Talos has Telegram (long-polling), mail (IMAP), WhatsApp through an operator-owned broker, and the terminal. Every way in fetches. That is a rule, not a gap: a webhook needs a port the world can reach, which turns an outbound-only process into a reachable one (CLAUDE.md, "Never let a channel receive"). Within that rule there is room for another channel.
What this is. One more channel that polls: Matrix (/sync), Signal through signal-cli in receive mode, or Slack through conversations.history — pick one. Same protocol as telegram.py: parse updates, hand Inbound to the conductor, identity resolved by the kernel against TALOS_ALLOWED_PRINCIPALS as <channel>:<id>, replies through the channel's own send path. No inbound port, no server, no "webhook for later".
Boundaries. A new module under talos/, its tests, the allowlist format, doctor. Nothing in policy.py or the other kernel files: a channel is a way in, it grants nothing, and the kernel must not need to know it exists. Media fetches, if any, go through the same allowlist check telegram.py uses (CLAUDE.md, "Never fetch on a stranger's say-so").
Proof. Tests against a faked API, one real conversation with approvals working, and a line in redteam.py if you touched how a principal is derived.
Talos has Telegram (long-polling), mail (IMAP), WhatsApp through an operator-owned broker, and the terminal. Every way in fetches. That is a rule, not a gap: a webhook needs a port the world can reach, which turns an outbound-only process into a reachable one (
CLAUDE.md, "Never let a channel receive"). Within that rule there is room for another channel.What this is. One more channel that polls: Matrix (
/sync), Signal throughsignal-cliin receive mode, or Slack throughconversations.history— pick one. Same protocol astelegram.py: parse updates, handInboundto the conductor, identity resolved by the kernel againstTALOS_ALLOWED_PRINCIPALSas<channel>:<id>, replies through the channel's own send path. No inbound port, no server, no "webhook for later".Boundaries. A new module under
talos/, its tests, the allowlist format,doctor. Nothing inpolicy.pyor the other kernel files: a channel is a way in, it grants nothing, and the kernel must not need to know it exists. Media fetches, if any, go through the same allowlist checktelegram.pyuses (CLAUDE.md, "Never fetch on a stranger's say-so").Proof. Tests against a faked API, one real conversation with approvals working, and a line in
redteam.pyif you touched how a principal is derived.