Pin Telegram host-ingress verifier fail-closed

[hanakannzashi]

Summary

• add a Telegram host-ingress registry regression proving shared-secret-header policy cannot be satisfied by webhook-signature verifier bindings
• update the manifest-driven channels plan to reflect completed transport/auth and generic serve-plan work

Tests

• cargo fmt --check
• cargo test -p ironclaw_host_ingress_registry
• cargo test -p ironclaw_host_api ingress --lib --tests
• cargo test -p ironclaw_reborn_composition host_ingress_serve_plan --lib --features slack-v2-host-beta,telegram-v2-host-beta

Base: stacked on manifest-driven-ingress-contract; no #5100 Telegram community implementation files changed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• staging
• reborn-integration

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 44955430-0e33-4fcb-8caa-7b877a7b8994

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request adds a unit test to verify that the Telegram auth binding verifier does not fall back to a webhook signature, and updates the manifest-driven channels planning document to mark Move 2 and Move 4 as completed, detailing the current state of the transport model unification and the collapse of the serve.rs per-channel sprawl. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.