@opentag/dispatcher 0.1.0 → 0.2.0

package/dist/index.js

@@ -1,45 +1,101 @@
 // src/callbacks.ts
-import { parseSlackThreadKey } from "@opentag/slack";
+import { createLarkReplyClient, parseLarkThreadKey, replyLarkMessage } from "@opentag/lark";
+import { createSlackPostMessagePayload, createSlackUpdateMessagePayload, parseSlackThreadKey } from "@opentag/slack";
+import { createTelegramSendMessageDraftPayload, createTelegramSendMessagePayload, parseTelegramThreadKey } from "@opentag/telegram";
+function slackUpdateUriFrom(postMessageUri) {
+  return postMessageUri.replace(/\/chat\.postMessage$/, "/chat.update");
+}
+function githubCommentUriFrom(input) {
+  if (input.responseBody.url) return input.responseBody.url;
+  if (typeof input.responseBody.id === "number") {
+    return input.commentsUri.replace(/\/comments$/, `/comments/${input.responseBody.id}`);
+  }
+  return void 0;
+}
+function slackBotTokenFor(input) {
+  if (input.agentId && input.botTokensByAgentId && Object.hasOwn(input.botTokensByAgentId, input.agentId) && typeof input.botTokensByAgentId[input.agentId] === "string") {
+    return input.botTokensByAgentId[input.agentId];
+  }
+  return input.botToken;
+}
 function createGitHubCallbackSink(input) {
   const fetchImpl = input.fetchImpl ?? fetch;
+  const commentUriByKey = /* @__PURE__ */ new Map();
+  const deliveryByKey = /* @__PURE__ */ new Map();
   return {
     async deliver(message) {
       if (message.provider !== "github") return;
       if (!input.token) return;
-      const response = await fetchImpl(message.uri, {
-        method: "POST",
-        headers: {
-          accept: "application/vnd.github+json",
-          authorization: `Bearer ${input.token}`,
-          "content-type": "application/json",
-          "x-github-api-version": "2022-11-28"
-        },
-        body: JSON.stringify({ body: message.body })
+      const statusKey = message.statusMessageKey ?? `${message.runId}:status`;
+      const previous = deliveryByKey.get(statusKey) ?? Promise.resolve();
+      const current = previous.then(async () => {
+        const existingCommentUri = commentUriByKey.get(statusKey);
+        const response = await fetchImpl(existingCommentUri ?? message.uri, {
+          method: existingCommentUri ? "PATCH" : "POST",
+          headers: {
+            accept: "application/vnd.github+json",
+            authorization: `Bearer ${input.token}`,
+            "content-type": "application/json",
+            "x-github-api-version": "2022-11-28"
+          },
+          body: JSON.stringify({ body: message.body })
+        });
+        if (!response.ok) {
+          throw new Error(`deliver GitHub callback failed: ${response.status} ${await response.text()}`);
+        }
+        if (!existingCommentUri) {
+          const body = await response.json();
+          const commentUri = githubCommentUriFrom({ commentsUri: message.uri, responseBody: body });
+          if (commentUri) {
+            commentUriByKey.set(statusKey, commentUri);
+          }
+        }
+        if (message.kind === "final") {
+          commentUriByKey.delete(statusKey);
+        }
+      });
+      deliveryByKey.set(statusKey, current);
+      await current.finally(() => {
+        if (deliveryByKey.get(statusKey) === current) {
+          deliveryByKey.delete(statusKey);
+        }
       });
-      if (!response.ok) {
-        throw new Error(`deliver GitHub callback failed: ${response.status} ${await response.text()}`);
-      }
     }
   };
 }
 function createSlackCallbackSink(input) {
   const fetchImpl = input.fetchImpl ?? fetch;
+  const statusMessageTsByKey = /* @__PURE__ */ new Map();
   return {
     async deliver(message) {
       if (message.provider !== "slack") return;
-      if (!input.botToken) return;
+      const botToken = slackBotTokenFor({
+        ...input.botToken ? { botToken: input.botToken } : {},
+        ...input.botTokensByAgentId ? { botTokensByAgentId: input.botTokensByAgentId } : {},
+        ...message.agentId ? { agentId: message.agentId } : {}
+      });
+      if (!botToken) return;
       const thread = parseSlackThreadKey(message.threadKey ?? "");
-      const response = await fetchImpl(message.uri, {
+      const existingStatusTs = message.statusMessageKey ? statusMessageTsByKey.get(message.statusMessageKey) : void 0;
+      const response = await fetchImpl(existingStatusTs ? slackUpdateUriFrom(message.uri) : message.uri, {
         method: "POST",
         headers: {
-          authorization: `Bearer ${input.botToken}`,
+          authorization: `Bearer ${botToken}`,
           "content-type": "application/json"
         },
-        body: JSON.stringify({
-          channel: thread.channelId,
-          text: message.body,
-          thread_ts: thread.threadTs
-        })
+        body: JSON.stringify(
+          existingStatusTs ? createSlackUpdateMessagePayload({
+            channelId: thread.channelId,
+            text: message.body,
+            messageTs: existingStatusTs,
+            ...message.blocks?.length ? { blocks: message.blocks } : {}
+          }) : createSlackPostMessagePayload({
+            channelId: thread.channelId,
+            text: message.body,
+            threadTs: thread.threadTs,
+            ...message.blocks?.length ? { blocks: message.blocks } : {}
+          })
+        )
       });
       if (!response.ok) {
         throw new Error(`deliver Slack callback failed: ${response.status} ${await response.text()}`);
@@ -48,6 +104,87 @@ function createSlackCallbackSink(input) {
       if (body.ok === false) {
         throw new Error(`deliver Slack callback failed: ${body.error ?? "unknown_error"}`);
       }
+      if (message.statusMessageKey && !existingStatusTs && body.ts) {
+        statusMessageTsByKey.set(message.statusMessageKey, body.ts);
+      }
+      if (message.kind === "final") {
+        for (const key of statusMessageTsByKey.keys()) {
+          if (key.startsWith(`${message.runId}:`)) {
+            statusMessageTsByKey.delete(key);
+          }
+        }
+      }
+    }
+  };
+}
+function createLarkCallbackSink(input) {
+  if (!input.client && Boolean(input.appId) !== Boolean(input.appSecret)) {
+    throw new Error("Lark callback sink requires both appId and appSecret (or neither).");
+  }
+  const client = input.client ?? (input.appId && input.appSecret ? createLarkReplyClient({ appId: input.appId, appSecret: input.appSecret, ...input.domain ? { domain: input.domain } : {} }) : void 0);
+  return {
+    async deliver(message) {
+      if (message.provider !== "lark") return;
+      if (!client) {
+        throw new Error("Lark callback sink received a lark message but has no client configured (missing appId/appSecret).");
+      }
+      if (!message.threadKey) {
+        throw new Error("Lark callback message is missing threadKey.");
+      }
+      const { messageId } = parseLarkThreadKey(message.threadKey);
+      await replyLarkMessage(client, { messageId, text: message.body });
+    }
+  };
+}
+function createTelegramCallbackSink(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const draftIdByKey = /* @__PURE__ */ new Map();
+  let nextDraftId = 1;
+  return {
+    async deliver(message) {
+      if (message.provider !== "telegram") return;
+      const botToken = slackBotTokenFor({
+        ...input.botToken ? { botToken: input.botToken } : {},
+        ...input.botTokensByAgentId ? { botTokensByAgentId: input.botTokensByAgentId } : {},
+        ...message.agentId ? { agentId: message.agentId } : {}
+      });
+      if (!botToken) return;
+      const thread = parseTelegramThreadKey(message.threadKey ?? "");
+      const statusKey = message.statusMessageKey ?? `${message.runId}:status`;
+      const isDraft = message.kind === "progress";
+      const draftId = isDraft ? draftIdByKey.get(statusKey) ?? nextDraftId++ : void 0;
+      if (isDraft && draftId && !draftIdByKey.has(statusKey)) {
+        draftIdByKey.set(statusKey, draftId);
+      }
+      const response = await fetchImpl(`https://api.telegram.org/bot${botToken}/${isDraft ? "sendMessageDraft" : "sendMessage"}`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(
+          isDraft ? createTelegramSendMessageDraftPayload({
+            chatId: thread.chatId,
+            text: message.body,
+            draftId,
+            ...thread.messageThreadId ? { messageThreadId: thread.messageThreadId } : {}
+          }) : createTelegramSendMessagePayload({
+            chatId: thread.chatId,
+            text: message.body,
+            replyToMessageId: thread.replyToMessageId,
+            ...thread.messageThreadId ? { messageThreadId: thread.messageThreadId } : {}
+          })
+        )
+      });
+      if (!response.ok) {
+        throw new Error(`deliver Telegram callback failed: ${response.status} ${await response.text()}`);
+      }
+      const body = await response.json();
+      if (body.ok === false) {
+        throw new Error(`deliver Telegram callback failed: ${body.description ?? "unknown_error"}`);
+      }
+      if (message.kind === "final") {
+        draftIdByKey.delete(statusKey);
+      }
     }
   };
 }
@@ -61,14 +198,224 @@ function createCompositeCallbackSink(sinks) {
   };
 }
 
-// src/server.ts
-import { OpenTagEventSchema, OpenTagRunResultSchema } from "@opentag/core";
+// src/presentation.ts
 import { renderAcknowledgement, renderFinalResult, renderProgress } from "@opentag/github";
+import { renderLarkAcknowledgement, renderLarkFinalResult } from "@opentag/lark";
+import { createSlackFinalResultBlocks, renderSlackAcknowledgement, renderSlackFinalResult } from "@opentag/slack";
+import { renderTelegramAcknowledgement, renderTelegramFinalResult, renderTelegramProgress } from "@opentag/telegram";
+function createDefaultCallbackPresentation() {
+  return {
+    shouldDeliverAcknowledgement(provider) {
+      return provider !== "lark";
+    },
+    shouldDeliverProgress(provider) {
+      return provider !== "slack" && provider !== "lark";
+    },
+    acknowledgement(input) {
+      if (input.provider === "slack") {
+        return renderSlackAcknowledgement(input.runId);
+      }
+      if (input.provider === "lark") {
+        return renderLarkAcknowledgement(input.runId);
+      }
+      if (input.provider === "telegram") {
+        return renderTelegramAcknowledgement(input.runId);
+      }
+      return renderAcknowledgement(input.runId);
+    },
+    progress(input) {
+      if (input.provider === "telegram") {
+        return renderTelegramProgress(input.message);
+      }
+      return renderProgress({ runId: input.runId, message: input.message });
+    },
+    final(input) {
+      if (input.provider === "slack") {
+        return {
+          body: renderSlackFinalResult(input.result),
+          blocks: createSlackFinalResultBlocks(input.result)
+        };
+      }
+      if (input.provider === "lark") {
+        return { body: renderLarkFinalResult(input.result) };
+      }
+      if (input.provider === "telegram") {
+        return { body: renderTelegramFinalResult(input.result) };
+      }
+      return { body: renderFinalResult(input.result) };
+    }
+  };
+}
+
+// src/server.ts
+import { createHash } from "crypto";
+import {
+  AdapterMutationMappingSchema,
+  ActorIdentitySchema,
+  ActionHintSchema,
+  conversationKeysFromEvent as conversationKeysFromEvent2,
+  parseThreadActionCommand,
+  projectTargetRefFromEvent as projectTargetRefFromEvent2,
+  suggestedActionCandidatesFromSnapshots,
+  createAdapterMutationCompilerRegistry,
+  OpenTagEventSchema,
+  OpenTagRunResultSchema,
+  PolicyRuleSchema,
+  RunEventImportanceSchema,
+  RunEventVisibilitySchema
+} from "@opentag/core";
+import {
+  applyGitHubIssueMutationOperation,
+  createGitHubIssueMutationCompiler
+} from "@opentag/github";
 import { createOpenTagRepository, migrateSchema } from "@opentag/store";
 import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { Hono } from "hono";
 import { z } from "zod";
+
+// src/admission.ts
+import {
+  conversationKeysFromEvent,
+  projectTargetRefFromEvent,
+  RunAdmissionDecisionSchema
+} from "@opentag/core";
+function isWriteCapable(event) {
+  return event.permissions.some((permission) => ["repo:write", "pr:create", "pr:update"].includes(permission.scope));
+}
+function actorIsAllowed(event, allowedActors) {
+  if (!allowedActors?.length) return true;
+  return allowedActors.includes(event.actor.handle ?? "") || allowedActors.includes(event.actor.providerUserId);
+}
+function admissionDecision(input) {
+  return RunAdmissionDecisionSchema.parse({
+    action: input.action,
+    reason: input.reason,
+    reasonCode: input.reasonCode,
+    decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...input.activeRunId ? { activeRunId: input.activeRunId } : {},
+    eventId: input.event.id
+  });
+}
+async function defaultAgentAccessProfileCheck() {
+  return { allowed: true };
+}
+function createAdmissionRuntime(input) {
+  const agentAccessProfileCheck = input.agentAccessProfileCheck ?? defaultAgentAccessProfileCheck;
+  return {
+    async admitRun(request) {
+      const existingRun = await input.repo.getRunByEventId({ eventId: request.event.id });
+      if (existingRun) {
+        return {
+          outcome: "drop_duplicate",
+          decision: admissionDecision({
+            action: "drop_duplicate",
+            reason: "Source event already created a run.",
+            reasonCode: "duplicate_source_event",
+            event: request.event,
+            activeRunId: existingRun.run.id
+          }),
+          run: existingRun.run,
+          idempotentReplay: true
+        };
+      }
+      const repoKey = projectTargetRefFromEvent(request.event);
+      if (!repoKey) {
+        return {
+          outcome: "needs_human_decision",
+          decision: admissionDecision({
+            action: "needs_human_decision",
+            reason: "The event did not resolve to a repository context.",
+            reasonCode: "repo_context_missing",
+            event: request.event
+          })
+        };
+      }
+      const binding = await input.repo.getRepoBinding(repoKey);
+      if (!binding) {
+        return {
+          outcome: "needs_human_decision",
+          decision: admissionDecision({
+            action: "needs_human_decision",
+            reason: "No repository binding is configured for this work context.",
+            reasonCode: "repo_not_bound",
+            event: request.event
+          })
+        };
+      }
+      if (isWriteCapable(request.event) && !actorIsAllowed(request.event, binding.allowedActors)) {
+        return {
+          outcome: "needs_human_decision",
+          decision: admissionDecision({
+            action: "needs_human_decision",
+            reason: "The requesting actor is not allowed to start a write-capable run in this repository.",
+            reasonCode: "actor_not_allowed_for_write",
+            event: request.event
+          })
+        };
+      }
+      const accessDecision = await agentAccessProfileCheck({ event: request.event, binding });
+      if (!accessDecision.allowed) {
+        return {
+          outcome: "needs_human_decision",
+          decision: admissionDecision({
+            action: "needs_human_decision",
+            reason: accessDecision.reason,
+            reasonCode: accessDecision.reasonCode ?? "agent_access_profile_denied",
+            event: request.event
+          })
+        };
+      }
+      let activeRun = null;
+      for (const conversationKey of conversationKeysFromEvent(request.event)) {
+        activeRun = await input.repo.findActiveRunForConversation({ conversationKey });
+        if (activeRun) break;
+      }
+      if (activeRun) {
+        const decision = admissionDecision({
+          action: "queue_follow_up",
+          reason: "A run is already active for this thread; queue the new request as follow-up work.",
+          reasonCode: isWriteCapable(request.event) ? "active_write_run_same_thread" : "active_run_same_thread",
+          event: request.event,
+          activeRunId: activeRun.run.id
+        });
+        const { followUpRequest, created } = await input.repo.createFollowUpRequest({
+          id: request.requestId,
+          event: request.event,
+          decision,
+          activeRunId: activeRun.run.id
+        });
+        if (created) {
+          await input.repo.appendRunEvent({
+            runId: activeRun.run.id,
+            type: "follow_up_request.queued",
+            payload: { followUpRequestId: followUpRequest.id, sourceEventId: request.event.id },
+            visibility: "audit",
+            importance: "normal",
+            message: decision.reason
+          });
+        }
+        return {
+          outcome: "follow_up_queued",
+          decision,
+          followUpRequest
+        };
+      }
+      return {
+        outcome: "start",
+        decision: admissionDecision({
+          action: "start",
+          reason: "Source event accepted and ready to create a run.",
+          reasonCode: "new_event",
+          event: request.event
+        }),
+        binding
+      };
+    }
+  };
+}
+
+// src/server.ts
 var CreateRunnerSchema = z.object({
   runnerId: z.string().min(1),
   name: z.string().min(1)
@@ -85,49 +432,621 @@ var CreateRepoBindingSchema = z.object({
 var CreateSlackChannelBindingSchema = z.object({
   teamId: z.string().min(1),
   channelId: z.string().min(1),
+  repoProvider: z.string().min(1).default("github"),
   owner: z.string().min(1),
   repo: z.string().min(1)
 });
+var CreateChannelBindingSchema = z.object({
+  provider: z.string().min(1),
+  accountId: z.string().min(1),
+  conversationId: z.string().min(1),
+  repoProvider: z.string().min(1),
+  owner: z.string().min(1),
+  repo: z.string().min(1),
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+var UpsertPolicyRuleSchema = z.object({
+  rule: PolicyRuleSchema
+});
+var UpsertMutationMappingSchema = z.object({
+  mapping: AdapterMutationMappingSchema
+});
 var CreateRunSchema = z.object({
   runId: z.string().min(1),
   event: OpenTagEventSchema
 });
+var PromoteFollowUpRequestSchema = z.object({
+  runId: z.string().min(1)
+});
 var CompleteRunSchema = z.object({
   result: OpenTagRunResultSchema
 });
+var ApprovalDecisionInputSchema = z.object({
+  id: z.string().min(1).optional(),
+  approvedIntentIds: z.array(z.string().min(1)),
+  rejectedIntentIds: z.array(z.string().min(1)).optional(),
+  approvedBy: ActorIdentitySchema,
+  approvedAt: z.string().datetime().optional(),
+  scope: z.enum(["manual", "policy"]).default("manual"),
+  reason: z.string().min(1).optional(),
+  metadata: z.record(z.string(), z.unknown()).optional()
+}).refine((value) => {
+  const rejected = new Set(value.rejectedIntentIds ?? []);
+  return value.approvedIntentIds.every((intentId) => !rejected.has(intentId));
+}, {
+  message: "approvedIntentIds and rejectedIntentIds must not overlap"
+});
+var ApplyPlanInputSchema = z.object({
+  id: z.string().min(1).optional(),
+  approvalDecisionId: z.string().min(1),
+  selectedIntentIds: z.array(z.string().min(1)).optional(),
+  adapter: z.string().min(1).optional(),
+  execute: z.boolean().optional()
+});
+var ThreadActionInputSchema = z.object({
+  id: z.string().min(1).optional(),
+  rawText: z.string().min(1),
+  actor: ActorIdentitySchema,
+  callback: z.object({
+    provider: z.string().min(1),
+    uri: z.string().min(1),
+    threadKey: z.string().min(1).optional()
+  }),
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+var ChildRunInputSchema = z.object({
+  runId: z.string().min(1),
+  action: ActionHintSchema,
+  commandText: z.string().min(1).optional(),
+  sourceProposalId: z.string().min(1).optional(),
+  sourceApplyPlanId: z.string().min(1).optional()
+});
 var ProgressSchema = z.object({
   type: z.string().min(1).optional(),
   message: z.string().min(1),
-  at: z.string().datetime().optional()
+  at: z.string().datetime().optional(),
+  visibility: RunEventVisibilitySchema.optional(),
+  importance: RunEventImportanceSchema.optional()
 });
-function repoKeyFromEvent(event) {
-  const owner = event.metadata["owner"];
-  const repo = event.metadata["repo"];
-  if (typeof owner !== "string" || typeof repo !== "string") return null;
+function childEventFromParent(input) {
   return {
-    provider: typeof event.metadata["repoProvider"] === "string" ? event.metadata["repoProvider"] : "github",
-    owner,
-    repo
+    ...input.parentEvent,
+    id: `evt_${input.childRunId}`,
+    sourceEventId: `${input.parentEvent.sourceEventId}:${input.childRunId}`,
+    receivedAt: input.receivedAt,
+    context: [...input.parentEvent.context, ...input.extraContext ?? []],
+    command: {
+      rawText: input.commandText ?? `Execute next action: ${input.actionKind}`,
+      intent: "run",
+      args: {
+        parentSourceEventId: input.parentEvent.sourceEventId,
+        actionKind: input.actionKind
+      }
+    },
+    metadata: {
+      ...input.parentEvent.metadata,
+      ...input.metadata ?? {}
+    }
   };
 }
-function isWriteCapable(event) {
-  return event.permissions.some((permission) => ["repo:write", "pr:create", "pr:update"].includes(permission.scope));
+function mappingsFromAdapterPlan(adapterPlan) {
+  if (!adapterPlan || typeof adapterPlan !== "object" || Array.isArray(adapterPlan)) return [];
+  const mappings = adapterPlan.mappings;
+  if (!Array.isArray(mappings)) return [];
+  return mappings.map((mapping) => AdapterMutationMappingSchema.parse(mapping));
 }
-function actorIsAllowed(event, allowedActors) {
+function conversationKeyFromCallback(input) {
+  return `${input.provider}:${input.threadKey ?? input.uri}`;
+}
+function metadataIssueNumber(metadata) {
+  const value = metadata?.["issueNumber"];
+  if (typeof value === "number" && Number.isInteger(value) && value > 0) return String(value);
+  if (typeof value === "string" && /^[1-9]\d*$/.test(value)) return value;
+  return void 0;
+}
+function metadataString(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function githubIssueWorkItemExternalId(metadata) {
+  const owner = metadataString(metadata, "owner");
+  const repo = metadataString(metadata, "repo");
+  const issueNumber = metadataIssueNumber(metadata);
+  if (!owner || !repo || !issueNumber) return void 0;
+  return `${owner}/${repo}#${issueNumber}`;
+}
+function conversationKeysFromThreadAction(input) {
+  const primary = conversationKeyFromCallback(input.callback);
+  const keys = [primary];
+  const issueNumber = metadataIssueNumber(input.metadata);
+  if (input.callback.provider === "github" && input.callback.threadKey && issueNumber) {
+    const suffix = `#${issueNumber}`;
+    if (input.callback.threadKey.endsWith(suffix)) {
+      keys.push(`github:${input.callback.threadKey.slice(0, -suffix.length)}`);
+    }
+  }
+  return [...new Set(keys)];
+}
+function proposalMatchesWorkItem(proposal, externalId) {
+  return proposal.snapshot.workThread?.workItemReference.externalId === externalId || proposal.event.workItem?.externalId === externalId;
+}
+function stableHash(value) {
+  return createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+function stableId(prefix, parts) {
+  return `${prefix}_${stableHash(JSON.stringify(parts))}`;
+}
+function actorKeys(actor) {
+  return [
+    actor.providerUserId,
+    actor.handle,
+    `${actor.provider}:${actor.providerUserId}`,
+    actor.handle ? `${actor.provider}:${actor.handle}` : void 0
+  ].filter((value) => typeof value === "string" && value.length > 0);
+}
+function actorAllowedByList(actor, allowedActors) {
   if (!allowedActors?.length) return true;
-  return allowedActors.includes(event.actor.handle ?? "") || allowedActors.includes(event.actor.providerUserId);
+  const keys = new Set(actorKeys(actor));
+  return allowedActors.some((allowedActor) => keys.has(allowedActor));
+}
+function actionCandidatesFor(proposals) {
+  const candidates = [];
+  let startIndex = 1;
+  for (const proposal of proposals) {
+    const proposalCandidates = suggestedActionCandidatesFromSnapshots([proposal.snapshot], startIndex).map((candidate) => ({
+      ...candidate,
+      proposal
+    }));
+    candidates.push(...proposalCandidates);
+    startIndex += proposalCandidates.length;
+  }
+  return candidates;
+}
+function resolveCandidateSelection(input) {
+  const candidates = actionCandidatesFor(input.proposals);
+  if (candidates.length === 0) {
+    return { ok: false, reason: "no_proposal", message: "I could not find any suggested actions for this thread." };
+  }
+  let selected = [];
+  const selection = input.command.selection;
+  if (selection.kind === "all") {
+    selected = candidates;
+  } else if (selection.kind === "index") {
+    selected = candidates.filter((candidate) => candidate.index === selection.index);
+  } else if (selection.kind === "proposal") {
+    selected = candidates.filter((candidate) => candidate.proposalId === selection.proposalId);
+  } else if (selection.kind === "intent") {
+    selected = candidates.filter((candidate) => candidate.intent.intentId === selection.intentId);
+  } else if (selection.kind === "domain") {
+    selected = candidates.filter((candidate) => candidate.intent.domain === selection.domain);
+  } else if (candidates.length === 1) {
+    selected = candidates;
+  } else {
+    return {
+      ok: false,
+      reason: "ambiguous",
+      runId: candidates[0]?.proposal.runId,
+      message: `I found ${candidates.length} suggested actions. Please reply with ${candidates.map((candidate) => `\`${input.command.verb} ${candidate.index}\``).join(", ")} or \`${input.command.verb} all\`.`
+    };
+  }
+  if (selected.length === 0) {
+    return {
+      ok: false,
+      reason: "no_match",
+      runId: candidates[0]?.proposal.runId,
+      message: "I could not match that reply to a suggested action. Please use an action number like `apply 1`."
+    };
+  }
+  const proposalIds = new Set(selected.map((candidate) => candidate.proposalId));
+  if (proposalIds.size !== 1) {
+    return {
+      ok: false,
+      reason: "ambiguous",
+      runId: selected[0]?.proposal.runId,
+      message: "That selection spans multiple proposals. Please apply or approve one proposal at a time using its action number."
+    };
+  }
+  return {
+    ok: true,
+    resolved: {
+      proposal: selected[0].proposal,
+      selectedIntentIds: selected.map((candidate) => candidate.intent.intentId),
+      selectedCandidates: selected
+    }
+  };
+}
+async function resolveThreadAction(input) {
+  const conversationKeys = conversationKeysFromThreadAction({
+    callback: input.callback,
+    ...input.metadata ? { metadata: input.metadata } : {}
+  });
+  const primaryConversationKey = conversationKeys[0];
+  const targetWorkItemExternalId = githubIssueWorkItemExternalId(input.metadata);
+  if (input.command.selection.kind === "proposal") {
+    const stored = await input.repo.getSuggestedChanges({ proposalId: input.command.selection.proposalId });
+    if (!stored) {
+      return { ok: false, reason: "no_proposal", message: `I could not find proposal \`${input.command.selection.proposalId}\`.` };
+    }
+    const claimed = await input.repo.getRun({ runId: stored.runId });
+    if (!claimed) {
+      return { ok: false, reason: "no_proposal", message: `I found the proposal but not its source run.` };
+    }
+    const proposalConversationKeys = conversationKeysFromEvent2(claimed.event);
+    if (!proposalConversationKeys.some((key) => conversationKeys.includes(key))) {
+      return { ok: false, reason: "no_match", runId: stored.runId, message: "That proposal does not belong to this source thread." };
+    }
+    const proposal = { runId: stored.runId, run: claimed.run, event: claimed.event, snapshot: stored.snapshot };
+    if (targetWorkItemExternalId && !proposalMatchesWorkItem(proposal, targetWorkItemExternalId)) {
+      return { ok: false, reason: "no_match", runId: stored.runId, message: "That proposal does not belong to this source thread." };
+    }
+    return resolveCandidateSelection({
+      command: input.command,
+      proposals: [proposal]
+    });
+  }
+  for (const conversationKey of conversationKeys) {
+    const proposals = await input.repo.listLatestSuggestedChangesForConversation({ conversationKey });
+    const scopedProposals = conversationKey !== primaryConversationKey && targetWorkItemExternalId ? proposals.filter((proposal) => proposalMatchesWorkItem(proposal, targetWorkItemExternalId)) : proposals;
+    if (scopedProposals.length > 0) return resolveCandidateSelection({ command: input.command, proposals: scopedProposals });
+  }
+  return resolveCandidateSelection({ command: input.command, proposals: [] });
+}
+function isGitHubRepoEvent(event) {
+  const repoProvider = event.metadata["repoProvider"];
+  return repoProvider === "github" || event.source === "github" && repoProvider === void 0;
+}
+function hasGitHubRepoTarget(event) {
+  return isGitHubRepoEvent(event) && typeof event.metadata["owner"] === "string" && typeof event.metadata["repo"] === "string";
+}
+function hasGitHubIssueOrPullTarget(event) {
+  return typeof event.metadata["issueNumber"] === "number" || typeof event.metadata["pullRequestNumber"] === "number";
+}
+function isRepoLevelGitHubIntent(intent) {
+  return intent.action === "create_pull_request";
+}
+function adapterForAction(input) {
+  return hasGitHubRepoTarget(input.event) && (hasGitHubIssueOrPullTarget(input.event) || input.selectedIntents.length > 0 && input.selectedIntents.every((intent) => isRepoLevelGitHubIntent(intent))) ? "github" : input.callbackProvider;
+}
+async function authorizeThreadAction(input) {
+  const repoKey = projectTargetRefFromEvent2(input.resolved.proposal.event);
+  if (!repoKey) {
+    return { ok: false, reason: "repo_context_missing", message: "The proposal does not resolve to a repository binding." };
+  }
+  const binding = await input.repo.getRepoBinding(repoKey);
+  if (!binding) {
+    return { ok: false, reason: "repo_binding_not_found", message: "No repository binding is configured for this proposal." };
+  }
+  if (!actorAllowedByList(input.actor, binding.allowedActors)) {
+    return {
+      ok: false,
+      reason: "actor_not_allowed",
+      message: "This actor is not allowed to approve or apply actions for the bound repository."
+    };
+  }
+  if (input.resolved.proposal.event.source === "slack") {
+    const teamId = input.resolved.proposal.event.metadata["teamId"];
+    const channelId = input.resolved.proposal.event.metadata["channelId"];
+    if (typeof teamId === "string" && typeof channelId === "string") {
+      const channelBinding = await input.repo.getChannelBinding({
+        provider: "slack",
+        accountId: teamId,
+        conversationId: channelId
+      });
+      if (!channelBinding || channelBinding.repoProvider !== repoKey.provider || channelBinding.owner !== repoKey.owner || channelBinding.repo !== repoKey.repo) {
+        return {
+          ok: false,
+          reason: "channel_binding_mismatch",
+          message: "The source channel binding is missing or no longer points at the proposal repository."
+        };
+      }
+    }
+  }
+  return { ok: true };
+}
+function stableApprovalId(input) {
+  return input.providedId ?? stableId("approval", [
+    input.resolved.proposal.snapshot.proposalId,
+    input.command.verb,
+    [...input.resolved.selectedIntentIds].sort(),
+    actorKeys(input.actor).sort()
+  ]);
+}
+function sortedValues(values) {
+  return [...values ?? []].sort();
+}
+function sameStringSet(left, right) {
+  return JSON.stringify(sortedValues(left)) === JSON.stringify(sortedValues(right));
+}
+function sameActor(left, right) {
+  return left.provider === right.provider && left.providerUserId === right.providerUserId && (left.handle ?? "") === (right.handle ?? "") && (left.organizationId ?? "") === (right.organizationId ?? "");
+}
+function approvalDecisionMatchesThreadAction(input) {
+  const approvedIntentIds = input.command.verb === "reject" ? [] : input.resolved.selectedIntentIds;
+  const rejectedIntentIds = input.command.verb === "reject" ? input.resolved.selectedIntentIds : [];
+  const metadata = input.decision.metadata;
+  const verb = metadata && typeof metadata === "object" && !Array.isArray(metadata) ? metadata["verb"] : void 0;
+  return input.decision.proposalId === input.resolved.proposal.snapshot.proposalId && sameStringSet(input.decision.approvedIntentIds, approvedIntentIds) && sameStringSet(input.decision.rejectedIntentIds, rejectedIntentIds) && sameActor(input.decision.approvedBy, input.actor) && verb === input.command.verb;
+}
+function stableApplyPlanId(input) {
+  return stableId("apply", [
+    input.resolved.proposal.snapshot.proposalId,
+    input.adapter,
+    [...input.resolved.selectedIntentIds].sort()
+  ]);
+}
+function stableChildRunId(input) {
+  return stableId("run_child", [
+    input.resolved.proposal.runId,
+    input.resolved.proposal.snapshot.proposalId,
+    input.command.verb,
+    [...input.resolved.selectedIntentIds].sort(),
+    input.sourceApplyPlanId ?? "",
+    input.fallbackReason ?? ""
+  ]);
+}
+function selectedIntentsAlreadyApplied(input) {
+  return input.selectedIntentIds.every(
+    (intentId) => input.plan.outcomes?.some((outcome) => outcome.intentId === intentId && outcome.outcome === "applied")
+  );
+}
+function githubTargetFromEvent(event) {
+  const owner = event.metadata["owner"];
+  const repoName = event.metadata["repo"];
+  const issueNumber = event.metadata["issueNumber"];
+  const pullRequestNumber = event.metadata["pullRequestNumber"];
+  if (!hasGitHubRepoTarget(event)) return null;
+  if (typeof owner !== "string" || typeof repoName !== "string") return null;
+  if (typeof pullRequestNumber === "number") {
+    return { owner, repoName, issueNumber: pullRequestNumber, pullRequestNumber, targetKind: "pull_request" };
+  }
+  if (typeof issueNumber === "number") {
+    return { owner, repoName, issueNumber, targetKind: "issue" };
+  }
+  return { owner, repoName };
+}
+function selectedActionSummary(candidates) {
+  return candidates.map((candidate) => `${candidate.index}. ${candidate.intent.summary}`).join("; ");
+}
+function childRunContextLines(input) {
+  const previousSummary = input.resolved.proposal.run.result?.summary ?? input.resolved.proposal.snapshot.summary;
+  return [
+    `- Proposal: \`${input.resolved.proposal.snapshot.proposalId}\``,
+    `- Selected intents: ${input.resolved.selectedIntentIds.map((intentId) => `\`${intentId}\``).join(", ")}`,
+    `- Previous run: \`${input.resolved.proposal.runId}\``,
+    ...input.approvalDecisionId ? [`- Approval decision: \`${input.approvalDecisionId}\``] : [],
+    `- Previous result: ${previousSummary}`,
+    ...input.sourceApplyPlanId ? [`- Apply plan: \`${input.sourceApplyPlanId}\``] : [],
+    ...input.fallbackReason ? [`- Fallback reason: ${input.fallbackReason}`] : []
+  ];
+}
+function renderChildRunCreatedBody(input) {
+  return [
+    input.lead,
+    "",
+    `Child run: \`${input.childRun.id}\``,
+    "",
+    "Context carried into the child run:",
+    ...childRunContextLines(input),
+    "",
+    "The model will continue from this approved proposal instead of starting from a fresh mention."
+  ].join("\n");
+}
+function actionContextPointer(input) {
+  const lines = [
+    "OpenTag thread action continuation.",
+    `User reply: ${input.command.rawText}`,
+    `Action: ${input.command.verb}`,
+    `Proposal: ${input.resolved.proposal.snapshot.proposalId}`,
+    `Proposal summary: ${input.resolved.proposal.snapshot.summary}`,
+    `Selected actions: ${selectedActionSummary(input.resolved.selectedCandidates)}`,
+    `Selected intents: ${input.resolved.selectedIntentIds.join(", ")}`,
+    `Previous run: ${input.resolved.proposal.runId}`,
+    `Previous summary: ${input.resolved.proposal.run.result?.summary ?? input.resolved.proposal.snapshot.summary}`
+  ];
+  if (input.approvalDecisionId) lines.push(`Approval decision: ${input.approvalDecisionId}`);
+  if (input.applyPlanId) lines.push(`Apply plan: ${input.applyPlanId}`);
+  if (input.fallbackReason) lines.push(`Fallback reason: ${input.fallbackReason}`);
+  return {
+    kind: "text",
+    uri: lines.join("\n"),
+    visibility: input.resolved.proposal.event.source === "github" ? "public" : "organization",
+    title: "OpenTag approved action context"
+  };
+}
+async function createChildRunForThreadAction(input) {
+  const runId = input.runId ?? stableChildRunId(input);
+  const action = ActionHintSchema.parse({
+    kind: "apply_suggested_changes",
+    targetId: input.resolved.proposal.snapshot.proposalId,
+    selectedIntentIds: input.resolved.selectedIntentIds,
+    metadata: {
+      threadActionVerb: input.command.verb,
+      rawText: input.command.rawText,
+      ...input.command.reason ? { reason: input.command.reason } : {},
+      ...input.approvalDecisionId ? { approvalDecisionId: input.approvalDecisionId } : {},
+      ...input.fallbackReason ? { fallbackReason: input.fallbackReason } : {}
+    }
+  });
+  const previousRunSummary = input.resolved.proposal.run.result?.summary ?? input.resolved.proposal.snapshot.summary;
+  const commandText = input.command.verb === "continue" ? `Continue approved OpenTag action: ${selectedActionSummary(input.resolved.selectedCandidates)}` : `Continue because OpenTag could not directly apply approved action: ${selectedActionSummary(input.resolved.selectedCandidates)}`;
+  const { run } = await input.repo.createRun({
+    id: runId,
+    event: childEventFromParent({
+      parentEvent: input.resolved.proposal.event,
+      childRunId: runId,
+      actionKind: action.kind,
+      commandText,
+      receivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      extraContext: [
+        actionContextPointer({
+          command: input.command,
+          resolved: input.resolved,
+          ...input.approvalDecisionId ? { approvalDecisionId: input.approvalDecisionId } : {},
+          ...input.sourceApplyPlanId ? { applyPlanId: input.sourceApplyPlanId } : {},
+          ...input.fallbackReason ? { fallbackReason: input.fallbackReason } : {}
+        })
+      ],
+      metadata: {
+        parentRunId: input.resolved.proposal.runId,
+        sourceProposalId: input.resolved.proposal.snapshot.proposalId,
+        selectedIntentIds: input.resolved.selectedIntentIds,
+        threadActionVerb: input.command.verb,
+        previousRunSummary,
+        ...input.approvalDecisionId ? { approvalDecisionId: input.approvalDecisionId } : {},
+        ...input.sourceApplyPlanId ? { sourceApplyPlanId: input.sourceApplyPlanId } : {},
+        ...input.fallbackReason ? { fallbackReason: input.fallbackReason } : {}
+      }
+    }),
+    parentRunId: input.resolved.proposal.runId,
+    triggeredByAction: action,
+    sourceProposalId: input.resolved.proposal.snapshot.proposalId,
+    ...input.sourceApplyPlanId ? { sourceApplyPlanId: input.sourceApplyPlanId } : {}
+  });
+  return run;
+}
+async function executeGitHubApplyPlan(input) {
+  if (input.plan.adapter !== "github") {
+    return { plan: input.plan, executed: false, fallbackReason: `Adapter ${input.plan.adapter ?? "unknown"} is not directly executable yet.` };
+  }
+  if (!input.githubApply) {
+    return { plan: input.plan, executed: false, fallbackReason: "GitHub apply is not configured on this dispatcher." };
+  }
+  const target = githubTargetFromEvent(input.resolved.proposal.event);
+  if (!target) {
+    return { plan: input.plan, executed: false, fallbackReason: "The source run does not include a GitHub issue or pull request target." };
+  }
+  const preflightOutcomeByIntentId = new Map((input.plan.outcomes ?? []).map((outcome) => [outcome.intentId, outcome]));
+  const executableIntents = input.resolved.proposal.snapshot.intents.filter((intent) => {
+    if (!input.resolved.selectedIntentIds.includes(intent.intentId)) return false;
+    const outcome = preflightOutcomeByIntentId.get(intent.intentId);
+    return outcome?.outcome === "skipped" && outcome.message?.startsWith("Preflight passed");
+  });
+  if (executableIntents.length === 0) {
+    return { plan: input.plan, executed: false, fallbackReason: "No selected intent has a direct adapter execution path." };
+  }
+  const executedOutcomes = [];
+  const compilerRegistry = createAdapterMutationCompilerRegistry([
+    createGitHubIssueMutationCompiler({
+      mappings: mappingsFromAdapterPlan(input.plan.adapterPlan),
+      ...target.targetKind ? { targetKind: target.targetKind } : {}
+    })
+  ]);
+  for (const compilation of compilerRegistry.compile("github", executableIntents)) {
+    if (!compilation.ok) {
+      executedOutcomes.push(compilation.outcome);
+      continue;
+    }
+    executedOutcomes.push(
+      await applyGitHubIssueMutationOperation({
+        target: {
+          token: input.githubApply.token,
+          owner: target.owner,
+          repo: target.repoName,
+          ...typeof target.issueNumber === "number" ? { issueNumber: target.issueNumber } : {},
+          ...target.pullRequestNumber ? { pullRequestNumber: target.pullRequestNumber } : {}
+        },
+        operation: compilation.operation,
+        ...input.githubApply.fetchImpl ? { fetchImpl: input.githubApply.fetchImpl } : {}
+      })
+    );
+  }
+  const executedOutcomeByIntentId = new Map(executedOutcomes.map((outcome) => [outcome.intentId, outcome]));
+  const mergedOutcomes = (input.plan.outcomes ?? []).map((outcome) => executedOutcomeByIntentId.get(outcome.intentId) ?? outcome);
+  const updated = await input.repo.updateApplyPlanOutcomes({
+    id: input.plan.id,
+    outcomes: mergedOutcomes,
+    externalWritesExecuted: true
+  });
+  const plan = updated ?? input.plan;
+  const allSelectedApplied = input.resolved.selectedIntentIds.every(
+    (intentId) => plan.outcomes?.some((outcome) => outcome.intentId === intentId && outcome.outcome === "applied")
+  );
+  return {
+    plan,
+    executed: allSelectedApplied,
+    ...allSelectedApplied ? {} : { fallbackReason: "Some selected intents were not directly applied." }
+  };
 }
 var noopCallbackSink = {
   async deliver() {
     return;
   }
 };
+function nextCallbackAttemptAt(input) {
+  const maxAttempts = input.maxAttempts ?? 5;
+  const nextAttempt = input.attempts + 1;
+  if (nextAttempt >= maxAttempts) return void 0;
+  const baseDelayMs = input.baseDelayMs ?? 5e3;
+  const maxDelayMs = input.maxDelayMs ?? 3e5;
+  const delayMs = Math.min(maxDelayMs, baseDelayMs * 2 ** Math.max(0, input.attempts));
+  return new Date((input.now ?? /* @__PURE__ */ new Date()).getTime() + delayMs).toISOString();
+}
+async function deliverCallbackDelivery(input) {
+  try {
+    await input.sink.deliver({
+      runId: input.delivery.runId,
+      kind: input.delivery.kind,
+      provider: input.delivery.provider,
+      uri: input.delivery.uri,
+      body: input.delivery.body,
+      ...input.delivery.threadKey ? { threadKey: input.delivery.threadKey } : {},
+      ...input.delivery.agentId ? { agentId: input.delivery.agentId } : {},
+      ...input.delivery.statusMessageKey ? { statusMessageKey: input.delivery.statusMessageKey } : {},
+      ...input.delivery.blocks ? { blocks: input.delivery.blocks } : {}
+    });
+    await input.repo.markCallbackDelivered({ deliveryId: input.delivery.id });
+    return true;
+  } catch (error) {
+    const nextAttemptAt = nextCallbackAttemptAt({ attempts: input.delivery.attempts, ...input.retry ?? {} });
+    await input.repo.markCallbackFailed({
+      deliveryId: input.delivery.id,
+      error: error instanceof Error ? error.message : String(error),
+      ...nextAttemptAt ? { nextAttemptAt } : {}
+    });
+    return false;
+  }
+}
+async function processPendingCallbacks(input) {
+  const maxAttempts = input.retry?.maxAttempts ?? 5;
+  const deliveries = await input.repo.claimPendingCallbackDeliveries({
+    limit: input.limit ?? 20,
+    ...input.retry?.now ? { now: input.retry.now } : {},
+    maxAttempts
+  });
+  const result = { processed: 0, delivered: 0, failed: 0 };
+  for (const delivery of deliveries) {
+    result.processed += 1;
+    const delivered = await deliverCallbackDelivery({
+      repo: input.repo,
+      sink: input.sink,
+      delivery,
+      ...input.retry ? { retry: input.retry } : {}
+    });
+    if (delivered) {
+      result.delivered += 1;
+    } else {
+      result.failed += 1;
+    }
+  }
+  return result;
+}
 async function deliverAndAudit(input) {
-  await input.sink.deliver(input.message);
-  await input.repo.appendRunEvent({
+  const delivery = await input.repo.enqueueCallbackDelivery({
     runId: input.message.runId,
-    type: `callback.${input.message.kind}.delivered`,
-    payload: input.message
+    kind: input.message.kind,
+    provider: input.message.provider,
+    uri: input.message.uri,
+    body: input.message.body,
+    ...input.message.threadKey ? { threadKey: input.message.threadKey } : {},
+    ...input.message.agentId ? { agentId: input.message.agentId } : {},
+    ...input.message.statusMessageKey ? { statusMessageKey: input.message.statusMessageKey } : {},
+    ...input.message.blocks ? { blocks: input.message.blocks } : {}
+  });
+  await deliverCallbackDelivery({
+    repo: input.repo,
+    sink: input.sink,
+    delivery,
+    ...input.retry ? { retry: input.retry } : {}
   });
 }
 function isAuthorized(request, pairingToken) {
@@ -140,6 +1059,12 @@ function createDispatcherApp(input) {
   const repo = createOpenTagRepository(drizzle(sqlite));
   const app = new Hono();
   const callbackSink = input.callbackSink ?? noopCallbackSink;
+  const presentation = input.presentation ?? createDefaultCallbackPresentation();
+  const callbackRetry = input.callbackRetry ?? {};
+  const admission = createAdmissionRuntime({
+    repo,
+    ...input.agentAccessProfileCheck ? { agentAccessProfileCheck: input.agentAccessProfileCheck } : {}
+  });
   app.get("/healthz", (c) => c.json({ ok: true }));
   app.use("/v1/*", async (c, next) => {
     if (!isAuthorized(c.req.raw, input.pairingToken)) {
@@ -152,6 +1077,11 @@ function createDispatcherApp(input) {
     await repo.registerRunner(parsed);
     return c.json({ ok: true }, 201);
   });
+  app.get("/v1/runners/:runnerId", async (c) => {
+    const runner = await repo.getRunner({ runnerId: c.req.param("runnerId") });
+    if (!runner) return c.json({ error: "runner_not_found" }, 404);
+    return c.json({ runner });
+  });
   app.post("/v1/repo-bindings", async (c) => {
     const parsed = CreateRepoBindingSchema.parse(await c.req.json());
     await repo.createRepoBinding({
@@ -174,6 +1104,78 @@ function createDispatcherApp(input) {
     if (!binding) return c.json({ error: "repo_binding_not_found" }, 404);
     return c.json({ binding });
   });
+  app.post("/v1/repo-bindings/:provider/:owner/:repo/policy-rules", async (c) => {
+    const parsed = UpsertPolicyRuleSchema.parse(await c.req.json());
+    const rule = await repo.upsertRepoPolicyRule({
+      provider: c.req.param("provider"),
+      owner: c.req.param("owner"),
+      repo: c.req.param("repo"),
+      rule: parsed.rule
+    });
+    return c.json({ rule }, 201);
+  });
+  app.get("/v1/repo-bindings/:provider/:owner/:repo/policy-rules", async (c) => {
+    const rules = await repo.listRepoPolicyRules({
+      provider: c.req.param("provider"),
+      owner: c.req.param("owner"),
+      repo: c.req.param("repo")
+    });
+    return c.json({ rules });
+  });
+  app.post("/v1/repo-bindings/:provider/:owner/:repo/mutation-mappings", async (c) => {
+    const parsed = UpsertMutationMappingSchema.parse(await c.req.json());
+    const mapping = await repo.upsertRepoMutationMapping({
+      provider: c.req.param("provider"),
+      owner: c.req.param("owner"),
+      repo: c.req.param("repo"),
+      mapping: parsed.mapping
+    });
+    return c.json({ mapping }, 201);
+  });
+  app.get("/v1/repo-bindings/:provider/:owner/:repo/mutation-mappings", async (c) => {
+    const mappings = await repo.listRepoMutationMappings({
+      provider: c.req.param("provider"),
+      owner: c.req.param("owner"),
+      repo: c.req.param("repo")
+    });
+    return c.json({ mappings });
+  });
+  app.get("/v1/repo-bindings/:provider/:owner/:repo/metrics", async (c) => {
+    const metrics = await repo.getRepoMetrics({
+      provider: c.req.param("provider"),
+      owner: c.req.param("owner"),
+      repo: c.req.param("repo")
+    });
+    return c.json({ metrics });
+  });
+  app.get("/v1/work-thread-metrics", async (c) => {
+    const threadId = c.req.query("threadId");
+    if (!threadId) return c.json({ error: "thread_id_required" }, 422);
+    const metrics = await repo.getWorkThreadMetrics({ threadId });
+    return c.json({ metrics });
+  });
+  app.post("/v1/channel-bindings", async (c) => {
+    const parsed = CreateChannelBindingSchema.parse(await c.req.json());
+    await repo.upsertChannelBinding({
+      provider: parsed.provider,
+      accountId: parsed.accountId,
+      conversationId: parsed.conversationId,
+      repoProvider: parsed.repoProvider,
+      owner: parsed.owner,
+      repo: parsed.repo,
+      ...parsed.metadata ? { metadata: parsed.metadata } : {}
+    });
+    return c.json({ ok: true }, 201);
+  });
+  app.get("/v1/channel-bindings/:provider/:accountId/:conversationId", async (c) => {
+    const binding = await repo.getChannelBinding({
+      provider: c.req.param("provider"),
+      accountId: c.req.param("accountId"),
+      conversationId: c.req.param("conversationId")
+    });
+    if (!binding) return c.json({ error: "channel_binding_not_found" }, 404);
+    return c.json({ binding });
+  });
   app.post("/v1/slack-channel-bindings", async (c) => {
     const parsed = CreateSlackChannelBindingSchema.parse(await c.req.json());
     await repo.createSlackChannelBinding(parsed);
@@ -189,31 +1191,425 @@ function createDispatcherApp(input) {
   });
   app.post("/v1/runs", async (c) => {
     const parsed = CreateRunSchema.parse(await c.req.json());
-    const repoKey = repoKeyFromEvent(parsed.event);
-    if (!repoKey) {
-      return c.json({ error: "repo_context_missing" }, 422);
+    const admitted = await admission.admitRun({ requestId: parsed.runId, event: parsed.event });
+    if (admitted.outcome === "needs_human_decision") {
+      return c.json({ decision: admitted.decision }, 202);
     }
-    const binding = await repo.getRepoBinding(repoKey);
-    if (!binding) {
-      return c.json({ error: "repo_not_bound" }, 403);
+    if (admitted.outcome === "drop_duplicate") {
+      await repo.appendRunEvent({
+        runId: admitted.run.id,
+        type: "admission.decided",
+        payload: admitted.decision,
+        visibility: "audit",
+        importance: "normal",
+        message: admitted.decision.reason
+      });
+      await repo.appendRunEvent({
+        runId: admitted.run.id,
+        type: "run.create_idempotent_replay",
+        payload: { requestedRunId: parsed.runId, eventId: parsed.event.id },
+        visibility: "audit",
+        importance: "low"
+      });
+      return c.json({ decision: admitted.decision, run: admitted.run, idempotentReplay: true }, 200);
     }
-    if (isWriteCapable(parsed.event) && !actorIsAllowed(parsed.event, binding.allowedActors)) {
-      return c.json({ error: "actor_not_allowed_for_write" }, 403);
+    if (admitted.outcome === "follow_up_queued") {
+      return c.json({ decision: admitted.decision, followUpRequest: admitted.followUpRequest }, 202);
     }
-    const run = await repo.createRun({ id: parsed.runId, event: parsed.event });
+    const createdRun = await repo.createRun({ id: parsed.runId, event: parsed.event });
+    if (!createdRun.created) {
+      return c.json(
+        {
+          decision: {
+            ...admitted.decision,
+            action: "drop_duplicate",
+            reason: "Source event already created a run.",
+            reasonCode: "duplicate_source_event",
+            activeRunId: createdRun.run.id
+          },
+          run: createdRun.run,
+          idempotentReplay: true
+        },
+        200
+      );
+    }
+    const { run } = createdRun;
+    if (presentation.shouldDeliverAcknowledgement(parsed.event.callback.provider)) {
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId: run.id,
+          kind: "acknowledgement",
+          provider: parsed.event.callback.provider,
+          uri: parsed.event.callback.uri,
+          body: presentation.acknowledgement({ provider: parsed.event.callback.provider, runId: run.id }),
+          ...parsed.event.target.agentId ? { agentId: parsed.event.target.agentId } : {},
+          ...parsed.event.callback.threadKey ? { threadKey: parsed.event.callback.threadKey } : {}
+        }
+      });
+    }
+    return c.json({ decision: admitted.decision, run }, 201);
+  });
+  app.post("/v1/thread-actions", async (c) => {
+    const parsed = ThreadActionInputSchema.parse(await c.req.json());
+    const command = parseThreadActionCommand(parsed.rawText);
+    if (!command) {
+      return c.json({ outcome: "ignored", reason: "not_action_command" }, 202);
+    }
+    const resolved = await resolveThreadAction({
+      repo,
+      command,
+      callback: parsed.callback,
+      ...parsed.metadata ? { metadata: parsed.metadata } : {}
+    });
+    if (!resolved.ok) {
+      if (resolved.runId) {
+        await deliverAndAudit({
+          repo,
+          sink: callbackSink,
+          retry: callbackRetry,
+          message: {
+            runId: resolved.runId,
+            kind: "final",
+            provider: parsed.callback.provider,
+            uri: parsed.callback.uri,
+            body: resolved.message,
+            ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+          }
+        });
+      }
+      return c.json({ outcome: resolved.reason, message: resolved.message }, resolved.reason === "no_proposal" ? 404 : 409);
+    }
+    const authorization = await authorizeThreadAction({
+      repo,
+      resolved: resolved.resolved,
+      actor: parsed.actor
+    });
+    if (!authorization.ok) {
+      return c.json({ outcome: "unauthorized", reason: authorization.reason, message: authorization.message }, 403);
+    }
+    const selectionText = selectedActionSummary(resolved.resolved.selectedCandidates);
+    const selectedIntents = resolved.resolved.proposal.snapshot.intents.filter(
+      (intent) => resolved.resolved.selectedIntentIds.includes(intent.intentId)
+    );
+    const adapter = adapterForAction({
+      event: resolved.resolved.proposal.event,
+      callbackProvider: parsed.callback.provider,
+      selectedIntents
+    });
+    const applyPlanId = stableApplyPlanId({ resolved: resolved.resolved, adapter });
+    if (command.verb === "apply") {
+      const existingPlan = await repo.getApplyPlan({ id: applyPlanId });
+      if (existingPlan) {
+        const existingDecision2 = await repo.getApprovalDecision({ id: existingPlan.approvalDecisionId });
+        if (selectedIntentsAlreadyApplied({ plan: existingPlan, selectedIntentIds: resolved.resolved.selectedIntentIds })) {
+          return c.json({ outcome: "already_applied", decision: existingDecision2, plan: existingPlan }, 200);
+        }
+        const fallbackReason = "An apply plan already exists for this selected action; OpenTag will not execute it again from a repeated thread reply.";
+        const childRun2 = await createChildRunForThreadAction({
+          repo,
+          command,
+          resolved: resolved.resolved,
+          runId: stableChildRunId({
+            command,
+            resolved: resolved.resolved,
+            sourceApplyPlanId: existingPlan.id,
+            fallbackReason
+          }),
+          approvalDecisionId: existingPlan.approvalDecisionId,
+          sourceApplyPlanId: existingPlan.id,
+          fallbackReason
+        });
+        await deliverAndAudit({
+          repo,
+          sink: callbackSink,
+          retry: callbackRetry,
+          message: {
+            runId: resolved.resolved.proposal.runId,
+            kind: "final",
+            provider: parsed.callback.provider,
+            uri: parsed.callback.uri,
+            body: renderChildRunCreatedBody({
+              lead: "This action was already planned, so OpenTag will not execute the external write again.",
+              resolved: resolved.resolved,
+              childRun: childRun2,
+              approvalDecisionId: existingPlan.approvalDecisionId,
+              sourceApplyPlanId: existingPlan.id,
+              fallbackReason
+            }),
+            ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+          }
+        });
+        return c.json({ outcome: "already_planned", decision: existingDecision2, plan: existingPlan, run: childRun2 }, 200);
+      }
+    }
+    const providedDecision = parsed.id ? await repo.getApprovalDecision({ id: parsed.id }) : null;
+    const canReuseProvidedDecision = providedDecision ? approvalDecisionMatchesThreadAction({
+      decision: providedDecision,
+      command,
+      resolved: resolved.resolved,
+      actor: parsed.actor
+    }) : false;
+    const approvalId = parsed.id && (!providedDecision || canReuseProvidedDecision) ? parsed.id : stableApprovalId({
+      command,
+      resolved: resolved.resolved,
+      actor: parsed.actor
+    });
+    const existingDecision = canReuseProvidedDecision ? providedDecision : await repo.getApprovalDecision({ id: approvalId });
+    const decision = existingDecision ?? await repo.recordApprovalDecision({
+      id: approvalId,
+      proposalId: resolved.resolved.proposal.snapshot.proposalId,
+      approvedIntentIds: command.verb === "reject" ? [] : resolved.resolved.selectedIntentIds,
+      ...command.verb === "reject" ? { rejectedIntentIds: resolved.resolved.selectedIntentIds } : {},
+      approvedBy: parsed.actor,
+      approvedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      scope: "manual",
+      ...command.reason ? { reason: command.reason } : {},
+      metadata: {
+        source: "thread_action",
+        rawText: command.rawText,
+        verb: command.verb,
+        selection: command.selection,
+        callback: parsed.callback,
+        ...parsed.metadata ? { ingressMetadata: parsed.metadata } : {}
+      }
+    });
+    if (!decision) {
+      return c.json({ error: "proposal_not_found" }, 404);
+    }
+    if (command.verb === "reject") {
+      if (existingDecision) {
+        return c.json({ outcome: "already_rejected", decision }, 200);
+      }
+      const body2 = `Rejected ${selectionText} from \`${resolved.resolved.proposal.snapshot.proposalId}\`.`;
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId: resolved.resolved.proposal.runId,
+          kind: "final",
+          provider: parsed.callback.provider,
+          uri: parsed.callback.uri,
+          body: body2,
+          ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+        }
+      });
+      return c.json({ outcome: "rejected", decision }, 201);
+    }
+    if (command.verb === "approve") {
+      if (existingDecision) {
+        return c.json({ outcome: "already_approved", decision }, 200);
+      }
+      const body2 = `Approved ${selectionText} from \`${resolved.resolved.proposal.snapshot.proposalId}\`.
+
+Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to apply it, or \`continue ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to continue with a follow-up run.`;
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId: resolved.resolved.proposal.runId,
+          kind: "final",
+          provider: parsed.callback.provider,
+          uri: parsed.callback.uri,
+          body: body2,
+          ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+        }
+      });
+      return c.json({ outcome: "approved", decision }, 201);
+    }
+    if (command.verb === "continue") {
+      const childRun2 = await createChildRunForThreadAction({
+        repo,
+        command,
+        resolved: resolved.resolved,
+        runId: stableChildRunId({ command, resolved: resolved.resolved }),
+        approvalDecisionId: decision.id
+      });
+      const body2 = renderChildRunCreatedBody({
+        lead: `Continuing from ${selectionText} in \`${resolved.resolved.proposal.snapshot.proposalId}\`.`,
+        resolved: resolved.resolved,
+        childRun: childRun2,
+        approvalDecisionId: decision.id
+      });
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId: resolved.resolved.proposal.runId,
+          kind: "final",
+          provider: parsed.callback.provider,
+          uri: parsed.callback.uri,
+          body: body2,
+          ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+        }
+      });
+      return c.json({ outcome: "child_run_created", decision, run: childRun2 }, 201);
+    }
+    const planResult = await repo.createApplyPlanOnce({
+      id: applyPlanId,
+      proposalId: resolved.resolved.proposal.snapshot.proposalId,
+      approvalDecisionId: decision.id,
+      selectedIntentIds: resolved.resolved.selectedIntentIds,
+      adapter
+    });
+    if (!planResult) {
+      return c.json({ error: "proposal_or_approval_not_found" }, 404);
+    }
+    if (!planResult.created) {
+      if (selectedIntentsAlreadyApplied({ plan: planResult.plan, selectedIntentIds: resolved.resolved.selectedIntentIds })) {
+        return c.json({ outcome: "already_applied", decision, plan: planResult.plan }, 200);
+      }
+      const fallbackReason = "An apply plan already exists for this selected action; OpenTag will not execute it again from a repeated thread reply.";
+      const childRun2 = await createChildRunForThreadAction({
+        repo,
+        command,
+        resolved: resolved.resolved,
+        runId: stableChildRunId({
+          command,
+          resolved: resolved.resolved,
+          sourceApplyPlanId: planResult.plan.id,
+          fallbackReason
+        }),
+        approvalDecisionId: decision.id,
+        sourceApplyPlanId: planResult.plan.id,
+        fallbackReason
+      });
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId: resolved.resolved.proposal.runId,
+          kind: "final",
+          provider: parsed.callback.provider,
+          uri: parsed.callback.uri,
+          body: renderChildRunCreatedBody({
+            lead: "This action was already planned, so OpenTag will not execute the external write again.",
+            resolved: resolved.resolved,
+            childRun: childRun2,
+            approvalDecisionId: decision.id,
+            sourceApplyPlanId: planResult.plan.id,
+            fallbackReason
+          }),
+          ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+        }
+      });
+      return c.json({ outcome: "already_planned", decision, plan: planResult.plan, run: childRun2 }, 200);
+    }
+    const plan = planResult.plan;
+    const execution = await executeGitHubApplyPlan({
+      repo,
+      plan,
+      resolved: resolved.resolved,
+      ...input.githubApply ? { githubApply: input.githubApply } : {}
+    });
+    if (execution.executed) {
+      const outcomes = execution.plan.outcomes ?? [];
+      const body2 = [
+        `Applied ${selectionText} from \`${resolved.resolved.proposal.snapshot.proposalId}\`.`,
+        "",
+        "Result:",
+        ...outcomes.filter((outcome) => resolved.resolved.selectedIntentIds.includes(outcome.intentId)).map((outcome) => `- \`${outcome.intentId}\`: ${outcome.outcome}${outcome.externalUri ? ` (${outcome.externalUri})` : ""}`)
+      ].join("\n");
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId: resolved.resolved.proposal.runId,
+          kind: "final",
+          provider: parsed.callback.provider,
+          uri: parsed.callback.uri,
+          body: body2,
+          ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+        }
+      });
+      return c.json({ outcome: "applied", decision, plan: execution.plan }, 201);
+    }
+    const childRun = await createChildRunForThreadAction({
+      repo,
+      command,
+      resolved: resolved.resolved,
+      runId: stableChildRunId({
+        command,
+        resolved: resolved.resolved,
+        sourceApplyPlanId: execution.plan.id,
+        fallbackReason: execution.fallbackReason ?? "OpenTag cannot directly apply this intent yet."
+      }),
+      approvalDecisionId: decision.id,
+      sourceApplyPlanId: execution.plan.id,
+      fallbackReason: execution.fallbackReason ?? "OpenTag cannot directly apply this intent yet."
+    });
+    const body = renderChildRunCreatedBody({
+      lead: `Action ${selectionText} was approved, but OpenTag cannot directly apply it yet.`,
+      resolved: resolved.resolved,
+      childRun,
+      approvalDecisionId: decision.id,
+      sourceApplyPlanId: execution.plan.id,
+      fallbackReason: execution.fallbackReason ?? "The adapter could not execute the selected intent."
+    });
     await deliverAndAudit({
       repo,
       sink: callbackSink,
+      retry: callbackRetry,
       message: {
-        runId: run.id,
-        kind: "acknowledgement",
-        provider: parsed.event.callback.provider,
-        uri: parsed.event.callback.uri,
-        body: renderAcknowledgement(run.id),
-        ...parsed.event.callback.threadKey ? { threadKey: parsed.event.callback.threadKey } : {}
+        runId: resolved.resolved.proposal.runId,
+        kind: "final",
+        provider: parsed.callback.provider,
+        uri: parsed.callback.uri,
+        body,
+        ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
       }
     });
-    return c.json({ run }, 201);
+    return c.json({ outcome: "child_run_created", decision, plan: execution.plan, run: childRun }, 201);
+  });
+  app.get("/v1/follow-up-requests/:id", async (c) => {
+    const followUpRequest = await repo.getFollowUpRequest({ id: c.req.param("id") });
+    if (!followUpRequest) return c.json({ error: "follow_up_request_not_found" }, 404);
+    return c.json({ followUpRequest });
+  });
+  app.post("/v1/follow-up-requests/:id/create-run", async (c) => {
+    const parsed = PromoteFollowUpRequestSchema.parse(await c.req.json());
+    let promoted;
+    try {
+      promoted = await repo.createRunFromFollowUpRequest({
+        followUpRequestId: c.req.param("id"),
+        runId: parsed.runId
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.startsWith("Follow-up request not found:")) {
+        return c.json({ error: "follow_up_request_not_found" }, 404);
+      }
+      if (message.includes("is not queued")) {
+        return c.json({ error: "follow_up_request_not_queued" }, 409);
+      }
+      throw error;
+    }
+    const followUpRequest = promoted.followUpRequest;
+    const event = followUpRequest.event;
+    if (presentation.shouldDeliverAcknowledgement(event.callback.provider)) {
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId: promoted.run.id,
+          kind: "acknowledgement",
+          provider: event.callback.provider,
+          uri: event.callback.uri,
+          body: presentation.acknowledgement({ provider: event.callback.provider, runId: promoted.run.id }),
+          ...event.target.agentId ? { agentId: event.target.agentId } : {},
+          ...event.callback.threadKey ? { threadKey: event.callback.threadKey } : {}
+        }
+      });
+    }
+    return c.json({ followUpRequest, run: promoted.run }, 201);
   });
   app.post("/v1/runners/:runnerId/claim", async (c) => {
     const claimed = await repo.claimNextRun({ runnerId: c.req.param("runnerId"), leaseSeconds: 60 });
@@ -226,60 +1622,260 @@ function createDispatcherApp(input) {
     return c.json({ ok: true });
   });
   app.post("/v1/runs/:runId/running", async (c) => {
+    return c.json({
+      error: "runner_scoped_endpoint_required",
+      message: "Use /v1/runners/:runnerId/runs/:runId/running, /progress, or /complete."
+    }, 410);
+  });
+  app.post("/v1/runners/:runnerId/runs/:runId/running", async (c) => {
     const body = z.object({ executor: z.string().min(1) }).parse(await c.req.json());
-    await repo.markRunning({ runId: c.req.param("runId"), executor: body.executor });
+    const ok = await repo.markRunning({
+      runId: c.req.param("runId"),
+      runnerId: c.req.param("runnerId"),
+      executor: body.executor
+    });
+    if (!ok) return c.json({ error: "run_not_claimed_by_runner" }, 404);
     return c.json({ ok: true });
   });
-  app.post("/v1/runs/:runId/progress", async (c) => {
+  app.post("/v1/runs/:runId/progress", async () => {
+    return new Response(JSON.stringify({
+      error: "runner_scoped_endpoint_required",
+      message: "Use /v1/runners/:runnerId/runs/:runId/running, /progress, or /complete."
+    }), { status: 410, headers: { "content-type": "application/json" } });
+  });
+  app.post("/v1/runners/:runnerId/runs/:runId/progress", async (c) => {
     const runId = c.req.param("runId");
     const body = ProgressSchema.parse(await c.req.json());
-    const stored = await repo.getRun({ runId });
-    if (!stored) return c.json({ error: "run_not_found" }, 404);
-    await repo.recordProgress({
+    const ok = await repo.recordProgress({
       runId,
+      runnerId: c.req.param("runnerId"),
       message: body.message,
       ...body.type ? { type: body.type } : {},
-      ...body.at ? { at: body.at } : {}
-    });
-    await deliverAndAudit({
-      repo,
-      sink: callbackSink,
-      message: {
-        runId,
-        kind: "progress",
-        provider: stored.event.callback.provider,
-        uri: stored.event.callback.uri,
-        body: renderProgress({ runId, message: body.message }),
-        ...stored.event.callback.threadKey ? { threadKey: stored.event.callback.threadKey } : {}
-      }
+      ...body.at ? { at: body.at } : {},
+      ...body.visibility ? { visibility: body.visibility } : {},
+      ...body.importance ? { importance: body.importance } : {}
     });
+    if (!ok) return c.json({ error: "run_not_claimed_by_runner" }, 404);
+    const stored = await repo.getRun({ runId });
+    if (!stored) return c.json({ error: "run_not_found" }, 404);
+    if (presentation.shouldDeliverProgress(stored.event.callback.provider)) {
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId,
+          kind: "progress",
+          provider: stored.event.callback.provider,
+          uri: stored.event.callback.uri,
+          body: presentation.progress({ provider: stored.event.callback.provider, runId, message: body.message }),
+          ...stored.event.target.agentId ? { agentId: stored.event.target.agentId } : {},
+          ...stored.event.callback.threadKey ? { threadKey: stored.event.callback.threadKey } : {},
+          statusMessageKey: `${runId}:status`
+        }
+      });
+    }
     return c.json({ ok: true });
   });
-  app.post("/v1/runs/:runId/complete", async (c) => {
+  app.post("/v1/runs/:runId/complete", async () => {
+    return new Response(JSON.stringify({
+      error: "runner_scoped_endpoint_required",
+      message: "Use /v1/runners/:runnerId/runs/:runId/running, /progress, or /complete."
+    }), { status: 410, headers: { "content-type": "application/json" } });
+  });
+  app.post("/v1/runners/:runnerId/runs/:runId/complete", async (c) => {
     const runId = c.req.param("runId");
     const parsed = CompleteRunSchema.parse(await c.req.json());
+    const ok = await repo.completeRun({ runId, runnerId: c.req.param("runnerId"), result: parsed.result });
+    if (!ok) return c.json({ error: "run_not_claimed_by_runner" }, 404);
     const stored = await repo.getRun({ runId });
     if (!stored) return c.json({ error: "run_not_found" }, 404);
-    await repo.completeRun({ runId, result: parsed.result });
+    const finalPresentation = presentation.final({ provider: stored.event.callback.provider, result: parsed.result });
     await deliverAndAudit({
       repo,
       sink: callbackSink,
+      retry: callbackRetry,
       message: {
         runId,
         kind: "final",
         provider: stored.event.callback.provider,
         uri: stored.event.callback.uri,
-        body: renderFinalResult(parsed.result),
-        ...stored.event.callback.threadKey ? { threadKey: stored.event.callback.threadKey } : {}
+        body: finalPresentation.body,
+        ...stored.event.target.agentId ? { agentId: stored.event.target.agentId } : {},
+        ...stored.event.callback.threadKey ? { threadKey: stored.event.callback.threadKey } : {},
+        ...finalPresentation.blocks?.length ? { blocks: finalPresentation.blocks } : {}
       }
     });
     return c.json({ ok: true });
   });
+  app.get("/v1/proposals/:proposalId", async (c) => {
+    const proposal = await repo.getSuggestedChanges({ proposalId: c.req.param("proposalId") });
+    if (!proposal) return c.json({ error: "proposal_not_found" }, 404);
+    return c.json(proposal);
+  });
+  app.get("/v1/proposals/:proposalId/lineage", async (c) => {
+    const lineage = await repo.getProposalLineage({ proposalId: c.req.param("proposalId") });
+    if (!lineage) return c.json({ error: "proposal_not_found" }, 404);
+    return c.json({ lineage });
+  });
+  app.get("/v1/proposals/:proposalId/current-intents", async (c) => {
+    const intents = await repo.listCurrentMutationIntents({ proposalId: c.req.param("proposalId") });
+    if (!intents) return c.json({ error: "proposal_not_found" }, 404);
+    return c.json({ intents });
+  });
+  app.post("/v1/proposals/:proposalId/approvals", async (c) => {
+    const proposalId = c.req.param("proposalId");
+    const parsedBody = ApprovalDecisionInputSchema.safeParse(await c.req.json());
+    if (!parsedBody.success) return c.json({ error: "invalid_approval_decision" }, 400);
+    const body = parsedBody.data;
+    const decision = await repo.recordApprovalDecision({
+      id: body.id ?? `approval_${proposalId}_${Date.now()}`,
+      proposalId,
+      approvedIntentIds: body.approvedIntentIds,
+      ...body.rejectedIntentIds?.length ? { rejectedIntentIds: body.rejectedIntentIds } : {},
+      approvedBy: body.approvedBy,
+      approvedAt: body.approvedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      scope: body.scope,
+      ...body.reason ? { reason: body.reason } : {},
+      ...body.metadata ? { metadata: body.metadata } : {}
+    });
+    if (!decision) return c.json({ error: "proposal_not_found" }, 404);
+    return c.json({ decision }, 201);
+  });
+  app.get("/v1/approvals/:approvalDecisionId", async (c) => {
+    const decision = await repo.getApprovalDecision({ id: c.req.param("approvalDecisionId") });
+    if (!decision) return c.json({ error: "approval_decision_not_found" }, 404);
+    return c.json({ decision });
+  });
+  app.post("/v1/proposals/:proposalId/apply-plans", async (c) => {
+    const proposalId = c.req.param("proposalId");
+    const body = ApplyPlanInputSchema.parse(await c.req.json());
+    let executableTarget;
+    if (body.execute) {
+      if (body.adapter !== "github") {
+        return c.json({ error: "apply_execution_adapter_not_supported" }, 422);
+      }
+      if (!input.githubApply) {
+        return c.json({ error: "github_apply_not_configured" }, 422);
+      }
+      const proposal = await repo.getSuggestedChanges({ proposalId });
+      if (!proposal) return c.json({ error: "proposal_not_found" }, 404);
+      const stored = await repo.getRun({ runId: proposal.runId });
+      if (!stored) return c.json({ error: "run_not_found" }, 404);
+      const target = githubTargetFromEvent(stored.event);
+      if (!target) {
+        return c.json({ error: "github_target_missing" }, 422);
+      }
+      executableTarget = { proposal, target };
+    }
+    const applyPlanInput = {
+      id: body.id ?? `apply_${proposalId}_${Date.now()}`,
+      proposalId,
+      approvalDecisionId: body.approvalDecisionId,
+      ...body.selectedIntentIds !== void 0 ? { selectedIntentIds: body.selectedIntentIds } : {},
+      ...body.adapter ? { adapter: body.adapter } : {}
+    };
+    let plan;
+    if (body.execute) {
+      const planResult = await repo.createApplyPlanOnce(applyPlanInput);
+      if (!planResult) return c.json({ error: "proposal_or_approval_not_found" }, 404);
+      plan = planResult.plan;
+      if (!planResult.created) {
+        return c.json({ plan, alreadyPlanned: true }, 200);
+      }
+    } else {
+      const planResult = await repo.createApplyPlan(applyPlanInput);
+      if (!planResult) return c.json({ error: "proposal_or_approval_not_found" }, 404);
+      plan = planResult;
+    }
+    if (body.execute && executableTarget) {
+      const githubApply = input.githubApply;
+      if (!githubApply) {
+        return c.json({ error: "github_apply_not_configured" }, 422);
+      }
+      const preflightOutcomeByIntentId = new Map((plan.outcomes ?? []).map((outcome) => [outcome.intentId, outcome]));
+      const executableIntents = executableTarget.proposal.snapshot.intents.filter((intent) => {
+        const outcome = preflightOutcomeByIntentId.get(intent.intentId);
+        return outcome?.outcome === "skipped" && outcome.message?.startsWith("Preflight passed");
+      });
+      const target = {
+        token: githubApply.token,
+        owner: executableTarget.target.owner,
+        repo: executableTarget.target.repoName,
+        ...typeof executableTarget.target.issueNumber === "number" ? { issueNumber: executableTarget.target.issueNumber } : {},
+        ...executableTarget.target.pullRequestNumber ? { pullRequestNumber: executableTarget.target.pullRequestNumber } : {}
+      };
+      const executedOutcomes = [];
+      const compilerRegistry = createAdapterMutationCompilerRegistry([
+        createGitHubIssueMutationCompiler({
+          mappings: mappingsFromAdapterPlan(plan.adapterPlan),
+          ...executableTarget.target.targetKind ? { targetKind: executableTarget.target.targetKind } : {}
+        })
+      ]);
+      for (const compilation of compilerRegistry.compile("github", executableIntents)) {
+        if (!compilation.ok) {
+          executedOutcomes.push(compilation.outcome);
+          continue;
+        }
+        executedOutcomes.push(
+          await applyGitHubIssueMutationOperation({
+            target,
+            operation: compilation.operation,
+            ...githubApply.fetchImpl ? { fetchImpl: githubApply.fetchImpl } : {}
+          })
+        );
+      }
+      const executedOutcomeByIntentId = new Map(executedOutcomes.map((outcome) => [outcome.intentId, outcome]));
+      const mergedOutcomes = (plan.outcomes ?? []).map((outcome) => executedOutcomeByIntentId.get(outcome.intentId) ?? outcome);
+      const executedPlan = await repo.updateApplyPlanOutcomes({
+        id: plan.id,
+        outcomes: mergedOutcomes,
+        externalWritesExecuted: true
+      });
+      return c.json({ plan: executedPlan ?? plan }, 201);
+    }
+    return c.json({ plan }, 201);
+  });
+  app.get("/v1/apply-plans/:applyPlanId", async (c) => {
+    const plan = await repo.getApplyPlan({ id: c.req.param("applyPlanId") });
+    if (!plan) return c.json({ error: "apply_plan_not_found" }, 404);
+    return c.json({ plan });
+  });
+  app.post("/v1/runs/:runId/child-runs", async (c) => {
+    const parentRunId = c.req.param("runId");
+    const body = ChildRunInputSchema.parse(await c.req.json());
+    const parent = await repo.getRun({ runId: parentRunId });
+    if (!parent) return c.json({ error: "parent_run_not_found" }, 404);
+    const receivedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const sourceProposalId = body.sourceProposalId ?? body.action.targetId;
+    const { run } = await repo.createRun({
+      id: body.runId,
+      event: childEventFromParent({
+        parentEvent: parent.event,
+        childRunId: body.runId,
+        ...body.commandText ? { commandText: body.commandText } : {},
+        actionKind: body.action.kind,
+        receivedAt
+      }),
+      parentRunId,
+      triggeredByAction: body.action,
+      ...sourceProposalId ? { sourceProposalId } : {},
+      ...body.sourceApplyPlanId ? { sourceApplyPlanId: body.sourceApplyPlanId } : {}
+    });
+    return c.json({ run }, 201);
+  });
   app.get("/v1/runs/:runId", async (c) => {
     const stored = await repo.getRun({ runId: c.req.param("runId") });
     if (!stored) return c.json({ error: "run_not_found" }, 404);
     return c.json(stored);
   });
+  app.get("/v1/runs/:runId/metrics", async (c) => {
+    const runId = c.req.param("runId");
+    const stored = await repo.getRun({ runId });
+    if (!stored) return c.json({ error: "run_not_found" }, 404);
+    const metrics = await repo.getRunMetrics({ runId });
+    return c.json({ metrics });
+  });
   app.get("/v1/runs/:runId/events", async (c) => {
     const events = await repo.listRunEvents({ runId: c.req.param("runId") });
     return c.json({ events });
@@ -288,8 +1884,12 @@ function createDispatcherApp(input) {
 }
 export {
   createCompositeCallbackSink,
+  createDefaultCallbackPresentation,
   createDispatcherApp,
   createGitHubCallbackSink,
-  createSlackCallbackSink
+  createLarkCallbackSink,
+  createSlackCallbackSink,
+  createTelegramCallbackSink,
+  processPendingCallbacks
 };
 //# sourceMappingURL=index.js.map