events.iterate.com

Event type reference

Public documentation generated from the stream processor contracts in OS: every processor, the event types it owns, their payload schemas and example events, and how processors consume, emit, and depend on each other.

14 processors · 101 event types

corev0.1.0

Maintains the stream's own reduced state.

events.iterate.com/stream/child-stream-createdRecords the immediate child stream segment under this stream.payload: { childPath }events.iterate.com/stream/configuredConfigures core stream runtime policy.payload: { config }events.iterate.com/stream/connection-closedObserves that a live connection from this stream to a processEventBatch callback closed. Abrupt Durable Object teardown can end an in-memory connection without leaving this best-effort close fact; runtime connection state is authoritative for what is open now.payload: { connectionKey, reason, error? }events.iterate.com/stream/connection-openedA live connection from this stream to a processEventBatch callback opened. Appended by the stream itself once per actual open; reconnecting after a transient break is a new connection.payload: { connectionKey, kind, openedBy? }events.iterate.com/stream/createdInitializes the core reduced state for a stream.payload: { projectId, path, streamId }events.iterate.com/stream/error-occurredRecords a structured stream or processor runner error.payload: { message, error? }events.iterate.com/stream/pausedRecords that the stream is paused and should reject ordinary appends.payload: { reason? }events.iterate.com/stream/processor-revivedA recovery-wired stream processor was revived after its incarnation died owing background work (in-flight obligations lost to an eviction). Appended by the platform's recovery keepalive, never emitted by a processor; the payload's processorSlug names which processor was revived (the type string is shared by every recovery-wired processor). Consumption is optional and only needed when the processor reacts to the fact itself; an unconsumed tail still receives the runner's eventless at-head turn so open obligations are not stranded.payload: { processorSlug, revivals, version }events.iterate.com/stream/resumedRecords that the stream has resumed accepting ordinary appends.payload: { reason? }events.iterate.com/stream/subscription-configuredConfigures or replaces one durable subscription for sending this stream's events to a receiver. This is the sole event that enables delivery.payload: { name?, description?, filter?, receiver }events.iterate.com/stream/subscription-cursor-setChanges the next source offset read by one copy, ITX-call, or webhook subscription (exclusive afterOffset semantics). It rejects offsets beyond the current stream head. A receiver call already in progress may still finish, but cannot advance this new position. Hosted processors reject this event because the processor stores its own checkpoint.payload: { name, afterOffset }events.iterate.com/stream/subscription-delivery-haltedOne subscription stopped after delivering matching source events exhausted the bounded retry count.payload: { name, reason, afterOffset, attempts, error? }events.iterate.com/stream/subscription-delivery-resumedResumes one halted subscription at its existing cursor.payload: { name }events.iterate.com/stream/subscription-removedRemoves one durable subscription.payload: { name, reason }events.iterate.com/stream/wokenRecords that a Durable Object incarnation has started running this stream.payload: { incarnationId }

projectv0.7.0

Project root: runs the project/create-requested → project/created bootstrap saga, births the sibling processors every project gets (root capability host, primary scheduler, config repo, email router, notification facet), catalogs the project's streams and domain objects, manages custom-domain routing, and holds the egress-approval policy.

events.iterate.com/project/agent-birth-defaults-configuredThe project's config worker declares birth defaults for agents born through the generic creation door: a list of plain agent-vocabulary events (a prompt is a keyed agents/context-added, a driver choice an agent/configured, a processor attachment an allowlisted stream/subscription-configured) appended into every matching birth batch with platform-minted content-hash idempotency keys. Latest occurrence wins; explicit call-site policies (integration routers) outrank it.payload: { matches?, birthEvents }events.iterate.com/project/agent-reply-presentedA signed-in client is ALREADY SHOWING an agent's chat reply to the user (the mobile thread screen and the web thread view append this when the reply renders foregrounded). Purely a delivery hint: push channels holding a pending chat-reply notification for the reply settle it suppressed instead of ringing a phone about something on screen. Claims for unknown or already-sent notifications are no-ops, so clients append freely.payload: { path, replyEventOffset }events.iterate.com/project/approval-presentedA signed-in client is ALREADY SHOWING a held approval batch to the user (the mobile in-thread dialog appends this when it renders foregrounded). Purely a delivery hint, never a decision: push channels holding a pending notification for the batch settle it suppressed instead of ringing a phone about something on screen. A claim copied before its notification intent waits durably for it; claims known to be late after an intent was already sent or settled are no-ops, so clients append freely.payload: { approvalRequestEventOffset }events.iterate.com/project/create-failedThe project creation saga reached a deterministic terminal failure and did not declare the project created. Transient availability and timeout failures remain open for durable redelivery. Fail-closed: nothing else reacts on the failed project stream.payload: { createRequestedAtOffset, error, request }events.iterate.com/project/create-requestedRequests the project creation saga. The terminal project/created certificate is appended only after sibling processors exist, the seeded default worker has built and answered its readiness probe, and its permanent root feed has been installed.payload: { config }events.iterate.com/project/createdThe project creation saga completed: sibling processors exist, the seeded default project worker is reachable, and its permanent root feed is installed. This is a platform certificate, not a userspace lifecycle hook.payload: { config, createRequestedAtOffset }events.iterate.com/project/custom-domain-add-requestedA custom domain should be provisioned and routed to this project.payload: { hostname }events.iterate.com/project/custom-domain-configuredThe hostname is configured and its KV routing registration points at this project.payload: { hostname, kind }events.iterate.com/project/custom-domain-provision-failedCustom-domain provisioning failed before an observed Cloudflare status.payload: { error, hostname }events.iterate.com/project/custom-domain-remove-requestedA custom domain should be removed from this project.payload: { hostname }events.iterate.com/project/custom-domain-removedA custom domain was removed from Cloudflare and routing KV.payload: { hostname }events.iterate.com/project/egress-rules-configuredReplace the project's egress approval rules wholesale. Every outbound request is matched against the ordered list at the Project DO's egress decision point (first match wins, no match allows): a `hold` verdict parks the request in an approval batch until a human decides it on this stream, `deny` refuses it outright.payload: { rules }events.iterate.com/project/heartbeat-triggeredA project-owned Scheduler heartbeat fired. Userspace handles this lifecycle event directly in the config worker.payload: { scheduleKey }events.iterate.com/project/human-approval-decidedTHE verdict on a held batch — one event decides every request in it, by index. When the project has active approval keys, a decision containing any `approve` verdict must carry `keyId` + `signature` (raw 64-byte r‖s ECDSA P-256 over the canonical approval.v2 message, base64) or the whole event is ignored. All-reject decisions never need a signature — deny is the fail-safe direction. The door honors the FIRST decided event referencing a batch; later ones are ignored.payload: { approvalRequestEventOffset, verdicts, decidedBy, reason?, keyId?, signature? }events.iterate.com/project/human-approval-key-addedEnroll a public key whose holder may approve held egress batches. Once any active key exists, decisions containing any `approve` verdict MUST carry a valid ECDSA P-256 signature over the canonical approval message (approval.v2) — unsigned approvals are ignored. All-reject decisions never require a signature.payload: { keyId, publicKey, label? }events.iterate.com/project/human-approval-key-revokedRevoke an enrolled approval key; signatures from it stop being accepted.payload: { keyId }events.iterate.com/project/human-approval-requestedA batch of outbound requests matched one `hold` rule and is parked at the egress door awaiting a human — a lone request is a batch of one. Everything is placeholder form — getSecret(...) references, never material. The requested event's offset IS the batch's identity: the decision references it as approvalRequestEventOffset, and each request's position in `requests` is its index within the batch.payload: { requests, ruleKey, ruleDescription?, streamContext?, expiresAt }events.iterate.com/project/human-approval-settledWhat actually happened after one approved request was released: the upstream status, or the delivery failure. Approval and outcome are separate facts — audits want both — and a batch's released requests finish independently, so each settles on its own.payload: { approvalRequestEventOffset, index, status?, error? }events.iterate.com/project/onboarding-completedThe project owner completed the onboarding agent flow.payload: { agentPath }events.iterate.com/project/worker-update-failedA post-creation config repo commit deterministically failed to build as the default project worker. A later config commit can repair it; transient availability remains open for redelivery.payload: { commitOid, error }events.iterate.com/project/worker-updatedThe platform successfully built, loaded, and probed the current default project worker, during creation or after a later config repo commit. This is the userspace configuration lifecycle hook; the raw trusted seed commit is not translated.payload: { commitOid }

repov0.8.0

Projects repo lifecycle, Git activity, and linked GitHub default-branch imports.

events.iterate.com/github/webhook-receivedOne GitHub push delivery, captured as decoded JSON on the connection stream and copied here by the repo's linkGithub subscription. The trusted envelope is structural while the vendor body stays loose.payload: { body, delivery, installationId }events.iterate.com/repo/cloudflare-artifact-event-receivedA Cloudflare Artifacts lifecycle or Git event captured from the deployment's event queue and routed to this repo stream.payload: { artifactName, body, cloudflareEventType?, namespace }events.iterate.com/repo/commit-completedThe repo's default branch advanced. OS-owned writes append this fact directly; Cloudflare Artifacts pushed events normalize external Git writes into the same fact.payload: { beforeCommitOid, branch, commitOid }events.iterate.com/repo/github-import-completedA GitHub import obligation completed, including when Artifacts was already at the current GitHub head.payload: { branch, commitOid, requestId, requestedCommitOid }events.iterate.com/repo/github-import-failedA GitHub import obligation failed without blocking later repo events; a later push or explicit sync can retry.payload: { branch, error, requestId, requestedCommitOid }events.iterate.com/repo/github-import-requestedA linked GitHub default-branch push opened a durable import obligation.payload: { branch, requestId, requestedCommitOid }events.iterate.com/repo/github-import-startedThe repo processor durably began a GitHub import attempt — journaled BEFORE the sync body runs, so an attempt that dies with its incarnation is visibly owed.payload: { branch, requestId, requestedCommitOid }events.iterate.com/repo/github-link-configuredThe repo was linked to a GitHub repository (mirror commits out and import fast-forward default-branch pushes).payload: { connection, installationId, owner, repo, repositoryId }events.iterate.com/repo/github-push-completedA mirror push delivered the branch head to the linked GitHub repository.payload: { branch, commitOid, owner, repo }events.iterate.com/repo/github-push-failedA mirror push to the linked GitHub repository failed. Best-effort mirroring self-heals: the next commit's push carries every missing commit, and repo.pushToGithub() repairs on demand.payload: { branch, commitOid, error, owner, repo }events.iterate.com/repo/github-syncedThe repo adopted the linked GitHub repository's branch head (syncFromGithub or resetFromGithub).payload: { branch, commitOid, forced, owner, previousCommitOid, repo, reset? }events.iterate.com/repo/github-unlinkedThe repo's GitHub link was removed.payload: { connection, owner, repo, repositoryId }events.iterate.com/repos/create-failedThe repo creation saga reached a terminal failure and did not declare the repo created. Fail-closed: nothing else ever reacts on a failed repo's stream.payload: { error, request }events.iterate.com/repos/create-requestedRequests the repo creation saga: seed an empty repo, copy a public GitHub template subtree, import a private GitHub repo at depth one, or import a public GitHub repo through Cloudflare Artifacts (full history unless depth is set). Terminates in repos/created or repos/create-failed.payload: { type } | { type, owner, path?, ref?, repo } | { type, connection, owner, repo } | { t…events.iterate.com/repos/createdThe repo creation saga completed and its backing Artifact is ready — the repo's birth certificate.payload: { request, artifactName, defaultBranch, remote }

agentv5.2.0

Maintains model-visible history, schedules debounced offset-identified LLM turns, runs them through the Workers AI transport, and executes scripts through the capability host.

events.iterate.com/agent/binding-setSets or enriches the typed external object this agent represents. Bindings are normally emitted atomically with integration agent creation, never inferred from paths. Contract-owned but reduced by integration processors, not by the agent.payload: { type, connection, channelId, threadTs, channelName?, url? } | { type, connection, cha…events.iterate.com/agent/configuredMerges a partial configuration into the agent's config; omitted keys keep their current values.payload: { config }events.iterate.com/agent/createdThe agent exists. Payload is open — provenance may ride along.payload: { …any }events.iterate.com/agent/llm-request-requestedThe recorded INTENT to run one LLM turn. Carries no id: the request's identity is the offset this event gets on commit. The reduce ignores it when no trigger is pending or a request already is open — a late debounced intent is a harmless stream fact.payload: { model, expiresAt }events.iterate.com/agent/llm-request-settledThe ONE terminal fact for an LLM request (succeeded | failed | cancelled), pointing back at the requested event's offset. Idempotency-keyed on that offset, so a zombie driver racing a fresh incarnation or an interrupt collapses to one settlement.payload: { requestOffset, durationMs?, result }events.iterate.com/agent/llm-response-chunkOne streamed chunk received from the transport, verbatim. Ephemeral: it reaches open browser/TUI connections but is excluded from default reads and durable subscriptions, and may be evicted — the durable truth is the assistant context item / llm-request-settled pair.payload: { chunk, llmRequestOffset, sequence }events.iterate.com/agent/pausedThe agent stopped scheduling turns (autonomous-loop breaker, or an operator). Mirrors stream/paused. A breaker pause names its causal trigger and reduces to nothing if newer external input already superseded it. The next external message resumes an applied pause; self-driven triggers stay parked.payload: { reason?, triggerOffset? }events.iterate.com/agent/resumedThe agent resumed scheduling turns. Mirrors stream/resumed.payload: { reason? }events.iterate.com/agent/summary-updatedUpdates the agent's human-readable summary. Omitted fields remain unchanged, null clears an optional field, and pinned false unpins. The same event is used whether an agent or a human initiated the edit; the processor's own conditional waiting clear ({ waitingFor: null, clearWaitingForThroughOffset }) only clears a wait established at or before the waking input's offset.payload: { title?, description?, activity?, waitingFor?, pinned? } | { waitingFor, clearWaitingF…events.iterate.com/agent/token-usage-reportedNormalized token counts and the model's context window for a successful LLM request. The processor translates vendor usage dialects (input_tokens vs prompt_tokens) at source, so consumers — the state tally, cost views, and compaction — see one shape.payload: { llmRequestOffset, model, maxContextTokens, inputTokens, outputTokens, cachedInputToke…events.iterate.com/agents/context-addedModel-visible context arrived (user message, developer note, assistant output, system item). The single source of truth for what the LLM sees.payload: { role, content, key?, files?, refs?, actor?, llmRequestPolicy?, llmRequestOffset?, com…events.iterate.com/agents/web-message-sentA visible agent message was sent to the web UI — by a script (itx.chat.sendMessage), or by a userland response interpreter delivering prose extracted straight from an assistant output. The processor mirrors script-sent messages back into context as assistant history so the model sees what it sent; extracted messages carry llmRequestOffset and are NOT mirrored — their raw text is already in history as the assistant context item.payload: { message, files?, llmRequestOffset? }

capability-hostv0.6.0

A tiny dynamic capability table and script execution stream.

events.iterate.com/capability-host/capability-providedA capability was mounted at a path.payload: { type, path, providerPager, instructions?, types?, flattenNestedPaths? } | { type, pat…events.iterate.com/capability-host/capability-provider-pager-connectedA provider client gave this Durable Object a hibernatable Pager: a return channel the host can Page after releasing ordinary RPC references. The event's offset is the Pager's durable identity.payload: {}events.iterate.com/capability-host/capability-provider-pager-disconnectedOne exact Capability Provider Pager disappeared. Every live mount referencing its connected event retires atomically; replacement Pagers and their mounts are unaffected.payload: { connectedAtOffset }events.iterate.com/capability-host/capability-revokedA dynamic capability was removed.payload: { path, providedAtOffset? }events.iterate.com/capability-host/createdCreates a capability-host processor on this stream. The birth certificate records the scope's `fallback`: the itx expression a capability miss follows (usually straight to the project root host), or null at the root.payload: { config, fallback? }events.iterate.com/capability-host/preamble-removedRemoves one preamble entry by key; unknown keys reduce to a no-op.payload: { key }events.iterate.com/capability-host/preamble-setUpserts one preamble entry: TypeScript injected above every later script in this scope, at typecheck and at execution. Keyed — a re-set at the same key replaces the code but keeps the entry's injection position (first-set offset). Entries recorded through setPreamble were compiled against the scope's assembled preamble at set time; a stale entry that stops compiling later never blocks a script (the run gate downgrades preamble-line errors to unchecked).payload: { key, code }events.iterate.com/capability-host/script-run-requestedA script should run in this capability scope. Before any attempt starts, the code is typechecked against the scope's capability types: a script with a PROVABLE error — a syntax error, or a near-miss typo where the compiler names the fix ("Did you mean 'get'?") — settles straight to an error completion carrying the compiler errors, without ever running (no started event). Everything less certain runs: capabilities are provided dynamically and declared types can lag the runtime, so bare property/argument mismatches, unknown/untyped capabilities, non-async block shapes, and checker failures all let the script run unchecked.payload: { code, executionId, expiresAt }events.iterate.com/capability-host/script-run-settledThe one durable settlement for a script obligation. Failures classify where execution stopped, whether script code may have run, and whether cancellation can prove external work ended.payload: { executionId, settlement }events.iterate.com/capability-host/script-run-startedAn attempt to run the script began. Appended BEFORE the script body executes, so requested-without-started provably never ran (safe to start late) while started-without-settled died mid-run (settled as failure, never re-run).payload: { executionId }

secretv0.7.0

Reduces one path-addressed secret — birth policy, encrypted material, egress pin, refresh strategy, usage audit — without ever exposing material.

sandboxv0.4.1

Sandbox lifecycle: explicit create/start/sleep/destroy commands and their completions, workspace snapshot/restore persistence, and configuration changes.

events.iterate.com/sandbox/backup-created/workspace was snapshotted to R2 (an explicit sleep() or the idle timer); this backup is what the next start restores.payload: { backupId }events.iterate.com/sandbox/backup-failedA workspace snapshot failed; the container still stops, and the previous good backup (if any) remains the restore source.payload: { error }events.iterate.com/sandbox/configuredThe sandbox's env-var map changed (setEnvVars, or `env` at create). `env` is the map set in this change (key → value; null = key unset); values are conventionally `getSecret(path)` placeholders substituted only at egress, or non-secret literals. NEVER put raw secret material in a value — it lands on this durable stream.payload: { env }events.iterate.com/sandbox/create-requesteditx.sandboxes.get(path).create was called: the claimed path, the requested instance type (fixed for the sandbox's whole life) and any initial config. UNLIKE every other sandbox event this lands on the /sandboxes CATALOGUE stream, idempotency-keyed by path — the append IS the atomic name claim, and its instance type is what routes get(path) to the right container namespace. Setup follows; `created` (on the sandbox's own stream) confirms it.payload: { path, instanceType, sleepAfter?, keepAlive?, env? }events.iterate.com/sandbox/createdThe sandbox exists: identity and configuration are durably stored and itx.sandboxes.get(path) resolves it. No container is running yet — the first command (or start()) boots one.payload: { config }events.iterate.com/sandbox/destroy-requesteddestroy() was called: tear the sandbox down permanently. `destroyed` confirms.payload: {}events.iterate.com/sandbox/destroyedThe sandbox is permanently gone: container torn down and the identity tombstoned — the path can never be created again (pick a new name). Workspace snapshots in R2 age out on their ttl.payload: {}events.iterate.com/sandbox/kill-requestedkill() was called: the current Durable Object incarnation is deliberately aborted after this fact is durably reduced. The container lifecycle and reduced running state are unchanged; the next request boots a fresh object around the same sandbox.payload: {}events.iterate.com/sandbox/sleep-requestedsleep() was called (Cloudflare's word for what the idle timer does, on demand): snapshot /workspace, then tear the container down. The sandbox stays created — the next start (or command) boots a fresh container and restores the snapshot. The SDK's stop() forwards here so no spelling skips the snapshot.payload: {}events.iterate.com/sandbox/start-requestedstart() was called: boot the container now (rather than lazily on the first command). `started` confirms the boot.payload: {}events.iterate.com/sandbox/startedThe sandbox container booted (the SDK's onStart hook) — after an explicit start() OR implicitly because a command reached a stopped sandbox. /workspace is restored from the newest snapshot before commands run.payload: {}events.iterate.com/sandbox/stoppedThe sandbox container exited (the SDK's onStop hook) — after an explicit sleep(), the idle timer (sleepAfter), or a destroy. May be appended on a LATER wake: the SDK delivers a stop that happened while the Durable Object was hibernated on the next wake.payload: {}events.iterate.com/sandbox/workspace-restored/workspace was restored from the named R2 snapshot into the fresh container — what makes stop/sleep survivable: files under /workspace come back, everything else on the container disk is gone.payload: { backupId }

workspacev0.4.0

Workspace lifecycle and configuration: existence plus an overlay of mount deviations. The default mount table is DERIVED (every project repo at its own /repos/** path, commit-to-main); overlays add extra mounts or change a derived mount's fields.

slackv0.3.0

Routes raw Slack webhooks into Slack-backed agent streams: reduces a `channel:thread_ts → stream path` routing table, births the routed agent stream on first contact, and forwards each webhook unchanged. It never interprets webhooks as agent context — that is the slack-agent processor's job.

slack-agentv0.11.0

Handles Slack-specific behavior for one routed Slack agent stream: transcribes forwarded webhooks into agent context (mention-gated LLM wake), compiles !bang commands into script runs, and paints the agent's summary/runtime onto Slack's assistant thread UI.

This processor owns no event types.

telegramv0.4.0

Routes raw Telegram webhook updates into Telegram-backed agent streams.

telegram-agentv0.3.0

Handles Telegram-specific behavior for one routed Telegram agent stream.

browser-raw-eventsv0.1.0

Stores raw stream events in the browser SQLite events table.

This processor owns no event types.

browser-feedv0.6.0

Browser-side projector reducing every stream event into the single feed_items table (pretty agent rows and grouped raw rows in one total order) plus live in-flight agent state.

This processor owns no event types.