@open-everywhere/core 0.1.0

package/agent/tools/create_routine.ts

@@ -0,0 +1,487 @@
+// create_routine turns an in-thread request into standing proactive work. Normally nothing is armed here — execute() posts a `routine.create` card and a human arms it with a click — but when the approver chain LOWERS the verb no card is posted and the routine is already armed when execute returns.
+// A fired turn has no acting principal, so a routine-context create_routine throws; code-templated re-arms such as the PR check-back loop ride subscribe_pr instead.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { resolveMode, actingPrincipalIdOf, unattendedOf } from "../access/request.js";
+import { bindFrom } from "../identity/binding.js";
+import { computeNextRun, parseCron } from "../routines/schedule.js";
+import { assertReportConsistent, describeTrigger, ROUTINE_MODEL_ROLES, type RoutineReport, type RoutineTrigger } from "../routines/routine.js";
+import type { ModelRole } from "../memory/domain.js";
+import { describeBoundPolicy } from "../routines/bound.js";
+import { renderFireMessage } from "../routines/fire-message.js";
+import { SCOPE_KINDS, eventNormalizer } from "../routines/event-model.js";
+import { validateSubscription } from "../routines/event-match.js";
+import { FILTER_MAX_LENGTH, probeFilter } from "../routines/jq-filter.js";
+import { webhookScheme } from "../routines/scheme-name.js";
+import { readGrantReach } from "../webhooks/achievability.js";
+import { findWebhook } from "../webhooks/config.js";
+import type { ReadableBy } from "../access/read-grant.js";
+import type { Domain } from "../memory/domain.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { CHECK_IN_DOCTRINE } from "../routines/check-in.js";
+import { declaredPermissionKinds } from "../routines/declared-permissions.js";
+import { validateRoutineCollectors } from "../routines/collector.js";
+import { validateRoutineGate } from "../routines/gate.js";
+import { untrustedIngestedThisTurn } from "../access/taint-signal.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { canDispatchRoutinesOn, reportTargetForSurface } from "../schedules/routine-dispatch.js";
+import { reportChannelFor, BINDING_TRUSTED_PLATFORMS } from "../memory/domain.js";
+import { domainKeyOf } from "../memory/partition.js";
+import { getConfig } from "../access/config.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+
+/** The scope-kind vocabulary rendered into the `jq` description, derived from the one closed vocabulary so the tool schema cannot drift from the document the evaluator builds. */
+const SCOPE_KINDS_LIST = SCOPE_KINDS.join(" | ");
+
+// The model-facing shape: one scheduled kind plus a required post policy. The stored trigger kinds are an implementation detail execute() maps onto.
+const trigger = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("scheduled"),
+    cron: z
+      .string()
+      .optional()
+      .describe('Standard 5-field UTC cron "min hour dom mon dow", e.g. "0 9 * * 1-5" = 9am weekdays. Exactly ONE of cron / everyMinutes / at.'),
+    everyMinutes: z.number().int().min(1).optional().describe("Run every N minutes from now. Exactly ONE of cron / everyMinutes / at. Effective resolution is the dispatcher tick (~10 min): finer cadences fire on the first tick at/after they're due."),
+    at: z
+      .string()
+      .optional()
+      .describe(
+        "ONE-SHOT: an ISO 8601 UTC instant to fire exactly ONCE, e.g. \"2026-07-08T09:00:00Z\" — must be in " +
+          "the future. Exactly ONE of cron / everyMinutes / at. Effective resolution is the dispatcher tick " +
+          "(~10 min): it fires on the first tick at/after this instant, then the routine disables itself " +
+          "(kept for audit/list visibility, not deleted). Tag-style check-in: \"check back on the PR in an " +
+          "hour\" -> create a `once` routine for now+1h; if nothing's changed when it fires, just create " +
+          "another one-shot to check again later — there's no re-arm state to manage. `postPolicy` is " +
+          "ignored when `at` is set (a single fire has no repeat to diff against). " +
+          CHECK_IN_DOCTRINE,
+      ),
+    postPolicy: z
+      .enum(["every-run", "only-on-change", "never"])
+      .optional()
+      .describe(
+        "REQUIRED for cron/everyMinutes (ignored for `at`). Decide from the TASK'S SHAPE, never from the " +
+          "user's phrasing: 'every-run' = the post IS the product (daily summary, digest, reminder — a " +
+          "silent run would be a failure); 'only-on-change' = the post is an alert ('check X and tell me " +
+          "when something is new/changed') — the fired turn records what it observed and a durable " +
+          "host-side diff decides whether to post (reliable across fires, unlike anything remembered " +
+          "in-session); 'never' = the work IS the product (updates a ticket, writes memory) — a post " +
+          "would be noise, so it reports nothing at all, except a problem it can't resolve. " +
+          "A cadence in the request ('hourly') only sets the schedule, never the policy. If " +
+          "genuinely unclear, ask in plain words ('post every hour regardless, or only when something new lands?').",
+      ),
+  }),
+  z.object({
+    kind: z.literal("event"),
+    source: z.string().describe("External event source. Must be one registered in this deployment — an unknown source is refused, naming the known set."),
+    jq: z
+      .string()
+      .max(FILTER_MAX_LENGTH)
+      .optional()
+      .describe(
+        "WHICH events, as a **jq expression** that must evaluate to exactly true or false, e.g. " +
+          '`.scope.container == "acme/web" and (.fields.action | IN("opened","reopened"))`. ' +
+          `The event is an object with .source, .event, .action, .fields.<name> (the source's matchable scalars) and .scope.<${SCOPE_KINDS_LIST}> (the container path; an absent level is null). ` +
+          "Use `and` / `or` / `not` freely — OR is expressible here, so a disjunction does NOT need two routines. " +
+          "An absent field is null, so `(.fields.x | IN(\"a\"))` is false when x is missing and `(.fields.x | IN(\"a\") | not)` is true. " +
+          "REQUIRED to reference a scope (`.scope.<kind>` or a scope field) for any source that spans many containers — subscribing to a whole tenant has to be spelled out. " +
+          "The expression is compiled and run once at creation, so a typo is refused here rather than arming a routine that silently never fires.",
+      ),
+  }),
+]);
+
+/**
+ * Maps the model-facing scheduled shape onto the stored trigger kinds. Exported for tests.
+ * `eventScheme` is the contract the named hook speaks; absent means the name is also the contract, which holds for every category-(a) hook and for the native fan-outs with no hook row.
+ */
+export function storedTrigger(t: z.infer<typeof trigger>, eventScheme?: string): RoutineTrigger {
+  if (t.kind === "event") {
+    // Create time is the only gate that can catch a subscription which could never match: an `event` routine has no clock, so nothing revisits the row and nothing downstream can tell a typo from "nothing has happened yet".
+    // Validated against the CONTRACT but stored against the NAME — storing the scheme would make every routine on one contract fire for every sender of it. This is only the STATIC half; compiling the filter is async and lives in execute().
+    validateSubscription(t.source, t.jq, eventScheme ?? t.source);
+    return { kind: "event", source: t.source, ...(t.jq ? { jq: t.jq } : {}) };
+  }
+  const present = [t.cron !== undefined, t.everyMinutes !== undefined, t.at !== undefined].filter(Boolean).length;
+  if (present !== 1) {
+    throw new Error("A scheduled routine needs exactly ONE of `cron`, `everyMinutes`, or `at`.");
+  }
+  if (t.at !== undefined) {
+    const when = new Date(t.at);
+    if (Number.isNaN(when.getTime())) {
+      throw new Error(`\`at\` must be a valid ISO 8601 timestamp, got "${t.at}".`);
+    }
+    return { kind: "once", at: when.toISOString() };
+  }
+  if (t.postPolicy === undefined) {
+    throw new Error("A cron/everyMinutes routine needs `postPolicy` (every-run, only-on-change, or never).");
+  }
+  if (t.postPolicy === "only-on-change") {
+    return t.cron !== undefined ? { kind: "watch", expr: t.cron } : { kind: "watch", everyMinutes: t.everyMinutes! };
+  }
+  // `never` maps onto the same trigger `every-run` does, deliberately: the schedule is unchanged and only the REPORT differs, so no dispatcher branch learns a fourth clock kind that ticks identically to two it has.
+  return t.cron !== undefined ? { kind: "cron", expr: t.cron } : { kind: "interval", everyMinutes: t.everyMinutes! };
+}
+
+/**
+ * The REPORT half of the model-facing shape: `postPolicy: "never"` becomes `{kind:"silent"}`, and every other policy stores nothing (absent means post). Exported for tests.
+ * A one-shot returns undefined whatever the policy says — `postPolicy` is documented as ignored there, and silently arming a check-back that cannot report would be the worst reading of an ignored field.
+ */
+export function storedReport(t: z.infer<typeof trigger>): RoutineReport | undefined {
+  if (t.kind === "event" || t.at !== undefined) return undefined;
+  return t.postPolicy === "never" ? { kind: "silent" } : undefined;
+}
+
+export default defineTool({
+  description:
+    "Create a durable ROUTINE so you act without being re-tagged: a scheduled job (cron/everyMinutes, with a required post policy — every run, only when something changed, or never, for work whose product is an action rather than a message), a ONE-SHOT (`at`, an ISO 8601 UTC instant — fires exactly once, then disables itself; e.g. 'check back on this in an hour' -> create a once routine for now+1h, and just create another one-shot to check again if nothing's changed — no re-arm state to manage), or an event subscription. Use this when the user asks for recurring, scheduled, one-time-later, or 'let me know when…' work. When talking to users, describe the policy in plain words ('I'll check every hour and only post when something changes', or 'I'll check back in an hour'), never internal jargon. Routines belong to this surface and survive their creator leaving; cancel with cancel_routine. If this surface can't host an approval card, the card goes to a card-capable channel in the same domain — the `message` field then names it, and you MUST relay that to the user, or the confirmation is somewhere they can't see. The prompt can invoke skills by name (e.g. 'run the <skill> skill, then …') — a fired routine sees this surface's domain and granted skills just like a normal turn, so a whole workflow can be one skill cron'd via a one-line prompt.",
+  inputSchema: z.object({
+    prompt: z.string().min(1).describe("What you should DO each time it fires, written as a self-contained instruction (an ordinary fire has no prior thread context; a durable job — see `job` — DOES, and accumulates it)."),
+    trigger,
+    job: z
+      .boolean()
+      .optional()
+      .describe(
+        "DURABLE JOB: ONE persistent session across fires, so multi-step work ACCUMULATES context " +
+          "instead of starting cold each time — the fires all live in one thread. Set it ONLY when the " +
+          "work has an END the job itself can recognise, because a job runs until its own session calls " +
+          "complete_job: \"watch this PR until it's merged\" ends — job. \"Check the dashboard every " +
+          "morning\" never ends — leave `job` off. Slack-only, and scheduled triggers only (not `event`).",
+      ),
+    permissions: z
+      .array(z.string())
+      .optional()
+      .describe(
+        "STANDING PERMISSIONS this routine may use without asking, declared here so the human arms the " +
+          "routine AND its permissions in one read. Only two things are declarable: \"pr.open\" (open pull " +
+          "requests) and \"tool:<connector tool>\" — ONE ROW PER TOOL, named exactly as you would call the " +
+          "tool, e.g. \"tool:notion__share_page\". A row lifts THAT TOOL ONLY: a routine that writes with " +
+          "three tools declares three rows, and a connector slug on its own (\"tool:notion\") names no tool " +
+          "and is refused. INFER CONSERVATIVELY — declare only what the prompt CERTAINLY needs every single " +
+          "fire ('read the queue and comment on each ticket' certainly needs the comment tool). " +
+          "Under-declaring costs the routine one refused step, which the human fixes by re-creating it with " +
+          "that row; over-declaring silently widens what runs unattended at 03:00. When in doubt, leave it " +
+          "out. Deletes are never declarable and always ask. Omit entirely for a routine that only reads or " +
+          "only posts here.",
+      ),
+    collectors: z
+      .array(z.string())
+      .optional()
+      .describe(
+        "PRE-RUN READS. Names of declared collectors the HOST runs BEFORE each fire, whose output is handed " +
+          "to the run as data — so the run starts from current inputs instead of guessing. You cannot invent " +
+          "one: the name, the tool it calls and the arguments it calls it with are all written in this " +
+          "deployment's config, and a name it does not declare is refused here with the list of names it does. " +
+          "Each collector needs its tool declared in `permissions` above, because a collector runs under the " +
+          "routine's declared permission and nothing wider. Omit for a routine that needs nothing fetched " +
+          "before it starts.",
+      ),
+    gate: z
+      .string()
+      .optional()
+      .describe(
+        "CONDITION GATE. The name of a declared predicate that decides whether this routine runs AT ALL, " +
+          "checked host-side over the collectors above before any session starts — for work that must not " +
+          "happen until something is verifiably true (\"do not tell them it is fixed until the fix is actually " +
+          "serving\"). Like `collectors`, the predicate itself is written in this deployment's config and a " +
+          "name it does not declare is refused here. It needs at least one `collector` — that is what it reads. " +
+          "It FAILS CLOSED: while the condition is false the routine does not run and says so in its audit trail. " +
+          "A one-shot routine is NOT retired by a gate saying no — it stays due and fires as soon as the condition " +
+          "holds. Omit for a routine that should run every time it is due.",
+      ),
+    // 🔴 DERIVED, never re-typed. A hardcoded enum here would be a FOURTH copy of the role
+    // vocabulary beside `ModelRoutes`, `ROUTINE_MODEL_ROLES` and the roles `models.ts` resolves —
+    // and the one copy no lint watches. A role added to the stack would then pass `lint:model-ids`
+    // RULE 6, be accepted by the store, and be rejected here, so no routine could ever name it:
+    // exactly the "a capability no routine can reach" state that rule exists to prevent.
+    modelRole: z
+      .enum(ROUTINE_MODEL_ROLES as readonly [ModelRole, ...ModelRole[]])
+      .optional()
+      .describe(
+        "MODEL ROLE. Which role of this deployment's model stack this routine's fires run on. OMIT IT unless " +
+          "you have a reason: omitting means the routine INHERITS the deployment's stack, which is what every " +
+          "routine did before this field existed and what almost every routine should keep doing. `utility` is " +
+          "the cheap summarising role and `supervisor` the cheap ambient one — pick one only for a routine whose " +
+          "work is genuinely mechanical, because a cheaper role degrades the run's judgement and nothing will " +
+          "tell you that it did. It names a ROLE and never a model id, so the routine follows the stack when the " +
+          "stack changes. Where this deployment routes no such role the routine simply runs the default one: " +
+          "naming a role is never an error and never a failure, it can just have no effect.",
+      ),
+  }),
+  outputSchema: z.object({
+    created: z.boolean(),
+    // Gated: nothing is armed yet — an approval card was posted for a human to confirm.
+    pending: z.boolean(),
+    pendingId: z.string().optional(),
+    trigger: z.string(),
+    nextRunAt: z.string().nullable().describe("When it WOULD first fire once armed (ISO, UTC), or null for event subscriptions."),
+    preview: z
+      .string()
+      .describe(
+        "The EXACT message this routine's first fire will receive — the temporal preamble, any protocol " +
+          "block (watch / durable job / silent), and your prompt. Rendered by the same code the dispatcher " +
+          "uses, so it cannot drift. Read it before telling the user what you've set up: if the protocol " +
+          "block contradicts what they asked for, the trigger or the post policy is wrong, not the prompt.",
+      ),
+    message: z.string().describe("Relay the substance of this to the user. When the approval card had to be posted in a DIFFERENT channel (this surface can't host one), it names that channel — say so explicitly, or they'll think nothing happened."),
+    autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+  }),
+  // `never()` means no eve-level approval field, not an ungated tool: the gate:member card is posted manually inside execute() via the `routine.create` ActionKind, which returns pending and arms nothing.
+  // Doing it in execute is what lets the tool inspect the resolved trigger and post a schedule-and-prompt card a human can actually read.
+  approval: never(),
+  async execute(input, ctx) {
+    // SOFT session cost checkpoint (OPE-62) — pause consequential work past a configured
+    // per-session threshold until a member confirms; no-op when unconfigured.
+    await requireSessionContinuation(ctx, "create_routine");
+    const mode = resolveMode(ctx);
+    if (mode === "mpim") {
+      throw new Error("Group DMs are execution-only — create routines in a channel or DM instead.");
+    }
+    const binding = bindFrom(ctx);
+    // Refuses AUTHORING a routine in a guest-bearing channel: `ApproverPolicy: "member"` puts no roster constraint on the clicker, so a guest could otherwise read a card, arm standing unattended autonomy, and leave.
+    // Scoped to BINDING_TRUSTED_PLATFORMS, where `external` carries information — binding fails closed to `external` for platforms that produce no verdict — and to a channel, because a DM has no roster and its `trust` answers a different question.
+    if (mode === "channel" && binding.trust === "external" && BINDING_TRUSTED_PLATFORMS.has(binding.platform)) {
+      throw new Error(
+        "I can't set up a routine in an externally-shared or guest-bearing channel — a routine fires unattended with standing authority, and this channel isn't confirmed all-in-org. Ask me in an internal channel.",
+      );
+    }
+    const p = resolvePartition(ctx);
+    // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+    // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+    // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+    // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+    // every unknown, so a single-wake turn is unchanged.
+    // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+    // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+    // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+    // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+    // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+    // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+    // conversation whose envelope is in the seat's shared context, through the reply fence's
+    // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+    // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+    // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+    // the merge road's impossibility.
+    // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+    // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+    // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+    // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+    // own target is a design choice this task does not hold.
+    const proposeScopeKey = await proposalScopeKey(ctx, p);
+    // A subscription names a HOOK, but the vocabulary it is validated against belongs to the hook's CONTRACT, and only the hook knows which one that is. Without this every category-(b) subscription would be refused as an unknown event source.
+    // A name matching no declaration resolves to undefined, and the pre-existing behaviour, the unknown-source refusal included, is unchanged.
+    const eventTrigger = input.trigger as z.infer<typeof trigger>;
+    const declaredHooks = (() => {
+      // WRAPPED for the same reason the config reads below are: `getConfig()` throws when the seam
+      // is unregistered, and an unanswerable question must not become a refusal.
+      try {
+        return getConfig().loadWebhooks?.() ?? [];
+      } catch {
+        return [];
+      }
+    })();
+    const hookRow = eventTrigger.kind === "event" ? findWebhook(declaredHooks, eventTrigger.source) : undefined;
+    const eventScheme = eventTrigger.kind === "event" ? webhookScheme(hookRow ? { source: hookRow.source } : { source: eventTrigger.source }) : undefined;
+    const t = storedTrigger(eventTrigger, eventScheme);
+    // The other half of the create-time gate: compile and run the jq filter once against a synthetic full-size document. Async, so it cannot live inside the synchronous mapper.
+    // An `event` routine has no clock, so a filter that fails to parse would sit `active` forever matching nothing. This also enforces the per-delivery cost ceiling, the only bound that catches a terminating-but-slow filter.
+    if (t.kind === "event" && t.jq !== undefined) {
+      await probeFilter(t.jq, t.source, eventNormalizer(eventScheme ?? t.source)?.matchKeys ?? []);
+    }
+    // A DM may carry every routine shape, and the ABSENCE of a guard here is the decision: member tier has no four-eyes requirement anywhere in this tree, and a card constrains the ROOM the authority acts in, never who may want it.
+    // Still open, so it is not mistaken for solved: fires are audited, but the standing grant authorising them is rendered nowhere an admin looks — a missing read, not a missing fence. A `mpim` group DM is refused above.
+
+    // The read-grant half of the create-time gate: arming a routine on a scope its domain cannot read otherwise succeeds, and the routine then simply never fires.
+    // This REFUSES on `unreachable` where `assertWebhooksValid` only warns, because a subscription that can never read its events does nothing else. It stays silent whenever `readGrantReach` cannot decide, which is most of the time and by design.
+    if (t.kind === "event") {
+      // `getConfig()` throws when the app-config seam is not registered — a real state in tests and in any embedding that mounts tools before config — and an unanswerable reachability question must not become a refusal.
+      let grant: ReadableBy | undefined;
+      let domains: readonly Domain[] | undefined;
+      try {
+        grant = hookRow?.readableBy ?? findWebhook(getConfig().loadWebhooks?.() ?? [], t.source)?.readableBy;
+        domains = getConfig().loadDomains();
+      } catch {
+        grant = undefined;
+        domains = undefined;
+      }
+      const reach = readGrantReach(p.surfaceKey, grant, domains);
+      const blocked = [...reach.impossible, ...reach.unreachable];
+      if (blocked.length > 0) {
+        throw new Error(
+          `A routine here can't read "${t.source}" events, so it would be armed and then never fire: ${blocked.join(" ")} ` +
+            `Arm it from a channel that can read this source, or have an operator widen the hook's readableBy in a PR.`,
+        );
+      }
+    }
+    // Validate a cron expression up front so the user gets a clear error now,
+    // not a silent never-firing routine.
+    const expr = t.kind === "cron" ? t.expr : t.kind === "watch" ? t.expr : undefined;
+    if (expr !== undefined) {
+      try {
+        parseCron(expr);
+      } catch (err) {
+        throw new Error(`That cron expression is invalid: ${String(err instanceof Error ? err.message : err)}`);
+      }
+    }
+
+    const now = new Date();
+    // `once`'s due instant is EXPLICIT (the validated `at`), not computed via "next
+    // occurrence after now" math — computeNextRun always returns null for "once" (see
+    // its header), so the initial nextRunAt is set directly here instead.
+    const next = t.kind === "once" ? new Date(t.at) : computeNextRun(t, now);
+    if ((t.kind === "cron" || t.kind === "interval" || t.kind === "watch") && next === null) {
+      throw new Error("That schedule never fires — check the cron expression.");
+    }
+    if (t.kind === "once" && next!.getTime() <= now.getTime()) {
+      throw new Error("`at` must be in the future — a one-shot routine can't fire in the past.");
+    }
+
+    // The gate: a routine fires without a fresh mention and can invoke skills by name, so nothing is armed on the spot. A card carries the schedule and prompt, and the arm click does the write. Fail-closed off a card-path surface.
+    // The check is `checkApprovalVenue`, not the pure `approvalVenueFor`: a redirect destination is chosen by config on the asker's behalf, so a candidate whose floor resolves to `guest` is skipped. It does NOT redirect away from a guest-floored own room.
+    const venueResult = await checkApprovalVenue(binding, p, () => getConfig().loadDomains());
+    if ("refusal" in venueResult) {
+      throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform));
+    }
+    const venue = venueResult.venue;
+
+    // The post-back destination is config-governed, host-resolved and never model-named.
+    // Creation asks the same registry the dispatcher will ask, so a platform with no wired post-back is redirected to the domain's `reportChannel` or refused naming the config key, instead of being armed and dry-running on every tick forever.
+    const canPostHere = canDispatchRoutinesOn(binding.platform);
+    let report = storedReport(input.trigger as z.infer<typeof trigger>);
+    if (!canPostHere) {
+      // A SILENT routine still has to `receive()` somewhere to run its turn at all — silence is a
+      // DELIVERY gate, not a destination — and `report` is one slot, so it cannot hold both. Refuse
+      // the pair rather than arm a routine that would dry-run forever while looking deliberate.
+      if (report?.kind === "silent") {
+        throw new Error(
+          `A "never"-posting routine still has to run somewhere, and "${binding.platform}" has no wired post-back at all, so there is nowhere to run it. Create it from a surface that can post (Slack, Discord, Teams).`,
+        );
+      }
+      const configured = reportChannelFor(domainKeyOf(p), getConfig().loadDomains());
+      if (!configured) {
+        throw new Error(
+          `A routine created here couldn't post anything — "${binding.platform}" has no wired post-back, so it would come due forever and never report. Set \`reportChannel\` on this channel's domain (agent/memory/config/domains/<name>.ts) to one of that domain's own Slack/Discord channels, and I can run it from here and report there; or ask me in a channel that can post.`,
+        );
+      }
+      const reportTarget = reportTargetForSurface(configured);
+      if (!reportTarget) {
+        throw new Error(
+          `This domain's \`reportChannel\` is "${configured}", but that surface's post-back target can't be derived from its key alone (Teams needs a stored conversation reference), so a routine reporting there would never post. Point \`reportChannel\` at a Slack or Discord channel in the same domain (agent/memory/config/domains/<name>.ts).`,
+        );
+      }
+      report = { kind: "surface", surfaceKey: configured, target: reportTarget };
+    }
+    // The enum makes "never + only-on-change" unreachable here, but the invariant belongs to the triple rather than to this schema, so it is asserted where the triple is first formed as well as at the store write, and neither site trusts the other.
+    // `input.job` is included so a job+watch combination is refused with the same message a hand-built or migrated row gets.
+    assertReportConsistent(t, report, input.job ? "job" : undefined);
+
+    // The session-join is Slack-only in v1 — the surface OE token-controls and can host-post a thread anchor into — and needs a clock trigger, because an `event` routine fires through an anchor-less path.
+    // Refuse a mis-shaped job at creation rather than arm one that silently will not persist.
+    if (input.job) {
+      if (binding.platform !== "slack") {
+        throw new Error(`Durable jobs are Slack-only for now — this is "${binding.platform}". Create a plain routine here, or a job from Slack.`);
+      }
+      if (t.kind === "event") {
+        throw new Error("A durable job fires on a schedule (cron / everyMinutes / a one-shot), not on an external event — drop `job`, or use a scheduled trigger.");
+      }
+      // A job in a DM is allowed, deliberately. A job is minted with a `bound` (`until` plus `maxFires`, whichever trips first) and retires itself whether or not it ever calls complete_job.
+      // That makes it the most bounded routine shape in the tree, not the least.
+    }
+    // 🔴 THE ACTING principal (OPE-269), which is what makes the header's "a routine-context
+    // create_routine throws" TRUE rather than merely intended. It read `principalIdOf` before, on
+    // the belief that a fire carries no principal — measurably false, a fire binds eve's schedule
+    // principal (`eve:app`), so a fired turn could mint standing autonomy of its own. Now that a
+    // fire binds as its routine's ATTESTED creator, the same read would additionally have stamped a
+    // real human as the author of a routine they never asked for, and put their name on its card.
+    // A re-arm loop that legitimately needs this rides `subscribe_pr` (open-tier, code-templated).
+    // principal-gate: presence — a fire minting standing autonomy of its own is the persist leg of the
+    // kill-chain, and the bound read would have stamped a real human as its author (OPE-269).
+    const createdBy = actingPrincipalIdOf(ctx);
+    if (!createdBy) {
+      throw new Error("create_routine needs a verified sender to gate the write — no principal id resolved, so there's no requester to show on the approval card.");
+    }
+    // The card's channel is the VENUE's, not necessarily this room's. Moving the card does not move the routine, which stays owned by, and unless config redirects it reports into, the room that asked for it.
+    const channelId = venue.channelId;
+
+    const target = binding.target;
+    const tainted = untrustedIngestedThisTurn();
+    // Declared permissions are validated HERE, where the author can fix a mis-spelled or over-wide row, then frozen into the pending's args verbatim.
+    // The card renders the frozen list and the arm click writes exactly it: the model proposes, and the authority still moves only on a human's click on a code-rendered card.
+    const permissions = (input.permissions ?? []).map((s) => s.trim()).filter((s) => s.length > 0);
+    declaredPermissionKinds(permissions); // throws, naming the vocabulary, on anything undeclarable
+    // OPE-151 — the PRE-RUN COLLECTORS and the CONDITION GATE, validated in the SAME moment and for
+    // the same reason: a name this deployment does not declare, or a collector whose tool the
+    // proposal did not also declare as a permission, must be refused where the author can fix it.
+    // The collector check reads `permissions` above, so the two lines cannot arm a card that
+    // promises a read the routine was never permitted.
+    const collectors = validateRoutineCollectors(input.collectors ?? [], permissions);
+    // The gate is validated AFTER the collectors, and against them: a gate reads the collection, so
+    // one named without any is refused here rather than armed and failing closed forever.
+    const gate = validateRoutineGate(input.gate, collectors);
+    const posted = await requestApproval(
+      {
+        org: p.org,
+        kind: "routine.create",
+        args: { org: p.org, partition: p, surfaceKey: p.surfaceKey, target, trigger: t, ...(report ? { report } : {}), prompt: input.prompt.trim(), ...(createdBy ? { createdBy } : {}), tainted, ...(input.job ? { sessionMode: "job" as const, boundPolicy: describeBoundPolicy(t, new Date()) } : {}), ...(permissions.length ? { permissions } : {}), ...(collectors.length ? { collectors } : {}), ...(gate ? { gate } : {}), ...(input.modelRole === undefined ? {} : { modelRole: input.modelRole }) },
+        scopeKey: proposeScopeKey,
+        domain: null,
+        requestedBy: createdBy,
+        channelId,
+        // A thread anchor is only meaningful in the room it came from — a cross-venue card must
+        // post top-level, never against a ts that belongs to a different workspace's channel.
+        threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+        // `postedTo` is the VENUE's key — where the card actually is, and where the TTL sweep and the decision wake must go looking.
+        postedTo: venue.surfaceKey,
+        chain: { unattended: unattendedOf(ctx) },
+      },
+      approvalPostDeps(venue.platform, ctx),
+    );
+
+    // The preview is rendered through the same routines/fire-message.ts the dispatcher renders from, so a preview that disagrees with the real fire is not expressible.
+    // Nothing is armed yet, so it renders against a PROPOSED row — a placeholder id, `createdAt: now`, no `lastRunAt` — which makes it the FIRST run, the one being described.
+    const preview = renderFireMessage({
+      id: "(pending)",
+      prompt: input.prompt.trim(),
+      createdAt: now.toISOString(),
+      trigger: t,
+      ...(report ? { report } : {}),
+      ...(input.job ? { sessionMode: "job" as const } : {}),
+    });
+
+    // Chain-lowered means no card was posted anywhere and the routine is ALREADY armed, so both halves of the card-path message would be wrong at once.
+    // `created` flips with the truth.
+    if (posted.autoApproved) {
+      return {
+        created: true,
+        pending: false,
+        autoApproved: true,
+        pendingId: posted.id,
+        trigger: describeTrigger(t, report),
+        nextRunAt: next ? next.toISOString() : null,
+        preview,
+        message: autoApprovedNote(
+          `${input.job ? "durable job" : "routine"} ${describeTrigger(t, report)}${tainted ? " ⚠ tainted" : ""}`,
+          posted.autoApproved,
+        ),
+      };
+    }
+
+    return {
+      created: false,
+      pending: true,
+      pendingId: posted.id,
+      trigger: describeTrigger(t, report),
+      nextRunAt: next ? next.toISOString() : null,
+      preview,
+      // When the card landed in another channel, say so in the same breath: a user who asks for a cron and sees no confirmation reads it as "the agent ignored me".
+      // The model is told to relay this string, because the card is by construction not visible from here.
+      message:
+        `${cardPostedPrefix(venue)} — ${input.job ? "durable job" : "routine"} ${describeTrigger(t, report)}${tainted ? " ⚠ tainted" : ""} awaiting a human to arm it (pending ${posted.id}).` +
+        cardPostedTail(venue, "arm it", posted),
+    };
+  },
+});