
          sudo install -d -o "$runner_uid" -g "$runner_gid" -m 0700 "$boundary_evidence_dir"
          chmod 0700 "$GITHUB_WORKSPACE"
          runner_sentinel="${runtime_root}/runner-sentinel"
          printf 'trusted-runner-only\n' | sudo tee "$runner_sentinel" >/dev/null
          sudo chown "$runner_uid:$runner_gid" "$runner_sentinel"
          sudo chmod 0600 "$runner_sentinel"

          printf '%s\n' "$sut_user" | sudo tee -a /etc/cron.deny /etc/at.deny >/dev/null
          sudo rm -f \
            "/var/lib/systemd/linger/${sut_user}" \
            "/var/spool/cron/crontabs/${sut_user}" \
            "/var/spool/cron/${sut_user}"
          sudo tee "/etc/security/limits.d/99-openclaw-telegram-sut.conf" >/dev/null <<EOF
          ${sut_user} hard core 0
          ${sut_user} soft core 0
          ${sut_user} hard nproc 256
          ${sut_user} soft nproc 256
          EOF

          sudo tee "$preload" >/dev/null <<'PRELOAD'
          import process from "node:process";
          import { isMainThread } from "node:worker_threads";

          if (isMainThread) {
            if (process.env.OPENCLAW_QA_SUT_PREENTRY_STOP !== "1") {
              throw new Error("trusted Telegram SUT preload was not armed");
            }
            delete process.env.OPENCLAW_QA_SUT_PREENTRY_STOP;
            process.kill(process.pid, "SIGSTOP");
          }
          PRELOAD
          sudo chown root:root "$preload"
          sudo chmod 0555 "$preload"

          {
            printf 'SUT_UID=%q\n' "$sut_uid"
            printf 'SUT_GID=%q\n' "$sut_gid"
            printf 'RUNNER_UID=%q\n' "$runner_uid"
            printf 'RUNNER_GID=%q\n' "$runner_gid"
            printf 'RUNNER_HOME=%q\n' "$runner_home"
            printf 'RUNNER_TEMP_DIR=%q\n' "$runner_temp"
            printf 'CANDIDATE_ROOT=%q\n' "$CANDIDATE_ROOT"
            printf 'RUNTIME_ROOT=%q\n' "$runtime_root"
            printf 'NODE_BIN=%q\n' "$node_bin"
            printf 'PRELOAD_PATH=%q\n' "$preload"
            printf 'RUNNER_SENTINEL=%q\n' "$runner_sentinel"
            printf 'TRUSTED_WORKSPACE=%q\n' "$GITHUB_WORKSPACE"
            printf 'EVIDENCE_ROOT=%q\n' "$evidence_root"
          } | sudo tee "$config" >/dev/null
          sudo chown root:root "$config"
          sudo chmod 0600 "$config"

          jq -n \
            --arg workflowSha "$CALLED_WORKFLOW_SHA" \
            --arg targetSha "$TARGET_SHA" \
            --arg runId "$GITHUB_RUN_ID" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --arg candidateArtifactId "$CANDIDATE_ARTIFACT_ID" \
            --arg candidateArtifactName "$CANDIDATE_ARCHIVE_NAME" \
            --arg candidateArtifactDigest "$CANDIDATE_ARTIFACT_DIGEST" \
            --arg candidateFileName "$CANDIDATE_ARCHIVE_NAME" \
            --arg candidateSha256 "$CANDIDATE_ARCHIVE_SHA256" \
            --arg candidateVersion "$CANDIDATE_VERSION" \
            '{
              version: 1,
              kind: "telegram-sut-boundary",
              runId: $runId,
              runAttempt: $runAttempt,
              workflowSha: $workflowSha,
              targetSha: $targetSha,
              candidateArtifact: {
                id: $candidateArtifactId,
                name: $candidateArtifactName,
                digest: $candidateArtifactDigest,
                runId: $runId,
                runAttempt: $runAttempt,
                fileName: $candidateFileName,
                sha256: $candidateSha256,
                sourceSha: $targetSha,
                version: $candidateVersion
              }
            }' >"${boundary_evidence_dir}/context.json"
          chmod 0600 "${boundary_evidence_dir}/context.json"

          sudo tee "$launcher" >/dev/null <<'LAUNCHER'
          #!/bin/bash
          set -Eeuo pipefail
          launcher_stage=entry
          trap 'exit_status=$?; trap - ERR; if [[ -n "${launcher_stage_file:-}" && -r "$launcher_stage_file" ]]; then launcher_stage="$(<"$launcher_stage_file")"; fi; printf "Telegram SUT launcher failed: stage=%s line=%s status=%s\n" "$launcher_stage" "$LINENO" "$exit_status" >&2; exit "$exit_status"' ERR

          transport_keys=(
            HOME
            LANG
            LC_ALL
            OPENCLAW_CLI
            OPENAI_API_KEY
            OPENAI_BASE_URL
            OPENCLAW_ALLOW_SLOW_REPLY_TESTS
            OPENCLAW_BUNDLED_PLUGINS_DIR
            OPENCLAW_COMPATIBILITY_HOST_VERSION
            OPENCLAW_CONFIG_PATH
            OPENCLAW_EMBEDDED_ABORT_SETTLE_TIMEOUT_MS
            OPENCLAW_GATEWAY_TOKEN
            OPENCLAW_HOME
            OPENCLAW_NO_RESPAWN
            OPENCLAW_OAUTH_DIR
            OPENCLAW_QA_ALLOW_LOCAL_IMAGE_PROVIDER
            OPENCLAW_QA_PARENT_PID
            OPENCLAW_QA_STAGED_RUNTIME_ROOT
            OPENCLAW_QA_TEMP_ROOT
            OPENCLAW_SKIP_BROWSER_CONTROL_SERVER
            OPENCLAW_SKIP_CANVAS_HOST
            OPENCLAW_SKIP_GMAIL_WATCHER
            OPENCLAW_SKIP_STARTUP_MODEL_PREWARM
            OPENCLAW_STATE_DIR
            OPENCLAW_TEST_FAST
            PATH
            TMPDIR
            XDG_CACHE_HOME
            XDG_CONFIG_HOME
            XDG_DATA_HOME
          )
          control_keys=(
            OPENCLAW_QA_SUT_BOUNDARY_COMMAND_FILE
            OPENCLAW_QA_SUT_BOUNDARY_COMMAND_SHA256
            OPENCLAW_QA_SUT_BOUNDARY_GENERATION
            OPENCLAW_QA_SUT_BOUNDARY_IDENTITY_FILE
            OPENCLAW_QA_SUT_BOUNDARY_SANDBOX_FILE
          )

          load_process_identity() {
            source /etc/openclaw-telegram-sut.conf
            identity_file="$(realpath -e "$1")"
            case "$identity_file" in
              "$RUNTIME_ROOT"/tmp/openclaw-qa-suite-*/process-boundary/identity-*.json | \
              "$RUNTIME_ROOT"/tmp/openclaw-"$RUNNER_UID"/openclaw-qa-suite-*/process-boundary/identity-*.json) ;;
              *) echo "Telegram SUT identity escaped the runtime root." >&2; exit 1 ;;
            esac
            [[ "$(stat -c '%F:%a:%u:%g' "$identity_file")" == "regular file:640:0:${RUNNER_GID}" ]]

            generation="$(jq -er '.generation' "$identity_file")"
            pid="$(jq -er '.pid' "$identity_file")"
            uid="$(jq -er '.uid' "$identity_file")"
            gid="$(jq -er '.gid' "$identity_file")"
            start_ticks="$(jq -er '.procStartTicks' "$identity_file")"
            pgrp="$(jq -er '.pgrp' "$identity_file")"
            command_file="$(jq -er '.commandFile.path' "$identity_file")"
            command_sha256="$(jq -er '.commandFile.sha256' "$identity_file")"
            [[ "$generation" =~ ^[a-f0-9-]{36}$ &&
                  "$pid" =~ ^[1-9][0-9]+$ &&
                  "$uid" == "$SUT_UID" &&
                  "$gid" == "$SUT_GID" &&
                  "$start_ticks" =~ ^[0-9]+$ &&
                  "$pgrp" =~ ^[1-9][0-9]+$ &&
                  "$command_sha256" =~ ^[a-f0-9]{64}$ ]]
            command_file="$(realpath -e "$command_file")"
            [[ "$(dirname "$command_file")" == "$(dirname "$identity_file")" ]]
            [[ "$(stat -c '%F:%a:%u:%g' "$command_file")" == "regular file:600:${RUNNER_UID}:${RUNNER_GID}" ]]
            [[ "$(sha256sum "$command_file" | awk '{print $1}')" == "$command_sha256" ]]
          }

          assert_live_process_identity() {
            proc_stat="$(cat "/proc/${pid}/stat")"
            proc_tail="${proc_stat##*) }"
            [[ "$(awk '{print $3}' <<<"$proc_tail")" == "$pgrp" ]]
            [[ "$(awk '{print $20}' <<<"$proc_tail")" == "$start_ticks" ]]
            read -r real_uid effective_uid saved_uid fs_uid < <(
              awk '/^Uid:/{print $2, $3, $4, $5}' "/proc/${pid}/status"
            )
            read -r real_gid effective_gid saved_gid fs_gid < <(
              awk '/^Gid:/{print $2, $3, $4, $5}' "/proc/${pid}/status"
            )
            [[ "$real_uid" == "$SUT_UID" &&
                  "$effective_uid" == "$SUT_UID" &&
                  "$saved_uid" == "$SUT_UID" &&
                  "$fs_uid" == "$SUT_UID" &&
                  "$real_gid" == "$SUT_GID" &&
                  "$effective_gid" == "$SUT_GID" &&
                  "$saved_gid" == "$SUT_GID" &&
                  "$fs_gid" == "$SUT_GID" ]]
          }

          send_verified_process_signal() {
            signal_name="$1"
            /usr/bin/python3 - \
              "$pid" "$start_ticks" "$pgrp" "$SUT_UID" "$SUT_GID" "$signal_name" <<'PY'
          import os
          import signal
          import sys

          pid = int(sys.argv[1])
          expected_start = sys.argv[2]
          expected_pgrp = int(sys.argv[3])
          expected_uid = int(sys.argv[4])
          expected_gid = int(sys.argv[5])
          signal_name = sys.argv[6]
          signal_value = getattr(signal, signal_name, None)
          if signal_value is None:
              raise SystemExit(f"unsupported signal: {signal_name}")

          pidfd = os.pidfd_open(pid)
          try:
              stat_tail = open(f"/proc/{pid}/stat", encoding="utf-8").read().rsplit(") ", 1)[1].split()
              status = {}
              with open(f"/proc/{pid}/status", encoding="utf-8") as handle:
                  for line in handle:
                      key, separator, value = line.partition(":")
                      if separator:
                          status[key] = value.strip()
              uids = [int(value) for value in status["Uid"].split()]
              gids = [int(value) for value in status["Gid"].split()]
              if (
                  stat_tail[19] != expected_start
                  or int(stat_tail[2]) != expected_pgrp
                  or uids != [expected_uid] * 4
                  or gids != [expected_gid] * 4
              ):
                  raise SystemExit("process identity changed before pidfd signal")
              signal.pidfd_send_signal(pidfd, signal_value)
          finally:
              os.close(pidfd)
          PY
          }

          verify_runtime_identity() {
            verification_mode="$1"
            case "$verification_mode" in
              preentry|live) ;;
              *) echo "Unsupported Telegram SUT verification mode: ${verification_mode}" >&2; exit 1 ;;
            esac

            verification_deadline=$((SECONDS + 30))
            while true; do
              proc_stat="$(cat "/proc/${pid}/stat")"
              proc_tail="${proc_stat##*) }"
              state="$(awk '{print $1}' <<<"$proc_tail")"
              if [[ "$verification_mode" == "preentry" && ("$state" == "T" || "$state" == "t") ]]; then
                break
              fi
              if [[ "$verification_mode" == "live" &&
                    "$state" != "T" && "$state" != "t" &&
                    "$state" != "Z" && "$state" != "X" && "$state" != "x" ]]; then
                break
              fi
              if ((SECONDS >= verification_deadline)); then
                echo "Telegram SUT did not reach the required ${verification_mode} state." >&2
                exit 1
              fi
              sleep 0.1
            done
            assert_live_process_identity
            state="$(awk '{print $1}' <<<"$proc_tail")"
            if [[ "$verification_mode" == "preentry" ]]; then
              [[ "$state" == "T" || "$state" == "t" ]]
            else
              [[ "$state" != "T" && "$state" != "t" &&
                    "$state" != "Z" && "$state" != "X" && "$state" != "x" ]]
            fi

            status="$(cat "/proc/${pid}/status")"
            [[ -z "$(awk '/^Groups:/{ $1=""; sub(/^ /, ""); print }' <<<"$status")" ]]
            grep -Eq '^NoNewPrivs:[[:space:]]+1$' <<<"$status"
            for capability in CapInh CapPrm CapEff CapBnd CapAmb; do
              grep -Eq "^${capability}:[[:space:]]+0+$" <<<"$status"
            done

            temp_root="$(dirname "$(dirname "$identity_file")")"
            cwd_relative="$(jq -er '.cwdRelative | select(type == "string" and length > 0)' "$command_file")"
            expected_cwd="$(realpath -e "${temp_root}/${cwd_relative}")"
            case "$expected_cwd" in
              "$temp_root"|"$temp_root"/*) ;;
              *) echo "Telegram SUT cwd escaped the runtime root." >&2; exit 1 ;;
            esac
            actual_cwd="$(realpath -e "/proc/${pid}/cwd")"
            [[ "$actual_cwd" == "$expected_cwd" ]]

            expected_executable="$(
              jq -er '.executable | select(type == "string" and length > 0)' "$command_file"
            )"
            expected_executable="$(realpath -e "$expected_executable")"
            actual_executable="$(realpath -e "/proc/${pid}/exe")"
            [[ "$actual_executable" == "$expected_executable" ]]

            cmdline_sha256="$(
              "$NODE_BIN" --input-type=commonjs - "$pid" "$command_file" <<'NODE'
          const { createHash } = require("node:crypto");
          const fs = require("node:fs");
          const [pid, commandFile] = process.argv.slice(2);
          const command = JSON.parse(fs.readFileSync(commandFile, "utf8"));
          if (
            typeof command.executable !== "string" ||
            !Array.isArray(command.argv) ||
            !command.argv.every((arg) => typeof arg === "string")
          ) {
            throw new Error("invalid process-boundary command");
          }
          const expected = Buffer.from(`${[command.executable, ...command.argv].join("\0")}\0`);
          const actual = fs.readFileSync(`/proc/${pid}/cmdline`);
          if (!actual.equals(expected)) {
            throw new Error("process-boundary command line mismatch");
          }
          process.stdout.write(createHash("sha256").update(actual).digest("hex"));
          NODE
            )"

            jq -cn \
              --arg generation "$generation" \
              --argjson pid "$pid" \
              --argjson uid "$SUT_UID" \
              --argjson gid "$SUT_GID" \
              --arg procStartTicks "$start_ticks" \
              --argjson pgrp "$pgrp" \
              --arg state "$state" \
              --arg cwd "$actual_cwd" \
              --arg executablePath "$actual_executable" \
              --arg cmdlineSha256 "$cmdline_sha256" \
              '{
                version: 1,
                generation: $generation,
                status: "pass",
                pid: $pid,
                uid: $uid,
                gid: $gid,
                procStartTicks: $procStartTicks,
                pgrp: $pgrp,
                state: $state,
                cwd: $cwd,
                executablePath: $executablePath,
                cmdlineSha256: $cmdlineSha256
              }'
          }

          target_processes_alive() {
            sut_uid_processes_alive ||
              ps -eo pgrp= | awk -v expected="$pgrp" '$1 == expected { found = 1 } END { exit !found }'
          }

          sut_uid_processes_alive() {
            pgrep -U "$SUT_UID" >/dev/null 2>&1 ||
              pgrep -u "$SUT_UID" >/dev/null 2>&1
          }

          terminate_sut_uid() {
            pkill -TERM -U "$SUT_UID" >/dev/null 2>&1 || true
            pkill -TERM -u "$SUT_UID" >/dev/null 2>&1 || true
            sleep 2
            pkill -KILL -U "$SUT_UID" >/dev/null 2>&1 || true
            pkill -KILL -u "$SUT_UID" >/dev/null 2>&1 || true

            consecutive_empty=0
            for _ in $(seq 1 30); do
              if sut_uid_processes_alive; then
                consecutive_empty=0
              else
                consecutive_empty=$((consecutive_empty + 1))
                if [[ "$consecutive_empty" -ge 2 ]]; then
                  return 0
                fi
              fi
              sleep 1
            done
            echo "Telegram SUT UID remained alive after forced shutdown." >&2
            return 1
          }

          if [[ "${1:-}" == "--signal" ]]; then
            shift
            exec sudo -n -- "$0" --root-signal "$@"
          fi

          if [[ "${1:-}" == "--terminate" ]]; then
            shift
            exec sudo -n -- "$0" --root-terminate "$@"
          fi

          if [[ "${1:-}" == "--terminate-uid" ]]; then
            shift
            exec sudo -n -- "$0" --root-terminate-uid
          fi

          if [[ "${1:-}" == "--verify" ]]; then
            shift
            exec sudo -n -- "$0" --root-verify "$@"
          fi

          if [[ "${1:-}" == "--root-verify" ]]; then
            [[ "$EUID" == "0" ]]
            shift
            verification_mode="${1:?}"
            requested_identity="${2:?}"
            load_process_identity "$requested_identity"
            verify_runtime_identity "$verification_mode"
            exit 0
          fi

          if [[ "${1:-}" == "--root-signal" ]]; then
            [[ "$EUID" == "0" ]]
            shift
            signal_name="${1:?}"
            requested_identity="${2:?}"
            case "$signal_name" in
              SIGCONT|SIGUSR1|SIGUSR2) ;;
              *) echo "Unsupported Telegram SUT signal: ${signal_name}" >&2; exit 1 ;;
            esac
            load_process_identity "$requested_identity"
            assert_live_process_identity
            send_verified_process_signal "$signal_name"
            exit 0
          fi

          if [[ "${1:-}" == "--root-terminate" ]]; then
            [[ "$EUID" == "0" ]]
            shift
            load_process_identity "${1:?}"
            proxy_pgrp="$(ps -o pgrp= -p "$$" | tr -d ' ')"
            [[ "$pgrp" != "$proxy_pgrp" ]]
            if [[ -r "/proc/${pid}/stat" ]]; then
              assert_live_process_identity
            fi
            pkill -TERM -U "$SUT_UID" >/dev/null 2>&1 || true
            pkill -TERM -u "$SUT_UID" >/dev/null 2>&1 || true
            sleep 2
            if [[ -r "/proc/${pid}/stat" ]]; then
              assert_live_process_identity
            fi
            pkill -KILL -U "$SUT_UID" >/dev/null 2>&1 || true
            pkill -KILL -u "$SUT_UID" >/dev/null 2>&1 || true

            consecutive_empty=0
            for _ in $(seq 1 30); do
              if target_processes_alive; then
                consecutive_empty=0
              else
                consecutive_empty=$((consecutive_empty + 1))
                if [[ "$consecutive_empty" -ge 2 ]]; then
                  exit 0
                fi
              fi
              sleep 1
            done
            echo "Telegram SUT process group or UID remained alive after forced shutdown." >&2
            exit 1
          fi

          if [[ "${1:-}" == "--root-terminate-uid" ]]; then
            [[ "$EUID" == "0" ]]
            source /etc/openclaw-telegram-sut.conf
            terminate_sut_uid
            exit 0
          fi

          if [[ "${1:-}" != "--root-run" ]]; then
            present=()
            for key in "${transport_keys[@]}" "${control_keys[@]}"; do
              if [[ -v "$key" ]]; then
                present+=("$key")
              fi
            done
            sudo_args=(-n)
            if ((${#present[@]})); then
              preserve_csv="$(IFS=,; printf '%s' "${present[*]}")"
              sudo_args+=(--preserve-env="$preserve_csv")
            fi
            exec sudo "${sudo_args[@]}" -- "$0" --root-run "$@"
          fi
          shift
          launcher_stage=root-run-setup
          [[ "$EUID" == "0" ]]
          source /etc/openclaw-telegram-sut.conf

          declare -A keep_env=()
          for key in "${transport_keys[@]}" "${control_keys[@]}"; do
            keep_env["$key"]=1
          done
          while IFS= read -r key; do
            if [[ ! -v "keep_env[$key]" ]]; then
              unset "$key"
            fi
          done < <(compgen -e)
          unset OLDPWD
          export PATH=/usr/sbin:/usr/bin:/sbin:/bin

          temp_root="$(realpath -e "${OPENCLAW_QA_TEMP_ROOT:?}")"
          case "$temp_root" in
            "$RUNTIME_ROOT"/tmp/openclaw-qa-suite-* | \
            "$RUNTIME_ROOT"/tmp/openclaw-"$RUNNER_UID"/openclaw-qa-suite-*) ;;
            *) echo "SUT temp root escaped the workflow runtime root." >&2; exit 1 ;;
          esac
          config_path="${temp_root}/openclaw.json"
          [[ -f "$config_path" && ! -L "$config_path" ]]
          [[ "$(realpath -e "$config_path")" == "$config_path" ]]

          export OPENCLAW_QA_TEMP_ROOT="$temp_root"
          export HOME="${temp_root}/home"
          export OPENCLAW_HOME="$HOME"
          export OPENCLAW_STATE_DIR="${temp_root}/state"
          export OPENCLAW_OAUTH_DIR="${OPENCLAW_STATE_DIR}/credentials"
          export OPENCLAW_CONFIG_PATH="$config_path"
          export XDG_CACHE_HOME="${temp_root}/xdg-cache"
          export XDG_CONFIG_HOME="${temp_root}/xdg-config"
          export XDG_DATA_HOME="${temp_root}/xdg-data"

          chown "$RUNNER_UID:$RUNNER_GID" "$temp_root"
          chmod 0711 "$temp_root"
          chown "$RUNNER_UID:$SUT_GID" "$config_path"
          chmod 0640 "$config_path"
          sut_tmp="${temp_root}/sut-tmp"
          install -d -o "$SUT_UID" -g "$SUT_GID" -m 0700 "$sut_tmp"
          export TMPDIR="$sut_tmp"
          for path in \
            "$temp_root/workspace" \
            "${OPENCLAW_HOME:?}" \
            "${OPENCLAW_STATE_DIR:?}" \
            "${XDG_CACHE_HOME:?}" \
            "${XDG_CONFIG_HOME:?}" \
            "${XDG_DATA_HOME:?}"; do
            [[ -d "$path" && ! -L "$path" ]]
            [[ "$(realpath -e "$path")" == "$path" ]]
            chown -R "$SUT_UID:$SUT_GID" "$path"
            chmod -R u=rwX,go= "$path"
          done
          if [[ -n "${OPENCLAW_BUNDLED_PLUGINS_DIR:-}" ]]; then
            chown -R root:root "$OPENCLAW_BUNDLED_PLUGINS_DIR"
            chmod -R a+rX,go-w "$OPENCLAW_BUNDLED_PLUGINS_DIR"
          fi

          boundary_mode=false
          for key in "${control_keys[@]}"; do
            if [[ -v "$key" ]]; then
              boundary_mode=true
            fi
          done
          expected_env_keys_b64=""
          sandbox_payload_b64=""
          if [[ "$boundary_mode" == "true" ]]; then
            for key in "${control_keys[@]}"; do
              [[ -v "$key" ]]
            done
            command_file="$(realpath -e "$OPENCLAW_QA_SUT_BOUNDARY_COMMAND_FILE")"
            identity_file="$(realpath -m "$OPENCLAW_QA_SUT_BOUNDARY_IDENTITY_FILE")"
            sandbox_file="$(realpath -m "$OPENCLAW_QA_SUT_BOUNDARY_SANDBOX_FILE")"
            generation="$OPENCLAW_QA_SUT_BOUNDARY_GENERATION"
            command_sha256="$OPENCLAW_QA_SUT_BOUNDARY_COMMAND_SHA256"
            control_dir="$(dirname "$command_file")"
            [[ "$control_dir" == "$temp_root/process-boundary" &&
                  "$(dirname "$identity_file")" == "$control_dir" &&
                  "$(dirname "$sandbox_file")" == "$control_dir" &&
                  "$(stat -c '%F:%a:%u:%g' "$command_file")" == "regular file:600:${RUNNER_UID}:${RUNNER_GID}" &&
                  "$(sha256sum "$command_file" | awk '{print $1}')" == "$command_sha256" ]]
            jq -e \
              --arg generation "$generation" \
              --arg executable "$NODE_BIN" \
              --arg preload "$PRELOAD_PATH" \
              --arg entry "$CANDIDATE_ROOT/dist/index.js" \
              '.version == 1 and
               .generation == $generation and
               .executable == $executable and
               .argv[0:3] == ["--import", $preload, $entry] and
               (.envKeys | type == "array" and length > 0)' \
              "$command_file" >/dev/null
            expected_env_keys_b64="$(jq -r '.envKeys[]' "$command_file" | base64 -w0)"
            sandbox_payload_b64="$(
              jq -c \
                --arg generation "$generation" \
                '{version: 1, generation: $generation, status: "pass", envKeys: .envKeys}' \
                "$command_file" |
                base64 -w0
            )"
            : >"$sandbox_file"
            chown root:"$RUNNER_GID" "$sandbox_file"
            chmod 0640 "$sandbox_file"
            export OPENCLAW_QA_SUT_PREENTRY_STOP=1
          else
            generation=""
            command_file=""
            identity_file=""
            sandbox_file=""
            command_sha256=""
          fi

          for key in "${control_keys[@]}"; do
            unset "$key"
          done
          export SUT_UID SUT_GID RUNNER_UID RUNNER_GID RUNNER_HOME RUNNER_TEMP_DIR
          export CANDIDATE_ROOT RUNTIME_ROOT NODE_BIN
          export PRELOAD_PATH RUNNER_SENTINEL TRUSTED_WORKSPACE EVIDENCE_ROOT
          export boundary_mode generation command_file identity_file sandbox_file
          export command_sha256 expected_env_keys_b64 sandbox_payload_b64

          launcher_stage=enter-mount-namespace
          launcher_stage_file="${RUNTIME_ROOT}/launcher-stage-${BASHPID}"
          printf '%s\n' "$launcher_stage" >"$launcher_stage_file"
          chmod 0600 "$launcher_stage_file"
          trap 'rm -f "$launcher_stage_file"' EXIT
          export launcher_stage_file
          /usr/bin/unshare \
            --mount \
            --fork \
            --propagation private \
            /bin/bash -ceu '
              set_launcher_stage() {
                launcher_stage="$1"
                printf "%s\n" "$launcher_stage" >"$launcher_stage_file"
              }
              set_launcher_stage mask-host-paths
              trap "exit_status=\$?; trap - ERR; printf \"Telegram SUT launcher failed: stage=%s line=%s status=%s\\n\" \"\$launcher_stage\" \"\$LINENO\" \"\$exit_status\" >&2; exit \"\$exit_status\"" ERR
              for masked_path in "$RUNNER_HOME" /tmp /var/tmp /dev/shm; do
                set_launcher_stage "mask-host-path:${masked_path}"
                [[ -d "$masked_path" ]]
                mount \
                  -t tmpfs \
                  -o mode=000,nosuid,nodev,noexec \
                  openclaw-telegram-mask \
                  "$masked_path"
              done
              set_launcher_stage mount-proc
              mount -t proc proc /proc -o nosuid,nodev,noexec,hidepid=2
              if [[ "$boundary_mode" == "true" ]]; then
                set_launcher_stage write-identity
                pid="$$"
                proc_stat="$(cat "/proc/${pid}/stat")"
                proc_tail="${proc_stat##*) }"
                pgrp="$(awk "{print \$3}" <<<"$proc_tail")"
                start_ticks="$(awk "{print \$20}" <<<"$proc_tail")"
                identity_tmp="${identity_file}.tmp-${pid}"
                jq -n \
                  --arg generation "$generation" \
                  --argjson pid "$pid" \
                  --argjson uid "$SUT_UID" \
                  --argjson gid "$SUT_GID" \
                  --arg procStartTicks "$start_ticks" \
                  --argjson pgrp "$pgrp" \
                  --arg commandPath "$command_file" \
                  --arg commandSha256 "$command_sha256" \
                  "{
                    version: 1,
                    generation: \$generation,
                    pid: \$pid,
                    uid: \$uid,
                    gid: \$gid,
                    procStartTicks: \$procStartTicks,
                    pgrp: \$pgrp,
                    commandFile: {path: \$commandPath, sha256: \$commandSha256}
                  }" >"$identity_tmp"
                chown root:"$RUNNER_GID" "$identity_tmp"
                chmod 0640 "$identity_tmp"
                mv "$identity_tmp" "$identity_file"
                exec 3>"$sandbox_file"
              fi

              set_launcher_stage launch-runtime
              unset launcher_stage_file
              exec /usr/bin/prlimit \
                --core=0:0 \
                --nproc=256:256 \
                -- \
                /usr/bin/setpriv \
                  --reuid="$SUT_UID" \
                  --regid="$SUT_GID" \
                  --clear-groups \
                  --no-new-privs \
                  --inh-caps=-all \
                  --ambient-caps=-all \
                  --bounding-set=-all \
                  --pdeathsig=KILL \
                  /bin/bash -ceu '\''
                    runtime_stage=verify-runtime-identity
                    fail_runtime_stage() {
                      exit_status="$1"
                      failure_line="$2"
                      trap - ERR
                      printf "Telegram SUT runtime preflight failed: stage=%s line=%s status=%s\n" \
                        "$runtime_stage" "$failure_line" "$exit_status" >&2
                      exit "$exit_status"
                    }
                    trap "fail_runtime_stage \$? \$LINENO" ERR
                    status="$(cat /proc/self/status)"
                    read -r real_uid effective_uid saved_uid fs_uid < <(
                      awk "/^Uid:/{print \$2, \$3, \$4, \$5}" <<<"$status"
                    )
                    read -r real_gid effective_gid saved_gid fs_gid < <(
                      awk "/^Gid:/{print \$2, \$3, \$4, \$5}" <<<"$status"
                    )
                    [[ "$real_uid" == "$SUT_UID" &&
                          "$effective_uid" == "$SUT_UID" &&
                          "$saved_uid" == "$SUT_UID" &&
                          "$fs_uid" == "$SUT_UID" &&
                          "$real_gid" == "$SUT_GID" &&
                          "$effective_gid" == "$SUT_GID" &&
                          "$saved_gid" == "$SUT_GID" &&
                          "$fs_gid" == "$SUT_GID" ]]
                    runtime_stage=verify-runtime-privileges
                    [[ -z "$(awk "/^Groups:/{\$1=\"\"; sub(/^ /, \"\"); print}" <<<"$status")" ]]
                    [[ "$(id -G)" == "$SUT_GID" ]]
                    grep -Eq "^NoNewPrivs:[[:space:]]+1$" <<<"$status"
                    for capability in CapInh CapPrm CapEff CapBnd CapAmb; do
                      grep -Eq "^${capability}:[[:space:]]+0+$" <<<"$status"
                    done
                    [[ "$(ulimit -Sc)" == "0" && "$(ulimit -Hc)" == "0" ]]
                    ! /usr/bin/sudo -n true >/dev/null 2>&1
                    runtime_stage=verify-parent-proc-hidden
                    for proc_path in environ mem fd cmdline; do
                      [[ ! -e "/proc/${OPENCLAW_QA_PARENT_PID:?}/${proc_path}" ]]
                    done
                    runtime_stage=verify-proc-visibility
                    OPENCLAW_QA_PROC_CONTROL=visible sleep 30 &
                    control_pid="$!"
                    trap "kill ${control_pid} >/dev/null 2>&1 || true" EXIT
                    proc_marker_visible=false
                    # The background child can still expose the shell pre-exec environment.
                    for _ in {1..100}; do
                      if tr "\0" "\n" <"/proc/${control_pid}/environ" 2>/dev/null |
                        grep -Fxq "OPENCLAW_QA_PROC_CONTROL=visible"; then
                        proc_marker_visible=true
                        break
                      fi
                      kill -0 "$control_pid" >/dev/null 2>&1 || break
                      sleep 0.05
                    done
                    [[ "$proc_marker_visible" == "true" ]]
                    # Reading the marker is the proof; the probe may exit before cleanup.
                    kill "$control_pid" >/dev/null 2>&1 || true
                    wait "$control_pid" || true
                    trap - EXIT
                    runtime_stage=verify-secret-env-hidden
                    ! tr "\0" "\n" </proc/self/environ |
                      grep -Eq "^(OPENCLAW_QA_CONVEX_SECRET[^=]*|OPENCLAW_QA_SUT_FORBIDDEN_SENTINEL|OPENCLAW_QA_TELEGRAM_(GROUP_ID|DRIVER_BOT_TOKEN|SUT_BOT_TOKEN)|GITHUB_[^=]*|ACTIONS_[^=]*|RUNNER_[^=]*|NPM_TOKEN|NODE_AUTH_TOKEN)="
                    runtime_stage=verify-runner-fds-hidden
                    while IFS= read -r fd_target; do
                      [[ "$fd_target" != *"/_runner_file_commands/"* &&
                            "$fd_target" != *"/github/file_commands/"* ]]
                    done < <(
                      for fd in /proc/self/fd/*; do
                        readlink "$fd" 2>/dev/null || true
                      done
                    )
                    runtime_stage=verify-runtime-files
                    [[ -r "$CANDIDATE_ROOT/dist/index.js" &&
                          ! -w "$CANDIDATE_ROOT/dist/index.js" &&
                          -r "${OPENCLAW_CONFIG_PATH:?}" &&
                          ! -w "$OPENCLAW_CONFIG_PATH" ]]
                    for writable_path in \
                      "${OPENCLAW_QA_TEMP_ROOT:?}/workspace" \
                      "${OPENCLAW_HOME:?}" \
                      "${OPENCLAW_STATE_DIR:?}" \
                      "${XDG_CACHE_HOME:?}" \
                      "${XDG_CONFIG_HOME:?}" \
                      "${XDG_DATA_HOME:?}" \
                      "${TMPDIR:?}"; do
                      [[ -d "$writable_path" && -w "$writable_path" ]]
                    done
                    runtime_stage=verify-host-paths-hidden
                    for protected_path in \
                      "$RUNNER_HOME" \
                      "$RUNNER_TEMP_DIR" \
                      "$RUNNER_SENTINEL" \
                      "$TRUSTED_WORKSPACE" \
                      "$EVIDENCE_ROOT" \
                      /tmp \
                      /var/tmp \
                      /dev/shm; do
                      [[ ! -r "$protected_path" && ! -w "$protected_path" ]]
                    done

                    runtime_stage=sanitize-runtime-env
                    runtime_boundary_mode="$boundary_mode"
                    runtime_candidate_root="$CANDIDATE_ROOT"
                    runtime_expected_env_keys_b64="$expected_env_keys_b64"
                    runtime_node_bin="$NODE_BIN"
                    runtime_preload_path="$PRELOAD_PATH"
                    runtime_sandbox_payload_b64="$sandbox_payload_b64"
                    unset \
                      CANDIDATE_ROOT \
                      EVIDENCE_ROOT \
                      NODE_BIN \
                      PRELOAD_PATH \
                      RUNNER_GID \
                      RUNNER_HOME \
                      RUNNER_SENTINEL \
                      RUNNER_TEMP_DIR \
                      RUNNER_UID \
                      RUNTIME_ROOT \
                      SUT_GID \
                      SUT_UID \
                      TRUSTED_WORKSPACE \
                      boundary_mode \
                      command_file \
                      command_sha256 \
                      expected_env_keys_b64 \
                      generation \
                      identity_file \
                      sandbox_file \
                      sandbox_payload_b64

                    if [[ "$runtime_boundary_mode" == "true" ]]; then
                      runtime_stage=verify-runtime-env
                      actual_env_keys_b64="$(
                        env |
                          cut -d= -f1 |
                          grep -Ev "^(PWD|SHLVL|_)$" |
                          sort -u |
                          base64 -w0
                      )"
                      [[ "$actual_env_keys_b64" == "$runtime_expected_env_keys_b64" ]]
                      runtime_stage=write-sandbox-proof
                      printf "%s" "$runtime_sandbox_payload_b64" | base64 -d >&3
                      exec 3>&-
                      runtime_stage=exec-runtime
                      exec "$runtime_node_bin" \
                        --import "$runtime_preload_path" \
                        "$runtime_candidate_root/dist/index.js" \
                        "$@"
                    fi
                    runtime_stage=exec-runtime
                    exec "$runtime_node_bin" "$runtime_candidate_root/dist/index.js" "$@"
                  '\'' openclaw-sut "$@"
            ' openclaw-sut "$@"
          LAUNCHER
          sudo chown root:root "$launcher"
          sudo chmod 0755 "$launcher"

          forwarded_env_keys="$(
            sed -n '/^transport_keys=(/,/^)/p' "$launcher" |
              sed -n '2,$p' |
              sed '$d' |
              sed 's/^[[:space:]]*//'
          )"
          forwarded_env_keys="$(paste -sd, <<<"$forwarded_env_keys")"
          {
            echo "candidate_root=$CANDIDATE_ROOT"
            echo "candidate_extract_root=$candidate_extract_root"
            echo "boundary_evidence_dir=$boundary_evidence_dir"
            echo "evidence_relative=$evidence_relative"
            echo "evidence_root=$evidence_root"
            echo "evidence_artifact_name=$evidence_artifact_name"
            echo "forwarded_env_keys=$forwarded_env_keys"
            echo "gid=$sut_gid"
            echo "launcher=$launcher"
            echo "preload=$preload"
            echo "runtime_root=$runtime_root"
            echo "runtime_executable=$node_bin"
            echo "uid=$sut_uid"
            echo "user=$sut_user"
          } >>"$GITHUB_OUTPUT"

      - name: Validate required QA credential env
        id: validate_credentials
        env:
          CREDENTIAL_ACQUIRE_TIMEOUT_MS: "60000"
          JOB_TIMEOUT_MINUTES: "60"
          LEASE_TTL_MS: "7200000"
          OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
          OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
          RUNNER_ENVIRONMENT: ${{ runner.environment }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$RUNNER_ENVIRONMENT" == "github-hosted" ]]
          ((JOB_TIMEOUT_MINUTES * 60 * 1000 < LEASE_TTL_MS))
          [[ -n "${OPENCLAW_QA_CONVEX_SITE_URL// }" ]]
          [[ -n "${OPENCLAW_QA_CONVEX_SECRET_CI// }" ]]

      - name: Run Telegram live lane
        id: run_lane
        env:
          CANDIDATE_ROOT: ${{ steps.create_sut.outputs.candidate_root }}
          EVIDENCE_RELATIVE: ${{ steps.create_sut.outputs.evidence_relative }}
          EVIDENCE_ROOT: ${{ steps.create_sut.outputs.evidence_root }}
          OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
          OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
          OPENCLAW_QA_CREDENTIAL_ACQUIRE_TIMEOUT_MS: "60000"
          OPENCLAW_QA_CREDENTIAL_LEASE_TTL_MS: "7200000"
          OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1"
          OPENCLAW_QA_SUT_FORBIDDEN_SENTINEL: trusted-parent-${{ github.run_id }}-${{ github.run_attempt }}
          OPENCLAW_QA_TELEGRAM_SUT_FORWARDED_ENV_KEYS: ${{ steps.create_sut.outputs.forwarded_env_keys }}
          OPENCLAW_QA_TELEGRAM_SUT_CLEANUP_TIMEOUT_MS: "60000"
          OPENCLAW_QA_TELEGRAM_SUT_GID: ${{ steps.create_sut.outputs.gid }}
          OPENCLAW_QA_TELEGRAM_SUT_OPENCLAW_COMMAND: ${{ steps.create_sut.outputs.launcher }}
          OPENCLAW_QA_TELEGRAM_SUT_PRELOAD_PATH: ${{ steps.create_sut.outputs.preload }}
          OPENCLAW_QA_TELEGRAM_SUT_PROCESS_BOUNDARY_DIR: ${{ steps.create_sut.outputs.boundary_evidence_dir }}
          OPENCLAW_QA_TELEGRAM_SUT_RUNTIME_EXECUTABLE: ${{ steps.create_sut.outputs.runtime_executable }}
          OPENCLAW_QA_TELEGRAM_SUT_UID: ${{ steps.create_sut.outputs.uid }}
          SUT_RUNTIME_ROOT: ${{ steps.create_sut.outputs.runtime_root }}
          SUT_UID: ${{ steps.create_sut.outputs.uid }}
          TARGET_SHA: ${{ inputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail
          output_dir="$EVIDENCE_ROOT"
          terminate_sut_uid() {
            "$OPENCLAW_QA_TELEGRAM_SUT_OPENCLAW_COMMAND" --terminate-uid
          }
          terminate_sut_uid_on_exit() {
            status="$?"
            trap - EXIT
            if ! terminate_sut_uid; then
              status=1
            fi
            exit "$status"
          }
          trap terminate_sut_uid_on_exit EXIT
          trap 'exit 130' INT
          trap 'exit 143' TERM
          {
            printf 'trusted_harness_sha=%s\n' "${{ needs.trusted_identity.outputs.workflow_sha }}"
            printf 'candidate_runtime_plugin_sha=%s\n' "$TARGET_SHA"
            printf 'trusted_scenario_source=verified_trusted_workflow_sha\n'
          } >"${output_dir}/source-attestation.txt"
          echo "output_dir=$output_dir" >>"$GITHUB_OUTPUT"

          run_qa_attempt() (
            set -euo pipefail
            exec 2>&1
            output_name="$1"
            shift
            workflow_command_token="$(openssl rand -hex 32)"
            printf '::stop-commands::%s\n' "$workflow_command_token"
            trap 'printf "::%s::\n" "$workflow_command_token"' EXIT
            set +e
            TMPDIR="${SUT_RUNTIME_ROOT}/tmp" \
              pnpm openclaw qa telegram \
                --repo-root "$CANDIDATE_ROOT" \
                --output-dir "${EVIDENCE_RELATIVE}/${output_name}" \
                --provider-mode mock-openai \
                --model mock-openai/gpt-5.6-luna \
                --alt-model mock-openai/gpt-5.6-luna-alt \
                --fast \
                --credential-source convex \
                --credential-role ci \
                "$@"
            status="$?"
            set -e
            exit "$status"
          )

          if ! run_qa_attempt preflight --scenario channel-canary; then
            echo "Telegram channel canary failed; skipping the remaining scenarios." >&2
            exit 1
          fi
          terminate_sut_uid

          remaining_scenarios=()
          while IFS=$'\t' read -r scenario_id default_label _; do
            if [[ "$default_label" == "default" && "$scenario_id" != "channel-canary" ]]; then
              remaining_scenarios+=(--scenario "$scenario_id")
            fi
          done < <(
            TMPDIR="${SUT_RUNTIME_ROOT}/tmp" \
              pnpm openclaw qa telegram \
                --repo-root "$CANDIDATE_ROOT" \
                --provider-mode mock-openai \
                --list-scenarios
          )
          ((${#remaining_scenarios[@]} > 0))

          for attempt in 1 2; do
            if run_qa_attempt "attempt-${attempt}" "${remaining_scenarios[@]}"; then
              exit 0
            fi
            terminate_sut_uid
            if [[ "$attempt" == "2" ]]; then
              exit 1
            fi
            echo "Telegram live lane failed on attempt ${attempt}; retrying once..." >&2
          done

      - name: Terminate isolated Telegram SUT
        id: terminate_sut
        if: always() && steps.create_sut.outputs.uid != ''
        env:
          SUT_UID: ${{ steps.create_sut.outputs.uid }}
        shell: bash
        run: |
          set -euo pipefail
          sudo pkill -TERM -U "$SUT_UID" >/dev/null 2>&1 || true
          sudo pkill -TERM -u "$SUT_UID" >/dev/null 2>&1 || true
          sleep 3
          sudo pkill -KILL -U "$SUT_UID" >/dev/null 2>&1 || true
          sudo pkill -KILL -u "$SUT_UID" >/dev/null 2>&1 || true

          consecutive_empty=0
          for _ in $(seq 1 30); do
            pids="$(
              {
                pgrep -U "$SUT_UID" || true
                pgrep -u "$SUT_UID" || true
              } | sort -u
            )"
            if [[ -z "$pids" ]]; then
              consecutive_empty=$((consecutive_empty + 1))
              if [[ "$consecutive_empty" -ge 2 ]]; then
                echo "quiescent=true" >>"$GITHUB_OUTPUT"
                exit 0
              fi
            else
              consecutive_empty=0
              sudo kill -KILL $pids >/dev/null 2>&1 || true
            fi
            sleep 1
          done
          echo "Isolated Telegram SUT UID still owns processes after terminal cleanup." >&2
          exit 1

      - name: Finalize trusted Telegram process-boundary evidence
        id: finalize_boundary
        if: always() && steps.terminate_sut.outputs.quiescent == 'true' && steps.run_lane.outputs.output_dir != ''
        env:
          BOUNDARY_EVIDENCE_DIR: ${{ steps.create_sut.outputs.boundary_evidence_dir }}
          OUTPUT_DIR: ${{ steps.run_lane.outputs.output_dir }}
        shell: bash
        run: |
          set -euo pipefail
          context_path="${BOUNDARY_EVIDENCE_DIR}/context.json"
          runtime_path="${BOUNDARY_EVIDENCE_DIR}/runtime-boundary.json"
          aggregate_name="telegram-sut-boundary-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.json"
          aggregate_path="${OUTPUT_DIR}/${aggregate_name}"
          shopt -s nullglob
          retain_lease_paths=("${BOUNDARY_EVIDENCE_DIR}"/retain-credential-lease-*.json)
          ((${#retain_lease_paths[@]} == 0))
          runtime_parts=("${BOUNDARY_EVIDENCE_DIR}"/runtime-boundary-*.json)
          ((${#runtime_parts[@]} > 0))
          jq -s \
            '{
              version: 1,
              kind: "qa-gateway-process-boundary",
              launches: [.[].launches[]]
            }' \
            "${runtime_parts[@]}" >"${runtime_path}.tmp"
          chmod 0600 "${runtime_path}.tmp"
          mv "${runtime_path}.tmp" "$runtime_path"

          jq -e \
            --arg runId "$GITHUB_RUN_ID" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            '
              .version == 1 and
              .kind == "telegram-sut-boundary" and
              .runId == $runId and
              .runAttempt == $runAttempt and
              (.workflowSha | test("^[a-f0-9]{40}$")) and
              (.targetSha | test("^[a-f0-9]{40}$")) and
              (.candidateArtifact.id | test("^[1-9][0-9]*$")) and
              (.candidateArtifact.name | length > 0) and
              (.candidateArtifact.digest | test("^[a-f0-9]{64}$")) and
              .candidateArtifact.runId == $runId and
              .candidateArtifact.runAttempt == $runAttempt and
              (.candidateArtifact.fileName | length > 0) and
              (.candidateArtifact.sha256 | test("^[a-f0-9]{64}$")) and
              (.candidateArtifact.sourceSha | test("^[a-f0-9]{40}$")) and
              (.candidateArtifact.version | length > 0)
            ' "$context_path" >/dev/null
          jq -e \
            '
              .version == 1 and
              .kind == "qa-gateway-process-boundary" and
              (.launches | type == "array" and length > 0) and
              all(
                .launches[];
                (.generation | test("^[a-f0-9-]{36}$")) and
                (.pid | type == "number" and . > 1) and
                (.procStartTicks | test("^[0-9]+$")) and
                (.pgrp | type == "number" and . > 1) and
                (.executablePath | length > 0) and
                (.preEntryCmdlineSha256 | test("^[a-f0-9]{64}$")) and
                (.commandFile.path | length > 0) and
                (.commandFile.sha256 | test("^[a-f0-9]{64}$")) and
                (.identityFile | length > 0) and
                (.sandboxFile | length > 0) and
                (.acceptedAt | length > 0) and
                (.exitedAt | length > 0) and
                (.quiescedAt | length > 0) and
                (
                  (
                    .terminalState == "ready-exited" and
                    (.readyAt | length > 0)
                  ) or
                  (
                    .terminalState == "failed-before-ready" and
                    (.readyAt == null)
                  )
                )
              ) and
              ([.launches[] | select(.terminalState == "ready-exited")] | length >= 2)
            ' "$runtime_path" >/dev/null

          while IFS=$'\t' read -r relative_path expected_sha256; do
            evidence_path="$(realpath -e "${BOUNDARY_EVIDENCE_DIR}/${relative_path}")"
            case "$evidence_path" in
              "${BOUNDARY_EVIDENCE_DIR}"/*) ;;
              *) echo "Process-boundary evidence escaped its trusted directory." >&2; exit 1 ;;
            esac
            [[ "$(stat -c '%F:%a' "$evidence_path")" == "regular file:600" ]]
            if [[ -n "$expected_sha256" ]]; then
              [[ "$(sha256sum "$evidence_path" | awk '{print $1}')" == "$expected_sha256" ]]
            fi
          done < <(
            jq -r '
              .launches[] |
              [.commandFile.path, .commandFile.sha256],
              [.identityFile, ""],
              [.sandboxFile, ""] |
              @tsv
            ' "$runtime_path"
          )

          aggregate_tmp="${aggregate_path}.tmp"
          jq -s '
            .[0] + {
              runtimeBoundary: (
                .[1] |
                .launches |= map(
                  .commandFile.path = ("process-boundary/" + .commandFile.path) |
                  .identityFile = ("process-boundary/" + .identityFile) |
                  .sandboxFile = ("process-boundary/" + .sandboxFile)
                )
              )
            }
          ' \
            "$context_path" \
            "$runtime_path" >"$aggregate_tmp"
          chmod 0600 "$aggregate_tmp"
          mv "$aggregate_tmp" "$aggregate_path"
          rm -f "$context_path" "$runtime_path" "${runtime_parts[@]}"
          echo "aggregate_path=$aggregate_path" >>"$GITHUB_OUTPUT"

      - name: Validate trusted Telegram evidence
        id: validate_evidence
        if: always() && steps.finalize_boundary.outputs.aggregate_path != ''
        env:
          OUTPUT_DIR: ${{ steps.run_lane.outputs.output_dir }}
        shell: bash
        run: |
          set -euo pipefail
          python3 scripts/release-telegram-candidate-archive.py validate-tree \
            "$OUTPUT_DIR" \
            --max-entries 100000 \
            --max-apparent-bytes 2147483648

      - name: Remove isolated Telegram SUT identity
        id: remove_sut
        if: always() && steps.terminate_sut.outputs.quiescent == 'true'
        env:
          SUT_USER: ${{ steps.create_sut.outputs.user }}
        shell: bash
        run: |
          set -euo pipefail
          sudo userdel "$SUT_USER"
          sudo rm -f \
            /etc/openclaw-telegram-sut.conf \
            /etc/security/limits.d/99-openclaw-telegram-sut.conf \
            /usr/local/bin/openclaw-telegram-sut-launcher

      - name: Upload Telegram QA artifacts
        id: upload_evidence
        if: always() && steps.validate_evidence.outcome == 'success'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ steps.create_sut.outputs.evidence_artifact_name }}
          path: ${{ steps.run_lane.outputs.output_dir }}
          retention-days: 14
          if-no-files-found: error

      - name: Remove isolated Telegram runtime files
        id: cleanup_runtime
        if: always() && steps.create_sut.outputs.runtime_root != ''
        env:
          CANDIDATE_ROOT: ${{ steps.create_sut.outputs.candidate_root }}
          CANDIDATE_EXTRACT_ROOT: ${{ steps.create_sut.outputs.candidate_extract_root }}
          RUNTIME_ROOT: ${{ steps.create_sut.outputs.runtime_root }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$RUNTIME_ROOT" == "/var/lib/openclaw-telegram-sut-runtime-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" ]]
          [[ "$CANDIDATE_ROOT" == "/opt/openclaw-telegram-sut-candidate-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" ]]
          [[ "$CANDIDATE_EXTRACT_ROOT" == "${RUNNER_TEMP}/openclaw-telegram-executor-extract" ]]
          sudo rm -rf -- "$RUNTIME_ROOT"
          sudo rm -rf -- "$CANDIDATE_ROOT"
          sudo rm -rf -- "$CANDIDATE_EXTRACT_ROOT"

      - name: Record Telegram execution status
        id: record_status
        if: always()
        env:
          OUTCOMES: >-
            ${{ steps.require_attestation.outcome }}
            ${{ steps.build_harness.outcome }}
            ${{ steps.metadata.outcome }}
            ${{ steps.download.outcome }}
            ${{ steps.extract_candidate.outcome }}
            ${{ steps.revalidate_provenance.outcome }}
            ${{ steps.create_sut.outcome }}
            ${{ steps.validate_credentials.outcome }}
            ${{ steps.run_lane.outcome }}
            ${{ steps.terminate_sut.outcome }}
            ${{ steps.finalize_boundary.outcome }}
            ${{ steps.validate_evidence.outcome }}
            ${{ steps.remove_sut.outcome }}
            ${{ steps.upload_evidence.outcome }}
            ${{ steps.cleanup_runtime.outcome }}
        shell: bash
        run: |
          set -euo pipefail
          status=success
          for outcome in $OUTCOMES; do
            [[ "$outcome" == "success" ]] || status=failure
          done
          echo "status=$status" >>"$GITHUB_OUTPUT"

  advisory_status:
    name: Record Telegram release-check status
    needs: [trusted_identity, build_candidate, attest_candidate, run_telegram]
    if: always()
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      actions: read
      contents: read
    steps:
      - name: Record advisory status
        id: record_status
        env:
          ARCHIVE_NAME: ${{ needs.build_candidate.outputs.archive_name }}
          ARCHIVE_SHA256: ${{ needs.build_candidate.outputs.archive_sha256 }}
          ATTESTATION_STATUS: ${{ needs.attest_candidate.outputs.status }}
          BUILD_RESULT: ${{ needs.build_candidate.result }}
          BUILD_STATUS: ${{ needs.build_candidate.outputs.status }}
          CANDIDATE_ARTIFACT_DIGEST: ${{ needs.build_candidate.outputs.artifact_digest }}
          CANDIDATE_ARTIFACT_ID: ${{ needs.build_candidate.outputs.artifact_id }}
          CANDIDATE_VERSION: ${{ needs.build_candidate.outputs.candidate_version }}
          EVIDENCE_ARTIFACT_DIGEST: ${{ needs.run_telegram.outputs.evidence_artifact_digest }}
          EVIDENCE_ARTIFACT_ID: ${{ needs.run_telegram.outputs.evidence_artifact_id }}
          EVIDENCE_ARTIFACT_NAME: ${{ needs.run_telegram.outputs.evidence_artifact_name }}
          EXECUTION_STATUS: ${{ needs.run_telegram.outputs.status }}
          IDENTITY_RESULT: ${{ needs.trusted_identity.result }}
          IDENTITY_STATUS: ${{ needs.trusted_identity.outputs.status }}
          RUN_RESULT: ${{ needs.run_telegram.result }}
          TARGET_SHA: ${{ inputs.target_sha }}
          WORKFLOW_SHA: ${{ needs.trusted_identity.outputs.workflow_sha }}
          ATTESTATION_RESULT: ${{ needs.attest_candidate.result }}
        shell: bash
        run: |
          set -euo pipefail
          status=failure
          if [[ "$IDENTITY_RESULT" == "cancelled" ||
                "$BUILD_RESULT" == "cancelled" ||
                "$ATTESTATION_RESULT" == "cancelled" ||
                "$RUN_RESULT" == "cancelled" ]]; then
            status=cancelled
          elif [[ "$IDENTITY_STATUS" == "success" &&
                  "$BUILD_STATUS" == "success" &&
                  "$ATTESTATION_STATUS" == "success" &&
                  "$EXECUTION_STATUS" == "success" ]]; then
            status=success
          fi

          candidate_artifact=null
          if [[ "$CANDIDATE_ARTIFACT_ID" =~ ^[1-9][0-9]*$ &&
                "$CANDIDATE_ARTIFACT_DIGEST" =~ ^[a-f0-9]{64}$ &&
                "$ARCHIVE_NAME" == "release-telegram-candidate-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${TARGET_SHA}.tar.zst" &&
                "$ARCHIVE_SHA256" =~ ^[a-f0-9]{64}$ &&
                -n "$CANDIDATE_VERSION" ]]; then
            candidate_artifact="$(
              jq -cn \
                --arg id "$CANDIDATE_ARTIFACT_ID" \
                --arg name "$ARCHIVE_NAME" \
                --arg digest "$CANDIDATE_ARTIFACT_DIGEST" \
                --arg runId "$GITHUB_RUN_ID" \
                --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
                --arg fileName "$ARCHIVE_NAME" \
                --arg sha256 "$ARCHIVE_SHA256" \
                --arg sourceSha "$TARGET_SHA" \
                --arg version "$CANDIDATE_VERSION" \
                '{
                  id: $id,
                  name: $name,
                  digest: $digest,
                  runId: $runId,
                  runAttempt: $runAttempt,
                  fileName: $fileName,
                  sha256: $sha256,
                  sourceSha: $sourceSha,
                  version: $version
                }'
            )"
          fi
          if [[ "$status" == "success" ]]; then
            [[ "$candidate_artifact" != "null" &&
                  "$WORKFLOW_SHA" =~ ^[a-f0-9]{40}$ &&
                  "$TARGET_SHA" =~ ^[a-f0-9]{40}$ &&
                  "$EVIDENCE_ARTIFACT_ID" =~ ^[1-9][0-9]*$ &&
                  "$EVIDENCE_ARTIFACT_DIGEST" =~ ^[a-f0-9]{64}$ &&
                  "$EVIDENCE_ARTIFACT_NAME" == "release-qa-live-telegram-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${TARGET_SHA}" ]]
          fi

          status_dir=".artifacts/release-check-status"
          status_file="${status_dir}/qa_live_telegram_release_checks-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.env"
          evidence_file="${status_dir}/qa_live_telegram_release_checks-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.json"
          mkdir -p "$status_dir"
          step_outcomes="identity:${IDENTITY_STATUS} build:${BUILD_STATUS} attest:${ATTESTATION_STATUS} execute:${EXECUTION_STATUS}"
          {
            printf 'run_id=%s\n' "$GITHUB_RUN_ID"
            printf 'run_attempt=%s\n' "$GITHUB_RUN_ATTEMPT"
            printf 'target_sha=%s\n' "$TARGET_SHA"
            printf 'workflow_sha=%s\n' "$WORKFLOW_SHA"
            printf 'job=%s\n' "qa_live_telegram_release_checks"
            printf 'variant=\n'
            printf 'status=%s\n' "$status"
            printf 'job_status=%s\n' "$RUN_RESULT"
            printf 'step_outcomes=%s\n' "$step_outcomes"
          } >"$status_file"
          jq -n \
            --arg status "$status" \
            --arg jobStatus "$RUN_RESULT" \
            --arg identityOutcome "identity:${IDENTITY_STATUS}" \
            --arg buildOutcome "build:${BUILD_STATUS}" \
            --arg attestOutcome "attest:${ATTESTATION_STATUS}" \
            --arg executeOutcome "execute:${EXECUTION_STATUS}" \
            --arg runId "$GITHUB_RUN_ID" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --arg workflowSha "$WORKFLOW_SHA" \
            --arg targetSha "$TARGET_SHA" \
            --arg evidenceId "$EVIDENCE_ARTIFACT_ID" \
            --arg evidenceName "$EVIDENCE_ARTIFACT_NAME" \
            --arg evidenceDigest "$EVIDENCE_ARTIFACT_DIGEST" \
            --argjson candidateArtifact "$candidate_artifact" \
            '{
              version: 1,
              kind: "release-check-status",
              job: "qa_live_telegram_release_checks",
              status: $status,
              jobStatus: $jobStatus,
              stepOutcomes: [
                $identityOutcome,
                $buildOutcome,
                $attestOutcome,
                $executeOutcome
              ],
              runId: $runId,
              runAttempt: $runAttempt,
              workflowSha: $workflowSha,
              targetSha: $targetSha,
              evidenceArtifact: {
                id: $evidenceId,
                name: $evidenceName,
                digest: $evidenceDigest,
                runId: $runId,
                runAttempt: $runAttempt
              },
              candidateArtifact: $candidateArtifact
            }' >"$evidence_file"
          {
            echo "status=$status"
            echo "status_file=$status_file"
            echo "evidence_file=$evidence_file"
          } >>"$GITHUB_OUTPUT"

      - name: Upload advisory status
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: release-check-status-qa-live-telegram-${{ inputs.target_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            ${{ steps.record_status.outputs.status_file }}
            ${{ steps.record_status.outputs.evidence_file }}
          retention-days: 14
          if-no-files-found: error

      - name: Require successful Telegram release check
        if: always()
        env:
          STATUS: ${{ steps.record_status.outputs.status }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$STATUS" == "success" ]]