[mashkovd]

Summary

• Set OPENCLAW_BOT_USERNAME=@MCTL_AI_bot so the "Ask OpenClaw" deeplink button on Telegram notifications opens the admins-openclaw bot instead of @mctl_me_bot (which belongs to mctl_labs).

Context

Operator wants to consolidate mctl-agent notifications onto the mctl_admins bot (@MCTL_AI_bot). PR #110 already routed all alerts to the admins-openclaw chat (TELEGRAM_CHAT_ID=8568443430), but a smoke test surfaced chat not found because @mctl_me_bot isn't a member of that chat. Switching the bot identity fixes the membership gap and aligns the deeplink button with the right OpenClaw deployment.

Required out-of-band

• Update Vault secret/platform/mctl-agent/tokens.telegram-bot-token with the BotFather token for @MCTL_AI_bot.
• Verify @MCTL_AI_bot is a member of admins-openclaw chat (8568443430) with permission to send messages.

Test plan

• Vault: vault kv patch -mount=secret platform/mctl-agent/tokens telegram-bot-token=<NEW_TOKEN>
• ESO refresh + kubectl -n admins rollout restart deploy/admins-mctl-agent-base-service
• Synthetic alert via POST https://agent.mctl.ai/api/v1/alerts (namespace=ovk) — message lands in admins-openclaw chat, no chat not found
• "Ask OpenClaw" button on the message deeplinks to t.me/MCTL_AI_bot?start=explain_<ticket>

[mashkovd]

@codex review

[mashkovd]

@copilot review

[Copilot]

@copilot review

Code review — commit 514504c

The change is minimal and correct. Here are my observations:

✅ What looks good

• OPENCLAW_BOT_USERNAME is correctly placed in the plaintext env: block (not externalSecret), since a bot username is not a secret.
• The comment block clearly explains the dependency between this value and the Vault telegram-bot-token, which helps future operators understand why both must change together.
• The TELEGRAM_BOT_TOKEN ExternalSecret binding is unchanged — updating the Vault path value out-of-band is the right approach.

⚠️ One thing to verify before merging

• The value is set as "@MCTL_AI_bot" (with the @ prefix). Please confirm that the mctl-agent application consumes this variable with the @ included when building the deeplink URL (i.e. it constructs t.me/MCTL_AI_bot?start=… rather than t.me/@MCTL_AI_bot?start=…). If the app prepends t.me/ and strips @ itself, the value should be "MCTL_AI_bot" without the prefix.

ℹ️ Minor note

• The env var is inserted between WEBHOOK_DEFAULT_TTL and DATABASE_URL. Placing it closer to the Telegram section (which lives in externalSecret.targetTemplateData) isn't possible since that's a different block, so the current placement is fine.

Overall the change is clean and safe to merge once the @ prefix question above is confirmed.

[mashkovd]

@copilot — verified: internal/notify/telegram.go:357 does username := strings.TrimPrefix(botUser, "@") before building the t.me/<username>?start=explain_<id> URL, so both @MCTL_AI_bot and MCTL_AI_bot produce the same deeplink. Keeping the @ for visual consistency with how the bot is referenced elsewhere.