Turn
The question arrives with platform identity, delivery metadata, and possibly private words. Reach first decides what may enter this turn, then commits its answer before any credential-bearing edge attempts the reply.
- Authenticate Gateway and verify application, guild, channel, trigger, size, and adapter revision; deduplicate the event before cognition.
- Resolve guest or enrolled authority and assemble labelled Context for this person, purpose, and place.
- Select one exact Pattern for mention,
/reach ask, or bounded presence under audience, quiet hours, budgets, cooldown, expiry, and dedupe. - Commit
ReachTurn@1with Habitat/trigger/caller evidence, Persona/AgentSpec revisions, Context references, Run correlation, output class, and terminal state. - Project at most one
ReachDelivery@1, retaining target, effect identity, payload digest, platform observation, and known/unknown delivery. End the awakening.
Choose an eligible cognition road
A public corpus cannot make the caller's question public. Before remote formation, remove Discord application/user/guild/channel/event ids, roles, presence, mentions, unrelated history, and delivery metadata unless an exact field is task-essential and independently eligible. Send only bounded question, selected public evidence, output contract, and necessary citation ids. Secrets, private people/customer facts, and unique internal incidents retain their labels and normally stay local or refuse.
For reach.external_converse@1, a bounded answer may use local Soulstone capability, one exact Portal model attempt while LychD owns retrieval/citations, or one outbound Intercom task to an enrolled sovereign specialist for reach.public_corpus_answer@1. The A2A road parks durably, quarantines the return, and adopts the first authenticated terminal. Repository inspection/mutation with an iterative CLI loop belongs to separate delegated-coding work; an admitted artifact can return later. Interactive coding subscriptions are outside Reach and Spellweaver automation.
Every remote attempt needs its exact EgressDecision and a Privacy Cut when policy requires one. Retry, fallback, payload, model, peer, or destination changes require another decision. Output remains attributed hostile input until explicit success, refusal, dependency, expiry, failure, or indeterminate settlement. Only a committed delivery intent reaches the Discord credential owner. Deployment owns placement/custody; the standalone E2E contract gives the full ledger chain.
Commands and interrupted delivery
/reach link and /reach unlink belong to Ward. /reach status shows only caller-owned or explicitly shared committed state. Messages, buttons, reactions, roles, and a fluent yes cannot authorize consent, deployment, repository/host mutation, deletion, secrets, authority change, or publication.
Gateway replay deduplicates namespaced event identity and payload digest. Expired interaction tokens may lead to status lookup, never re-running work to manufacture a reply. Disconnect after send leaves delivery unknown until effect identity/payload reconcile.
A contained adapter compromise revokes its Principal, rotates the bot token, closes Gateway, marks deliveries uncertain, and preserves secret-free evidence. Recreate the unit from zero authority only after proving its boundary. Host/root compromise follows the selected profile's clean rebuild, not an in-place restart.
Proving one turn
Deterministic Gateway fixtures and fake text capability prove mention/command, no ambient-message records, guest/member separation, consequential-request refusal, restart dedupe, quiet-hour budgets, revocation, and no duplicate after uncertain delivery. No live Discord/model enters the proof.