Vestry

The product answers questions from a community’s own message history. Reaching that history means speaking a stateful protocol that was not designed for services to depend on: sessions carry state, the connection is long-lived, and failure modes arrive as protocol-level surprises rather than HTTP status codes.

Left unbounded, that protocol becomes the architecture. Session state spreads, every service learns about the transport, and a protocol failure becomes a product outage.

The protocol-facing layer is isolated and holds session state alone. Everything past it speaks gRPC with Protocol Buffers as the contract, across four Rust services.

The boundary is the design decision. A protocol failure stays at the boundary: the services behind it see a contract that does not change shape, and a session problem cannot become a product problem.

It answers from the group’s own history and cites the message it stood on. A citation is not a nicety here — it is what makes an answer checkable by the people who wrote the source material and are in the best position to catch it being wrong.

A set of grounding conditions is checked before it is allowed to speak at all, and failing any one of them means silence rather than a hedged answer. Silence is the ordinary outcome, and the assistant keeps a record of the occasions it declined to speak, so the restraint is auditable rather than asserted. Vestry is not affiliated with or endorsed by Telegram.