Owned event types
events.iterate.com/project/agent-reply-presentedA signed-in client is ALREADY SHOWING an agent's chat reply to the user (the mobile thread screen and the web thread view append this when the reply renders foregrounded). Purely a delivery hint: push channels holding a pending chat-reply notification for the reply settle it suppressed instead of ringing a phone about something on screen. Claims for unknown or already-sent notifications are no-ops, so clients append freely.payload: { path, replyEventOffset }events.iterate.com/project/approval-presentedA signed-in client is ALREADY SHOWING a held approval batch to the user (the mobile in-thread dialog appends this when it renders foregrounded). Purely a delivery hint, never a decision: push channels holding a pending notification for the batch settle it suppressed instead of ringing a phone about something on screen. A claim copied before its notification intent waits durably for it; claims known to be late after an intent was already sent or settled are no-ops, so clients append freely.payload: { approvalRequestEventOffset }events.iterate.com/project/create-failedThe project creation saga reached a deterministic terminal failure and did not declare the project created. Transient availability and timeout failures remain open for durable redelivery. Fail-closed: nothing else reacts on the failed project stream.payload: { createRequestedAtOffset, error, request }emitted by 1 · consumed by 1events.iterate.com/project/create-requestedRequests the project creation saga. The terminal project/created certificate is appended only after sibling processors exist, the seeded default worker has built and answered its readiness probe, and its permanent root feed has been installed.payload: { config }consumed by 1events.iterate.com/project/createdThe project creation saga completed: sibling processors exist, the seeded default project worker is reachable, and its permanent root feed is installed. The feed receives this as its first userspace lifecycle hook; creation itself does not wait for that userspace consequence.payload: { config, createRequestedAtOffset }emitted by 1 · consumed by 1events.iterate.com/project/custom-domain-add-requestedA custom domain should be provisioned and routed to this project.payload: { hostname }consumed by 1events.iterate.com/project/custom-domain-configuredThe hostname is configured and its KV routing registration points at this project.payload: { hostname, kind }emitted by 1 · consumed by 1events.iterate.com/project/custom-domain-provision-failedCustom-domain provisioning failed before an observed Cloudflare status.payload: { error, hostname }emitted by 1 · consumed by 1events.iterate.com/project/custom-domain-remove-requestedA custom domain should be removed from this project.payload: { hostname }consumed by 1events.iterate.com/project/custom-domain-removedA custom domain was removed from Cloudflare and routing KV.payload: { hostname }emitted by 1 · consumed by 1events.iterate.com/project/egress-rules-configuredReplace the project's egress approval rules wholesale. Every outbound request is matched against the ordered list at the Project DO's egress decision point (first match wins, no match allows): a `hold` verdict parks the request in an approval batch until a human decides it on this stream, `deny` refuses it outright.payload: { rules }consumed by 1events.iterate.com/project/heartbeat-triggeredA project-owned Scheduler heartbeat fired. Userspace handles this lifecycle event directly in the config worker.payload: { scheduleKey }consumed by 1events.iterate.com/project/human-approval-decidedTHE verdict on a held batch — one event decides every request in it, by index. When the project has active approval keys, a decision containing any `approve` verdict must carry `keyId` + `signature` (raw 64-byte r‖s ECDSA P-256 over the canonical approval.v2 message, base64) or the whole event is ignored. All-reject decisions never need a signature — deny is the fail-safe direction. The door honors the FIRST decided event referencing a batch; later ones are ignored.payload: { approvalRequestEventOffset, verdicts, decidedBy, reason?, keyId?, signature? }events.iterate.com/project/human-approval-key-addedEnroll a public key whose holder may approve held egress batches. Once any active key exists, decisions containing any `approve` verdict MUST carry a valid ECDSA P-256 signature over the canonical approval message (approval.v2) — unsigned approvals are ignored. All-reject decisions never require a signature.payload: { keyId, publicKey, label? }consumed by 1events.iterate.com/project/human-approval-key-revokedRevoke an enrolled approval key; signatures from it stop being accepted.payload: { keyId }consumed by 1events.iterate.com/project/human-approval-requestedA batch of outbound requests matched one `hold` rule and is parked at the egress door awaiting a human — a lone request is a batch of one. Everything is placeholder form — getSecret(...) references, never material. The requested event's offset IS the batch's identity: the decision references it as approvalRequestEventOffset, and each request's position in `requests` is its index within the batch.payload: { requests, ruleKey, ruleDescription?, streamContext?, expiresAt }consumed by 1events.iterate.com/project/human-approval-settledWhat actually happened after one approved request was released: the upstream status, or the delivery failure. Approval and outcome are separate facts — audits want both — and a batch's released requests finish independently, so each settles on its own.payload: { approvalRequestEventOffset, index, status?, error? }events.iterate.com/project/worker-update-failedA post-creation config repo commit deterministically failed to build as the default project worker. A later config commit can repair it; transient availability remains open for redelivery.payload: { commitOid, error }emitted by 1 · consumed by 1events.iterate.com/project/worker-updatedThe platform successfully built, loaded, and probed the current default project worker, during creation or after a later config repo commit. This is the userspace configuration lifecycle hook; the raw trusted seed commit is not translated.payload: { commitOid }emitted by 1 · consumed by 1
Consumes
Consumes * — every event on the stream reaches this processor's reducer, with these types named explicitly:
events.iterate.com/project/egress-rules-configuredReplace the project's egress approval rules wholesale. Every outbound request is matched against the ordered list at the Project DO's egress decision point (first match wins, no match allows): a `hold` verdict parks the request in an approval batch until a human decides it on this stream, `deny` refuses it outright.events.iterate.com/project/human-approval-key-addedEnroll a public key whose holder may approve held egress batches. Once any active key exists, decisions containing any `approve` verdict MUST carry a valid ECDSA P-256 signature over the canonical approval message (approval.v2) — unsigned approvals are ignored. All-reject decisions never require a signature.events.iterate.com/project/human-approval-key-revokedRevoke an enrolled approval key; signatures from it stop being accepted.events.iterate.com/project/human-approval-requestedA batch of outbound requests matched one `hold` rule and is parked at the egress door awaiting a human — a lone request is a batch of one. Everything is placeholder form — getSecret(...) references, never material. The requested event's offset IS the batch's identity: the decision references it as approvalRequestEventOffset, and each request's position in `requests` is its index within the batch.events.iterate.com/project/custom-domain-add-requestedA custom domain should be provisioned and routed to this project.events.iterate.com/project/custom-domain-configuredThe hostname is configured and its KV routing registration points at this project.events.iterate.com/project/custom-domain-provision-failedCustom-domain provisioning failed before an observed Cloudflare status.events.iterate.com/project/custom-domain-remove-requestedA custom domain should be removed from this project.events.iterate.com/project/custom-domain-removedA custom domain was removed from Cloudflare and routing KV.events.iterate.com/project/create-requestedRequests the project creation saga. The terminal project/created certificate is appended only after sibling processors exist, the seeded default worker has built and answered its readiness probe, and its permanent root feed has been installed.events.iterate.com/project/createdThe project creation saga completed: sibling processors exist, the seeded default project worker is reachable, and its permanent root feed is installed. The feed receives this as its first userspace lifecycle hook; creation itself does not wait for that userspace consequence.events.iterate.com/project/create-failedThe project creation saga reached a deterministic terminal failure and did not declare the project created. Transient availability and timeout failures remain open for durable redelivery. Fail-closed: nothing else reacts on the failed project stream.events.iterate.com/project/worker-updatedThe platform successfully built, loaded, and probed the current default project worker, during creation or after a later config repo commit. This is the userspace configuration lifecycle hook; the raw trusted seed commit is not translated.events.iterate.com/project/worker-update-failedA post-creation config repo commit deterministically failed to build as the default project worker. A later config commit can repair it; transient availability remains open for redelivery.events.iterate.com/project/heartbeat-triggeredA project-owned Scheduler heartbeat fired. Userspace handles this lifecycle event directly in the config worker.events.iterate.com/repo/commit-completedowned by repoThe repo's default branch advanced. OS-owned writes append this fact directly; Cloudflare Artifacts pushed events normalize external Git writes into the same fact.events.iterate.com/repos/createdowned by repoThe repo creation saga completed and its backing Artifact is ready — the repo's birth certificate.events.iterate.com/repos/create-failedowned by repoThe repo creation saga reached a terminal failure and did not declare the repo created. Fail-closed: nothing else ever reacts on a failed repo's stream.events.iterate.com/secret/createdowned by secretCreates a secret processor on this stream. The payload is the immutable birth certificate; the DO copies this event to the project root stream, where the project processor catalogs the secret.events.iterate.com/workspace/createdowned by workspaceCreates a workspace processor on this stream — a pure existence marker. Mounts are not birth facts: every project repo is mounted at its own /repos/** path by derivation; deviations arrive as workspace/configured patches.events.iterate.com/stream/createdowned by coreInitializes the core reduced state for a stream.events.iterate.com/stream/child-stream-createdowned by coreRecords the immediate child stream segment under this stream.events.iterate.com/capability-host/capability-provider-pager-connectedowned by capability-hostA provider client gave this Durable Object a hibernatable Pager: a return channel the host can Page after releasing ordinary RPC references. The event's offset is the Pager's durable identity.events.iterate.com/capability-host/capability-provider-pager-disconnectedowned by capability-hostOne exact Capability Provider Pager disappeared. Every live mount referencing its connected event retires atomically; replacement Pagers and their mounts are unaffected.
Emits
events.iterate.com/capability-host/createdowned by capability-hostCreates a capability-host processor on this stream. The birth certificate records the scope's `fallback`: the itx expression a capability miss follows (usually straight to the project root host), or null at the root.events.iterate.com/project/custom-domain-configuredThe hostname is configured and its KV routing registration points at this project.events.iterate.com/project/custom-domain-provision-failedCustom-domain provisioning failed before an observed Cloudflare status.events.iterate.com/project/custom-domain-removedA custom domain was removed from Cloudflare and routing KV.events.iterate.com/project/createdThe project creation saga completed: sibling processors exist, the seeded default project worker is reachable, and its permanent root feed is installed. The feed receives this as its first userspace lifecycle hook; creation itself does not wait for that userspace consequence.events.iterate.com/project/create-failedThe project creation saga reached a deterministic terminal failure and did not declare the project created. Transient availability and timeout failures remain open for durable redelivery. Fail-closed: nothing else reacts on the failed project stream.events.iterate.com/project/worker-updatedThe platform successfully built, loaded, and probed the current default project worker, during creation or after a later config repo commit. This is the userspace configuration lifecycle hook; the raw trusted seed commit is not translated.events.iterate.com/project/worker-update-failedA post-creation config repo commit deterministically failed to build as the default project worker. A later config commit can repair it; transient availability remains open for redelivery.events.iterate.com/repos/create-requestedowned by repoRequests the repo creation saga: seed an empty repo, copy a public GitHub template subtree, import a private GitHub repo at depth one, or import a public GitHub repo through Cloudflare Artifacts (full history unless depth is set). Terminates in repos/created or repos/create-failed.events.iterate.com/stream/subscription-configuredowned by coreConfigures or replaces one durable subscription for sending this stream's events to a receiver. This is the sole event that enables delivery.events.iterate.com/stream/subscription-removedowned by coreRemoves one durable subscription.