Implement the avatar and a preflight dry run

The avatar is now applied rather than deferred: BotFather's /setuserpic is a
conversation in which you send a photo, so the file is uploaded and sent as
a message. It is content addressed -- replacing the file is what triggers an
update, and the digest is recorded only after BotFather confirms, so a failed
upload retries rather than being remembered as done. The image is validated
before the conversation starts, because an image rejected halfway leaves the
bot registered without a picture.

Adds `provision preflight`: spec, avatar, OpenBao reachability, credentials,
session presence, salt and the resulting plan, checked in one run that writes
nothing and never contacts Telegram. Every failure it reports is one that
would otherwise surface after a phone number had been spent.

Two bugs it found immediately. The avatar path is documented as repo-relative
but resolved against the spec's own directory, so the real campaign spec
failed to find its own asset. And the OpenBao error named both variables when
only one was missing, sending the reader to check the one already set.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172sgCZEEDJcnQmr4SGDvKa

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1361245@bnt-lap001
Assistant-Session: b3b428ef-f3e6-4688-b091-01f71461d66a
This commit is contained in:
tegwick 2026-09-04 22:12:56 +02:00
parent 014ee5c746
commit 7347bd6302
11 changed files with 661 additions and 46 deletions

View file

@ -34,6 +34,20 @@ are just interfaces that were never built.
---
## Check everything first
Before spending a phone number, run the dry run. It exercises the spec, the
avatar, the OpenBao wiring, the credentials and the resulting plan, and it
neither writes anything nor contacts Telegram:
```bash
go run ./cmd/provision preflight --spec ../pr-hall-of-helix/presence/telegram.yaml
```
Every failure it reports is one that would otherwise have surfaced after an
account was registered or a BotFather conversation was under way. Run it again
after each step below; it is cheap and it is the only check that costs nothing.
## Before you start
Have these ready. Stopping halfway through to find one is how the session
@ -162,10 +176,9 @@ description, creates the test channel, adds the bot as administrator with
`post_messages` only, generates the redaction salt if it is absent, and writes
`presence/resolved/hall-of-helix.yaml`.
Two things it will *not* do on this first run, both by design and both reported
in the plan. The **public channel is held** until a rendering has been checked in
the test channel. The **avatar is deferred**: `/setuserpic` needs a photo upload
that is not implemented, so set it by hand in @BotFather, or wait.
One thing it will *not* do on this first run, by design and reported in the
plan: the **public channel is held** until a rendering has been checked in the
test channel.
**Read the plan before approving it.** That is the human judgement this design
keeps — not clicking through BotFather, but deciding whether the diff is what