Turn

1. Authenticate the Gateway session; verify application, guild, channel, trigger, size, and adapter revision; deduplicate the provider event before cognition.
2. Resolve guest or enrolled caller authority and assemble a labelled, purpose-bounded Context for this person and place only.
3. Run one exact Pattern: direct mention, deliberate /reach ask, or bounded presence under audience, quiet-hour, budget, cooldown, expiry, and dedupe policy.
4. Commit ReachTurn@1 with Habitat, trigger, caller evidence, Persona and AgentSpec revisions, Context references, Run correlation, output class, and terminal state.
5. Project at most one ReachDelivery@1, binding target, effect identity, payload digest, platform result, and known or unknown delivery. End the awakening.

The Pattern may obtain cognition from a local capability, a model Portal, or one outbound Intercom task. Every remote attempt requires a Privacy Cut when policy demands one and a fresh exact EgressDecision; retry, fallback, payload, model, peer, or destination change requires another decision. Provider or peer output returns as attributed untrusted input and takes an explicit success, refusal, dependency, expiry, failure, or indeterminate route. Only a committed delivery intent may reach the credential-bearing Discord edge. The selected deployment profile owns placement and cross-host custody; the standalone receipt owns the complete baseline record and recovery chain.

Public corpus does not make the caller's query public. Before a remote branch, Reach removes Discord user/application/guild/channel/event ids, roles, presence, platform mentions, unrelated history, and delivery metadata unless one field is task-essential and independently eligible. It sends only the bounded question, selected public evidence bundle, output contract, and necessary citation identifiers. A query that introduces a secret, private person, customer fact, or unique internal incident follows its own labels and normally remains local or refuses.

For reach.external_converse@1, road choice is narrow:

An interactive coding subscription is outside Reach and Spellweaver automation. The shared execution-road contract owns the general choice; Reach owns only this application's eligible subset.

/reach link and /reach unlink belong to Ward. /reach status projects only caller-owned or explicitly shared committed state. A message, button, reaction, role, or fluent “yes” cannot settle consent or authorize deployment, repository mutation, host lifecycle, destructive deletion, secrets, authority changes, or publication.

Gateway replay deduplicates by the provider-namespaced event identity and payload digest. After an interaction token expires, status may retrieve committed state; work is never rerun to manufacture a reply. Disconnect after send leaves delivery unknown until reconciled by effect identity and payload digest.

A contained Discord-adapter compromise revokes its Principal, rotates the bot token, closes the Gateway session, marks pending deliveries uncertain, preserves secret-free evidence, and may recreate that unit from zero authority after its boundary is proved. Host/root compromise follows the selected profile recovery contract, including the standalone clean-rebuild procedure, never an in-place restart.

Proving one turn

Use deterministic Gateway fixtures and a fake text capability. Prove one mention and one command, zero records for ambient messages, guest/member authority separation, refusal of consequential requests, restart-safe dedupe, quiet-hour budgets, revocation, and no duplicate after uncertain delivery. No live Discord or live model enters the proof.

References: Mirror · Ward · Context · Deployment profiles · Discord Gateway