# Task 5 evidence — Telegram/cron activation templates and isolated dry run

## Scope and runtime decision

- Changed only profile-local activation assets under
  `/home/cube/.hermes/profiles/physique-coach` and this evidence file.
- No Hermes gateway was started; no Telegram poll, outbound delivery, token
  read, or existing bridge/default-profile change occurred.
- Installed Hermes cron cannot safely provision a paused job: its
  `create_job()` record sets `enabled: True` and `state: scheduled`, and the
  CLI does not expose an atomic create-paused option. Hermes cron delivery may
  send through Telegram REST without a running gateway. The deliverable is
  therefore declarative-only at `activation/cron-jobs.paused.yaml`.

## Contract artifacts

- `activation/telegram-config.template.yaml` keeps `enabled: false` and puts
  `allow_from`, `group_allow_from`, and `group_allowed_chats` directly on the
  Telegram platform configuration.
- The delivery target contract is `telegram:<chat_id>` or
  `telegram:<chat_id>:<TELEGRAM_CRON_THREAD_ID>`.
- The paused job definitions preserve `11 8 * * *` and `0 * * * *` in
  `Asia/Seoul`, no-agent restricted scripts, idempotency keys, and fail-closed
  unset-token behavior.
- Both gate scripts require exactly
  `HERMES_HOME=/home/cube/.hermes/profiles/physique-coach`; any other value
  exits silently before a claim or output.

## Commands and results

```text
env -i PATH="$PATH" HERMES_HOME=/home/cube/.hermes/profiles/physique-coach \
  /home/cube/.hermes/profiles/physique-coach/activation/dry-run.sh
PASS: paused/unconfigured profile; no gateway, polling, network, or delivery attempted

env -i PATH="$PATH" HERMES_HOME=/home/cube/.hermes/profiles/physique-coach \
  /home/cube/.hermes/profiles/physique-coach/activation/dry-run.sh \
  --simulate-enabled --date 2030-01-02
PASS: idempotency claim recorded before local dry-run output; no collector or delivery invoked

# Same invocation a second time
PASS: duplicate source wake-up suppressed before output

# Sanitized unset-token gate execution
PASS: unset-token check-in silent; source gate silent; gateway/poll process set unchanged
```

Static scans also passed:

- no network, polling, or delivery command appears in the activation scripts;
- no token assignment appears in the new activation assets;
- activation directories/scripts are owner-only (`0700`) and templates and
  fixtures are owner-only (`0600`).

## Routing fixtures

`authorized-dm.fixture` is accepted. Unauthorized DM, group, and forum-topic
fixtures are rejected by the offline dry run. The dry run performs no network
access and is blocked if a configured credential is present.