@open-everywhere/core 0.1.0

package/agent/schedules/dream-mode3.ts

@@ -0,0 +1,311 @@
+// The Mode-3 ("failure digest") SCHEDULE — the weekly, harness-level learning pass (sibling
+// to schedules/tidy.ts's daily Mode-2 pass; see memory/dream/mode3.ts for the pure logic this
+// wires up). Once a week it reads each swept org's audited failure-shaped rows from the past
+// 7 days, buckets + facets them into up to 3 clusters (mode3.ts), and posts a digest to the
+// admin channel — the SAME admin channel the access-request flow already posts to
+// (approvals/access-request.ts's `cfg.adminChannel`), reused rather than inventing a second
+// admin-notification path.
+//
+// FAIL-SOFT, throughout (the task's explicit contract): a bad LLM facet call never throws
+// (mode3.ts's facet judge is fail-quiet already); a missing admin-channel config just skips
+// the post (logged); an empty week is a quiet no-op (buildMode3Report returns null — no
+// report, no audit row, no post); and a per-org audit-read/report-build failure is caught and
+// logged so one bad org never aborts the sweep for the rest.
+//
+// ORG ENUMERATION: reuses schedules/tidy.ts's `tidyOrgs()` — the same `OE_TIDY_ORGS` env, one
+// source of truth for "which orgs does this deployment sweep", rather than a second env knob.
+
+import { defineSchedule } from "eve/schedules";
+import { getConfig } from "../access/config.js";
+import { readAudit, appendAudit } from "../audit/audit.js";
+import { DREAM_ACTOR } from "../memory/dream/proposal.js";
+import { buildMode3Report, formatMode3Report, isFailureAction, type Mode3Report } from "../memory/dream/mode3.js";
+import { clusterFailures } from "../memory/dream/mode3-cluster.js";
+import { lastMileDedupeKey, lastMileLine, runLastMile, type LastMileDeps, type LastMileOutcome } from "../memory/dream/mode3-last-mile.js";
+import type { AuditEntry } from "../operational/store.js";
+import { bridgeSlackForm } from "../channels/slack-bridge.js";
+import { tidyOrgs } from "./tidy.js";
+import { postOnce, outboundKey } from "../operational/post-once.js";
+
+function log(msg: string): void {
+  console.log(`[open-everywhere:dream/mode3] ${msg}`);
+}
+
+const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+
+/** Posts one Slack Web API call — same shape as approvals/access-request.ts's injected
+ *  `post`, default `slackForm`, swappable in tests. */
+export type Mode3Poster = (method: string, body: string) => Promise<Record<string, unknown> | undefined>;
+
+export interface Mode3TickReport {
+  readonly orgs: number;
+  /** Orgs whose week produced a non-empty report (built + audited, whether or not posted). */
+  readonly reports: number;
+  /** Reports that were actually posted to the admin channel (channel configured + post ok). */
+  readonly posted: number;
+}
+
+/** The admin channel to post to, or undefined when access-requests isn't configured on this
+ *  deployment — FAIL-SOFT (unlike access-request.ts's requireAccessRequestsConfig, Mode 3
+ *  must never throw for an absent, optional notification target; it just skips the post). */
+function adminChannel(): string | undefined {
+  try {
+    return getConfig().loadAccessRequests?.()?.adminChannel ?? undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Distinct Slack channel ids to name-resolve per tick — the digest renders at most
+ *  3 clusters × 3 examples, so a cap this size covers every rendered line. */
+const MAX_NAME_LOOKUPS = 12;
+
+/**
+ * Slack channel-id → "#name" for the digest's example lines, resolved through the SAME
+ * injected poster the digest posts with. `conversations.info` needs no scope the deploy
+ * doesn't already hold (the channel-trust gate reads it on every join). Only `C…`/`G…`
+ * ids are looked up — a DM (`D…`) has no name. FAIL-SOFT throughout: any miss leaves the
+ * id unmapped and the example line falls back to raw ids — names are a rendering nicety,
+ * never load-bearing.
+ */
+async function slackSurfaceNames(rows: readonly AuditEntry[], post: Mode3Poster): Promise<Map<string, string>> {
+  const ids = new Set<string>();
+  for (const row of rows) {
+    if (!isFailureAction(row.action)) continue;
+    if (row.platform !== "slack" || !row.surface || !/^[CG]/.test(row.surface)) continue;
+    ids.add(row.surface);
+    if (ids.size >= MAX_NAME_LOOKUPS) break;
+  }
+  const names = new Map<string, string>();
+  for (const id of ids) {
+    try {
+      const json = await post("conversations.info", new URLSearchParams({ channel: id }).toString());
+      const channel = json?.ok === true ? (json.channel as Record<string, unknown> | undefined) : undefined;
+      if (channel && typeof channel.name === "string" && channel.name.length > 0) names.set(id, `#${channel.name}`);
+    } catch {
+      // fail-soft — this id renders as its raw form
+    }
+  }
+  return names;
+}
+
+/** First line of an error's message, bounded — outcome strings are durable, model-readable audit
+ *  detail, so they must never carry a stack trace or an unbounded interpolation. */
+function errBrief(err: unknown): string {
+  return String(err instanceof Error ? err.message : err).split("\n")[0].slice(0, 160);
+}
+
+/** What one org's digest pass did — the input to the OPE-635 heartbeat row `mode3Tick` always
+ *  writes after calling this, whichever branch below returned. */
+interface OrgDigestOutcome {
+  /** A short, stable sentence. Error interpolations go through errBrief(), so a heartbeat row
+   *  never carries a stack trace or an unbounded message. */
+  readonly outcome: string;
+  readonly totalFailures?: number;
+  readonly reported: boolean;
+  readonly posted: boolean;
+}
+
+/**
+ * One org's digest pass — audit-read, build, post. Factored out of `mode3Tick` so the OUTER loop
+ * can always write the OPE-635 heartbeat row after this returns, on every branch, instead of the
+ * `continue`-per-failure-mode shape that left early returns with no trace at all.
+ */
+/** The last-mile outcome as durable audit detail — the discriminant, plus what it left behind. */
+function lastMileDetail(outcome: LastMileOutcome): Record<string, unknown> {
+  switch (outcome.kind) {
+    case "opened":
+      return { kind: outcome.kind, number: outcome.number, url: outcome.url, updated: outcome.updated };
+    case "refused":
+      return { kind: outcome.kind, reason: outcome.reason };
+    case "failed-after-write":
+      return { kind: outcome.kind, reason: outcome.reason, head: outcome.head };
+    default:
+      return { kind: outcome.kind };
+  }
+}
+
+/**
+ * The last mile, run AT MOST ONCE per digest per org — the same idempotency the admin-channel post
+ * two functions below already carries, and for a stronger reason. A schedule `run` is a durable
+ * step: an interrupt after this arm cloned the repository and opened its draft, but before the
+ * step recorded completion, re-runs the whole tick. The deterministic head keeps the pull-request
+ * count at one, but the clone, the repro and the approval call would all be paid again. postOnce
+ * (org-partitioned, short TTL) skips the resume duplicate. Fail-OPEN, like the post: a dedupe-store
+ * outage still runs the arm.
+ *
+ * 🔴 THE KEY IS THE ORG PLUS THE TOP CLUSTER'S SIGNATURE — never its label or its count. The label
+ * is a `utility`-model completion, so a resumed tick that re-judges can produce a different one;
+ * the count comes from a `now - 7 days` window that SLIDES on a later resume. Either would make the
+ * key differ across exactly the resume this guard exists for. A given cluster's signature is
+ * computed from the audited rows alone (memory/dream/mode3-last-mile.ts lastMileDedupeKey), so a
+ * RE-JUDGED tick never moves the key; a RE-WINDOWED rebuild moves it only if the new window ranks
+ * a different cluster first. A genuinely different top cluster next week is still a different key,
+ * which is what keeps this a guard and not a mute.
+ *
+ * 🔴 WHAT THIS DOES NOT COVER. postOnce's dedupe row has a SHORT TTL (operational/post-once.ts —
+ * 60 s today), so a resume later than that window finds no row and the arm runs again. The bound on
+ * the PULL REQUEST count is not this guard at all: it is the deterministic head branch, which makes
+ * a second run update the same pull request. What a late resume re-pays is the approval call, the
+ * clone and the repro. Say that, rather than claiming resume-safety the mechanism cannot deliver.
+ *
+ * The skip takes postOnce's own `skipped` branch and returns a real outcome, so the digest line
+ * stays honest about what happened — never a bare `undefined` the caller has to guess at.
+ */
+async function runLastMileOnce(org: string, report: Mode3Report, deps: LastMileDeps | undefined): Promise<LastMileOutcome> {
+  const fingerprint = lastMileDedupeKey(report) ?? "none";
+  // 🔴 NOT `refused`. The earlier attempt may already have cut the branch or opened the draft
+  // before it was interrupted, so this outcome must not print "refused before it wrote anything".
+  const skipped: LastMileOutcome = { kind: "skipped-resume" };
+  return (
+    (await postOnce<LastMileOutcome>({
+      org,
+      key: outboundKey({ surface: "dream", channel: "last-mile", action: "dream.mode3-last-mile", payload: fingerprint }),
+      run: () => runLastMile(report, deps),
+      skipped: () => skipped,
+    })) ?? skipped
+  );
+}
+
+async function runOrgDigest(input: {
+  readonly org: string;
+  readonly now: Date;
+  readonly windowStart: Date;
+  readonly post: Mode3Poster;
+  readonly channel: string | undefined;
+  /** Injected last-mile seams (config/repro/approval/provider) — the test's whole hold on the
+   *  OPE-619 arm. Absent means the tracked literal, which ships the arm off. */
+  readonly lastMile: LastMileDeps | undefined;
+}): Promise<OrgDigestOutcome> {
+  const { org, now, windowStart, post, channel } = input;
+
+  let rows;
+  try {
+    rows = await readAudit({ org, since: windowStart.toISOString(), limit: 2000 });
+  } catch (err) {
+    log(`skip ${org} — audit read failed: ${String(err)}`);
+    return { outcome: `failed: audit read — ${errBrief(err)}`, reported: false, posted: false };
+  }
+
+  let report: Mode3Report | null;
+  try {
+    // Names are for the POSTED digest's human reader — with no admin channel configured
+    // nothing is posted, so skip the lookups (and keep "no channel → poster never called").
+    const names = channel ? await slackSurfaceNames(rows, post) : new Map<string, string>();
+    report = await buildMode3Report(org, rows, windowStart.toISOString(), now.toISOString(), {
+      // v2 (OPE-35): the Clio-shaped signature clustering, not v1's group-by-action. Passed in
+      // rather than imported by mode3.ts so the module edge stays one-way — see BucketOptions.
+      cluster: clusterFailures,
+      surfaceName: (r) => (r.platform === "slack" && r.surface ? names.get(r.surface) : undefined),
+    });
+  } catch (err) {
+    // Fail-soft: a bad LLM response (or any other build-time surprise) must not throw or
+    // spam the admin channel — skip this org's digest for this run, try again next week.
+    log(`skip ${org} — report build failed: ${String(err)}`);
+    return { outcome: `failed: report build — ${errBrief(err)}`, reported: false, posted: false };
+  }
+  if (!report) return { outcome: "no-op: empty week", reported: false, posted: false }; // by design — never posts on nothing
+
+  // OPE-619's optional last mile, for the TOP cluster only. It ships OFF, so the default outcome
+  // here is `disabled` and nothing is cloned, approved or opened. It runs BEFORE the post because
+  // the draft pull request is the product; the digest line only reports what it did. runLastMile
+  // never throws — a broken arm must not take down the digest that carries it.
+  const lastMile = await runLastMileOnce(org, report, input.lastMile);
+
+  await appendAudit({
+    org,
+    platform: "dream",
+    workspace: "mode3",
+    principalId: DREAM_ACTOR,
+    action: "dream.mode3_report",
+    detail: {
+      totalFailures: report.totalFailures,
+      clusters: report.clusters.map((c) => ({ action: c.action, count: c.count, label: c.label, judged: c.judged })),
+      lastMile: lastMileDetail(lastMile),
+    },
+  });
+
+  if (!channel) {
+    log(`org ${org}: digest built (${report.totalFailures} failure event(s)) but no admin channel configured — skipped post`);
+    return { outcome: "reported: no admin channel configured — skipped post", totalFailures: report.totalFailures, reported: true, posted: false };
+  }
+  try {
+    const text = formatMode3Report(report, lastMileLine(lastMile));
+    // Idempotency (operational/post-once.ts): a schedule `run` is a durable step; an interrupt
+    // after the digest posts but before the step records completion would re-run the tick and
+    // re-post the same weekly digest. postOnce (org-partitioned, short TTL) skips the resume
+    // duplicate. No stableId here — schedules get no eve callId — so the key is the org + digest
+    // content; distinct orgs are distinct partitions, so identical text across orgs both post.
+    // Fail-open: a dedupe-store outage still posts the digest.
+    const res = await postOnce({
+      org,
+      key: outboundKey({ surface: "dream", channel, action: "dream.mode3-digest", payload: text }),
+      run: async () => {
+        const body = new URLSearchParams();
+        body.set("channel", channel);
+        body.set("text", text);
+        return await post("chat.postMessage", body.toString());
+      },
+    });
+    if (res?.ok === true) return { outcome: "reported: posted", totalFailures: report.totalFailures, reported: true, posted: true };
+    log(`org ${org}: admin-channel post did not confirm ok (${JSON.stringify(res)})`);
+    return { outcome: "reported: post did not confirm ok", totalFailures: report.totalFailures, reported: true, posted: false };
+  } catch (err) {
+    log(`org ${org}: admin-channel post failed — ${String(err)}`); // fail-soft, never throw
+    return { outcome: `reported: post failed — ${errBrief(err)}`, totalFailures: report.totalFailures, reported: true, posted: false };
+  }
+}
+
+/**
+ * One digest pass over `orgs`' past-`now`-week audit trail. Injected clock + org list + poster
+ * so it's fully unit-testable (mirrors schedules/tidy.ts's tidyTick shape).
+ */
+export async function mode3Tick(
+  opts: {
+    readonly now?: Date;
+    readonly orgs?: readonly string[];
+    readonly post?: Mode3Poster;
+    /** Injected last-mile seams. Absent ⇒ the tracked literal, which ships the arm off. */
+    readonly lastMile?: LastMileDeps;
+  } = {},
+): Promise<Mode3TickReport> {
+  const now = opts.now ?? new Date();
+  const windowStart = new Date(now.getTime() - WEEK_MS);
+  const orgs = opts.orgs ?? tidyOrgs();
+  const post = opts.post ?? bridgeSlackForm;
+  const channel = adminChannel();
+
+  let reports = 0;
+  let posted = 0;
+
+  for (const org of orgs) {
+    const result = await runOrgDigest({ org, now, windowStart, post, channel, lastMile: opts.lastMile });
+    if (result.reported) reports++;
+    if (result.posted) posted++;
+
+    // OPE-635: EVERY branch above — audit-read failure, report-build failure, an empty week, a
+    // report with nowhere to post, a post that failed or a post that landed — writes this row.
+    // An empty week used to leave NOTHING (see `dream.mode3_report` above, which fires only on a
+    // non-empty week by design), so a dead weekly cron and a quiet week read identically. This
+    // heartbeat fires every week, for every org, whatever happened.
+    await appendAudit({
+      org,
+      platform: "dream",
+      workspace: "mode3",
+      principalId: DREAM_ACTOR,
+      action: "dream.mode3_tick",
+      detail: { outcome: result.outcome, ...(result.totalFailures !== undefined ? { totalFailures: result.totalFailures } : {}) },
+    });
+  }
+
+  log(`tick: ${orgs.length} org(s) swept — ${reports} digest(s) built, ${posted} posted`);
+  return { orgs: orgs.length, reports, posted };
+}
+
+export default defineSchedule({
+  // Weekly, Monday 05:00 UTC — one hour after the daily tidy's 04:00 window, still quiet.
+  cron: "0 5 * * 1",
+  async run() {
+    await mode3Tick();
+  },
+});

package/agent/schedules/routine-dispatch.ts

@@ -0,0 +1,213 @@
+// The provider-bundle routine-dispatch seam (OPE-114 stage 4) — extracted from schedules/dispatch.ts
+// so the adapter-api barrel can re-export it WITHOUT pulling the dispatcher's `defineSchedule` default
+// (a module-load eve schedule construction, plus the slack/discord channel graph) into every
+// barrel consumer. dispatch.ts imports the registry + DispatchTarget from here; a provider bundle whose
+// surface supports proactive routine fires (Teams is the first extracted one) registers its resolver
+// through registerRoutineDispatch from its registerXProvider() boot call.
+
+import type { Channel } from "eve/channels";
+import type { DiscordReceiveTarget } from "eve/channels/discord";
+import type { SessionMode } from "../access/resolver.js";
+import { reportDestinationOf, type Routine } from "../routines/routine.js";
+import type { UnifiedWakeOrigin } from "../channels/unified-window.js";
+import { admitProviderRegistration } from "../access/provider-selection.js";
+import { bridgeSlackChannel } from "../channels/slack-bridge.js";
+
+/** Maps a routine to everything a fire needs: the channel value + adapter target to post its result
+ *  into, the session mode (which the spend gate + the memory grain both read), and the platform auth attributes to
+ *  stamp onto the fired session. Every channel now comes from a provider bundle — the extracted
+ *  bundles (teams/discord) supply theirs through this seam, and core's one inline resolver
+ *  (slack) reaches its channel through the provider bridge — so `channel` is the generic eve Channel. */
+export interface DispatchTarget {
+  /** The channel module to `receive()` into. Extracted provider bundles (teams/discord —
+   *  OPE-114 stage 4) supply their own channel through the routine-dispatch seam, and slack's comes
+   *  through the provider bridge, so the type is the generic eve Channel, not a fixed union. */
+  readonly channel: Channel<any, any, any>;
+  /** The EXACT receive-target shape that channel's `receive()` accepts. Stored-target
+   *  extras (raw facts like Discord's guildId) are stripped by the resolver — they feed
+   *  `attributes` instead, never the adapter call. The open `Record` arm carries an extracted
+   *  bundle's own receive-target shape (e.g. eve's TeamsReceiveTarget). */
+  readonly target: { channelId: string; threadTs?: string } | DiscordReceiveTarget | Readonly<Record<string, unknown>>;
+  /** Session mode of the fire's surface. Since OPE-267 it no longer decides WHETHER the spend gate
+   *  bites — every mode is capped, DMs included — only which `perDomain` criteria layer the fire
+   *  resolves against (dm vs public) and the fire's memory/standing grain. Derived from POSITIVE
+   *  stored facts where possible; anything ambiguous resolves to "channel". */
+  readonly mode: SessionMode;
+  /** The auth attributes the platform's bindFrom mapper reads to re-derive workspace/surface/mode.
+   *  A resolver contributes PLATFORM IDENTITY ONLY — never a principal and never a trust verdict.
+   *  Those are added by routines/fire-auth.ts at the dispatch site, where the live per-fire rechecks
+   *  actually run (the CHANNEL's conversations.info answer and, since OPE-269, the CREATOR's
+   *  membership answer). The split matters: a stored target is data, so a verdict derived from it
+   *  would be a verdict decided at creation time wearing a fresh timestamp. */
+  readonly attributes: Readonly<Record<string, string>>;
+  /** The wake ORIGIN a fire on this target replies into — the seam that lets a triggered flow join
+   *  the unified window at THREAD grain instead of landing native (OPE-144, routines/fire-window.ts).
+   *  It is the SAME `UnifiedWakeOrigin` shape a live inbound wake carries, so the fire's `reply`
+   *  resolves through the identical durable `wakeId → origin` map and posts through the identical
+   *  per-platform arm (channels/unified-reply.ts).
+   *
+   *  OPTIONAL, and its ABSENCE is the fail-closed default: a bundle that has not (yet) declared how
+   *  its surface addresses a reply keeps the pre-OPE-144 native fire exactly as today. Core's slack
+   *  resolver fills it in below; an extracted bundle opts in by returning it from its own resolver.
+   *  Never model-authored — it is host-derived from the routine's STORED target. */
+  readonly origin?: UnifiedWakeOrigin;
+}
+
+/** A provider bundle's routine dispatcher — resolves one of its routines to a DispatchTarget. */
+export interface RoutineDispatchProvider {
+  /** Map a routine on this platform to its full {@link DispatchTarget} (channel + receive-target +
+   *  mode + auth attributes), or null when the stored target is missing/incomplete (dry-run). */
+  readonly resolveTarget: (routine: Routine) => DispatchTarget | null;
+  /**
+   * OPTIONAL (OPE-148): derive a post-back target for a CONFIGURED channel from its surfaceKey
+   * ALONE — no live binding, no stored row. This is what lets `Domain.reportChannel` name a
+   * destination an operator wrote in config months before any routine existed, and it is the only
+   * producer of a `{kind:"surface"}` {@link Routine.report}.
+   *
+   * ABSENT IS A REAL ANSWER, not a stub to fill in later: a platform whose post-back target is not
+   * recoverable from the key may not be named as a report channel, and the config lint says so by
+   * name. One such platform exists today and it is not an oversight — **Teams** needs a whole Bot
+   * Framework conversation reference (`serviceUrl` + conversation id), which a surface key does not
+   * carry and cannot imply.
+   *
+   * 🔴 THE REASON IS NOW THE SHAPE OF THIS HOOK, NOT THE ABSENCE OF THE DATA. Since OPE-887 the Teams
+   * bundle DOES hold conversation references — captured off inbound activities into the
+   * `proactive_address` table (operational/store.ts) — so the reference a Teams report channel would
+   * need exists. This member cannot use it: resolution here is SYNCHRONOUS and a store read is not.
+   * Giving Teams a `reportTargetFor` therefore means widening this member to a promise first, and
+   * that reaches `create_routine`'s config-time lint and every caller of
+   * {@link reportTargetForSurface}. Until somebody wants it, Teams still declares no arm.
+   */
+  readonly reportTargetFor?: (surfaceKey: string) => Readonly<Record<string, unknown>> | null;
+}
+
+const ROUTINE_DISPATCH: Map<string, RoutineDispatchProvider> = new Map();
+
+/** Register (or replace) a provider bundle's routine dispatcher (registerXProvider() calls this). */
+export function registerRoutineDispatch(platform: string, provider: RoutineDispatchProvider): void {
+  if (!admitProviderRegistration(platform, "routine-dispatch")) return;
+  ROUTINE_DISPATCH.set(platform, provider);
+}
+
+/** Resolve a registered routine dispatcher for a platform (the dispatcher's fallback path). */
+export function resolveRegisteredRoutineDispatch(platform: string): RoutineDispatchProvider | undefined {
+  return ROUTINE_DISPATCH.get(platform);
+}
+
+// --- the shared target resolution (moved out of schedules/dispatch.ts, OPE-139) ----------------
+// It lived next to the cron dispatcher, which meant the EVENT fan-out (routines/github-fanout.ts)
+// couldn't reach it without importing a module whose default export constructs an eve schedule at
+// load — so the fan-out hardcoded `platform !== "slack"` and silently skipped every Discord /
+// Teams-targeted event routine. It lives HERE now, beside the registry it consults, so
+// both the clock leg and the event leg resolve a target through the SAME seam.
+
+/** One stored-target field as a non-empty string, or undefined (never a coerced
+ *  non-string — the store row is data, validated on the way out, not trusted). */
+function storedString(t: Routine["target"], key: string): string | undefined {
+  const v = t?.[key];
+  return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+
+// --- Slack ---------------------------------------------------------------------
+// Post-back = a fresh channel message via `to(slack, { channelId }).send(message, { auth })`.
+// Mode from the target id prefix — the same split slackMode()'s own id-prefix
+// fallback uses (identity/binding.ts) when no channel_type is available.
+function resolveSlackTarget(r: Routine): DispatchTarget | null {
+  const channelId = storedString(r.target, "channelId");
+  if (!channelId) return null;
+  // The channel object comes from the provider bridge — no Slack provider registered ⇒ null ⇒
+  // the routine runs DRY-RUN (fail-closed: no send, schedule not advanced), same as an unwired
+  // platform always has.
+  const slackChannel = bridgeSlackChannel();
+  if (!slackChannel) return null;
+  const mode: SessionMode = channelId.startsWith("D") ? "dm" : "channel";
+  return {
+    channel: slackChannel,
+    target: { channelId },
+    mode,
+    // The same three facts buildSlackAuth captures on a live inbound message. team_id
+    // comes back off the surfaceKey — Slack team ids are seg()-safe, so the segment
+    // round-trips verbatim.
+    attributes: {
+      team_id: r.surfaceKey.split("/")[1] ?? "",
+      channel_id: channelId,
+      channel_type: mode === "dm" ? "im" : "channel",
+    },
+    // OPE-144: a fire on this channel replies TOP-LEVEL (no threadTs) — the same origin a top-level
+    // ambient Slack wake carries, and byte-identical in effect to today's `to(slack,{channelId})`
+    // post-back. A durable JOB fire narrows this to its stored thread anchor at the dispatch site
+    // (schedules/dispatch.ts), where the anchor is known.
+    origin: { platform: "slack", channelId },
+  };
+}
+
+/**
+ * Map a routine to the channel + adapter target + mode + auth attributes a fire needs, or null
+ * when nothing is wired (the caller then runs DRY-RUN — fail-closed: no send, never a send to the
+ * wrong place, and the clock leg additionally does not advance the schedule).
+ *
+ * The provider-bundle registry is checked FIRST — an extracted platform's resolver (teams,
+ * discord) participates identically to a built-in one, and a registered resolver may
+ * also override an in-core wiring. Core keeps only the slack resolver inline, reaching the
+ * extracted slack channel through the provider bridge. Unknown/unregistered platforms (linear,
+ * local/dev) have no wired post-back → null.
+ *
+ * OPE-148 — THE ONE LINE that separates WHERE A ROUTINE LIVES from WHERE IT REPORTS is the first
+ * one: {@link reportDestinationOf} substitutes the configured report destination's surfaceKey +
+ * target when the row carries one, and returns the routine unchanged otherwise. Everything below
+ * is untouched, and every OTHER consumer of the row (spend partition, ownership, GC reach, the
+ * `routine.fire` marker) keeps reading `routine.surfaceKey`. Deliberately one line: this function
+ * is on the critical path of every clock fire on every surface, and a regression here breaks all
+ * proactivity rather than only the new cases.
+ */
+export function resolveRoutineTarget(routine: Routine): DispatchTarget | null {
+  const r = reportDestinationOf(routine);
+  const platform = r.surfaceKey.split("/")[0];
+  if (platform === undefined) return null;
+  const provider = resolveRegisteredRoutineDispatch(platform);
+  if (provider) return provider.resolveTarget(r);
+  switch (platform) {
+    case "slack":
+      return resolveSlackTarget(r);
+    default:
+      return null;
+  }
+}
+
+/**
+ * Can a routine on this platform actually POST BACK — via a registered provider resolver, or core's
+ * one inline Slack case? (OPE-148.)
+ *
+ * WHY THIS EXISTS AS A CREATE-TIME PREDICATE. Until now the only thing that noticed an unwired
+ * platform was {@link resolveRoutineTarget} returning null AT FIRE TIME, which the dispatcher turns
+ * into a dry-run that does not advance the schedule — i.e. a routine that is due forever and posts
+ * nothing, forever. That is invisible from the surface that armed it. So creation asks the SAME
+ * registry the fire will ask, and refuses a routine that could never report.
+ *
+ * It is deliberately a PLATFORM predicate, not a routine one: at creation there is no row yet, and
+ * the question ("is this surface family wired for proactive posts") is answered by registration.
+ * A routine whose stored TARGET is incomplete still dry-runs — that is a different failure, caught
+ * at fire time by the resolvers' own null returns, and it stays that way.
+ */
+export function canDispatchRoutinesOn(platform: string): boolean {
+  return platform === "slack" || resolveRegisteredRoutineDispatch(platform) !== undefined;
+}
+
+/**
+ * The post-back target for a CONFIGURED report channel ({@link Domain.reportChannel}), derived from
+ * its surfaceKey alone, or null when this platform cannot express one — see
+ * {@link RoutineDispatchProvider.reportTargetFor} for why "cannot" is a real answer.
+ *
+ * Core answers for slack inline, exactly as it resolves slack's routine target inline: a Slack
+ * surfaceKey's third segment IS the channel id (`approvals/flow.ts` postedToSurfaceKey builds it
+ * that way), so `{ channelId }` round-trips. Every other platform answers through its own bundle.
+ */
+export function reportTargetForSurface(surfaceKey: string): Readonly<Record<string, unknown>> | null {
+  const segs = surfaceKey.split("/");
+  const platform = segs[0];
+  const surface = segs[2];
+  if (platform === undefined || surface === undefined || surface.length === 0 || segs.length !== 3) return null;
+  const provider = resolveRegisteredRoutineDispatch(platform);
+  if (provider) return provider.reportTargetFor ? provider.reportTargetFor(surfaceKey) : null;
+  return platform === "slack" ? { channelId: surface } : null;
+}