Customer-support triage on Telegram

1Install enclawed-oss

curl -fsSL --proto '=https' --tlsv1.2 https://enclawed.com/install.sh | bash

enclawed --version
ls ~/.enclawed/

2Provide the bridge secrets via env

Bot tokens are CSPs (Critical Security Parameters); they live in env vars, never in the JSON config. telegram-llm’s secrets.mjs loads them through loadFromEnv() at boot and zeroizes them at shutdown.

# Shell env (e.g. ~/.zshrc, ~/.bashrc, or a systemd unit's
# EnvironmentFile=...). Do NOT paste this token into the config file.
export ENCLAWED_TELEGRAM_BOT_TOKEN="123456:ABC-DEF..."
export ENCLAWED_TELEGRAM_OPS_CHAT="-1009876543210"
# Legacy OPENCLAW_* names still work for backward compatibility — if
# both are set, ENCLAWED_* wins.

The framework policy (egress allowlist, default classification, DLP / prompt-shield enablement) is configured programmatically at bootstrap. A minimal shim for this scenario looks like:

// bootstrap-shim.ts — load BEFORE any extension code touches the network.
import { bootstrapEnclawed } from "enclawed/bootstrap";
import { createPolicy } from "enclawed/policy";
import { makeLabel, LEVEL } from "enclawed/classification";

await bootstrapEnclawed({
  policy: createPolicy({
    enforceAllowlists: true,
    allowedHosts:      ["api.telegram.org", "127.0.0.1", "::1", "localhost"],
    allowedChannels:   ["telegram"],
    allowedProviders:  ["ollama"],          // or your LLM provider id
    maxOutputClearance: makeLabel({ level: LEVEL.UNCLASSIFIED }),
    defaultDataLabel:   makeLabel({ level: LEVEL.UNCLASSIFIED }),
  }),
});

The same Policy can be expressed entirely in JSON via the enclawed.policy.* block of ~/.enclawed/enclawed.json; bootstrap reads that file before any plugin loads. extensions.telegram-llm.tokenEnv + per-channel "mode": "read" | "read-write" declarations and a top-level enclawed.hitl.{gateTools, approvalChannel, approvalUrl, approvalAuthEnv, timeoutSec} block are all read by the bridge today — the parser is extensions/telegram-llm/src/config-builder.mjs (parseHitlConfig, parseDlpConfig, parseTelegramChannelsConfig). Run enclawed policy show to print the resolved policy without launching the bridge.

3Wire HITL approvals through your broker

The bridge ships a default NoBrokerHitl broker that fails closed: every irreversible operation is denied unless you install a real broker (Slack, web UI, signed CLI, dedicated ops Telegram chat). This is deliberate — a forgotten broker is broken, not destructive.

// Install a broker that posts approval requests into your ops chat
// and resolves them on an inline reply. Implements the contract from
// extensions/telegram-llm/src/hitl-broker.mjs — see WebhookHitl as
// a starting point.
import { WebhookHitl } from "@enclawed/telegram-llm";

const hitl = new WebhookHitl({
  endpoint: process.env.ENCLAWED_TELEGRAM_OPS_CHAT, // your ops sink
  timeoutMs: 900_000,
});

const bridge = new SecureBridge({
  core: { policy, audit, dlp, promptShield },
  telegram,
  llm,
  systemPrompt,
  hitl,                                            // <-- the contract
  defaultClassification: "UNCLASSIFIED",
});

// Anywhere the agent wants to do something irreversible:
await bridge.executeIrreversible(
  { operation: "telegram.send-to-customer", severity: "high", reasoning: "first-line reply" },
  async () => telegram.sendMessage(customerChatId, draft),
);

The bridge appends irreversible.request, then either irreversible.decision+irreversible.executed on approval, or a HITL denied audit line on refusal — all SHA-256-chained.

4Author the agent system prompt

Configure the agent (via enclawed configure or enclawed agents add) with the system prompt that encodes the classification rules. The shipped SecureBridge.handleUpdate(...) entrypoint applies this prompt as the system message and wraps the inbound text in <untrusted_user_input> tags so the model treats it as data, not as a follow-up instruction.

You are a first-line customer-support agent.

For every new inbound message:

1. Classify into exactly one of:
     - billing        (invoice, payment, refund, subscription tier)
     - bug-report     (something doesn't work, error message)
     - feature-req    (asks for something we don't have)
     - account        (login, password, MFA, account recovery)
     - other          (anything that does not fit above)

2. Draft a one-paragraph response in plain, polite English.
     - Address the sender by first name if known.
     - Never invent product features or refund policies.
     - For billing / account: route to a human; do not give a direct answer.
     - For bug-report: acknowledge, ask for steps to reproduce if missing.

3. Emit the draft. The bridge will wrap any outbound message in
   executeIrreversible(...) and pause until your HITL broker
   approves or denies.

The classification rules live in the system prompt; HITL enforcement lives in the bridge code, not in the prompt. A jailbroken prompt cannot talk itself out of the HITL gate — the gate is the broker contract, not a model instruction.

5Run the bridge

Today, the bridge is a long-lived host process that polls Telegram and dispatches every update through SecureBridge.handleUpdate(...). A minimal launcher:

// run-support-bridge.ts (driven by your bootstrap shim from step 2)
import { SecureBridge, TelegramTransport, OpenAiProvider, loadFromEnv } from "@enclawed/telegram-llm";
import { core } from "./bootstrap-shim.js";  // policy, audit, dlp, promptShield, hitl

const botToken = loadFromEnv("ENCLAWED_TELEGRAM_BOT_TOKEN", "telegram-bot-token");
const telegram = new TelegramTransport({ token: botToken });

const bridge = new SecureBridge({
  core,
  telegram,
  llm: new OpenAiProvider({ ... }),  // or local Ollama via OpenAI-compat
  systemPrompt,
  defaultClassification: "UNCLASSIFIED",
});

await bridge.runPollLoop({ pollSec: 30 });
// SIGTERM -> await bridge.shutdown();  // zeroizes all secrets

Send a couple of test messages from a different Telegram account into the bot. Each one drives handleUpdate(...) through: channel-policy gate → prompt-shield sanitize/detect → inbound DLP → LLM call (allowlist-gated) → outbound DLP → HITL gate for any irreversible op → reply.

A markdown-task-file runner with --watch long-poll mode is on the roadmap; today, host the bridge in a systemd unit or container and inspect its progress through the audit log.

6Inspect the audit log

The log lives at the path picked at boot — $ENCLAWED_AUDIT_PATH if set, otherwise ~/.enclawed/audit.jsonl (open flavor) or /var/log/enclawed/audit.jsonl (enclaved flavor). Each line is a JSON object with ts, type, actor, level, payload, prevHash, and recordHash.

tail -n 6 ~/.enclawed/audit.jsonl | jq .

# Excerpt (real record shapes):
#
# { "ts": 1716210131000,
#   "type": "telegram.recv",
#   "actor": "telegram-llm",
#   "level": "UNCLASSIFIED",
#   "payload": { "chatId": -100..., "userId": ..., "textLength": 142, "injectionFlags": [] },
#   "prevHash":  "b201...",
#   "recordHash":"a14f..." }
#
# { "ts": 1716210133000,
#   "type": "irreversible.request",
#   "actor": "telegram-llm",
#   "level": "UNCLASSIFIED",
#   "payload": { "operation": "telegram.send-to-customer", "severity": "high",
#                "reasoning": "first-line reply" },
#   "prevHash":  "a14f...",
#   "recordHash":"ee2a..." }
#
# { "ts": 1716210162000,
#   "type": "irreversible.decision",
#   "actor": "telegram-llm",
#   "level": "UNCLASSIFIED",
#   "payload": { "operation": "telegram.send-to-customer", "approved": true,
#                "decider": "ops:user:1024", "decisionTs": "2026-05-20T14:02:42Z" },
#   "prevHash":  "ee2a...",
#   "recordHash":"6c10..." }

Verify the chain end-to-end:

enclawed audit verify
# omit the path to verify the default log; pass an explicit path otherwise.