VIRGO

TROUBLESHOOTING & DIAGNOSTICS

Observe the failure without reading the conversation.

Begin with available read-only inspection. The channel doctor described here is the designed guided workflow: it observes only routing and admission metadata, asks the owner for one bounded message, and emits a receipt.

MEASURE FIRST

Name the layer before touching it.

virgo onboard --profile ./machine.json --inspectRe-measure onboarding stages without prompting.
virgo onboard --profile ./machine.json --dry-runPreview recorded progress without changing files.
virgo hub statusContainer presence, health, and release/config match.

Whole-system virgo status and persona status are designed surfaces, not executable in the pinned release. Use the available narrow inspection instead of pretending a command exists.

CHANNEL DOCTOR · DESIGNED

A consented probe with a hard privacy boundary.

1 · Owner starts doctorvirgo channel doctor [<binding>] acquires a single-flight lease and arms a bounded observation window.
→
2 · Guided prompt“Send one message to your persona now.”
→
3 · ReceiptLane + authentication presence + terminal HTTP or adapter-admission status.
TRACE ONLYlane · authentication-value presence (Authorization-header presence for HTTP) · terminal HTTP or adapter-admission statusNEVER TRACEbearer value · body · sender · conversation ID · query · message content

THREE OUTCOMES + PRIVACY GUARD

Exactly one candidate may receive an attributed verdict.

00

Concurrent traffic

More than one candidate produces inconclusive_concurrent_traffic. Report only candidate count and redacted terminal-status histogram, attribute none, and retry later.

01

No route trace

No request appeared in the bounded window. Check registration or messaging endpoint and installed-app binding.

02

Request, auth absent or rejected

auth=absent identifies unauthenticated traffic. auth=present plus 401/403 directs identity, credential, JWT audience diagnosis—without recording the token.

03

Auth present, 2xx

Adapter admission succeeded. Continue downstream through durable queue, consumer, side-effect, and ack chain.

NO-TRACE CHECKPOINTS ONLY

Verify the platform's declared route.

  • TeamsNo machine-readable checkpoint is guaranteed. In Developer Portal, compare the recorded bot App ID and exact expected messaging callback.
  • Azure BotRead the ARM bot resource App ID and endpoint; the human fallback checks those exact fields under Azure Bot Configuration.
  • TelegramUse Bot API getWebhookInfo for webhook URL and last delivery error; the guided fallback shows no token.

The doctor presents these only after a no-trace verdict. They are checkpoints, not permission to capture payload content or credential values.

RECEIPT

Report what was measured, not what was guessed.

A useful diagnostic result states the bounded window, adapter/lane, authorization presence, terminal status, selected branch, and next checkpoint. It contains no message or identity payload.