fix(ci): accept attested legacy Telegram evidence (#117330)

* fix(ci): attest legacy Telegram QA evidence mode

* fix(ci): attest Telegram QA evidence contract

* refactor(ci): narrow Telegram evidence compatibility

.github/workflows/openclaw-release-telegram-qa.yml

@@ -2551,7 +2551,7 @@ jobs:
             ' "$proof_path" >/dev/null
           done
 
-      - name: Finalize trusted Telegram process-boundary evidence
+      - name: Finalize trusted Telegram execution evidence
         id: finalize_boundary
         if: always() && steps.terminate_sut.outputs.quiescent == 'true' && steps.run_lane.outputs.output_dir != ''
         env:
@@ -2574,13 +2574,14 @@ jobs:
           jq -e \
             --arg runId "$GITHUB_RUN_ID" \
             --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
+            --arg targetSha "$TARGET_SHA" \
             '
               .version == 1 and
               .kind == "telegram-sut-boundary" and
               .runId == $runId and
               .runAttempt == $runAttempt and
               (.workflowSha | test("^[a-f0-9]{40}$")) and
-              (.targetSha | test("^[a-f0-9]{40}$")) and
+              .targetSha == $targetSha and
               (.candidateArtifact.id | test("^[1-9][0-9]*$")) and
               (.candidateArtifact.name | length > 0) and
               (.candidateArtifact.digest | test("^[a-f0-9]{64}$")) and
@@ -2588,15 +2589,24 @@ jobs:
               .candidateArtifact.runAttempt == $runAttempt and
               (.candidateArtifact.fileName | length > 0) and
               (.candidateArtifact.sha256 | test("^[a-f0-9]{64}$")) and
-              (.candidateArtifact.sourceSha | test("^[a-f0-9]{40}$")) and
+              .candidateArtifact.sourceSha == $targetSha and
               (.candidateArtifact.version | length > 0)
             ' "$context_path" >/dev/null
 
-          # This frozen extended-stable candidate predates the boundary protocol.
-          # Every other target fails closed until it emits the required evidence.
-          legacy_process_boundary_target_sha="2dbfe013e511d0c7e0720356f5af5c7bb210db19"
-          if [[ "$TARGET_SHA" == "$legacy_process_boundary_target_sha" ]]; then
-            jq --arg executionMode "legacy-runner" \
+          # The archive and source tree were independently attested before this step.
+          # A tracked contract opts legacy candidates into the pre-boundary evidence shape.
+          legacy_contract_path="${CANDIDATE_ROOT}/qa/contracts/telegram-execution-evidence.json"
+          if [[ -e "$legacy_contract_path" || -L "$legacy_contract_path" ]]; then
+            [[ -f "$legacy_contract_path" && ! -L "$legacy_contract_path" ]]
+            candidate_version="$(jq -er '.candidateArtifact.version' "$context_path")"
+            jq -e --arg candidateVersion "$candidate_version" '
+              (keys | sort) == ["candidateVersion", "kind", "mode", "version"] and
+              .version == 1 and
+              .kind == "openclaw-release-telegram-execution-evidence" and
+              .mode == "legacy-direct-runner-v1" and
+              .candidateVersion == $candidateVersion
+            ' "$legacy_contract_path" >/dev/null
+            jq --arg executionMode "legacy-direct-runner-v1" \
               '. + {executionMode: $executionMode}' "$context_path" >"$aggregate_path"
             chmod 0600 "$aggregate_path"
             echo "aggregate_path=$aggregate_path" >>"$GITHUB_OUTPUT"