fix(telegram): preserve authorization union across group sources

[agent-sting]

Summary

• preserve union semantics across global, group-user, allowed-chat, environment, and pairing authorization
• scope routed Telegram profile authorization and pairing state consistently
• retain pre-initialization media gating behavior

Resolves the behavior tracked internally as I-Ca-038 and supersedes the incomplete approach in #69617.

Fixes #68716.

Validation

• 358 focused gateway/Telegram tests passed
• full suite: 47,703 passed, 13 failed; 12 failures reproduced unchanged on canonical main, and the one branch regression was fixed with dedicated coverage
• independent review: no findings
• Sting exact-config authorization matrix: 9/9 passed
• Sting gateway restarted successfully and remains active with zero automatic restarts

[teknium1]

Thanks for carrying forward the authorization-union and multiplex pairing work. The premise is verified on current main: plugins/platforms/telegram/adapter.py:1045-1054 selects group_allow_from as the sole intake authority, despite website/docs/user-guide/messaging/telegram.md:996-1029 documenting independent global-user, group-user, and group-chat grants.

Problems

• The PR is currently marked DIRTY against current main (head 71de87cac8bf43bc8b4cf394573b753a91c86e7d, base 339d968689a3b91c5f537d7198ff28abde32ab3b), and the relevant gateway code has moved substantially.

Suggested changes

• During salvage, retain the early intake gate while applying the union at the current intake and runner paths (plugins/platforms/telegram/adapter.py:1045-1054; gateway/authz_mixin.py:571-652).
• Preserve the current BasePlatformAdapter.build_source profile-routing seam (gateway/platforms/base.py:6555) and validate multiplex secret-scope behavior.

Automated hermes-sweeper review.

[GottZ]

This was generated by AI during triage.

Summary

Four PRs address #68716: #57189 adds only the group-user grant at intake, #68784 defers group-scoped decisions to the runner, #69617 centralizes the full authorization union, and #72084 carries that union forward while also covering environment, pairing, and multiplex-profile authorization.

Related pull requests

• fix(gateway): honor group_allow_from for Telegram group/forum chats #57189 [closed] partial — (+17/-3) — partial duplicate: unions group_allow_from with allow_from for group/forum intake, fixing the group-user case but not the documented group_allowed_chats grant. Although closed, it remains relevant as the smallest corroborating implementation and was superseded by the more complete approaches.
• fix(telegram): don't let allow_from short-circuit group authorization (#68716) #68784 [closed] best fix — (+381/-38) — superseded best-fix candidate: defers group/forum intake to the runner when either group-scoped rule is configured and adds a broad regression matrix, but its has_group_scope/deferral design targets an authorization path later redesigned on main. Although recorded as a best available fix, it remains closed because its own rebase analysis found the patch structurally inapplicable; fix(telegram): preserve authorization union across group sources #72084 carries the applicable union behavior onto the newer paths.
• fix(telegram): preserve group authorization union #69617 [closed] duplicate — (+133/-37) — blocked duplicate: centralizes global-user, group-user, and group-chat grants across intake and runner authorization, directly matching the reported cause. It remains closed because the contributor review found that empty config lists became explicit rejections; fix(telegram): preserve authorization union across group sources #72084 addresses that objection by treating empty applicable lists as no decision and adds dedicated coverage.
• fix(telegram): preserve authorization union across group sources #72084 best fix — (+738/-67) — keep-open salvage candidate: preserves the complete config/environment authorization union and fixes fix(telegram): preserve group authorization union #69617's empty-list regression, while also adding profile-scoped secret, pairing, routing, channel, and cold-path handling. The diff directly addresses the current sole-group_allow_from intake behavior identified by the automated keep_open review, but its broad, dirty branch must be rebased and reconciled with the moved intake, runner, and build_source paths.

Duplicates

#57189 is a partial duplicate of the intake fix. #68784 and #69617 substantially duplicate the authorization-union core now carried by #72084, with #69617 additionally serving as the source of the empty-list regression that #72084 corrects.

Suggested consolidation

Keep #72084 open with a salvage path, consistent with its automated keep_open review: rebase it onto current main and retain the scoped authorization-union helper, empty-list semantics, focused union tests, early intake gate, current BasePlatformAdapter.build_source routing seam, and multiplex secret/pairing isolation. Leave #57189, #68784, and #69617 closed as superseded duplicates; despite the recorded best-fix status for #68784, its diff is tied to the obsolete has_group_scope/runner-deferral architecture, while #72084 contains the applicable successor and explicitly addresses the contributor-blocking empty-list defect in #69617.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I68716(["issue #68716 (open)"])
    subgraph Dup57189 ["PRs duplicating each other"]
        P57189["PR #57189 (closed)"]
        P68784["PR #68784 (closed)"]
        P69617["PR #69617 (closed)"]
        P72084["PR #72084 (open)"]
    end
    P72084 -->|best fix| I68716
    class I68716 open
    class P57189 closed
    class P68784 closed
    class P69617 closed
    class P72084 open
    class P68784 best
    class P72084 best
    class P72084 target
    click I68716 "https://github.com/NousResearch/hermes-agent/issues/68716"
    click P57189 "https://github.com/NousResearch/hermes-agent/pull/57189"
    click P68784 "https://github.com/NousResearch/hermes-agent/pull/68784"
    click P69617 "https://github.com/NousResearch/hermes-agent/pull/69617"
    click P72084 "https://github.com/NousResearch/hermes-agent/pull/72084"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed (state tag in the node label).

Cross-PR triage: Reviewed 4 pull requests and 1 issue in this complex. Each diff was read against this issue; Assessment working set: 81 kB of PR diffs, 13 kB of issue/PR text, 13 kB of discussion (22 comments), 7 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.