Parent and architecture

• Implementation epic: #6
• Architecture: #1
• Cloud bootstrap: #12
• Depends on: #17

Outcome

Prove the real cloud-dev Telegram text/image path and the operational routing controls after the external ingress is available.

Estimate

• 5 SP / 3 engineering days
• Risk: high

Scope

• Drain any pre-existing Telegram retry backlog and establish a fresh test boundary.
• Send one fresh text update and one fresh image update through the Cloudflare webhook.
• Prove, using opaque IDs and counts only:
  • Cloudflare acceptance and one Yandex Workflow execution per update;
  • API Gateway/control ingestion;
  • YDB update deduplication, run and outbox state;
  • Object Storage input/attachment manifests without reading contents;
  • YMQ dispatch and delivery queue/DLQ attributes;
  • isolated deterministic worker completion;
  • Telegram delivery back to the originating chat.
• Exercise one safe duplicate-update retry and prove no duplicate logical run/outbox.
• Demonstrate API Gateway control-slot routing with canary weight changes.
• Demonstrate rollback to the prior stable slot without rebuilding images.
• Record image digests, commit SHA, migration head and redacted cloud resource evidence in #12.

Non-goals

• External ingress implementation.
• Monitoring alert provisioning.
• Subscription-backed Codex/OpenCode/Claude/Hermes execution.
• Reading or publishing message text, images, Telegram identities, tokens or capability URLs.

Verification

• getWebhookInfo remains at zero pending updates and has no new delivery error.
• Two fresh Telegram inputs produce two successful workflow executions and terminal delivery states.
• YMQ and DLQ counts return to the expected steady state.
• The artifact bucket contains tenant-prefixed objects with expected counts/sizes only.
• A duplicate frontend update resolves to its canonical run.
• Canary traffic is observed on the candidate slot, then rollback is observed on the stable slot.

Acceptance criteria

• The evidence proves the whole external-to-internal-to-external path without inspecting payload contents.
• All test identifiers and time boundaries are explicit.
• Canary and rollback use reviewed Terraform plans under the deployment lock.
• No data-bearing or secret-bearing diagnostic output is attached to a public issue.