@opentag/dispatcher 0.2.0 → 0.3.1

package/dist/index.js

@@ -1,7 +1,20 @@
 // src/callbacks.ts
-import { createLarkReplyClient, parseLarkThreadKey, replyLarkMessage } from "@opentag/lark";
-import { createSlackPostMessagePayload, createSlackUpdateMessagePayload, parseSlackThreadKey } from "@opentag/slack";
+import {
+  createLarkReplyClient,
+  patchLarkMessageCard,
+  parseLarkThreadKey,
+  replyLarkMessage,
+  updateLarkTextMessage
+} from "@opentag/lark";
+import {
+  createSlackPostMessagePayload,
+  createSlackReactionPayload,
+  createSlackUpdateMessagePayload,
+  parseSlackThreadKey,
+  slackSourceReceiptReactionName
+} from "@opentag/slack";
 import { createTelegramSendMessageDraftPayload, createTelegramSendMessagePayload, parseTelegramThreadKey } from "@opentag/telegram";
+var DEFAULT_SLACK_SOURCE_RECEIPT_TIMEOUT_MS = 5e3;
 function slackUpdateUriFrom(postMessageUri) {
   return postMessageUri.replace(/\/chat\.postMessage$/, "/chat.update");
 }
@@ -18,6 +31,31 @@ function slackBotTokenFor(input) {
   }
   return input.botToken;
 }
+function metadataString(metadata, key) {
+  const value = metadata[key];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function slackSourceMessageTarget(receipt) {
+  if (receipt.provider !== "slack") return null;
+  const channelId = metadataString(receipt.event.metadata, "channelId");
+  const messageTs = metadataString(receipt.event.metadata, "messageTs");
+  return channelId && messageTs ? { channelId, messageTs } : null;
+}
+function isAbortError(error) {
+  return error instanceof Error && error.name === "AbortError";
+}
+async function fetchWithTimeout(input) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), input.timeoutMs);
+  try {
+    return await input.fetchImpl(input.uri, { ...input.init, signal: controller.signal });
+  } catch (error) {
+    if (isAbortError(error)) return null;
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function createGitHubCallbackSink(input) {
   const fetchImpl = input.fetchImpl ?? fetch;
   const commentUriByKey = /* @__PURE__ */ new Map();
@@ -70,9 +108,9 @@ function createSlackCallbackSink(input) {
     async deliver(message) {
       if (message.provider !== "slack") return;
       const botToken = slackBotTokenFor({
-        ...input.botToken ? { botToken: input.botToken } : {},
-        ...input.botTokensByAgentId ? { botTokensByAgentId: input.botTokensByAgentId } : {},
-        ...message.agentId ? { agentId: message.agentId } : {}
+        botToken: input.botToken,
+        botTokensByAgentId: input.botTokensByAgentId,
+        agentId: message.agentId
       });
       if (!botToken) return;
       const thread = parseSlackThreadKey(message.threadKey ?? "");
@@ -117,6 +155,51 @@ function createSlackCallbackSink(input) {
     }
   };
 }
+function createSlackSourceReceiptSink(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const reactionsAddUri = input.reactionsAddUri ?? "https://slack.com/api/reactions.add";
+  const timeoutMs = input.timeoutMs ?? DEFAULT_SLACK_SOURCE_RECEIPT_TIMEOUT_MS;
+  return {
+    async deliver(receipt) {
+      const target = slackSourceMessageTarget(receipt);
+      if (!target) return { delivered: false };
+      const botToken = slackBotTokenFor({
+        botToken: input.botToken,
+        botTokensByAgentId: input.botTokensByAgentId,
+        agentId: receipt.agentId
+      });
+      if (!botToken) return { delivered: false };
+      const response = await fetchWithTimeout({
+        fetchImpl,
+        uri: reactionsAddUri,
+        timeoutMs,
+        init: {
+          method: "POST",
+          headers: {
+            authorization: `Bearer ${botToken}`,
+            "content-type": "application/json"
+          },
+          body: JSON.stringify(
+            createSlackReactionPayload({
+              channelId: target.channelId,
+              messageTs: target.messageTs,
+              name: slackSourceReceiptReactionName(receipt.state)
+            })
+          )
+        }
+      });
+      if (!response) return { delivered: false };
+      if (!response.ok) {
+        throw new Error(`deliver Slack source receipt failed: ${response.status} ${await response.text()}`);
+      }
+      const body = await response.json().catch(() => ({}));
+      if (body?.ok === false && body.error !== "already_reacted") {
+        throw new Error(`deliver Slack source receipt failed: ${body?.error ?? "unknown_error"}`);
+      }
+      return { delivered: true };
+    }
+  };
+}
 function createLarkCallbackSink(input) {
   if (!input.client && Boolean(input.appId) !== Boolean(input.appSecret)) {
     throw new Error("Lark callback sink requires both appId and appSecret (or neither).");
@@ -131,8 +214,27 @@ function createLarkCallbackSink(input) {
       if (!message.threadKey) {
         throw new Error("Lark callback message is missing threadKey.");
       }
+      if (message.externalMessageId) {
+        if (message.rich?.provider === "lark") {
+          await patchLarkMessageCard(client, {
+            messageId: message.externalMessageId,
+            card: message.rich.payload
+          });
+        } else {
+          await updateLarkTextMessage(client, {
+            messageId: message.externalMessageId,
+            text: message.body
+          });
+        }
+        return { externalMessageId: message.externalMessageId };
+      }
       const { messageId } = parseLarkThreadKey(message.threadKey);
-      await replyLarkMessage(client, { messageId, text: message.body });
+      const reply = await replyLarkMessage(client, {
+        messageId,
+        text: message.body,
+        ...message.rich?.provider === "lark" ? { card: message.rich.payload } : {}
+      });
+      return reply.messageId ? { externalMessageId: reply.messageId } : void 0;
     }
   };
 }
@@ -144,9 +246,9 @@ function createTelegramCallbackSink(input) {
     async deliver(message) {
       if (message.provider !== "telegram") return;
       const botToken = slackBotTokenFor({
-        ...input.botToken ? { botToken: input.botToken } : {},
-        ...input.botTokensByAgentId ? { botTokensByAgentId: input.botTokensByAgentId } : {},
-        ...message.agentId ? { agentId: message.agentId } : {}
+        botToken: input.botToken,
+        botTokensByAgentId: input.botTokensByAgentId,
+        agentId: message.agentId
       });
       if (!botToken) return;
       const thread = parseTelegramThreadKey(message.threadKey ?? "");
@@ -191,70 +293,282 @@ function createTelegramCallbackSink(input) {
 function createCompositeCallbackSink(sinks) {
   return {
     async deliver(message) {
+      let result;
+      let delivered = false;
+      const failures = [];
       for (const sink of sinks) {
-        await sink.deliver(message);
+        try {
+          const deliveredResult = await sink.deliver(message);
+          delivered = true;
+          if (deliveredResult?.externalMessageId && !result?.externalMessageId) {
+            result = { externalMessageId: deliveredResult.externalMessageId };
+          }
+        } catch (error) {
+          failures.push(error);
+        }
+      }
+      if (!delivered && failures.length > 0) {
+        throw new AggregateError(failures, "Composite callback delivery failed for every sink.");
       }
+      return result;
     }
   };
 }
 
 // src/presentation.ts
-import { renderAcknowledgement, renderFinalResult, renderProgress } from "@opentag/github";
-import { renderLarkAcknowledgement, renderLarkFinalResult } from "@opentag/lark";
-import { createSlackFinalResultBlocks, renderSlackAcknowledgement, renderSlackFinalResult } from "@opentag/slack";
-import { renderTelegramAcknowledgement, renderTelegramFinalResult, renderTelegramProgress } from "@opentag/telegram";
+import {
+  createFinalSummaryPresentation,
+  createRunStatusPresentation,
+  platformCapabilityForProvider,
+  renderOpenTagPresentationPlainText,
+  shouldDeliverCallbackProgress,
+  shouldDeliverCallbackRunStatus
+} from "@opentag/core";
+import { renderAcknowledgement, renderFinalSummaryPresentation, renderProgress } from "@opentag/github";
+import {
+  createLarkActionReceiptCard,
+  createLarkDoctorSummaryCard,
+  createLarkFinalSummaryCard,
+  createLarkRunStatusCard,
+  createLarkSourceThreadStatusCard,
+  renderLarkActionReceiptPresentation,
+  renderLarkFinalSummaryPresentation,
+  renderLarkRunStatusPresentation
+} from "@opentag/lark";
+import {
+  createSlackActionReceiptBlocks,
+  createSlackDoctorSummaryBlocks,
+  createSlackFinalSummaryBlocks,
+  createSlackSourceThreadStatusBlocks,
+  renderSlackActionReceiptPresentation,
+  renderSlackAcknowledgement,
+  renderSlackFinalSummaryPresentation
+} from "@opentag/slack";
+import { renderTelegramAcknowledgement, renderTelegramFinalSummaryPresentation, renderTelegramProgress } from "@opentag/telegram";
+function renderRunStatus(provider, presentation) {
+  const canRenderRich = supportsRichPresentation(provider);
+  if (canRenderRich && provider === "lark") {
+    return {
+      body: renderLarkRunStatusPresentation(presentation),
+      rich: {
+        provider: "lark",
+        payload: createLarkRunStatusCard(presentation)
+      }
+    };
+  }
+  if (presentation.state === "received") {
+    if (provider === "slack") {
+      return { body: renderSlackAcknowledgement(presentation.runId) };
+    }
+    if (provider === "telegram") {
+      return { body: renderTelegramAcknowledgement(presentation.runId) };
+    }
+    return { body: renderAcknowledgement(presentation.runId) };
+  }
+  const message = presentation.message ?? presentation.nextAction ?? presentation.state;
+  if (provider === "telegram") {
+    return { body: renderTelegramProgress(message) };
+  }
+  return { body: renderProgress({ runId: presentation.runId, message }) };
+}
+function supportsRichPresentation(provider) {
+  return platformCapabilityForProvider(provider)?.supportsRichPresentation === true;
+}
+function renderFinalSummary(provider, presentation) {
+  const canRenderRich = supportsRichPresentation(provider);
+  if (canRenderRich && provider === "slack") {
+    return {
+      body: renderSlackFinalSummaryPresentation(presentation),
+      blocks: createSlackFinalSummaryBlocks(presentation)
+    };
+  }
+  if (canRenderRich && provider === "lark") {
+    return {
+      body: renderLarkFinalSummaryPresentation(presentation),
+      rich: {
+        provider: "lark",
+        payload: createLarkFinalSummaryCard(presentation)
+      }
+    };
+  }
+  if (provider === "telegram") {
+    return { body: renderTelegramFinalSummaryPresentation(presentation) };
+  }
+  return { body: renderFinalSummaryPresentation(presentation) };
+}
+function renderDoctorSummary(provider, presentation) {
+  const body = renderOpenTagPresentationPlainText(presentation);
+  const canRenderRich = supportsRichPresentation(provider);
+  if (canRenderRich && provider === "slack") {
+    return {
+      body,
+      blocks: createSlackDoctorSummaryBlocks(presentation)
+    };
+  }
+  if (canRenderRich && provider === "lark") {
+    return {
+      body,
+      rich: {
+        provider: "lark",
+        payload: createLarkDoctorSummaryCard(presentation)
+      }
+    };
+  }
+  return { body };
+}
+function renderSourceThreadStatus(provider, presentation) {
+  const body = renderOpenTagPresentationPlainText(presentation);
+  const canRenderRich = supportsRichPresentation(provider);
+  if (canRenderRich && provider === "slack") {
+    return {
+      body,
+      blocks: createSlackSourceThreadStatusBlocks(presentation)
+    };
+  }
+  if (canRenderRich && provider === "lark") {
+    return {
+      body,
+      rich: {
+        provider: "lark",
+        payload: createLarkSourceThreadStatusCard(presentation)
+      }
+    };
+  }
+  return { body };
+}
+function renderActionReceipt(provider, presentation) {
+  const body = provider === "slack" ? renderSlackActionReceiptPresentation(presentation) : provider === "lark" ? renderLarkActionReceiptPresentation(presentation) : renderOpenTagPresentationPlainText(presentation);
+  const canRenderRich = supportsRichPresentation(provider);
+  if (canRenderRich && provider === "slack") {
+    return {
+      body,
+      blocks: createSlackActionReceiptBlocks(presentation)
+    };
+  }
+  if (canRenderRich && provider === "lark") {
+    return {
+      body,
+      rich: {
+        provider: "lark",
+        payload: createLarkActionReceiptCard(presentation)
+      }
+    };
+  }
+  return { body };
+}
 function createDefaultCallbackPresentation() {
   return {
     shouldDeliverAcknowledgement(provider) {
-      return provider !== "lark";
+      return shouldDeliverCallbackRunStatus(provider);
+    },
+    shouldDeliverStatusUpdate(provider) {
+      return shouldDeliverCallbackRunStatus(provider);
+    },
+    shouldDeliverRunStatusUpdate(input) {
+      if (input.provider === "lark" && input.state === "running") return false;
+      return this.shouldDeliverStatusUpdate(input.provider);
     },
     shouldDeliverProgress(provider) {
-      return provider !== "slack" && provider !== "lark";
+      return shouldDeliverCallbackProgress(provider);
     },
-    acknowledgement(input) {
-      if (input.provider === "slack") {
-        return renderSlackAcknowledgement(input.runId);
+    runStatusPresentation(input) {
+      return createRunStatusPresentation({
+        runId: input.runId,
+        state: input.state,
+        ...input.message ? { message: input.message } : {},
+        ...input.nextAction ? { nextAction: input.nextAction } : {},
+        ...input.detailVisibility ? { detailVisibility: input.detailVisibility } : {}
+      });
+    },
+    acknowledgementPresentation(input) {
+      return this.runStatusPresentation({
+        runId: input.runId,
+        state: "received",
+        detailVisibility: "source_thread"
+      });
+    },
+    progressPresentation(input) {
+      return this.runStatusPresentation({
+        runId: input.runId,
+        state: "running",
+        message: input.message,
+        detailVisibility: "audit"
+      });
+    },
+    finalPresentation(input) {
+      return createFinalSummaryPresentation({
+        result: input.result,
+        ...input.receiptContext ? { receiptContext: input.receiptContext } : {},
+        ...input.runId ? { auditRunId: input.runId } : {}
+      });
+    },
+    render(input) {
+      if (input.presentation.kind === "run_status") {
+        return renderRunStatus(input.provider, input.presentation);
+      }
+      if (input.presentation.kind === "final_summary") {
+        return renderFinalSummary(input.provider, input.presentation);
+      }
+      if (input.presentation.kind === "doctor_summary") {
+        return renderDoctorSummary(input.provider, input.presentation);
       }
-      if (input.provider === "lark") {
-        return renderLarkAcknowledgement(input.runId);
+      if (input.presentation.kind === "source_thread_status") {
+        return renderSourceThreadStatus(input.provider, input.presentation);
       }
-      if (input.provider === "telegram") {
-        return renderTelegramAcknowledgement(input.runId);
+      if (input.presentation.kind === "action_receipt") {
+        return renderActionReceipt(input.provider, input.presentation);
       }
-      return renderAcknowledgement(input.runId);
+      return {
+        body: renderOpenTagPresentationPlainText(input.presentation)
+      };
+    },
+    acknowledgement(input) {
+      return this.render({ provider: input.provider, presentation: this.acknowledgementPresentation({ runId: input.runId }) }).body;
+    },
+    runStatus(input) {
+      return this.render({
+        provider: input.provider,
+        presentation: this.runStatusPresentation({
+          runId: input.runId,
+          state: input.state,
+          ...input.message ? { message: input.message } : {},
+          ...input.nextAction ? { nextAction: input.nextAction } : {},
+          ...input.detailVisibility ? { detailVisibility: input.detailVisibility } : {}
+        })
+      });
     },
     progress(input) {
-      if (input.provider === "telegram") {
-        return renderTelegramProgress(input.message);
-      }
-      return renderProgress({ runId: input.runId, message: input.message });
+      return this.runStatus({
+        provider: input.provider,
+        runId: input.runId,
+        state: "running",
+        message: input.message,
+        detailVisibility: "audit"
+      }).body;
     },
     final(input) {
-      if (input.provider === "slack") {
-        return {
-          body: renderSlackFinalResult(input.result),
-          blocks: createSlackFinalResultBlocks(input.result)
-        };
-      }
-      if (input.provider === "lark") {
-        return { body: renderLarkFinalResult(input.result) };
-      }
-      if (input.provider === "telegram") {
-        return { body: renderTelegramFinalResult(input.result) };
-      }
-      return { body: renderFinalResult(input.result) };
+      return this.render({
+        provider: input.provider,
+        presentation: this.finalPresentation({
+          result: input.result,
+          ...input.runId ? { runId: input.runId } : {},
+          ...input.receiptContext ? { receiptContext: input.receiptContext } : {}
+        })
+      });
     }
   };
 }
 
 // src/server.ts
-import { createHash } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import {
   AdapterMutationMappingSchema,
   ActorIdentitySchema,
   ActionHintSchema,
+  capabilityForMutationIntent,
   conversationKeysFromEvent as conversationKeysFromEvent2,
   parseThreadActionCommand,
+  permissionScopesAllowCapability,
   projectTargetRefFromEvent as projectTargetRefFromEvent2,
   suggestedActionCandidatesFromSnapshots,
   createAdapterMutationCompilerRegistry,
@@ -262,7 +576,12 @@ import {
   OpenTagRunResultSchema,
   PolicyRuleSchema,
   RunEventImportanceSchema,
-  RunEventVisibilitySchema
+  RunEventVisibilitySchema,
+  DEFAULT_MAX_REQUEST_BODY_BYTES,
+  RequestBodyTooLargeError,
+  platformCapabilityForProvider as platformCapabilityForProvider2,
+  readRequestTextWithLimit,
+  shouldDeliverSourceReceipt
 } from "@opentag/core";
 import {
   applyGitHubIssueMutationOperation,
@@ -272,6 +591,7 @@ import { createOpenTagRepository, migrateSchema } from "@opentag/store";
 import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 
 // src/admission.ts
@@ -416,6 +736,144 @@ function createAdmissionRuntime(input) {
 }
 
 // src/server.ts
+var RequestBodyRejectedError = class extends Error {
+  reason;
+  publicError;
+  constructor(input) {
+    super(input.reason);
+    this.name = "RequestBodyRejectedError";
+    this.reason = input.reason;
+    this.publicError = input.publicError ?? input.reason;
+  }
+};
+function requestBodyTooLarge(c, maxBytes) {
+  return new HTTPException(413, {
+    res: c.json({ error: "request_body_too_large", maxBytes }, 413)
+  });
+}
+async function parseBody(c, schema, options = {}) {
+  let json;
+  try {
+    const rawBody = await readRequestTextWithLimit(c.req.raw, { maxBytes: options.maxBytes ?? DEFAULT_MAX_REQUEST_BODY_BYTES });
+    json = JSON.parse(rawBody);
+  } catch (err) {
+    if (err instanceof RequestBodyTooLargeError) throw requestBodyTooLarge(c, err.maxBytes);
+    if (err instanceof HTTPException) throw err;
+    if (err instanceof SyntaxError) {
+      throw new HTTPException(400, {
+        res: c.json({ error: "invalid_json_body" }, 400),
+        cause: new RequestBodyRejectedError({ reason: "invalid_json_body" })
+      });
+    }
+    throw err;
+  }
+  const result = schema.safeParse(json);
+  if (!result.success) {
+    const publicError = options.invalidBodyError ?? "invalid_request_body";
+    throw new HTTPException(400, {
+      res: c.json({ error: publicError, issues: result.error.issues }, 400),
+      cause: new RequestBodyRejectedError({ reason: "invalid_request_body", publicError })
+    });
+  }
+  return result.data;
+}
+function normalizeRateLimitedEndpoint(method, path) {
+  return `${method.toUpperCase()} ${path}`.replace(/^([A-Z]+) \/v1\/runners\/[^/]+\/runs\/[^/]+/, "$1 /v1/runners/:runnerId/runs/:runId").replace(/^([A-Z]+) \/v1\/runners\/[^/]+/, "$1 /v1/runners/:runnerId").replace(/^([A-Z]+) \/v1\/repo-bindings\/[^/]+\/[^/]+\/[^/]+/, "$1 /v1/repo-bindings/:provider/:owner/:repo").replace(/^([A-Z]+) \/v1\/channel-bindings\/[^/]+\/[^/]+\/[^/]+/, "$1 /v1/channel-bindings/:provider/:accountId/:conversationId").replace(/^([A-Z]+) \/v1\/slack-channel-bindings\/[^/]+\/[^/]+/, "$1 /v1/slack-channel-bindings/:teamId/:channelId").replace(/^([A-Z]+) \/v1\/follow-up-requests\/[^/]+/, "$1 /v1/follow-up-requests/:id").replace(/^([A-Z]+) \/v1\/proposals\/[^/]+/, "$1 /v1/proposals/:proposalId").replace(/^([A-Z]+) \/v1\/approvals\/[^/]+/, "$1 /v1/approvals/:approvalDecisionId").replace(/^([A-Z]+) \/v1\/apply-plans\/[^/]+/, "$1 /v1/apply-plans/:applyPlanId").replace(/^([A-Z]+) \/v1\/runs\/[^/]+/, "$1 /v1/runs/:runId");
+}
+function rateLimitRunnerId(path) {
+  return path.match(/^\/v1\/runners\/([^/]+)/)?.[1] ?? "none";
+}
+function rateLimitSourcePlatform(path) {
+  const channelProvider = path.match(/^\/v1\/channel-bindings\/([^/]+)/)?.[1];
+  if (channelProvider) return channelProvider;
+  const repoProvider = path.match(/^\/v1\/repo-bindings\/([^/]+)/)?.[1];
+  if (repoProvider) return repoProvider;
+  if (path.startsWith("/v1/slack-channel-bindings/")) return "slack";
+  return "unknown";
+}
+function safeDecodeRateLimitSegment(value) {
+  if (!value) return void 0;
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function rateLimitTenant(path) {
+  const channel = path.match(/^\/v1\/channel-bindings\/([^/]+)\/([^/]+)/);
+  if (channel) {
+    const provider = safeDecodeRateLimitSegment(channel[1]) ?? "unknown";
+    const accountId = safeDecodeRateLimitSegment(channel[2]) ?? "unknown";
+    return `${provider}:${accountId}`;
+  }
+  const legacySlack = path.match(/^\/v1\/slack-channel-bindings\/([^/]+)/);
+  if (legacySlack) return `slack:${safeDecodeRateLimitSegment(legacySlack[1]) ?? "unknown"}`;
+  const repo = path.match(/^\/v1\/repo-bindings\/([^/]+)\/([^/]+)/);
+  if (repo) {
+    const provider = safeDecodeRateLimitSegment(repo[1]) ?? "unknown";
+    const owner = safeDecodeRateLimitSegment(repo[2]) ?? "unknown";
+    return `${provider}:${owner}`;
+  }
+  return "unknown";
+}
+function rateLimitTokenFingerprint(authorization) {
+  if (!authorization) return "none";
+  return createHash("sha256").update(authorization).digest("hex").slice(0, 16);
+}
+function rawTokenFingerprint(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function rateLimitKey(c) {
+  const path = new URL(c.req.url).pathname;
+  return [
+    `token=${rateLimitTokenFingerprint(c.req.raw.headers.get("authorization"))}`,
+    `runner=${rateLimitRunnerId(path)}`,
+    `source=${rateLimitSourcePlatform(path)}`,
+    `tenant=${rateLimitTenant(path)}`,
+    `endpoint=${normalizeRateLimitedEndpoint(c.req.method, path)}`
+  ].join("|");
+}
+function createDispatcherRateLimitMiddleware(options) {
+  if (!Number.isFinite(options.windowMs) || options.windowMs <= 0) {
+    throw new Error("rateLimit.windowMs must be a positive number.");
+  }
+  if (!Number.isFinite(options.maxRequests) || options.maxRequests <= 0) {
+    throw new Error("rateLimit.maxRequests must be a positive number.");
+  }
+  const buckets = /* @__PURE__ */ new Map();
+  const now = options.now ?? (() => Date.now());
+  return async (c, next) => {
+    const currentTime = now();
+    for (const [bucketKey, bucket2] of buckets) {
+      if (bucket2.resetAt <= currentTime) buckets.delete(bucketKey);
+    }
+    const key = rateLimitKey(c);
+    const existing = buckets.get(key);
+    const bucket = existing && existing.resetAt > currentTime ? existing : { count: 0, resetAt: currentTime + options.windowMs };
+    if (bucket.count >= options.maxRequests) {
+      const retryAfterMs = Math.max(0, bucket.resetAt - currentTime);
+      c.header("retry-after", String(Math.ceil(retryAfterMs / 1e3)));
+      return c.json(
+        {
+          error: "rate_limited",
+          retryAfterMs,
+          maxRequests: options.maxRequests,
+          windowMs: options.windowMs
+        },
+        429
+      );
+    }
+    bucket.count += 1;
+    buckets.set(key, bucket);
+    await next();
+  };
+}
+function shouldDeliverRunStatusUpdate(presentation, input) {
+  return presentation.shouldDeliverRunStatusUpdate?.(input) ?? presentation.shouldDeliverStatusUpdate(input.provider);
+}
+function larkLifecycleStatusMessageKey(input) {
+  return input.provider === "lark" ? `${input.runId}:status` : void 0;
+}
 var CreateRunnerSchema = z.object({
   runnerId: z.string().min(1),
   name: z.string().min(1)
@@ -455,11 +913,32 @@ var CreateRunSchema = z.object({
   runId: z.string().min(1),
   event: OpenTagEventSchema
 });
+var RecordControlPlaneEventSchema = z.object({
+  type: z.string().min(1),
+  severity: z.enum(["info", "warn", "error"]).optional(),
+  subject: z.string().min(1).optional(),
+  payload: z.record(z.string(), z.unknown()).optional(),
+  createdAt: z.string().datetime().optional()
+});
+var PruneSourceDeliveriesSchema = z.object({
+  olderThan: z.string().datetime(),
+  limit: z.number().int().positive().max(1e5).optional()
+});
 var PromoteFollowUpRequestSchema = z.object({
   runId: z.string().min(1)
 });
 var CompleteRunSchema = z.object({
-  result: OpenTagRunResultSchema
+  result: OpenTagRunResultSchema,
+  idempotencyKey: z.string().min(1).max(256).optional()
+});
+var MarkRunningSchema = z.object({
+  executor: z.string().min(1),
+  runTimeoutMs: z.number().int().positive().optional(),
+  idempotencyKey: z.string().min(1).max(256).optional()
+});
+var CancelRunSchema = z.object({
+  reason: z.string().min(1).optional(),
+  requestedBy: z.string().min(1).optional()
 });
 var ApprovalDecisionInputSchema = z.object({
   id: z.string().min(1).optional(),
@@ -501,13 +980,38 @@ var ChildRunInputSchema = z.object({
   sourceProposalId: z.string().min(1).optional(),
   sourceApplyPlanId: z.string().min(1).optional()
 });
+var CHILD_EVENT_METADATA_REPLAY_KEYS = [
+  "sourceDeliveryId",
+  "webhookDeliveryId",
+  "deliveryId",
+  "githubDeliveryId",
+  "githubDeliveryGuid",
+  "slackEventId",
+  "larkEventId",
+  "signatureState",
+  "signatureVerified",
+  "verifiedSignature",
+  "webhookSignatureVerified",
+  "githubSignatureVerified"
+];
 var ProgressSchema = z.object({
   type: z.string().min(1).optional(),
   message: z.string().min(1),
   at: z.string().datetime().optional(),
   visibility: RunEventVisibilitySchema.optional(),
-  importance: RunEventImportanceSchema.optional()
+  importance: RunEventImportanceSchema.optional(),
+  idempotencyKey: z.string().min(1).max(256).optional()
 });
+function childEventMetadata(parentMetadata, metadata) {
+  const sanitized = { ...parentMetadata };
+  for (const key of CHILD_EVENT_METADATA_REPLAY_KEYS) {
+    delete sanitized[key];
+  }
+  return {
+    ...sanitized,
+    ...metadata ?? {}
+  };
+}
 function childEventFromParent(input) {
   return {
     ...input.parentEvent,
@@ -523,10 +1027,8 @@ function childEventFromParent(input) {
         actionKind: input.actionKind
       }
     },
-    metadata: {
-      ...input.parentEvent.metadata,
-      ...input.metadata ?? {}
-    }
+    metadata: childEventMetadata(input.parentEvent.metadata, input.metadata),
+    permissions: input.permissions ?? input.parentEvent.permissions
   };
 }
 function mappingsFromAdapterPlan(adapterPlan) {
@@ -544,13 +1046,35 @@ function metadataIssueNumber(metadata) {
   if (typeof value === "string" && /^[1-9]\d*$/.test(value)) return value;
   return void 0;
 }
-function metadataString(metadata, key) {
+function metadataString2(metadata, key) {
   const value = metadata?.[key];
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+function sourceContainerMetadata(input) {
+  if (input.provider === "lark") {
+    return { tenantKey: input.accountId, chatId: input.conversationId };
+  }
+  if (input.provider === "slack") {
+    return { teamId: input.accountId, channelId: input.conversationId };
+  }
+  if (input.provider === "telegram") {
+    return { botId: input.accountId, chatId: input.conversationId };
+  }
+  return { accountId: input.accountId, conversationId: input.conversationId };
+}
+function latestRunTimeoutMs(events) {
+  for (const event of [...events].reverse()) {
+    if (event.type !== "run.running" || !event.payload || typeof event.payload !== "object") continue;
+    const runTimeoutMs = event.payload.runTimeoutMs;
+    if (typeof runTimeoutMs === "number" && Number.isInteger(runTimeoutMs) && runTimeoutMs > 0) {
+      return runTimeoutMs;
+    }
+  }
+  return void 0;
+}
 function githubIssueWorkItemExternalId(metadata) {
-  const owner = metadataString(metadata, "owner");
-  const repo = metadataString(metadata, "repo");
+  const owner = metadataString2(metadata, "owner");
+  const repo = metadataString2(metadata, "repo");
   const issueNumber = metadataIssueNumber(metadata);
   if (!owner || !repo || !issueNumber) return void 0;
   return `${owner}/${repo}#${issueNumber}`;
@@ -662,6 +1186,30 @@ async function resolveThreadAction(input) {
   });
   const primaryConversationKey = conversationKeys[0];
   const targetWorkItemExternalId = githubIssueWorkItemExternalId(input.metadata);
+  const metadataProposalId = metadataString2(input.metadata, "proposalId");
+  const metadataIntentId = metadataString2(input.metadata, "intentId");
+  if (metadataProposalId && (input.command.selection.kind === "index" || input.command.selection.kind === "latest")) {
+    const stored = await input.repo.getSuggestedChanges({ proposalId: metadataProposalId });
+    if (!stored) {
+      return { ok: false, reason: "no_proposal", message: `I could not find proposal \`${metadataProposalId}\`.` };
+    }
+    const claimed = await input.repo.getRun({ runId: stored.runId });
+    if (!claimed) {
+      return { ok: false, reason: "no_proposal", message: "I found the proposal but not its source run." };
+    }
+    const proposalConversationKeys = conversationKeysFromEvent2(claimed.event);
+    if (!proposalConversationKeys.some((key) => conversationKeys.includes(key))) {
+      return { ok: false, reason: "no_match", runId: stored.runId, message: "That proposal does not belong to this source thread." };
+    }
+    const proposal = { runId: stored.runId, run: claimed.run, event: claimed.event, snapshot: stored.snapshot };
+    if (targetWorkItemExternalId && !proposalMatchesWorkItem(proposal, targetWorkItemExternalId)) {
+      return { ok: false, reason: "no_match", runId: stored.runId, message: "That proposal does not belong to this source thread." };
+    }
+    return resolveCandidateSelection({
+      command: metadataIntentId ? { ...input.command, selection: { kind: "intent", intentId: metadataIntentId } } : { ...input.command, selection: { kind: "proposal", proposalId: metadataProposalId } },
+      proposals: [proposal]
+    });
+  }
   if (input.command.selection.kind === "proposal") {
     const stored = await input.repo.getSuggestedChanges({ proposalId: input.command.selection.proposalId });
     if (!stored) {
@@ -707,6 +1255,240 @@ function isRepoLevelGitHubIntent(intent) {
 function adapterForAction(input) {
   return hasGitHubRepoTarget(input.event) && (hasGitHubIssueOrPullTarget(input.event) || input.selectedIntents.length > 0 && input.selectedIntents.every((intent) => isRepoLevelGitHubIntent(intent))) ? "github" : input.callbackProvider;
 }
+function executorConditionsFromIntent(intent) {
+  const value = intent.params?.["executorConditions"];
+  if (!Array.isArray(value)) return [];
+  return value.filter((condition) => typeof condition === "string" && condition.length > 0);
+}
+var GITHUB_PREFLIGHT_TIMEOUT_MS = 5e3;
+function githubPreflightCacheKey(input) {
+  return `${input.owner}/${input.repo}${input.path}`;
+}
+function createGitHubPreflightDeadline(timeoutMs) {
+  if (typeof AbortController === "undefined") return { clear: () => {
+  }, didTimeout: () => false };
+  const controller = new AbortController();
+  let didTimeout = false;
+  const timeout = setTimeout(() => {
+    didTimeout = true;
+    controller.abort();
+  }, timeoutMs);
+  return {
+    signal: controller.signal,
+    clear: () => clearTimeout(timeout),
+    didTimeout: () => didTimeout
+  };
+}
+async function githubPreflight(input) {
+  if (input.cache) {
+    const cacheKey = githubPreflightCacheKey(input);
+    const cached = input.cache.get(cacheKey);
+    if (cached) return await cached;
+    const pending = githubPreflightUncached(input);
+    input.cache.set(cacheKey, pending);
+    return await pending;
+  }
+  return await githubPreflightUncached(input);
+}
+async function githubPreflightUncached(input) {
+  let response;
+  const deadline = createGitHubPreflightDeadline(GITHUB_PREFLIGHT_TIMEOUT_MS);
+  try {
+    response = await (input.githubApply.fetchImpl ?? fetch)(`https://api.github.com/repos/${input.owner}/${input.repo}${input.path}`, {
+      method: "GET",
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${input.githubApply.token}`,
+        "x-github-api-version": "2022-11-28"
+      },
+      ...deadline.signal ? { signal: deadline.signal } : {}
+    });
+  } catch (error) {
+    if (deadline.didTimeout()) {
+      return {
+        state: "needs_setup",
+        setupReason: `GitHub preflight timed out for ${input.description} after ${GITHUB_PREFLIGHT_TIMEOUT_MS}ms.`
+      };
+    }
+    return {
+      state: "needs_setup",
+      setupReason: `GitHub preflight failed for ${input.description}: ${error instanceof Error ? error.message : String(error)}.`
+    };
+  } finally {
+    deadline.clear();
+  }
+  if (response.ok) return null;
+  if (response.status === 401 || response.status === 403) {
+    return {
+      state: "needs_setup",
+      setupReason: `GitHub apply token cannot access ${input.description}. Check repository permissions and token scopes.`
+    };
+  }
+  if (response.status === 404) {
+    return {
+      state: "needs_setup",
+      setupReason: input.notFoundReason
+    };
+  }
+  return {
+    state: "needs_setup",
+    setupReason: `GitHub preflight failed for ${input.description}: HTTP ${response.status}.`
+  };
+}
+async function preflightGitHubOperation(input) {
+  const base = {
+    githubApply: input.githubApply,
+    owner: input.target.owner,
+    repo: input.target.repoName,
+    ...input.preflightCache ? { cache: input.preflightCache } : {}
+  };
+  if (input.operation.kind === "create_pull_request") {
+    const head = encodeURIComponent(input.operation.head);
+    const baseBranch = encodeURIComponent(input.operation.base);
+    const [headPreflight, basePreflight] = await Promise.all([
+      githubPreflight({
+        ...base,
+        path: `/branches/${head}`,
+        description: `GitHub branch ${input.operation.head}`,
+        notFoundReason: `GitHub branch ${input.operation.head} was not found.`
+      }),
+      githubPreflight({
+        ...base,
+        path: `/branches/${baseBranch}`,
+        description: `GitHub base branch ${input.operation.base}`,
+        notFoundReason: `GitHub base branch ${input.operation.base} was not found.`
+      })
+    ]);
+    return headPreflight ?? basePreflight;
+  }
+  if (input.operation.kind === "request_review") {
+    if (typeof input.target.pullRequestNumber !== "number") {
+      return {
+        state: "needs_setup",
+        setupReason: "The source thread does not include a GitHub pull request target."
+      };
+    }
+    return await githubPreflight({
+      ...base,
+      path: `/pulls/${input.target.pullRequestNumber}`,
+      description: `GitHub pull request #${input.target.pullRequestNumber}`,
+      notFoundReason: `GitHub pull request #${input.target.pullRequestNumber} was not found.`
+    });
+  }
+  if (typeof input.target.issueNumber !== "number") {
+    return {
+      state: "needs_setup",
+      setupReason: "The source thread does not include a GitHub issue or pull request target."
+    };
+  }
+  return await githubPreflight({
+    ...base,
+    path: `/issues/${input.target.issueNumber}`,
+    description: `GitHub issue or pull request #${input.target.issueNumber}`,
+    notFoundReason: `GitHub issue or pull request #${input.target.issueNumber} was not found.`
+  });
+}
+async function directApplyReceiptCapability(input) {
+  const capability = capabilityForMutationIntent(input.intent);
+  if (!capability) {
+    return {
+      state: "unsupported",
+      setupReason: `No source-thread apply capability is registered for ${input.intent.action}.`
+    };
+  }
+  if (capability.capabilityClass !== "external_write") {
+    return {
+      state: "unsupported",
+      setupReason: "This action is audit-only for now; continue if a follow-up run should handle it."
+    };
+  }
+  const adapter = adapterForAction({
+    event: input.event,
+    callbackProvider: input.callbackProvider,
+    selectedIntents: [input.intent]
+  });
+  if (adapter !== "github") {
+    return {
+      state: "needs_setup",
+      setupReason: `Direct apply for ${adapter} actions is not configured on this dispatcher.`
+    };
+  }
+  if (!input.githubApply) {
+    return {
+      state: "needs_setup",
+      setupReason: "GitHub apply is not configured on this dispatcher."
+    };
+  }
+  if (!hasGitHubRepoTarget(input.event)) {
+    return {
+      state: "needs_setup",
+      setupReason: "The source thread does not include a GitHub repository target."
+    };
+  }
+  if (!isRepoLevelGitHubIntent(input.intent) && !hasGitHubIssueOrPullTarget(input.event)) {
+    return {
+      state: "needs_setup",
+      setupReason: "The source thread does not include a GitHub issue or pull request target."
+    };
+  }
+  if (!permissionScopesAllowCapability(input.event.permissions ?? [], capability)) {
+    return {
+      state: "needs_setup",
+      setupReason: `Missing platform permission for ${capability.id}.`
+    };
+  }
+  const missingExecutorConditions = (capability.requiredExecutorConditions ?? []).filter(
+    (condition) => !executorConditionsFromIntent(input.intent).includes(condition)
+  );
+  if (missingExecutorConditions.length > 0) {
+    return {
+      state: "needs_setup",
+      setupReason: `Missing executor condition: ${missingExecutorConditions.join(", ")}.`
+    };
+  }
+  const githubTarget = githubTargetFromEvent(input.event);
+  if (!githubTarget) {
+    return {
+      state: "needs_setup",
+      setupReason: "The source thread does not include a GitHub repository target."
+    };
+  }
+  const compilation = createGitHubIssueMutationCompiler({
+    ...githubTarget?.targetKind ? { targetKind: githubTarget.targetKind } : {}
+  }).compile(input.intent);
+  if (!compilation.ok) {
+    return {
+      state: compilation.outcome.outcome === "unsupported" ? "unsupported" : "needs_setup",
+      setupReason: compilation.outcome.message ?? "GitHub cannot apply this action from the current source thread."
+    };
+  }
+  const preflight = await preflightGitHubOperation({
+    githubApply: input.githubApply,
+    target: githubTarget,
+    operation: compilation.operation,
+    ...input.preflightCache ? { preflightCache: input.preflightCache } : {}
+  });
+  if (preflight) return preflight;
+  return { state: "ready_to_apply" };
+}
+async function actionReceiptContextForFinal(input) {
+  const preflightCache = /* @__PURE__ */ new Map();
+  const capabilityEntries = await Promise.all(
+    (input.result.suggestedChanges ?? []).flatMap(
+      (snapshot) => snapshot.intents.map(async (intent) => {
+        const capability = await directApplyReceiptCapability({
+          event: input.event,
+          callbackProvider: input.event.callback.provider,
+          intent,
+          ...input.githubApply ? { githubApply: input.githubApply } : {},
+          preflightCache
+        });
+        return [intent.intentId, capability];
+      })
+    )
+  );
+  return { capabilityByIntentId: Object.fromEntries(capabilityEntries) };
+}
 async function authorizeThreadAction(input) {
   const repoKey = projectTargetRefFromEvent2(input.resolved.proposal.event);
   if (!repoKey) {
@@ -789,6 +1571,13 @@ function selectedIntentsAlreadyApplied(input) {
     (intentId) => input.plan.outcomes?.some((outcome) => outcome.intentId === intentId && outcome.outcome === "applied")
   );
 }
+function selectedPlanOutcomes(input) {
+  return (input.plan.outcomes ?? []).filter((outcome) => input.selectedIntentIds.includes(outcome.intentId));
+}
+function selectedIntentsHaveStaleOutcome(input) {
+  const outcomes = selectedPlanOutcomes(input);
+  return outcomes.some((outcome) => outcome.outcome === "stale") && outcomes.every((outcome) => outcome.outcome !== "applied");
+}
 function githubTargetFromEvent(event) {
   const owner = event.metadata["owner"];
   const repoName = event.metadata["repo"];
@@ -807,30 +1596,124 @@ function githubTargetFromEvent(event) {
 function selectedActionSummary(candidates) {
   return candidates.map((candidate) => `${candidate.index}. ${candidate.intent.summary}`).join("; ");
 }
-function childRunContextLines(input) {
-  const previousSummary = input.resolved.proposal.run.result?.summary ?? input.resolved.proposal.snapshot.summary;
-  return [
-    `- Proposal: \`${input.resolved.proposal.snapshot.proposalId}\``,
-    `- Selected intents: ${input.resolved.selectedIntentIds.map((intentId) => `\`${intentId}\``).join(", ")}`,
-    `- Previous run: \`${input.resolved.proposal.runId}\``,
-    ...input.approvalDecisionId ? [`- Approval decision: \`${input.approvalDecisionId}\``] : [],
-    `- Previous result: ${previousSummary}`,
-    ...input.sourceApplyPlanId ? [`- Apply plan: \`${input.sourceApplyPlanId}\``] : [],
-    ...input.fallbackReason ? [`- Fallback reason: ${input.fallbackReason}`] : []
-  ];
+function selectedActionReceiptTitle(selectionText) {
+  return selectionText.split(";").map((part) => part.trim().replace(/^\d+\.\s*/, "")).filter(Boolean).join("; ");
+}
+function sentenceWithTerminalPunctuation(value) {
+  return /[.!?。！？]$/u.test(value) ? value : `${value}.`;
+}
+function addPermissionGrant(permissions, grant) {
+  if (permissions.some((permission) => permission.scope === grant.scope)) return permissions;
+  return [...permissions, grant];
+}
+function childRunPermissionsForThreadAction(input) {
+  let permissions = [...input.resolved.proposal.event.permissions ?? []];
+  if (input.command.verb === "apply" || input.command.verb === "continue") {
+    permissions = addPermissionGrant(permissions, {
+      scope: "repo:read",
+      reason: "inspect the repository while continuing an approved source-thread action"
+    });
+    permissions = addPermissionGrant(permissions, {
+      scope: "repo:write",
+      reason: "apply an approved source-thread mutation on a run branch"
+    });
+  }
+  if (input.resolved.selectedCandidates.some((candidate) => candidate.intent.action === "create_pull_request")) {
+    permissions = addPermissionGrant(permissions, {
+      scope: "pr:create",
+      reason: "create the pull request approved in the source thread"
+    });
+  }
+  return permissions;
 }
 function renderChildRunCreatedBody(input) {
+  const title = selectedActionReceiptTitle(input.selectionText ?? selectedActionSummary(input.resolved.selectedCandidates));
+  if (input.provider === "slack") {
+    return [
+      input.lead,
+      `Action: ${title}`,
+      ...input.fallbackReason ? [`Reason: ${input.fallbackReason}`] : []
+    ].join("\n");
+  }
   return [
     input.lead,
     "",
-    `Child run: \`${input.childRun.id}\``,
+    `Action: ${title}`,
     "",
-    "Context carried into the child run:",
-    ...childRunContextLines(input),
+    `Child run: \`${input.childRun.id}\``,
     "",
-    "The model will continue from this approved proposal instead of starting from a fresh mention."
+    ...input.fallbackReason ? [`Reason: ${input.fallbackReason}`, ""] : [],
+    `Audit: run \`opentag status --run ${input.childRun.id}\` locally.`
   ].join("\n");
 }
+function applyOutcomeSummary(outcome) {
+  if (outcome.externalUri) return `${outcome.outcome}: ${outcome.externalUri}`;
+  if (outcome.message) return `${outcome.outcome}: ${outcome.message}`;
+  return `${outcome.outcome}.`;
+}
+function applyOutcomeReceiptLines(outcomes) {
+  if (outcomes.length === 0) return ["Result: applied."];
+  if (outcomes.length === 1) {
+    const outcome = outcomes[0];
+    if (outcome.externalUri) return [`Result: ${outcome.externalUri}`];
+    if (outcome.message) return [`Result: ${outcome.outcome}. ${outcome.message}`];
+    return [`Result: ${outcome.outcome}.`];
+  }
+  return ["Results:", ...outcomes.map((outcome) => `- ${applyOutcomeSummary(outcome)}`)];
+}
+function renderAppliedThreadActionBody(input) {
+  const selectedOutcomes = input.outcomes.filter((outcome) => input.selectedIntentIds.includes(outcome.intentId));
+  return [`Applied: ${sentenceWithTerminalPunctuation(selectedActionReceiptTitle(input.selectionText))}`, ...applyOutcomeReceiptLines(selectedOutcomes)].join("\n");
+}
+function renderAlreadyAppliedThreadActionBody(input) {
+  return [`Already applied: ${sentenceWithTerminalPunctuation(selectedActionReceiptTitle(input.selectionText))}`, "No external write was repeated."].join("\n");
+}
+function renderAlreadyPlannedThreadActionBody(input) {
+  return [`Already planned: ${sentenceWithTerminalPunctuation(selectedActionReceiptTitle(input.selectionText))}`, "OpenTag did not execute this repeated reply."].join("\n");
+}
+function renderStaleThreadActionBody(input) {
+  return [
+    `Stale: ${sentenceWithTerminalPunctuation(selectedActionReceiptTitle(input.selectionText))}`,
+    "The target changed since this action was proposed.",
+    `Reply \`continue ${input.continueIndex}\` to refresh from the current thread state.`
+  ].join("\n");
+}
+function renderThreadActionRecordedBody(input) {
+  const title = selectedActionReceiptTitle(input.selectionText);
+  if (input.verb === "approve") {
+    const index = input.applyIndex ?? 1;
+    const nextLines = input.directApply?.ready ? [`Next: reply \`apply ${index}\` to write it to the system of record, or \`continue ${index}\` to continue in OpenTag.`] : [
+      ...input.directApply?.reason ? [`Direct apply is not available yet: ${sentenceWithTerminalPunctuation(input.directApply.reason)}`] : ["Direct apply is not available yet."],
+      `Next: reply \`continue ${index}\` to continue in OpenTag.`
+    ];
+    return [
+      `Approved only: ${sentenceWithTerminalPunctuation(title)}`,
+      "No external write was performed.",
+      ...nextLines
+    ].join("\n");
+  }
+  return [`Rejected: ${sentenceWithTerminalPunctuation(title)}`, "No external write will be performed for this action."].join("\n");
+}
+async function selectedDirectApplyStatus(input) {
+  if (input.candidates.length === 0) return { ready: false, reason: "No selected action was found." };
+  const preflightCache = /* @__PURE__ */ new Map();
+  for (const candidate of input.candidates) {
+    const capability = await directApplyReceiptCapability({
+      event: input.event,
+      callbackProvider: input.callbackProvider,
+      intent: candidate.intent,
+      ...input.githubApply ? { githubApply: input.githubApply } : {},
+      preflightCache
+    });
+    if (capability.state !== "ready_to_apply") {
+      return {
+        ready: false,
+        reason: capability.setupReason ?? `Receipt state is ${capability.state}.`
+      };
+    }
+  }
+  return { ready: true };
+}
 function actionContextPointer(input) {
   const lines = [
     "OpenTag thread action continuation.",
@@ -895,7 +1778,8 @@ async function createChildRunForThreadAction(input) {
         ...input.approvalDecisionId ? { approvalDecisionId: input.approvalDecisionId } : {},
         ...input.sourceApplyPlanId ? { sourceApplyPlanId: input.sourceApplyPlanId } : {},
         ...input.fallbackReason ? { fallbackReason: input.fallbackReason } : {}
-      }
+      },
+      permissions: childRunPermissionsForThreadAction({ resolved: input.resolved, command: input.command })
     }),
     parentRunId: input.resolved.proposal.runId,
     triggeredByAction: action,
@@ -972,6 +1856,11 @@ var noopCallbackSink = {
     return;
   }
 };
+var noopSourceReceiptSink = {
+  async deliver() {
+    return { delivered: false };
+  }
+};
 function nextCallbackAttemptAt(input) {
   const maxAttempts = input.maxAttempts ?? 5;
   const nextAttempt = input.attempts + 1;
@@ -983,7 +1872,13 @@ function nextCallbackAttemptAt(input) {
 }
 async function deliverCallbackDelivery(input) {
   try {
-    await input.sink.deliver({
+    const externalMessageId = input.delivery.externalMessageId ?? (input.delivery.statusMessageKey ? await input.repo.findCallbackExternalMessageId({
+      runId: input.delivery.runId,
+      provider: input.delivery.provider,
+      ...input.delivery.threadKey ? { threadKey: input.delivery.threadKey } : {},
+      statusMessageKey: input.delivery.statusMessageKey
+    }) : void 0);
+    const deliveryResult = await input.sink.deliver({
       runId: input.delivery.runId,
       kind: input.delivery.kind,
       provider: input.delivery.provider,
@@ -992,15 +1887,23 @@ async function deliverCallbackDelivery(input) {
       ...input.delivery.threadKey ? { threadKey: input.delivery.threadKey } : {},
       ...input.delivery.agentId ? { agentId: input.delivery.agentId } : {},
       ...input.delivery.statusMessageKey ? { statusMessageKey: input.delivery.statusMessageKey } : {},
-      ...input.delivery.blocks ? { blocks: input.delivery.blocks } : {}
+      ...externalMessageId ? { externalMessageId } : {},
+      ...input.delivery.blocks ? { blocks: input.delivery.blocks } : {},
+      ...input.delivery.rich ? { rich: input.delivery.rich } : {}
+    });
+    const deliveredExternalMessageId = deliveryResult?.externalMessageId ?? externalMessageId;
+    await input.repo.markCallbackDelivered({
+      deliveryId: input.delivery.id,
+      ...deliveredExternalMessageId ? { externalMessageId: deliveredExternalMessageId } : {}
     });
-    await input.repo.markCallbackDelivered({ deliveryId: input.delivery.id });
     return true;
   } catch (error) {
+    const maxAttempts = input.retry?.maxAttempts ?? 5;
     const nextAttemptAt = nextCallbackAttemptAt({ attempts: input.delivery.attempts, ...input.retry ?? {} });
     await input.repo.markCallbackFailed({
       deliveryId: input.delivery.id,
       error: error instanceof Error ? error.message : String(error),
+      maxAttempts,
       ...nextAttemptAt ? { nextAttemptAt } : {}
     });
     return false;
@@ -1040,7 +1943,8 @@ async function deliverAndAudit(input) {
     ...input.message.threadKey ? { threadKey: input.message.threadKey } : {},
     ...input.message.agentId ? { agentId: input.message.agentId } : {},
     ...input.message.statusMessageKey ? { statusMessageKey: input.message.statusMessageKey } : {},
-    ...input.message.blocks ? { blocks: input.message.blocks } : {}
+    ...input.message.blocks ? { blocks: input.message.blocks } : {},
+    ...input.message.rich ? { rich: input.message.rich } : {}
   });
   await deliverCallbackDelivery({
     repo: input.repo,
@@ -1049,9 +1953,113 @@ async function deliverAndAudit(input) {
     ...input.retry ? { retry: input.retry } : {}
   });
 }
-function isAuthorized(request, pairingToken) {
-  if (!pairingToken) return true;
-  return request.headers.get("authorization") === `Bearer ${pairingToken}`;
+async function deliverSourceReceiptBestEffort(input) {
+  try {
+    const result = await input.sink.deliver(input.receipt);
+    if (!result.delivered) return result;
+    await input.repo.appendRunEvent({
+      runId: input.receipt.runId,
+      type: "source_receipt.delivered",
+      payload: {
+        provider: input.receipt.provider,
+        state: input.receipt.state
+      },
+      visibility: "audit",
+      importance: "low",
+      message: `Source ${input.receipt.state} receipt delivered.`
+    });
+    return result;
+  } catch (error) {
+    await input.repo.appendRunEvent({
+      runId: input.receipt.runId,
+      type: "source_receipt.failed",
+      payload: {
+        provider: input.receipt.provider,
+        state: input.receipt.state,
+        error: error instanceof Error ? error.message : String(error)
+      },
+      visibility: "audit",
+      importance: "low",
+      message: `Source ${input.receipt.state} receipt failed.`
+    });
+    return { delivered: false };
+  }
+}
+function isRunnerRuntimeEndpoint(method, path) {
+  if (method !== "POST") return false;
+  if (/^\/v1\/runners\/[^/]+\/claim$/.test(path)) return true;
+  if (/^\/v1\/runners\/[^/]+\/runs\/[^/]+\/(running|heartbeat|progress|complete)$/.test(path)) return true;
+  return /^\/v1\/runs\/[^/]+\/(running|progress|complete)$/.test(path);
+}
+function isRunnerOperatorEndpoint(method, path) {
+  if (method === "GET") {
+    if (path === "/v1/control-plane-alerts") return true;
+    if (/^\/v1\/runners\/[^/]+$/.test(path)) return true;
+    if (/^\/v1\/repo-bindings\/[^/]+\/[^/]+\/[^/]+$/.test(path)) return true;
+    if (/^\/v1\/channel-bindings\/[^/]+\/[^/]+\/[^/]+(?:\/status)?$/.test(path)) return true;
+    return /^\/v1\/runs\/[^/]+(?:\/events|\/metrics)?$/.test(path);
+  }
+  if (method !== "POST") return false;
+  if (path === "/v1/source-deliveries/prune") return true;
+  if (/^\/v1\/runs\/[^/]+\/cancel$/.test(path)) return true;
+  return /^\/v1\/channel-bindings\/[^/]+\/[^/]+\/[^/]+\/cancel-active-run$/.test(path);
+}
+function dispatcherAuthScope(request) {
+  const path = new URL(request.url).pathname;
+  const method = request.method.toUpperCase();
+  if (isRunnerRuntimeEndpoint(method, path)) return "runner_runtime";
+  if (isRunnerOperatorEndpoint(method, path)) return "runner_operator";
+  return "pairing";
+}
+function authMatches(request, token) {
+  return Boolean(token) && request.headers.get("authorization") === `Bearer ${token}`;
+}
+function bearerToken(request) {
+  const authorization = request.headers.get("authorization");
+  if (!authorization?.startsWith("Bearer ")) return void 0;
+  return authorization.slice("Bearer ".length);
+}
+function configuredRunnerTokens(input) {
+  return [...new Set([input.runnerToken, ...input.runnerTokens ?? []].map((token) => token?.trim()).filter((token) => Boolean(token)))];
+}
+function normalizeRevokedRunnerTokenFingerprints(fingerprints) {
+  return new Set((fingerprints ?? []).map((fingerprint) => fingerprint.trim().toLowerCase()).filter(Boolean));
+}
+function authMatchesAny(request, tokens) {
+  return tokens.some((token) => authMatches(request, token));
+}
+function requestUsesRevokedRunnerToken(input) {
+  const token = bearerToken(input.request);
+  if (!token) return false;
+  return input.revokedRunnerTokenFingerprints.has(rawTokenFingerprint(token).toLowerCase());
+}
+function revokedRunnerTokenResult() {
+  return {
+    ok: false,
+    reason: "runner_token_revoked",
+    message: "Runner token has been revoked or expired. Pair again or update daemon.runnerToken before retrying."
+  };
+}
+function authorizeDispatcherRequest(input) {
+  if (!input.pairingToken && input.runnerTokens.length === 0) return { ok: true };
+  const revokedRunnerToken = requestUsesRevokedRunnerToken({
+    request: input.request,
+    revokedRunnerTokenFingerprints: input.revokedRunnerTokenFingerprints
+  });
+  if (revokedRunnerToken) return revokedRunnerTokenResult();
+  const scope = dispatcherAuthScope(input.request);
+  const pairingMatches = authMatches(input.request, input.pairingToken);
+  const runnerMatches = authMatchesAny(input.request, input.runnerTokens);
+  if (scope === "pairing") {
+    return pairingMatches ? { ok: true } : { ok: false, reason: "invalid_pairing_token" };
+  }
+  if (scope === "runner_runtime") {
+    if (input.runnerTokens.length > 0) {
+      return runnerMatches ? { ok: true } : { ok: false, reason: "invalid_runner_token" };
+    }
+    return pairingMatches ? { ok: true } : { ok: false, reason: "invalid_pairing_token" };
+  }
+  return runnerMatches || pairingMatches ? { ok: true } : { ok: false, reason: "invalid_dispatcher_token" };
 }
 function createDispatcherApp(input) {
   const sqlite = new Database(input.databasePath);
@@ -1059,22 +2067,237 @@ function createDispatcherApp(input) {
   const repo = createOpenTagRepository(drizzle(sqlite));
   const app = new Hono();
   const callbackSink = input.callbackSink ?? noopCallbackSink;
+  const sourceReceiptSink = input.sourceReceiptSink ?? noopSourceReceiptSink;
   const presentation = input.presentation ?? createDefaultCallbackPresentation();
   const callbackRetry = input.callbackRetry ?? {};
+  const maxRequestBodyBytes = input.maxRequestBodyBytes ?? DEFAULT_MAX_REQUEST_BODY_BYTES;
+  const runnerTokens = configuredRunnerTokens(input);
+  const revokedRunnerTokenFingerprints = normalizeRevokedRunnerTokenFingerprints(input.revokedRunnerTokenFingerprints);
+  const requestEndpoint = (c) => normalizeRateLimitedEndpoint(c.req.method, new URL(c.req.url).pathname);
+  const recordControlPlaneEvent = async (input2) => {
+    await repo.appendControlPlaneEvent({
+      type: input2.type,
+      ...input2.severity ? { severity: input2.severity } : {},
+      ...input2.subject ? { subject: input2.subject } : {},
+      ...input2.payload ? { payload: input2.payload } : {},
+      ...input2.createdAt ? { createdAt: input2.createdAt } : {}
+    });
+  };
+  const parseDispatcherBody = async (c, schema, options = {}) => {
+    try {
+      return await parseBody(c, schema, { maxBytes: maxRequestBodyBytes, ...options });
+    } catch (err) {
+      if (err instanceof HTTPException && err.status === 413) {
+        await recordControlPlaneEvent({
+          type: "security.request_body_rejected",
+          severity: "warn",
+          subject: requestEndpoint(c),
+          payload: {
+            reason: "request_body_too_large",
+            endpoint: requestEndpoint(c),
+            maxBytes: maxRequestBodyBytes,
+            contentLength: c.req.raw.headers.get("content-length") ?? null
+          }
+        });
+      }
+      if (err instanceof HTTPException && err.status === 400 && err.cause instanceof RequestBodyRejectedError) {
+        await recordControlPlaneEvent({
+          type: "security.request_body_rejected",
+          severity: "warn",
+          subject: requestEndpoint(c),
+          payload: {
+            reason: err.cause.reason,
+            error: err.cause.publicError,
+            endpoint: requestEndpoint(c),
+            contentLength: c.req.raw.headers.get("content-length") ?? null
+          }
+        });
+      }
+      throw err;
+    }
+  };
+  const appendSuppressedRunStatusCallback = async (input2) => {
+    const capability = platformCapabilityForProvider2(input2.provider);
+    await repo.appendRunEvent({
+      runId: input2.runId,
+      type: "callback.progress.suppressed",
+      payload: {
+        provider: input2.provider,
+        reason: "platform_liveness_strategy",
+        requestedStatus: input2.state,
+        livenessStrategy: capability?.livenessStrategy ?? "unknown"
+      },
+      visibility: "audit",
+      importance: "low",
+      message: "Run status callback suppressed by platform liveness strategy; use status or audit for details."
+    });
+  };
+  async function deliverPromotedFollowUpAcknowledgement(input2) {
+    if (!presentation.shouldDeliverAcknowledgement(input2.event.callback.provider)) return;
+    const acknowledgementPresentation = presentation.acknowledgementPresentation({ runId: input2.run.id });
+    const acknowledgement = presentation.render({
+      provider: input2.event.callback.provider,
+      presentation: acknowledgementPresentation
+    });
+    const statusMessageKey = larkLifecycleStatusMessageKey({ provider: input2.event.callback.provider, runId: input2.run.id });
+    await deliverAndAudit({
+      repo,
+      sink: callbackSink,
+      retry: callbackRetry,
+      message: {
+        runId: input2.run.id,
+        kind: "acknowledgement",
+        provider: input2.event.callback.provider,
+        uri: input2.event.callback.uri,
+        body: acknowledgement.body,
+        ...input2.event.target.agentId ? { agentId: input2.event.target.agentId } : {},
+        ...input2.event.callback.threadKey ? { threadKey: input2.event.callback.threadKey } : {},
+        ...statusMessageKey ? { statusMessageKey } : {},
+        ...acknowledgement.blocks?.length ? { blocks: acknowledgement.blocks } : {},
+        ...acknowledgement.rich ? { rich: acknowledgement.rich } : {}
+      }
+    });
+  }
+  async function promoteFollowUpRequest(input2) {
+    const promoted = await repo.createRunFromFollowUpRequest(input2);
+    await deliverPromotedFollowUpAcknowledgement({
+      run: promoted.run,
+      event: promoted.followUpRequest.event
+    });
+    return promoted;
+  }
+  async function promoteNextFollowUpAfterTerminalRun(input2) {
+    const [next] = await repo.listQueuedFollowUpsForActiveRun({ activeRunId: input2.activeRunId });
+    if (!next) return null;
+    try {
+      const promoted = await promoteFollowUpRequest({
+        followUpRequestId: next.id,
+        runId: `run_${randomUUID()}`
+      });
+      await repo.appendRunEvent({
+        runId: input2.activeRunId,
+        type: "follow_up_request.auto_promoted",
+        payload: {
+          followUpRequestId: promoted.followUpRequest.id,
+          createdRunId: promoted.run.id
+        },
+        visibility: "audit",
+        importance: "normal",
+        message: `Promoted queued follow-up ${promoted.followUpRequest.id} into run ${promoted.run.id}.`
+      });
+      return promoted;
+    } catch (error) {
+      await repo.appendRunEvent({
+        runId: input2.activeRunId,
+        type: "follow_up_request.auto_promote_failed",
+        payload: {
+          followUpRequestId: next.id,
+          error: error instanceof Error ? error.message : String(error)
+        },
+        visibility: "audit",
+        importance: "high",
+        message: `Could not auto-promote queued follow-up ${next.id}.`
+      });
+      return null;
+    }
+  }
   const admission = createAdmissionRuntime({
     repo,
     ...input.agentAccessProfileCheck ? { agentAccessProfileCheck: input.agentAccessProfileCheck } : {}
   });
   app.get("/healthz", (c) => c.json({ ok: true }));
+  if (input.rateLimit) {
+    app.use("/v1/*", createDispatcherRateLimitMiddleware(input.rateLimit));
+  }
   app.use("/v1/*", async (c, next) => {
-    if (!isAuthorized(c.req.raw, input.pairingToken)) {
-      return c.json({ error: "unauthorized" }, 401);
+    const authorization = authorizeDispatcherRequest({
+      request: c.req.raw,
+      pairingToken: input.pairingToken,
+      runnerTokens,
+      revokedRunnerTokenFingerprints
+    });
+    if (!authorization.ok) {
+      await recordControlPlaneEvent({
+        type: "security.auth_failed",
+        severity: "warn",
+        subject: requestEndpoint(c),
+        payload: {
+          reason: authorization.reason,
+          endpoint: requestEndpoint(c),
+          hasAuthorization: Boolean(c.req.raw.headers.get("authorization")),
+          tokenFingerprint: rateLimitTokenFingerprint(c.req.raw.headers.get("authorization"))
+        }
+      });
+      return c.json(
+        {
+          error: "unauthorized",
+          reason: authorization.reason,
+          ...authorization.message ? { message: authorization.message } : {}
+        },
+        401
+      );
     }
     await next();
   });
+  app.get("/v1/control-plane-events", async (c) => {
+    const limitValue = Number(c.req.query("limit") ?? 100);
+    const limit = Number.isFinite(limitValue) ? Math.max(1, Math.min(500, Math.floor(limitValue))) : 100;
+    const eventQuery = { limit };
+    const type = c.req.query("type");
+    const severity = c.req.query("severity");
+    if (type) eventQuery.type = type;
+    if (severity === "info" || severity === "warn" || severity === "error") eventQuery.severity = severity;
+    const events = await repo.listControlPlaneEvents(eventQuery);
+    return c.json({ events });
+  });
+  app.post("/v1/control-plane-events", async (c) => {
+    const parsed = await parseDispatcherBody(c, RecordControlPlaneEventSchema);
+    await recordControlPlaneEvent(parsed);
+    return c.json({ ok: true }, 201);
+  });
+  app.get("/v1/control-plane-alerts", async (c) => {
+    const limitValue = Number(c.req.query("limit") ?? 5e3);
+    const limit = Number.isFinite(limitValue) ? Math.max(1, Math.min(1e4, Math.floor(limitValue))) : 5e3;
+    const since = c.req.query("since");
+    const alerts = await repo.summarizeControlPlaneAlerts({
+      limit,
+      ...since ? { since } : {}
+    });
+    return c.json({ alerts });
+  });
+  app.post("/v1/source-deliveries/prune", async (c) => {
+    const parsed = await parseDispatcherBody(c, PruneSourceDeliveriesSchema);
+    const pruneInput = {
+      olderThan: parsed.olderThan,
+      ...parsed.limit !== void 0 ? { limit: parsed.limit } : {}
+    };
+    const result = await repo.pruneSourceDeliveries(pruneInput);
+    await recordControlPlaneEvent({
+      type: "maintenance.source_deliveries_pruned",
+      severity: "info",
+      subject: "source_deliveries",
+      payload: {
+        olderThan: parsed.olderThan,
+        limit: parsed.limit ?? null,
+        scanned: result.scanned,
+        pruned: result.pruned,
+        retainedActive: result.retainedActive
+      }
+    });
+    return c.json({ result });
+  });
   app.post("/v1/runners", async (c) => {
-    const parsed = CreateRunnerSchema.parse(await c.req.json());
+    const parsed = await parseDispatcherBody(c, CreateRunnerSchema);
     await repo.registerRunner(parsed);
+    await recordControlPlaneEvent({
+      type: "runner.registered",
+      severity: "info",
+      subject: parsed.runnerId,
+      payload: {
+        runnerId: parsed.runnerId,
+        name: parsed.name
+      }
+    });
     return c.json({ ok: true }, 201);
   });
   app.get("/v1/runners/:runnerId", async (c) => {
@@ -1083,7 +2306,7 @@ function createDispatcherApp(input) {
     return c.json({ runner });
   });
   app.post("/v1/repo-bindings", async (c) => {
-    const parsed = CreateRepoBindingSchema.parse(await c.req.json());
+    const parsed = await parseDispatcherBody(c, CreateRepoBindingSchema);
     await repo.createRepoBinding({
       provider: parsed.provider,
       owner: parsed.owner,
@@ -1093,6 +2316,20 @@ function createDispatcherApp(input) {
       ...parsed.defaultExecutor ? { defaultExecutor: parsed.defaultExecutor } : {},
       ...parsed.allowedActors?.length ? { allowedActors: parsed.allowedActors } : {}
     });
+    await recordControlPlaneEvent({
+      type: "binding.repository.upserted",
+      severity: "info",
+      subject: `${parsed.provider}:${parsed.owner}/${parsed.repo}`,
+      payload: {
+        provider: parsed.provider,
+        owner: parsed.owner,
+        repo: parsed.repo,
+        runnerId: parsed.runnerId,
+        hasWorkspacePath: Boolean(parsed.workspacePath),
+        ...parsed.defaultExecutor ? { defaultExecutor: parsed.defaultExecutor } : {},
+        allowedActorsCount: parsed.allowedActors?.length ?? 0
+      }
+    });
     return c.json({ ok: true }, 201);
   });
   app.get("/v1/repo-bindings/:provider/:owner/:repo", async (c) => {
@@ -1105,13 +2342,32 @@ function createDispatcherApp(input) {
     return c.json({ binding });
   });
   app.post("/v1/repo-bindings/:provider/:owner/:repo/policy-rules", async (c) => {
-    const parsed = UpsertPolicyRuleSchema.parse(await c.req.json());
+    const parsed = await parseDispatcherBody(c, UpsertPolicyRuleSchema);
+    const provider = c.req.param("provider");
+    const owner = c.req.param("owner");
+    const repoName = c.req.param("repo");
     const rule = await repo.upsertRepoPolicyRule({
-      provider: c.req.param("provider"),
-      owner: c.req.param("owner"),
-      repo: c.req.param("repo"),
+      provider,
+      owner,
+      repo: repoName,
       rule: parsed.rule
     });
+    await recordControlPlaneEvent({
+      type: "binding.repository.policy_rule.upserted",
+      severity: "info",
+      subject: `${provider}:${owner}/${repoName}:${rule.id}`,
+      payload: {
+        provider,
+        owner,
+        repo: repoName,
+        ruleId: rule.id,
+        scope: rule.scope,
+        effect: rule.effect,
+        ...rule.capabilityId ? { capabilityId: rule.capabilityId } : {},
+        ...rule.mutationDomain ? { mutationDomain: rule.mutationDomain } : {},
+        hasReason: Boolean(rule.reason)
+      }
+    });
     return c.json({ rule }, 201);
   });
   app.get("/v1/repo-bindings/:provider/:owner/:repo/policy-rules", async (c) => {
@@ -1123,13 +2379,32 @@ function createDispatcherApp(input) {
     return c.json({ rules });
   });
   app.post("/v1/repo-bindings/:provider/:owner/:repo/mutation-mappings", async (c) => {
-    const parsed = UpsertMutationMappingSchema.parse(await c.req.json());
+    const parsed = await parseDispatcherBody(c, UpsertMutationMappingSchema);
+    const provider = c.req.param("provider");
+    const owner = c.req.param("owner");
+    const repoName = c.req.param("repo");
     const mapping = await repo.upsertRepoMutationMapping({
-      provider: c.req.param("provider"),
-      owner: c.req.param("owner"),
-      repo: c.req.param("repo"),
+      provider,
+      owner,
+      repo: repoName,
       mapping: parsed.mapping
     });
+    await recordControlPlaneEvent({
+      type: "binding.repository.mutation_mapping.upserted",
+      severity: "info",
+      subject: `${provider}:${owner}/${repoName}:${mapping.id}`,
+      payload: {
+        provider,
+        owner,
+        repo: repoName,
+        mappingId: mapping.id,
+        adapter: mapping.adapter,
+        domain: mapping.domain,
+        strategy: mapping.strategy,
+        valueCount: Object.keys(mapping.values).length,
+        hasDescription: Boolean(mapping.description)
+      }
+    });
     return c.json({ mapping }, 201);
   });
   app.get("/v1/repo-bindings/:provider/:owner/:repo/mutation-mappings", async (c) => {
@@ -1155,7 +2430,7 @@ function createDispatcherApp(input) {
     return c.json({ metrics });
   });
   app.post("/v1/channel-bindings", async (c) => {
-    const parsed = CreateChannelBindingSchema.parse(await c.req.json());
+    const parsed = await parseDispatcherBody(c, CreateChannelBindingSchema);
     await repo.upsertChannelBinding({
       provider: parsed.provider,
       accountId: parsed.accountId,
@@ -1165,6 +2440,20 @@ function createDispatcherApp(input) {
       repo: parsed.repo,
       ...parsed.metadata ? { metadata: parsed.metadata } : {}
     });
+    await recordControlPlaneEvent({
+      type: "binding.channel.upserted",
+      severity: "info",
+      subject: `${parsed.provider}:${parsed.accountId}/${parsed.conversationId}`,
+      payload: {
+        provider: parsed.provider,
+        accountId: parsed.accountId,
+        conversationId: parsed.conversationId,
+        repoProvider: parsed.repoProvider,
+        owner: parsed.owner,
+        repo: parsed.repo,
+        hasMetadata: Boolean(parsed.metadata)
+      }
+    });
     return c.json({ ok: true }, 201);
   });
   app.get("/v1/channel-bindings/:provider/:accountId/:conversationId", async (c) => {
@@ -1176,9 +2465,94 @@ function createDispatcherApp(input) {
     if (!binding) return c.json({ error: "channel_binding_not_found" }, 404);
     return c.json({ binding });
   });
+  app.get("/v1/channel-bindings/:provider/:accountId/:conversationId/status", async (c) => {
+    const provider = c.req.param("provider");
+    const accountId = c.req.param("accountId");
+    const conversationId = c.req.param("conversationId");
+    const binding = await repo.getChannelBinding({ provider, accountId, conversationId });
+    if (!binding) return c.json({ error: "channel_binding_not_found" }, 404);
+    const active = await repo.findCancelableRunForSourceContainer({
+      source: provider,
+      repoProvider: binding.repoProvider,
+      owner: binding.owner,
+      repo: binding.repo,
+      metadata: sourceContainerMetadata({ provider, accountId, conversationId })
+    });
+    const queuedFollowUps = active ? await repo.listQueuedFollowUpsForActiveRun({ activeRunId: active.run.id }) : [];
+    const runTimeoutMs = active ? latestRunTimeoutMs(await repo.listRunEvents({ runId: active.run.id })) : void 0;
+    return c.json({
+      binding,
+      ...active ? { activeRun: active.run, activeEvent: active.event } : {},
+      ...runTimeoutMs ? { runTimeoutPolicy: { hardTimeoutMs: runTimeoutMs } } : {},
+      queuedFollowUps
+    });
+  });
+  app.delete("/v1/channel-bindings/:provider/:accountId/:conversationId", async (c) => {
+    const provider = c.req.param("provider");
+    const accountId = c.req.param("accountId");
+    const conversationId = c.req.param("conversationId");
+    const deleted = await repo.deleteChannelBinding({
+      provider,
+      accountId,
+      conversationId
+    });
+    if (!deleted) return c.json({ error: "channel_binding_not_found" }, 404);
+    await recordControlPlaneEvent({
+      type: "binding.channel.deleted",
+      severity: "info",
+      subject: `${provider}:${accountId}/${conversationId}`,
+      payload: {
+        provider,
+        accountId,
+        conversationId
+      }
+    });
+    return c.body(null, 204);
+  });
+  app.post("/v1/channel-bindings/:provider/:accountId/:conversationId/cancel-active-run", async (c) => {
+    const provider = c.req.param("provider");
+    const accountId = c.req.param("accountId");
+    const conversationId = c.req.param("conversationId");
+    const parsed = await parseDispatcherBody(c, CancelRunSchema);
+    const binding = await repo.getChannelBinding({ provider, accountId, conversationId });
+    if (!binding) return c.json({ error: "channel_binding_not_found" }, 404);
+    const active = await repo.findCancelableRunForSourceContainer({
+      source: provider,
+      repoProvider: binding.repoProvider,
+      owner: binding.owner,
+      repo: binding.repo,
+      metadata: sourceContainerMetadata({ provider, accountId, conversationId })
+    });
+    if (!active) return c.json({ error: "active_run_not_found" }, 404);
+    const outcome = await repo.cancelRun({
+      runId: active.run.id,
+      ...parsed.reason ? { reason: parsed.reason } : {},
+      ...parsed.requestedBy ? { requestedBy: parsed.requestedBy } : {}
+    });
+    if (outcome.outcome === "not_found") return c.json({ error: "run_not_found" }, 404);
+    if (outcome.outcome === "already_terminal") {
+      return c.json({ error: "run_already_terminal", run: outcome.run }, 409);
+    }
+    return c.json({ outcome: "cancelled", run: outcome.run });
+  });
   app.post("/v1/slack-channel-bindings", async (c) => {
-    const parsed = CreateSlackChannelBindingSchema.parse(await c.req.json());
+    const parsed = await parseDispatcherBody(c, CreateSlackChannelBindingSchema);
     await repo.createSlackChannelBinding(parsed);
+    await recordControlPlaneEvent({
+      type: "binding.channel.upserted",
+      severity: "info",
+      subject: `slack:${parsed.teamId}/${parsed.channelId}`,
+      payload: {
+        provider: "slack",
+        accountId: parsed.teamId,
+        conversationId: parsed.channelId,
+        repoProvider: parsed.repoProvider ?? "github",
+        owner: parsed.owner,
+        repo: parsed.repo,
+        compatibilityEndpoint: "/v1/slack-channel-bindings",
+        hasMetadata: false
+      }
+    });
     return c.json({ ok: true }, 201);
   });
   app.get("/v1/slack-channel-bindings/:teamId/:channelId", async (c) => {
@@ -1190,43 +2564,69 @@ function createDispatcherApp(input) {
     return c.json({ binding });
   });
   app.post("/v1/runs", async (c) => {
-    const parsed = CreateRunSchema.parse(await c.req.json());
+    const parsed = await parseDispatcherBody(c, CreateRunSchema);
     const admitted = await admission.admitRun({ requestId: parsed.runId, event: parsed.event });
     if (admitted.outcome === "needs_human_decision") {
+      const projectTarget = projectTargetRefFromEvent2(parsed.event);
+      await recordControlPlaneEvent({
+        type: "admission.needs_human_decision",
+        severity: ["repo_context_missing", "repo_not_bound"].includes(admitted.decision.reasonCode) ? "warn" : "info",
+        subject: parsed.runId,
+        payload: {
+          runId: parsed.runId,
+          decision: admitted.decision,
+          source: parsed.event.source,
+          sourceEventId: parsed.event.sourceEventId,
+          projectTarget: projectTarget ? `${projectTarget.provider}:${projectTarget.owner}/${projectTarget.repo}` : null
+        }
+      });
       return c.json({ decision: admitted.decision }, 202);
     }
     if (admitted.outcome === "drop_duplicate") {
-      await repo.appendRunEvent({
-        runId: admitted.run.id,
-        type: "admission.decided",
-        payload: admitted.decision,
-        visibility: "audit",
-        importance: "normal",
-        message: admitted.decision.reason
-      });
-      await repo.appendRunEvent({
-        runId: admitted.run.id,
-        type: "run.create_idempotent_replay",
-        payload: { requestedRunId: parsed.runId, eventId: parsed.event.id },
-        visibility: "audit",
-        importance: "low"
-      });
-      return c.json({ decision: admitted.decision, run: admitted.run, idempotentReplay: true }, 200);
+      const replay = await repo.createRun({ id: parsed.runId, event: parsed.event });
+      const decision = replay.created ? admitted.decision : replay.replayDecision;
+      return c.json({ decision, run: replay.run, idempotentReplay: true }, 200);
     }
     if (admitted.outcome === "follow_up_queued") {
+      const event = admitted.followUpRequest.event;
+      const activeRunId = admitted.followUpRequest.activeRunId;
+      if (activeRunId && shouldDeliverRunStatusUpdate(presentation, { provider: event.callback.provider, state: "queued" })) {
+        const queuedPresentation = presentation.runStatusPresentation({
+          runId: activeRunId,
+          state: "queued",
+          message: `Queued follow-up ${admitted.followUpRequest.id} behind the active run.`,
+          nextAction: "Wait for the active run final reply, send another follow-up to queue more context, or request cancellation with /stop.",
+          detailVisibility: "source_thread"
+        });
+        const queued = presentation.render({
+          provider: event.callback.provider,
+          presentation: queuedPresentation
+        });
+        await deliverAndAudit({
+          repo,
+          sink: callbackSink,
+          retry: callbackRetry,
+          message: {
+            runId: activeRunId,
+            kind: "progress",
+            provider: event.callback.provider,
+            uri: event.callback.uri,
+            body: queued.body,
+            ...event.target.agentId ? { agentId: event.target.agentId } : {},
+            ...event.callback.threadKey ? { threadKey: event.callback.threadKey } : {},
+            ...queued.blocks?.length ? { blocks: queued.blocks } : {},
+            ...queued.rich ? { rich: queued.rich } : {},
+            statusMessageKey: `${activeRunId}:status`
+          }
+        });
+      }
       return c.json({ decision: admitted.decision, followUpRequest: admitted.followUpRequest }, 202);
     }
     const createdRun = await repo.createRun({ id: parsed.runId, event: parsed.event });
     if (!createdRun.created) {
       return c.json(
         {
-          decision: {
-            ...admitted.decision,
-            action: "drop_duplicate",
-            reason: "Source event already created a run.",
-            reasonCode: "duplicate_source_event",
-            activeRunId: createdRun.run.id
-          },
+          decision: createdRun.replayDecision,
           run: createdRun.run,
           idempotentReplay: true
         },
@@ -1234,7 +2634,25 @@ function createDispatcherApp(input) {
       );
     }
     const { run } = createdRun;
-    if (presentation.shouldDeliverAcknowledgement(parsed.event.callback.provider)) {
+    const sourceReceiptDelivery = await deliverSourceReceiptBestEffort({
+      repo,
+      sink: sourceReceiptSink,
+      receipt: {
+        runId: run.id,
+        provider: parsed.event.callback.provider,
+        state: "received",
+        event: parsed.event,
+        ...parsed.event.target.agentId ? { agentId: parsed.event.target.agentId } : {}
+      }
+    });
+    const shouldDeliverAcknowledgement = presentation.shouldDeliverAcknowledgement(parsed.event.callback.provider) || shouldDeliverSourceReceipt(parsed.event.callback.provider) && !sourceReceiptDelivery.delivered;
+    if (shouldDeliverAcknowledgement) {
+      const acknowledgementPresentation = presentation.acknowledgementPresentation({ runId: run.id });
+      const acknowledgement = presentation.render({
+        provider: parsed.event.callback.provider,
+        presentation: acknowledgementPresentation
+      });
+      const statusMessageKey = larkLifecycleStatusMessageKey({ provider: parsed.event.callback.provider, runId: run.id });
       await deliverAndAudit({
         repo,
         sink: callbackSink,
@@ -1244,16 +2662,19 @@ function createDispatcherApp(input) {
           kind: "acknowledgement",
           provider: parsed.event.callback.provider,
           uri: parsed.event.callback.uri,
-          body: presentation.acknowledgement({ provider: parsed.event.callback.provider, runId: run.id }),
+          body: acknowledgement.body,
           ...parsed.event.target.agentId ? { agentId: parsed.event.target.agentId } : {},
-          ...parsed.event.callback.threadKey ? { threadKey: parsed.event.callback.threadKey } : {}
+          ...parsed.event.callback.threadKey ? { threadKey: parsed.event.callback.threadKey } : {},
+          ...statusMessageKey ? { statusMessageKey } : {},
+          ...acknowledgement.blocks?.length ? { blocks: acknowledgement.blocks } : {},
+          ...acknowledgement.rich ? { rich: acknowledgement.rich } : {}
         }
       });
     }
     return c.json({ decision: admitted.decision, run }, 201);
   });
   app.post("/v1/thread-actions", async (c) => {
-    const parsed = ThreadActionInputSchema.parse(await c.req.json());
+    const parsed = await parseDispatcherBody(c, ThreadActionInputSchema);
     const command = parseThreadActionCommand(parsed.rawText);
     if (!command) {
       return c.json({ outcome: "ignored", reason: "not_action_command" }, 202);
@@ -1305,22 +2726,24 @@ function createDispatcherApp(input) {
       if (existingPlan) {
         const existingDecision2 = await repo.getApprovalDecision({ id: existingPlan.approvalDecisionId });
         if (selectedIntentsAlreadyApplied({ plan: existingPlan, selectedIntentIds: resolved.resolved.selectedIntentIds })) {
+          await deliverAndAudit({
+            repo,
+            sink: callbackSink,
+            retry: callbackRetry,
+            message: {
+              runId: resolved.resolved.proposal.runId,
+              kind: "final",
+              provider: parsed.callback.provider,
+              uri: parsed.callback.uri,
+              body: renderAlreadyAppliedThreadActionBody({ selectionText }),
+              ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+            }
+          });
           return c.json({ outcome: "already_applied", decision: existingDecision2, plan: existingPlan }, 200);
         }
-        const fallbackReason = "An apply plan already exists for this selected action; OpenTag will not execute it again from a repeated thread reply.";
-        const childRun2 = await createChildRunForThreadAction({
-          repo,
-          command,
-          resolved: resolved.resolved,
-          runId: stableChildRunId({
-            command,
-            resolved: resolved.resolved,
-            sourceApplyPlanId: existingPlan.id,
-            fallbackReason
-          }),
-          approvalDecisionId: existingPlan.approvalDecisionId,
-          sourceApplyPlanId: existingPlan.id,
-          fallbackReason
+        const isStale = selectedIntentsHaveStaleOutcome({
+          plan: existingPlan,
+          selectedIntentIds: resolved.resolved.selectedIntentIds
         });
         await deliverAndAudit({
           repo,
@@ -1331,18 +2754,14 @@ function createDispatcherApp(input) {
             kind: "final",
             provider: parsed.callback.provider,
             uri: parsed.callback.uri,
-            body: renderChildRunCreatedBody({
-              lead: "This action was already planned, so OpenTag will not execute the external write again.",
-              resolved: resolved.resolved,
-              childRun: childRun2,
-              approvalDecisionId: existingPlan.approvalDecisionId,
-              sourceApplyPlanId: existingPlan.id,
-              fallbackReason
-            }),
+            body: isStale ? renderStaleThreadActionBody({
+              selectionText,
+              continueIndex: resolved.resolved.selectedCandidates[0]?.index ?? 1
+            }) : renderAlreadyPlannedThreadActionBody({ selectionText }),
             ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
           }
         });
-        return c.json({ outcome: "already_planned", decision: existingDecision2, plan: existingPlan, run: childRun2 }, 200);
+        return c.json({ outcome: isStale ? "stale" : "already_planned", decision: existingDecision2, plan: existingPlan }, 200);
       }
     }
     const providedDecision = parsed.id ? await repo.getApprovalDecision({ id: parsed.id }) : null;
@@ -1383,7 +2802,10 @@ function createDispatcherApp(input) {
       if (existingDecision) {
         return c.json({ outcome: "already_rejected", decision }, 200);
       }
-      const body2 = `Rejected ${selectionText} from \`${resolved.resolved.proposal.snapshot.proposalId}\`.`;
+      const body2 = renderThreadActionRecordedBody({
+        verb: "reject",
+        selectionText
+      });
       await deliverAndAudit({
         repo,
         sink: callbackSink,
@@ -1403,9 +2825,18 @@ function createDispatcherApp(input) {
       if (existingDecision) {
         return c.json({ outcome: "already_approved", decision }, 200);
       }
-      const body2 = `Approved ${selectionText} from \`${resolved.resolved.proposal.snapshot.proposalId}\`.
-
-Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to apply it, or \`continue ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to continue with a follow-up run.`;
+      const directApply = await selectedDirectApplyStatus({
+        event: resolved.resolved.proposal.event,
+        callbackProvider: parsed.callback.provider,
+        candidates: resolved.resolved.selectedCandidates,
+        ...input.githubApply ? { githubApply: input.githubApply } : {}
+      });
+      const body2 = renderThreadActionRecordedBody({
+        verb: "approve",
+        selectionText,
+        applyIndex: resolved.resolved.selectedCandidates[0]?.index ?? 1,
+        directApply
+      });
       await deliverAndAudit({
         repo,
         sink: callbackSink,
@@ -1430,9 +2861,11 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
         approvalDecisionId: decision.id
       });
       const body2 = renderChildRunCreatedBody({
-        lead: `Continuing from ${selectionText} in \`${resolved.resolved.proposal.snapshot.proposalId}\`.`,
+        lead: "Continuing in OpenTag from this approved action.",
         resolved: resolved.resolved,
         childRun: childRun2,
+        provider: parsed.callback.provider,
+        selectionText,
         approvalDecisionId: decision.id
       });
       await deliverAndAudit({
@@ -1462,22 +2895,24 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
     }
     if (!planResult.created) {
       if (selectedIntentsAlreadyApplied({ plan: planResult.plan, selectedIntentIds: resolved.resolved.selectedIntentIds })) {
+        await deliverAndAudit({
+          repo,
+          sink: callbackSink,
+          retry: callbackRetry,
+          message: {
+            runId: resolved.resolved.proposal.runId,
+            kind: "final",
+            provider: parsed.callback.provider,
+            uri: parsed.callback.uri,
+            body: renderAlreadyAppliedThreadActionBody({ selectionText }),
+            ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+          }
+        });
         return c.json({ outcome: "already_applied", decision, plan: planResult.plan }, 200);
       }
-      const fallbackReason = "An apply plan already exists for this selected action; OpenTag will not execute it again from a repeated thread reply.";
-      const childRun2 = await createChildRunForThreadAction({
-        repo,
-        command,
-        resolved: resolved.resolved,
-        runId: stableChildRunId({
-          command,
-          resolved: resolved.resolved,
-          sourceApplyPlanId: planResult.plan.id,
-          fallbackReason
-        }),
-        approvalDecisionId: decision.id,
-        sourceApplyPlanId: planResult.plan.id,
-        fallbackReason
+      const isStale = selectedIntentsHaveStaleOutcome({
+        plan: planResult.plan,
+        selectedIntentIds: resolved.resolved.selectedIntentIds
       });
       await deliverAndAudit({
         repo,
@@ -1488,18 +2923,14 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
           kind: "final",
           provider: parsed.callback.provider,
           uri: parsed.callback.uri,
-          body: renderChildRunCreatedBody({
-            lead: "This action was already planned, so OpenTag will not execute the external write again.",
-            resolved: resolved.resolved,
-            childRun: childRun2,
-            approvalDecisionId: decision.id,
-            sourceApplyPlanId: planResult.plan.id,
-            fallbackReason
-          }),
+          body: isStale ? renderStaleThreadActionBody({
+            selectionText,
+            continueIndex: resolved.resolved.selectedCandidates[0]?.index ?? 1
+          }) : renderAlreadyPlannedThreadActionBody({ selectionText }),
           ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
         }
       });
-      return c.json({ outcome: "already_planned", decision, plan: planResult.plan, run: childRun2 }, 200);
+      return c.json({ outcome: isStale ? "stale" : "already_planned", decision, plan: planResult.plan }, 200);
     }
     const plan = planResult.plan;
     const execution = await executeGitHubApplyPlan({
@@ -1510,12 +2941,11 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
     });
     if (execution.executed) {
       const outcomes = execution.plan.outcomes ?? [];
-      const body2 = [
-        `Applied ${selectionText} from \`${resolved.resolved.proposal.snapshot.proposalId}\`.`,
-        "",
-        "Result:",
-        ...outcomes.filter((outcome) => resolved.resolved.selectedIntentIds.includes(outcome.intentId)).map((outcome) => `- \`${outcome.intentId}\`: ${outcome.outcome}${outcome.externalUri ? ` (${outcome.externalUri})` : ""}`)
-      ].join("\n");
+      const body2 = renderAppliedThreadActionBody({
+        selectionText,
+        selectedIntentIds: resolved.resolved.selectedIntentIds,
+        outcomes
+      });
       await deliverAndAudit({
         repo,
         sink: callbackSink,
@@ -1531,6 +2961,25 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
       });
       return c.json({ outcome: "applied", decision, plan: execution.plan }, 201);
     }
+    if (selectedIntentsHaveStaleOutcome({ plan: execution.plan, selectedIntentIds: resolved.resolved.selectedIntentIds })) {
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId: resolved.resolved.proposal.runId,
+          kind: "final",
+          provider: parsed.callback.provider,
+          uri: parsed.callback.uri,
+          body: renderStaleThreadActionBody({
+            selectionText,
+            continueIndex: resolved.resolved.selectedCandidates[0]?.index ?? 1
+          }),
+          ...parsed.callback.threadKey ? { threadKey: parsed.callback.threadKey } : {}
+        }
+      });
+      return c.json({ outcome: "stale", decision, plan: execution.plan }, 200);
+    }
     const childRun = await createChildRunForThreadAction({
       repo,
       command,
@@ -1546,9 +2995,11 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
       fallbackReason: execution.fallbackReason ?? "OpenTag cannot directly apply this intent yet."
     });
     const body = renderChildRunCreatedBody({
-      lead: `Action ${selectionText} was approved, but OpenTag cannot directly apply it yet.`,
+      lead: "Needs setup before OpenTag can apply this action directly.",
       resolved: resolved.resolved,
       childRun,
+      provider: parsed.callback.provider,
+      selectionText,
       approvalDecisionId: decision.id,
       sourceApplyPlanId: execution.plan.id,
       fallbackReason: execution.fallbackReason ?? "The adapter could not execute the selected intent."
@@ -1574,10 +3025,10 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
     return c.json({ followUpRequest });
   });
   app.post("/v1/follow-up-requests/:id/create-run", async (c) => {
-    const parsed = PromoteFollowUpRequestSchema.parse(await c.req.json());
+    const parsed = await parseDispatcherBody(c, PromoteFollowUpRequestSchema);
     let promoted;
     try {
-      promoted = await repo.createRunFromFollowUpRequest({
+      promoted = await promoteFollowUpRequest({
         followUpRequestId: c.req.param("id"),
         runId: parsed.runId
       });
@@ -1592,23 +3043,6 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
       throw error;
     }
     const followUpRequest = promoted.followUpRequest;
-    const event = followUpRequest.event;
-    if (presentation.shouldDeliverAcknowledgement(event.callback.provider)) {
-      await deliverAndAudit({
-        repo,
-        sink: callbackSink,
-        retry: callbackRetry,
-        message: {
-          runId: promoted.run.id,
-          kind: "acknowledgement",
-          provider: event.callback.provider,
-          uri: event.callback.uri,
-          body: presentation.acknowledgement({ provider: event.callback.provider, runId: promoted.run.id }),
-          ...event.target.agentId ? { agentId: event.target.agentId } : {},
-          ...event.callback.threadKey ? { threadKey: event.callback.threadKey } : {}
-        }
-      });
-    }
     return c.json({ followUpRequest, run: promoted.run }, 201);
   });
   app.post("/v1/runners/:runnerId/claim", async (c) => {
@@ -1628,13 +3062,67 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
     }, 410);
   });
   app.post("/v1/runners/:runnerId/runs/:runId/running", async (c) => {
-    const body = z.object({ executor: z.string().min(1) }).parse(await c.req.json());
-    const ok = await repo.markRunning({
-      runId: c.req.param("runId"),
+    const runId = c.req.param("runId");
+    const body = await parseDispatcherBody(c, MarkRunningSchema);
+    const headerIdempotencyKey = c.req.header("idempotency-key")?.trim();
+    const idempotencyKey = body.idempotencyKey?.trim() || headerIdempotencyKey;
+    const runningOutcome = await repo.markRunning({
+      runId,
       runnerId: c.req.param("runnerId"),
-      executor: body.executor
+      executor: body.executor,
+      ...body.runTimeoutMs ? { runTimeoutMs: body.runTimeoutMs } : {},
+      ...idempotencyKey ? { idempotencyKey } : {}
     });
-    if (!ok) return c.json({ error: "run_not_claimed_by_runner" }, 404);
+    if (runningOutcome === "not_found") return c.json({ error: "run_not_claimed_by_runner" }, 404);
+    if (runningOutcome === "duplicate") return c.json({ ok: true, replayed: true });
+    const stored = await repo.getRun({ runId });
+    if (!stored) return c.json({ error: "run_not_found" }, 404);
+    const provider = stored.event.callback.provider;
+    if (shouldDeliverSourceReceipt(provider)) {
+      await deliverSourceReceiptBestEffort({
+        repo,
+        sink: sourceReceiptSink,
+        receipt: {
+          runId,
+          provider,
+          state: "running",
+          event: stored.event,
+          ...stored.event.target.agentId ? { agentId: stored.event.target.agentId } : {}
+        }
+      });
+    }
+    if (shouldDeliverRunStatusUpdate(presentation, { provider, state: "running" })) {
+      const runningPresentation = presentation.runStatusPresentation({
+        runId,
+        state: "running",
+        message: `Running with ${body.executor}.`,
+        nextAction: "Wait for the final reply, send a follow-up to queue more context, or request cancellation with /stop.",
+        detailVisibility: "source_thread"
+      });
+      const running = presentation.render({
+        provider,
+        presentation: runningPresentation
+      });
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId,
+          kind: "progress",
+          provider,
+          uri: stored.event.callback.uri,
+          body: running.body,
+          ...stored.event.target.agentId ? { agentId: stored.event.target.agentId } : {},
+          ...stored.event.callback.threadKey ? { threadKey: stored.event.callback.threadKey } : {},
+          ...running.blocks?.length ? { blocks: running.blocks } : {},
+          ...running.rich ? { rich: running.rich } : {},
+          statusMessageKey: `${runId}:status`
+        }
+      });
+    } else if (presentation.shouldDeliverStatusUpdate(provider)) {
+      await appendSuppressedRunStatusCallback({ runId, provider, state: "running" });
+    }
     return c.json({ ok: true });
   });
   app.post("/v1/runs/:runId/progress", async () => {
@@ -1645,20 +3133,31 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
   });
   app.post("/v1/runners/:runnerId/runs/:runId/progress", async (c) => {
     const runId = c.req.param("runId");
-    const body = ProgressSchema.parse(await c.req.json());
-    const ok = await repo.recordProgress({
+    const body = await parseDispatcherBody(c, ProgressSchema);
+    const headerIdempotencyKey = c.req.header("idempotency-key")?.trim();
+    const idempotencyKey = body.idempotencyKey?.trim() || headerIdempotencyKey;
+    const progressOutcome = await repo.recordProgress({
       runId,
       runnerId: c.req.param("runnerId"),
       message: body.message,
       ...body.type ? { type: body.type } : {},
       ...body.at ? { at: body.at } : {},
       ...body.visibility ? { visibility: body.visibility } : {},
-      ...body.importance ? { importance: body.importance } : {}
+      ...body.importance ? { importance: body.importance } : {},
+      ...idempotencyKey ? { idempotencyKey } : {}
     });
-    if (!ok) return c.json({ error: "run_not_claimed_by_runner" }, 404);
+    if (progressOutcome === "not_found") return c.json({ error: "run_not_claimed_by_runner" }, 404);
+    if (progressOutcome === "duplicate") return c.json({ ok: true, replayed: true });
     const stored = await repo.getRun({ runId });
     if (!stored) return c.json({ error: "run_not_found" }, 404);
-    if (presentation.shouldDeliverProgress(stored.event.callback.provider)) {
+    const progressVisibility = body.visibility ?? "audit";
+    const shouldDeliverProgress = presentation.shouldDeliverProgress(stored.event.callback.provider);
+    if (progressVisibility === "human" && shouldDeliverProgress) {
+      const progressPresentation = presentation.progressPresentation({ runId, message: body.message });
+      const progress = presentation.render({
+        provider: stored.event.callback.provider,
+        presentation: progressPresentation
+      });
       await deliverAndAudit({
         repo,
         sink: callbackSink,
@@ -1668,12 +3167,29 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
           kind: "progress",
           provider: stored.event.callback.provider,
           uri: stored.event.callback.uri,
-          body: presentation.progress({ provider: stored.event.callback.provider, runId, message: body.message }),
+          body: progress.body,
           ...stored.event.target.agentId ? { agentId: stored.event.target.agentId } : {},
           ...stored.event.callback.threadKey ? { threadKey: stored.event.callback.threadKey } : {},
+          ...progress.blocks?.length ? { blocks: progress.blocks } : {},
+          ...progress.rich ? { rich: progress.rich } : {},
           statusMessageKey: `${runId}:status`
         }
       });
+    } else if (progressVisibility === "human") {
+      const capability = platformCapabilityForProvider2(stored.event.callback.provider);
+      await repo.appendRunEvent({
+        runId,
+        type: "callback.progress.suppressed",
+        payload: {
+          provider: stored.event.callback.provider,
+          reason: "platform_liveness_strategy",
+          requestedVisibility: progressVisibility,
+          livenessStrategy: capability?.livenessStrategy ?? "unknown"
+        },
+        visibility: "audit",
+        importance: "low",
+        message: "Progress callback suppressed by platform liveness strategy; use status or audit for details."
+      });
     }
     return c.json({ ok: true });
   });
@@ -1685,12 +3201,64 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
   });
   app.post("/v1/runners/:runnerId/runs/:runId/complete", async (c) => {
     const runId = c.req.param("runId");
-    const parsed = CompleteRunSchema.parse(await c.req.json());
-    const ok = await repo.completeRun({ runId, runnerId: c.req.param("runnerId"), result: parsed.result });
-    if (!ok) return c.json({ error: "run_not_claimed_by_runner" }, 404);
+    const parsed = await parseDispatcherBody(c, CompleteRunSchema);
+    const headerIdempotencyKey = c.req.header("idempotency-key")?.trim();
+    const idempotencyKey = parsed.idempotencyKey?.trim() || headerIdempotencyKey;
+    const outcome = await repo.completeRun({
+      runId,
+      runnerId: c.req.param("runnerId"),
+      result: parsed.result,
+      ...idempotencyKey ? { idempotencyKey } : {}
+    });
+    if (outcome === "not_found") return c.json({ error: "run_not_claimed_by_runner" }, 404);
+    if (outcome === "duplicate") return c.json({ ok: true, replayed: true });
     const stored = await repo.getRun({ runId });
     if (!stored) return c.json({ error: "run_not_found" }, 404);
-    const finalPresentation = presentation.final({ provider: stored.event.callback.provider, result: parsed.result });
+    const receiptContext = await actionReceiptContextForFinal({
+      event: stored.event,
+      result: parsed.result,
+      ...input.githubApply ? { githubApply: input.githubApply } : {}
+    });
+    if (parsed.result.conclusion === "needs_human" && shouldDeliverRunStatusUpdate(presentation, { provider: stored.event.callback.provider, state: "waiting_for_approval" })) {
+      const waitingPresentation = presentation.runStatusPresentation({
+        runId,
+        state: "waiting_for_approval",
+        message: "Waiting for approval.",
+        nextAction: "Review the source-thread action receipt, then approve, reject, apply, or continue from the source thread.",
+        detailVisibility: "source_thread"
+      });
+      const waiting = presentation.render({
+        provider: stored.event.callback.provider,
+        presentation: waitingPresentation
+      });
+      await deliverAndAudit({
+        repo,
+        sink: callbackSink,
+        retry: callbackRetry,
+        message: {
+          runId,
+          kind: "progress",
+          provider: stored.event.callback.provider,
+          uri: stored.event.callback.uri,
+          body: waiting.body,
+          ...stored.event.target.agentId ? { agentId: stored.event.target.agentId } : {},
+          ...stored.event.callback.threadKey ? { threadKey: stored.event.callback.threadKey } : {},
+          ...waiting.blocks?.length ? { blocks: waiting.blocks } : {},
+          ...waiting.rich ? { rich: waiting.rich } : {},
+          statusMessageKey: `${runId}:status`
+        }
+      });
+    }
+    const finalPresentation = presentation.finalPresentation({
+      result: parsed.result,
+      runId,
+      receiptContext
+    });
+    const finalCallback = presentation.render({
+      provider: stored.event.callback.provider,
+      presentation: finalPresentation
+    });
+    const statusMessageKey = larkLifecycleStatusMessageKey({ provider: stored.event.callback.provider, runId });
     await deliverAndAudit({
       repo,
       sink: callbackSink,
@@ -1700,13 +3268,25 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
         kind: "final",
         provider: stored.event.callback.provider,
         uri: stored.event.callback.uri,
-        body: finalPresentation.body,
+        body: finalCallback.body,
         ...stored.event.target.agentId ? { agentId: stored.event.target.agentId } : {},
         ...stored.event.callback.threadKey ? { threadKey: stored.event.callback.threadKey } : {},
-        ...finalPresentation.blocks?.length ? { blocks: finalPresentation.blocks } : {}
+        ...statusMessageKey ? { statusMessageKey } : {},
+        ...finalCallback.blocks?.length ? { blocks: finalCallback.blocks } : {},
+        ...finalCallback.rich ? { rich: finalCallback.rich } : {}
       }
     });
-    return c.json({ ok: true });
+    const shouldPromoteFollowUp = parsed.result.conclusion !== "needs_human" && parsed.result.conclusion !== "cancelled";
+    const promotedFollowUp = shouldPromoteFollowUp ? await promoteNextFollowUpAfterTerminalRun({ activeRunId: runId }) : null;
+    return c.json({
+      ok: true,
+      ...promotedFollowUp ? {
+        promotedFollowUp: {
+          followUpRequest: promotedFollowUp.followUpRequest,
+          run: promotedFollowUp.run
+        }
+      } : {}
+    });
   });
   app.get("/v1/proposals/:proposalId", async (c) => {
     const proposal = await repo.getSuggestedChanges({ proposalId: c.req.param("proposalId") });
@@ -1725,9 +3305,7 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
   });
   app.post("/v1/proposals/:proposalId/approvals", async (c) => {
     const proposalId = c.req.param("proposalId");
-    const parsedBody = ApprovalDecisionInputSchema.safeParse(await c.req.json());
-    if (!parsedBody.success) return c.json({ error: "invalid_approval_decision" }, 400);
-    const body = parsedBody.data;
+    const body = await parseDispatcherBody(c, ApprovalDecisionInputSchema, { invalidBodyError: "invalid_approval_decision" });
     const decision = await repo.recordApprovalDecision({
       id: body.id ?? `approval_${proposalId}_${Date.now()}`,
       proposalId,
@@ -1749,7 +3327,7 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
   });
   app.post("/v1/proposals/:proposalId/apply-plans", async (c) => {
     const proposalId = c.req.param("proposalId");
-    const body = ApplyPlanInputSchema.parse(await c.req.json());
+    const body = await parseDispatcherBody(c, ApplyPlanInputSchema);
     let executableTarget;
     if (body.execute) {
       if (body.adapter !== "github") {
@@ -1843,7 +3421,7 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
   });
   app.post("/v1/runs/:runId/child-runs", async (c) => {
     const parentRunId = c.req.param("runId");
-    const body = ChildRunInputSchema.parse(await c.req.json());
+    const body = await parseDispatcherBody(c, ChildRunInputSchema);
     const parent = await repo.getRun({ runId: parentRunId });
     if (!parent) return c.json({ error: "parent_run_not_found" }, 404);
     const receivedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -1869,6 +3447,19 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
     if (!stored) return c.json({ error: "run_not_found" }, 404);
     return c.json(stored);
   });
+  app.post("/v1/runs/:runId/cancel", async (c) => {
+    const parsed = await parseDispatcherBody(c, CancelRunSchema);
+    const outcome = await repo.cancelRun({
+      runId: c.req.param("runId"),
+      ...parsed.reason ? { reason: parsed.reason } : {},
+      ...parsed.requestedBy ? { requestedBy: parsed.requestedBy } : {}
+    });
+    if (outcome.outcome === "not_found") return c.json({ error: "run_not_found" }, 404);
+    if (outcome.outcome === "already_terminal") {
+      return c.json({ error: "run_already_terminal", run: outcome.run }, 409);
+    }
+    return c.json({ outcome: "cancelled", run: outcome.run });
+  });
   app.get("/v1/runs/:runId/metrics", async (c) => {
     const runId = c.req.param("runId");
     const stored = await repo.getRun({ runId });
@@ -1880,6 +3471,13 @@ Reply with \`apply ${resolved.resolved.selectedCandidates[0]?.index ?? 1}\` to a
     const events = await repo.listRunEvents({ runId: c.req.param("runId") });
     return c.json({ events });
   });
+  app.onError((err, c) => {
+    if (err instanceof HTTPException) {
+      return err.getResponse();
+    }
+    console.error("dispatcher unhandled error", err);
+    return c.json({ error: "internal_server_error" }, 500);
+  });
   return app;
 }
 export {
@@ -1889,6 +3487,7 @@ export {
   createGitHubCallbackSink,
   createLarkCallbackSink,
   createSlackCallbackSink,
+  createSlackSourceReceiptSink,
   createTelegramCallbackSink,
   processPendingCallbacks
 };