@reventlessdev/reventless-aws 3.0.0-alpha.382 → 3.0.0-alpha.384

package/CHANGELOG.md

@@ -3,6 +3,33 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.384 (2026-10-16)
+
+* fix(auth)!: only operators read the framework's own stores ([a2fd202](https://github.com/ReventlessDev/reventless-core/commit/a2fd2022b6876dae855b185df7f8263353fc971d))
+
+### BREAKING CHANGES
+
+* a caller outside the elevated groups is refused the
+framework's to-do, schedule and audit stores. On AWS, a roles-gated
+view's …ByIds, …Refs, …Items and …By<Index> fields refuse callers
+outside its roles.
+
+
+
+# 3.0.0-alpha.383 (2026-10-16)
+
+* feat!(automation): schedules set by events ([53bc436](https://github.com/ReventlessDev/reventless-core/commit/53bc4363dffce81ef36475728bf0dae704716021))
+* feat!(automation): declared schedules tick an automation ([420acd2](https://github.com/ReventlessDev/reventless-core/commit/420acd2233aadf700141a31d9d3e0fdc8074bef7))
+
+### BREAKING CHANGES
+
+* a hand-written AutomationSlice.Mapping.Make the PPX does
+not see must define `let reschedule = _ => []`.
+* a hand-written AutomationSlice spec the PPX does not see must
+declare `let schedule = None`.
+
+
+
 # 3.0.0-alpha.382 (2026-10-16)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.382",
+  "version": "3.0.0-alpha.384",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -22,19 +22,19 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.31",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.28",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.32",
     "@reventlessdev/rescript-node": "2.0.0-alpha.22",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.29",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
     "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
-    "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.295",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.192",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.159",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.164",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.40"
+    "@reventlessdev/rescript-web": "1.0.0-alpha.7",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.297",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.194",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.161",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.40",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.166"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Platform.res

@@ -815,12 +815,16 @@ module MakeWithConfig = (
     | None => resolveHookedApi()
     }
 
+  // Set by `makeScheduler`, before any plugin builds; the automation Lambda's
+  // finalizer, inside `hooks`, reads it for the stack's schedule group.
+  let schedulerRoleUrnRef = ref(Pulumi.Output.make(""))
+
   let hooks: ReventlessCore.Plugin_Helpers.platformHooks = {
     // AWS uses Interstack for admin extension points — leave ref at empty dict.
     adminExtensionPoints: ref(Pulumi.Output.make(Dict.make())),
     // Platform context — populated by makePlatform/deployPlugin before plugin build.
     scheduler: ref(None),
-    schedulerRoleUrn: ref(Pulumi.Output.make("")),
+    schedulerRoleUrn: schedulerRoleUrnRef,
     api: hooksApiRef,
     apiRole: hooksApiRoleRef,
     adminApi: hooksAdminApiRef,
@@ -920,7 +924,10 @@ module MakeWithConfig = (
     onDcbSlicesCreated: dcbEventLogUnknown => {
       let dcbEventLog = dcbEventLogUnknown->asDcbEventLog
       StateViewSliceRuntime_Builder_Single.finishWithDcbEventLog(dcbEventLog)
-      AutomationSliceRuntime_Builder_Single.finishWithDcbEventLog(dcbEventLog)
+      AutomationSliceRuntime_Builder_Single.finishWithDcbEventLog(
+        ~schedulerRoleArn=schedulerRoleUrnRef.contents,
+        dcbEventLog,
+      )
     },
     // Heartbeat EP channel hook — extracts SQS queue URL for heartbeat Lambda handler
     // and records the calling plugin's id so the Lambda runtime can emit Connect commands

package/src/Platform.res.mjs

@@ -544,6 +544,9 @@ function MakeWithConfig(Config) {
       return resolveHookedApi();
     }
   };
+  let schedulerRoleUrnRef = {
+    contents: Pulumi.output("")
+  };
   let hooks_subscriptionInfraHook = Stdlib_Option.map(domainEventsApiOpt, eventsApi => (params => {
     let allEventTopics = params.allEventTopics;
     let allQueryDbs = params.allQueryDbs;
@@ -604,7 +607,7 @@ function MakeWithConfig(Config) {
   };
   let hooks_onDcbSlicesCreated = dcbEventLogUnknown => {
     StateViewSliceRuntime_Builder_Single$ReventlessAws.finishWithDcbEventLog(dcbEventLogUnknown);
-    AutomationSliceRuntime_Builder_Single$ReventlessAws.finishWithDcbEventLog(dcbEventLogUnknown);
+    AutomationSliceRuntime_Builder_Single$ReventlessAws.finishWithDcbEventLog(schedulerRoleUrnRef.contents, dcbEventLogUnknown);
   };
   let hooks_onHeartbeatEpChannelAvailable = (remoteChannelUnknown, pluginId, heartbeatInterval) => {
     let resource = remoteChannelUnknown.resources[0];
@@ -620,9 +623,6 @@ function MakeWithConfig(Config) {
   let hooks_scheduler = {
     contents: undefined
   };
-  let hooks_schedulerRoleUrn = {
-    contents: Pulumi.output("")
-  };
   let hooks_deployTarget = {
     contents: "Domain"
   };
@@ -638,7 +638,7 @@ function MakeWithConfig(Config) {
     onHeartbeatEpChannelAvailable: hooks_onHeartbeatEpChannelAvailable,
     adminExtensionPoints: hooks_adminExtensionPoints,
     scheduler: hooks_scheduler,
-    schedulerRoleUrn: hooks_schedulerRoleUrn,
+    schedulerRoleUrn: schedulerRoleUrnRef,
     api: hooksApiRef,
     apiRole: hooksApiRoleRef,
     adminApi: hooksAdminApiRef,
@@ -713,7 +713,7 @@ function MakeWithConfig(Config) {
   let makeScheduler = () => {
     let component = Scheduler$ReventlessAws.make(undefined);
     let outputs = Component$ReventlessCore.outputs(component);
-    hooks_schedulerRoleUrn.contents = outputs.resource.urn;
+    schedulerRoleUrnRef.contents = outputs.resource.urn;
     return Component$ReventlessCore.operations(component);
   };
   let provisionPgChangeFeedRelay = () => {
@@ -884,7 +884,7 @@ function MakeWithConfig(Config) {
     } else {
       pluginReadModelTableName = undefined;
     }
-    PluginExtensionPointRuntime_Builder$ReventlessAws.registerPluginExtensionPoint(pluginReadModelTableName, hooks_schedulerRoleUrn.contents, undefined);
+    PluginExtensionPointRuntime_Builder$ReventlessAws.registerPluginExtensionPoint(pluginReadModelTableName, schedulerRoleUrnRef.contents, undefined);
     let pluginEpEventTopicArn = Output$Pulumi.flatMap(admin.extensionPointsOutputs, eps => {
       let ep = eps.find(ep => ep.name === PluginExtensionPointSpec$ReventlessInfra.name);
       if (ep !== undefined) {
@@ -900,7 +900,7 @@ function MakeWithConfig(Config) {
         return Pulumi.output("NOT_AVAILABLE");
       }
     });
-    PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, Config.cloner, undefined);
+    PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, schedulerRoleUrnRef.contents, undefined, undefined, domainApiId, Config.cloner, undefined);
     let offloadProtection = Util_StoreLayout$ReventlessAws.protectionOfDeployedStack();
     let offloadBucket = new (Aws.s3.Bucket)("reventless-offload", {
       forceDestroy: offloadProtection === "Unprotected",
@@ -1960,6 +1960,9 @@ function Make($star) {
       return resolveHookedApi();
     }
   };
+  let schedulerRoleUrnRef = {
+    contents: Pulumi.output("")
+  };
   let hooks_subscriptionInfraHook = Stdlib_Option.map(domainEventsApiOpt, eventsApi => (params => {
     let allEventTopics = params.allEventTopics;
     let allQueryDbs = params.allQueryDbs;
@@ -2020,7 +2023,7 @@ function Make($star) {
   };
   let hooks_onDcbSlicesCreated = dcbEventLogUnknown => {
     StateViewSliceRuntime_Builder_Single$ReventlessAws.finishWithDcbEventLog(dcbEventLogUnknown);
-    AutomationSliceRuntime_Builder_Single$ReventlessAws.finishWithDcbEventLog(dcbEventLogUnknown);
+    AutomationSliceRuntime_Builder_Single$ReventlessAws.finishWithDcbEventLog(schedulerRoleUrnRef.contents, dcbEventLogUnknown);
   };
   let hooks_onHeartbeatEpChannelAvailable = (remoteChannelUnknown, pluginId, heartbeatInterval) => {
     let resource = remoteChannelUnknown.resources[0];
@@ -2036,9 +2039,6 @@ function Make($star) {
   let hooks_scheduler = {
     contents: undefined
   };
-  let hooks_schedulerRoleUrn = {
-    contents: Pulumi.output("")
-  };
   let hooks_deployTarget = {
     contents: "Domain"
   };
@@ -2054,7 +2054,7 @@ function Make($star) {
     onHeartbeatEpChannelAvailable: hooks_onHeartbeatEpChannelAvailable,
     adminExtensionPoints: hooks_adminExtensionPoints,
     scheduler: hooks_scheduler,
-    schedulerRoleUrn: hooks_schedulerRoleUrn,
+    schedulerRoleUrn: schedulerRoleUrnRef,
     api: hooksApiRef,
     apiRole: hooksApiRoleRef,
     adminApi: hooksAdminApiRef,
@@ -2129,7 +2129,7 @@ function Make($star) {
   let makeScheduler = () => {
     let component = Scheduler$ReventlessAws.make(undefined);
     let outputs = Component$ReventlessCore.outputs(component);
-    hooks_schedulerRoleUrn.contents = outputs.resource.urn;
+    schedulerRoleUrnRef.contents = outputs.resource.urn;
     return Component$ReventlessCore.operations(component);
   };
   let provisionPgChangeFeedRelay = () => {
@@ -2283,7 +2283,7 @@ function Make($star) {
     } else {
       pluginReadModelTableName = undefined;
     }
-    PluginExtensionPointRuntime_Builder$ReventlessAws.registerPluginExtensionPoint(pluginReadModelTableName, hooks_schedulerRoleUrn.contents, undefined);
+    PluginExtensionPointRuntime_Builder$ReventlessAws.registerPluginExtensionPoint(pluginReadModelTableName, schedulerRoleUrnRef.contents, undefined);
     let pluginEpEventTopicArn = Output$Pulumi.flatMap(admin.extensionPointsOutputs, eps => {
       let ep = eps.find(ep => ep.name === PluginExtensionPointSpec$ReventlessInfra.name);
       if (ep !== undefined) {
@@ -2299,7 +2299,7 @@ function Make($star) {
         return Pulumi.output("NOT_AVAILABLE");
       }
     });
-    PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, false, undefined);
+    PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, schedulerRoleUrnRef.contents, undefined, undefined, domainApiId, false, undefined);
     let offloadProtection = Util_StoreLayout$ReventlessAws.protectionOfDeployedStack();
     let offloadBucket = new (Aws.s3.Bucket)("reventless-offload", {
       forceDestroy: offloadProtection === "Unprotected",

package/src/adapter/Runtime/AutomationSliceEntryPoint.mjs

@@ -70,7 +70,8 @@ async function buildAllHandlers() {
       : Ops.makeAutomationRegisteredHandler(
           entry,
           specModule.name,
-          automationSliceCallbackMake(specModule)(bodyModule)
+          automationSliceCallbackMake(specModule)(bodyModule),
+          specModule.schedule
         );
     // A slice can listen on several streams — its plugin's DCB log and any
     // Aggregate EventTopic it named. Register the one handler under each, since
@@ -100,11 +101,14 @@ const routed = StreamOps.makeRoutedHandler(
   builtPromise.then((b) => b.handlers),
 );
 
-// The scheduled sweep arrives as the EventBridge rule's constant Input, which
-// has no `records` — so this branch is the one place that must probe an untyped
-// Lambda payload, which is what this shell exists for. Everything it dispatches
-// to is type-checked in AutomationSliceEntryPoint_Ops.
-export const handler = async (event, context) =>
-  event?.reventlessSweep
-    ? Ops.runSweeps((await builtPromise).sweeps)
-    : routed(event, context);
+// Three invocations carry no `records`: the sweep (the EventBridge rule's constant
+// Input), a schedule's tick (the Scheduler's input), and the deploy's reconcile of
+// the declared schedules. Telling them apart means probing an untyped Lambda
+// payload, which is what this shell exists for. Everything they dispatch to is
+// type-checked in AutomationSliceEntryPoint_Ops.
+export const handler = async (event, context) => {
+  if (event?.reventlessSweep) return Ops.runSweeps((await builtPromise).sweeps);
+  if (event?.reventlessTick) return Ops.runTick((await builtPromise).sweeps, event.reventlessTick);
+  if (event?.reventlessReconcile) return Ops.reconcileSchedules((await builtPromise).sweeps);
+  return routed(event, context);
+};

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -32,6 +32,8 @@ type handlerEntry = {
   commandQueueIsFifo: option<bool>,
   sourceUrn: string,
   context: option<Reventless.AutomationSlice.context>,
+  /** The slice's schedules store; absent for a slice that maps no `Clock`. */
+  schedulesTableName: option<string>,
 }
 
 let strOf = (obj: dict<JSON.t>, key: string): option<string> =>
@@ -59,6 +61,7 @@ let decodeEntry = (json: JSON.t): option<handlerEntry> =>
     commandQueueIsFifo: h->Dict.get("commandQueueIsFifo")->Option.flatMap(JSON.Decode.bool),
     sourceUrn: h->strOf("sourceUrn")->Option.getOr(""),
     context: h->Dict.get("context")->Option.flatMap(decodeContext),
+    schedulesTableName: h->strOf("schedulesTableName"),
   })
 
 // A compact entry names its slice and carries only what the deploy resolved;
@@ -96,6 +99,7 @@ let decodeCompactEntry = (
     // urns stay in the config for the multi-source registration to use.
     sourceUrn: urns->Array.get(0)->Option.getOr(""),
     context: m->Dict.get("context")->Option.flatMap(decodeContext),
+    schedulesTableName: h->strOf("s"),
   }
 }
 
@@ -286,6 +290,94 @@ let makeLoadTodoItems = (
     }
 }
 
+// ── An automation's schedules ───────────────────────────────────────────────
+// The rows are the truth: they are written before the platform is told, and a
+// cold container reads them all once, as it does the to-do list. Unlike to-do
+// rows, a schedule row can go, so the sync deletes what the dict no longer holds.
+
+let scheduleTable = (tableName): Util_DynamoDb_Runtime.resolvedTable => {
+  id: "",
+  name: tableName,
+  arn: "",
+  hashKey: "id",
+}
+
+let makeScheduleStore = (
+  ~tableName,
+  ~rows: dict<ReventlessCore.AutomationSlice_Schedules.row>,
+  ~comp,
+) => {
+  let table = scheduleTable(tableName)
+  let save = QueryDbStorage_DynamoDb_Runtime.save(table)
+  let delete = QueryDbStorage_DynamoDb_Runtime.delete(table)
+  let stored: ref<array<string>> = ref([])
+  let loaded = ref(false)
+  let load = async () =>
+    if !loaded.contents {
+      loaded := true
+      let params: AwsSdk.DynamoDb.DocumentClient.ScanCommand.input = {
+        tableName,
+        consistentRead: true,
+      }
+      let _ = await Util_DynamoDb_Runtime.scanStream(params)
+      ->Stream.runCollect
+      ->Effect.map(items =>
+        items->Array.forEach(item => {
+          let json = item->JSON.stringifyAny->Option.getOr("")->JSON.parseOrThrow
+          switch json->Reventless.Util_Sury.fromJson(
+            ReventlessCore.AutomationSlice_Schedules.rowSchema,
+          ) {
+          | row if rows->Dict.get(row.key)->Option.isNone => rows->Dict.set(row.key, row)
+          | _ => ()
+          | exception _ => ()
+          }
+        })
+      )
+      ->Effect.catchAll(err =>
+        ReventlessCore.EffectLogger.logError(
+          ~comp,
+          `restore: couldn't read the schedules from ${tableName}: ${DynamoDb_Error.message(err)}`,
+        )
+      )
+      ->Effect.runPromise
+      stored := rows->Dict.keysToArray
+    }
+  let sync = async () => {
+    let keys = rows->Dict.keysToArray
+    let _ = await rows
+    ->Dict.toArray
+    ->Array.map(((key, row)) =>
+      save(
+        key,
+        row->Reventless.Util_Sury.toJson(ReventlessCore.AutomationSlice_Schedules.rowSchema),
+        ReventlessCore.QueryDb.Overwrite,
+        None,
+      )
+    )
+    ->Promise.all
+    let _ = await stored.contents
+    ->Array.filter(key => !(keys->Array.includes(key)))
+    ->Array.map(key => delete(key, None))
+    ->Promise.all
+    stored := keys
+  }
+  (load, sync)
+}
+
+/** This Lambda's own ARN, which the slice's schedules invoke. */
+let ownArn = () => {
+  let env = key => NodeProcess.env->Dict.get(key)->Option.getOr("")
+  let account = env("SCHEDULER_ROLE_ARN")->String.split(":")->Array.get(4)->Option.getOr("")
+  `arn:aws:lambda:${env("AWS_REGION")}:${account}:function:${env("AWS_LAMBDA_FUNCTION_NAME")}`
+}
+
+let platformSchedulesOf = (~slice) =>
+  ScheduledPublisher_EventBridgeScheduler_Runtime.platformSchedules(
+    ~roleArn=NodeProcess.env->Dict.get("SCHEDULER_ROLE_ARN")->Option.getOr(""),
+    ~lambdaArn=ownArn(),
+    ~slice,
+  )
+
 // ── Platform capabilities ───────────────────────────────────────────────────
 
 /**
@@ -361,6 +453,32 @@ let capabilities = (): Reventless.Capabilities.t => {
 type automationCallback = ReventlessCore.AutomationSlice_Callback.runtime
 type outboundCallback<'event> = ReventlessCore.OutboundTranslationSlice_Callback.runtime<'event>
 
+/** A scheduled slice's schedule rows, as the Lambda keeps them: load once, sync,
+    and the platform that follows them. */
+type schedulesStep = {
+  load: unit => promise<unit>,
+  sync: unit => promise<unit>,
+  platform: ReventlessInfra.AutomationSlice.platformSchedules,
+}
+
+let loadSchedules = async step =>
+  switch step {
+  | Some({load}) => await load()
+  | None => ()
+  }
+
+// The rows are stored first, then the platform follows them.
+let followSchedules = async (step, callback: automationCallback) =>
+  switch step {
+  | Some({sync, platform}) =>
+    let changes = callback.takeScheduleChanges()
+    if changes->Array.length > 0 {
+      await sync()
+      await ReventlessCore.AutomationSlice_Schedules.tell(platform, changes)
+    }
+  | None => ()
+  }
+
 // Automation: phase 1 takes the RAW envelope JSONs — the callback routes by
 // `meta.service` and unwraps `{id, meta, event}` itself — plus the context.
 let makeAutomationJsonEventsHandler = (
@@ -369,6 +487,7 @@ let makeAutomationJsonEventsHandler = (
   ~publishJsons: ReventlessCore.CommandTopic.publishJsons,
   ~syncTodoItems: unit => promise<unit>,
   ~loadTodoItems: unit => promise<unit>,
+  ~schedules: unit => option<schedulesStep>=() => None,
 ): ReventlessCore.EventCollector.jsonEventsHandler =>
   stream =>
     stream
@@ -376,8 +495,10 @@ let makeAutomationJsonEventsHandler = (
     ->Effect.flatMap(jsons =>
       Effect.promise(async () => {
         await loadTodoItems()
+        await loadSchedules(schedules())
         callback.phase1(jsons, context)
         await syncTodoItems()
+        await followSchedules(schedules(), callback)
         await callback.phase2(publishJsons)
         await syncTodoItems()
       })
@@ -447,12 +568,19 @@ type builtSlice = {
   registered: StreamRoutedEntryPoint_Ops.registeredHandler,
   sweep: unit => promise<unit>,
   comp: string,
+  name: string,
+  /** Delivers `Tick({key, at})`; `None` for an outbound slice, which maps no `Clock`. */
+  tick: option<(~key: string, ~at: float) => promise<unit>>,
+  /** Brings the slice's schedules in line with its spec and its rows, at a deploy;
+      `None` for an outbound slice. */
+  reconcile: option<unit => promise<unit>>,
 }
 
 let makeAutomationRegisteredHandler = (
   entry: handlerEntry,
   ~sliceName: string,
   ~callback: automationCallback,
+  ~schedule: option<Reventless.Schedule.time>,
 ): builtSlice => {
   let comp = `AutomationSlice(${sliceName})`
   let publishJsons = makePublishJsons(
@@ -470,15 +598,29 @@ let makeAutomationRegisteredHandler = (
     ~rowSchema=ReventlessCore.AutomationSlice_Callback.todoRowSchema,
     ~comp,
   )
+  let context = entry.context->Option.getOr(defaultContext(sliceName))
+  // Built on first use: the platform reads the environment, which a test sets late.
+  let step = ref(None)
+  let schedules = () =>
+    switch (step.contents, entry.schedulesTableName) {
+    | (Some(s), _) => Some(s)
+    | (None, Some(tableName)) =>
+      let (load, sync) = makeScheduleStore(~tableName, ~rows=callback.schedules, ~comp)
+      let s = {load, sync, platform: platformSchedulesOf(~slice=sliceName)}
+      step := Some(s)
+      Some(s)
+    | (None, None) => None
+    }
   {
     registered: {
       handler: StreamRoutedEntryPoint_Ops.toStreamHandler(
         makeAutomationJsonEventsHandler(
-          ~context=entry.context->Option.getOr(defaultContext(sliceName)),
+          ~context,
           ~callback,
           ~publishJsons,
           ~syncTodoItems,
           ~loadTodoItems,
+          ~schedules,
         ),
       ),
       comp,
@@ -489,6 +631,44 @@ let makeAutomationRegisteredHandler = (
       await syncTodoItems()
     },
     comp,
+    name: sliceName,
+    // The same steps as an event batch, with the tick as its one event.
+    tick: Some(
+      async (~key, ~at) => {
+        await loadTodoItems()
+        await loadSchedules(schedules())
+        callback.phase1([ReventlessCore.AutomationSlice_Callback.tickEvent(~key, ~at)], context)
+        await syncTodoItems()
+        // A once-only schedule's row goes when it fires.
+        switch schedules() {
+        | Some({sync}) => await sync()
+        | None => ()
+        }
+        await callback.phase2(publishJsons)
+        await syncTodoItems()
+      },
+    ),
+    reconcile: Some(
+      async () =>
+        switch schedules() {
+        | Some({load, sync, platform}) =>
+          await load()
+          await ReventlessCore.AutomationSlice_Schedules.reconcile(
+            callback.schedules,
+            platform,
+            ~declaredTime=schedule,
+            ~now=Date.now(),
+          )
+          await sync()
+        // No Clock mapping, so no schedule of the slice may stay on the platform.
+        | None =>
+          let platform = platformSchedulesOf(~slice=sliceName)
+          let names = await platform.names()
+          for i in 0 to names->Array.length - 1 {
+            await platform.removeName(names->Array.getUnsafe(i))
+          }
+        },
+    ),
   }
 }
 
@@ -533,6 +713,9 @@ let makeOutboundRegisteredHandler = (
       await syncTodoItems()
     },
     comp,
+    name: sliceName,
+    tick: None,
+    reconcile: None,
   }
 }
 
@@ -557,3 +740,46 @@ let runSweeps = async (slices: array<builtSlice>) => {
     }
   }
 }
+
+// ── Schedules ───────────────────────────────────────────────────────────────
+
+/** A Scheduler invocation: which slice's schedule fired, its key, and its scheduled time. */
+type tickInvocation = {slice: string, key: string, at: string}
+
+/**
+Deliver a schedule's firing to its slice. `at` is the Scheduler's placeholder,
+filled in as `2026-10-16T06:00:00Z`. A tick for a slice this Lambda does not host,
+or one that maps no `Clock`, throws, so the Scheduler retries and the error is logged.
+*/
+let runTick = async (slices: array<builtSlice>, invocation: tickInvocation) =>
+  switch slices->Array.find(s => s.name == invocation.slice)->Option.flatMap(s => s.tick) {
+  | Some(tick) =>
+    let at = invocation.at->Date.fromString->Date.getTime
+    if at->Float.isNaN {
+      JsError.throwWithMessage(`tick for ${invocation.slice}: "${invocation.at}" is not a time`)
+    }
+    await tick(~key=invocation.key, ~at)
+  | None =>
+    JsError.throwWithMessage(`tick for ${invocation.slice}: no automation of that name here`)
+  }
+
+/**
+Bring every automation's schedules in line, at a deploy: its declared time into its
+rows, and the platform's schedules to its rows. Run by the deploy, so a failure fails
+it; unlike a sweep, one slice's failure stops the rest.
+*/
+let reconcileSchedules = async (slices: array<builtSlice>) => {
+  if NodeProcess.env->Dict.get("SCHEDULER_ROLE_ARN")->Option.getOr("") == "" {
+    JsError.throwWithMessage(`reconcile: SCHEDULER_ROLE_ARN is not set`)
+  }
+  let reconciles = slices->Array.filterMap(s => s.reconcile)
+  for i in 0 to reconciles->Array.length - 1 {
+    await (reconciles->Array.getUnsafe(i))()
+  }
+  ReventlessCore.EffectLogger.logInfo(
+    ~comp="AutomationSliceRuntime",
+    `reconcile: the schedules of ${reconciles
+      ->Array.length
+      ->Int.toString} automation(s) are in line`,
+  )->Effect.runSync
+}