diff --git a/.env.example b/.env.example
index 465d645..8e6c5df 100644
--- a/.env.example
+++ b/.env.example
@@ -229,3 +229,37 @@ SUPERVISOR_TOKEN=
 # Set to runsc to run every computer under gVisor, if the host has it. Unset, a computer is an
 # ordinary container and shares the host kernel, which is worth knowing when the Bot is not ours.
 COMPUTER_RUNTIME=
+
+# ---------------------------------------------------------------------------
+# Routines: work a Bot does without being asked
+# ---------------------------------------------------------------------------
+
+# The switch. `off` leaves routines writable and readable, and stops every way of running one: the
+# clock, Run now, and a webhook delivery alike.
+#
+# All three, because this is what a second copy of a deployment wants. Restoring a database dump onto
+# a development machine otherwise means somebody's real routines browsing their real systems at eight
+# o'clock, and the restored webhook triggers keep their endpoint ids and their secrets, so the
+# senders that were configured against them go on setting Bots working. The run is unattended either
+# way, so nobody is there to notice. With this off the receiver below is not started at all. It is a
+# whole-deployment switch for that reason, and it is announced at boot rather than being a silent
+# absence of activity.
+# ROUTINE_SCHEDULER=off
+
+# Where webhook deliveries arrive. Defaults to one above PORT. Not started when ROUTINE_SCHEDULER is
+# off, because a delivery does not go through the clock and closing one door is not closing the other.
+#
+# A port of its own, not a path on the API. This is the one surface in the product meant to be
+# reachable by a third party, and the way to keep the rest of the API away from it is for the rest of
+# the API not to be on it: this listener serves /health and /hooks/:endpointId and answers 404 to
+# everything else, including anything that looks like an API path.
+#
+# Each trigger has a random endpoint id and a bearer secret, shown once when it is created or
+# rotated and stored only as a hash. A new trigger keeps its first authenticated delivery as a sample
+# and runs nothing until somebody has looked at what arrived and confirmed it in /admin/webhooks.
+# ROUTINE_WEBHOOK_PORT=3002
+
+# What the receiver binds to. 127.0.0.1 unless this says otherwise, the same posture as everything
+# else here: an endpoint reachable from the internet should be a decision somebody made, not one they
+# inherited by starting the server. Put a reverse proxy in front of it rather than opening it wide.
+# ROUTINE_WEBHOOK_HOST=127.0.0.1
diff --git a/README.md b/README.md
index 244670c..1d45916 100644
--- a/README.md
+++ b/README.md
@@ -112,6 +112,7 @@ A Bot is any endpoint speaking [AG-UI](https://github.com/ag-ui-protocol/ag-ui),
 | `/channel/:id`       | Converse with one coworker and view its live screen/profile panel. |
 | `/bot`               | Direct chat with a Bot; `?agent=<id>` selects one.                 |
 | `/skills`            | Create and enable personal skills.                                 |
+| `/routines`          | Schedule unattended work, run one now, and read its run history.   |
 | `/settings`          | User preferences.                                                  |
 | `/admin/connectors`  | Configure deployment knowledge sources.                            |
 | `/admin/credentials` | Store write-only encrypted credentials.                            |
@@ -120,6 +121,7 @@ A Bot is any endpoint speaking [AG-UI](https://github.com/ag-ui-protocol/ag-ui),
 | `/admin/components`  | Publish components and govern which Bots may use them.             |
 | `/admin/playground`  | Draft and publish sandboxed components in the browser.             |
 | `/admin/plugins`     | Configure MCP servers, MCP grants, and deployment skills.          |
+| `/admin/webhooks`    | Create webhook triggers, confirm a first delivery, rotate secrets. |
 | `/admin/audit`       | Review permitted, refused, and failed actions.                     |
 
 ## Features
@@ -133,6 +135,8 @@ A Bot is any endpoint speaking [AG-UI](https://github.com/ag-ui-protocol/ag-ui),
 - **Components instead of prose**: compiled React components live in `app/src/components/gallery/`, sandboxed ones are authored in `/admin/playground` and published with no deployment. Every call asks the server whether the component exists, is published, and is not withheld from that Bot. Data functions are granted per component.
 - **Governed MCP**: a curated catalogue ships for Atlassian, Box, Slack, Salesforce and ServiceNow. Custom servers must pass URL checks, and any tool not positively classified as a read is treated as a write.
 - **Skills are instructions, not capabilities**: personal skills attach only to Bots their author owns, deployment skills are admin-owned, and both are invoked with `/` in the composer.
+- **Routines run unattended, through the same gateway**: a scheduled run drives the Bot server side with no browser in the loop, and every tool call still goes through the gateway, so the same policy decides it and the same audit row records it. A window the deployment slept through is recorded as `missed` rather than fired late. `run.unattended` is a policy attribute, so a deployment can write `run.unattended && intent == "activate"` to let a routine read and never press.
+- **Webhook triggers on their own port**: deliveries arrive on `ROUTINE_WEBHOOK_PORT` (default `PORT + 1`), which serves `/health` and `/hooks/:endpointId` and nothing else. A bearer secret is stored only as a hash and compared in constant time, and a new trigger keeps its FIRST authenticated delivery as a sample and runs nothing until a person has looked at it. Triggers are an administrator's: they are the deployment's exposure rather than one person's work, and `/admin/webhooks` lists every one of them.
 - **An audit trail you can read**: `/admin/audit` lists what was permitted, what was refused and what failed, and every refusal carries the rule that caused it.
 - **Credentials encrypted at rest**: stored through `/admin/credentials`, never returned by an API, and redacted from audit events.
 - **Loopback by default**: computers bind to `127.0.0.1` and require a per-container token, so nothing reaches a logged-in browser by knowing its port.
diff --git a/app/src/components/admin/admin-sidebar.tsx b/app/src/components/admin/admin-sidebar.tsx
index 1a5559e..fd5105c 100644
--- a/app/src/components/admin/admin-sidebar.tsx
+++ b/app/src/components/admin/admin-sidebar.tsx
@@ -8,6 +8,7 @@ import {
   IconPlugConnected,
   IconPuzzle,
   IconShieldCheck,
+  IconWebhook,
 } from "@tabler/icons-react";
 import { Link, type LinkOptions } from "@tanstack/react-router";
 import type * as React from "react";
@@ -84,6 +85,13 @@ const GROUPS: {
         icon: IconCode,
         linkOptions: { to: "/admin/playground" },
       },
+      // Under what Bots can do rather than what they can reach: a trigger does not grant a Bot
+      // anything, it lets somebody else start work the Bot could already do.
+      {
+        title: "Webhooks",
+        icon: IconWebhook,
+        linkOptions: { to: "/admin/webhooks" },
+      },
     ],
   },
   {
diff --git a/app/src/components/app-sidebar/app-sidebar.tsx b/app/src/components/app-sidebar/app-sidebar.tsx
index eed2823..36277b0 100644
--- a/app/src/components/app-sidebar/app-sidebar.tsx
+++ b/app/src/components/app-sidebar/app-sidebar.tsx
@@ -1,5 +1,6 @@
 import {
   IconBolt,
+  IconClockPlay,
   IconLogout,
   IconPlus,
   IconSearch,
@@ -286,6 +287,30 @@ export function AppSidebar({ ...props }: React.ComponentProps<typeof Sidebar>) {
               <span className="text-sm trackint-tight">Skills</span>
             </SidebarMenuButton>
           </SidebarMenuItem>
+          <SidebarMenuItem>
+            {/*
+             * Beside Skills rather than inside Admin, and for the same reason: a routine is work a
+             * person schedules for their own Bot, not a deployment-wide setting. What an
+             * administrator governs is the boundary those runs meet, which is already in Admin.
+             */}
+            <SidebarMenuButton
+              className="hover:bg-foreground/5 h-10"
+              render={(props) => (
+                <Link
+                  {...props}
+                  to="/routines"
+                  activeProps={{
+                    className: "bg-foreground/5",
+                  }}
+                />
+              )}
+            >
+              <div className="size-[28px] flex items-center justify-center">
+                <IconClockPlay />
+              </div>
+              <span className="text-sm trackint-tight">Routines</span>
+            </SidebarMenuButton>
+          </SidebarMenuItem>
           <SidebarMenuItem>
             <SidebarMenuButton
               className="hover:bg-foreground/5 h-10"
diff --git a/app/src/lib/routines/queries.ts b/app/src/lib/routines/queries.ts
new file mode 100644
index 0000000..ab7ede4
--- /dev/null
+++ b/app/src/lib/routines/queries.ts
@@ -0,0 +1,187 @@
+import { queryOptions } from "@tanstack/react-query";
+
+/**
+ * Routines and webhook triggers, as the browser sees them.
+ *
+ * The shapes mirror the server's records rather than being a convenience view of them, so a field
+ * added there shows up here as a type error rather than as a value the page silently ignores.
+ */
+
+export type RoutineSchedule =
+  | { type: "once"; at: string }
+  /** `time` is HH:MM UTC and `weekdays` is 0 for Sunday through 6 for Saturday, as the server's is. */
+  | { type: "daily"; time: string; weekdays: number[] };
+
+export type RoutineRunStatus =
+  | "queued"
+  | "running"
+  | "completed"
+  | "failed"
+  /** The deployment was not running when the window came round. See the page for why this exists. */
+  | "missed";
+
+export type RoutineRun = {
+  id: string;
+  routineId: string;
+  trigger: "schedule" | "manual" | "webhook";
+  status: RoutineRunStatus;
+  startedAt: string;
+  finishedAt: string | null;
+  summary: string | null;
+  error: string | null;
+  threadId: string | null;
+};
+
+export type Routine = {
+  id: string;
+  agentId: string;
+  ownerUserId: string;
+  name: string;
+  prompt: string;
+  schedule: RoutineSchedule;
+  enabled: boolean;
+  createdAt: string;
+  updatedAt: string;
+  /** Computed by the server on every read. Null for a schedule that will never call again. */
+  nextDueAt: string | null;
+  lastRun: RoutineRun | null;
+};
+
+export type WebhookTrigger = {
+  id: string;
+  /** The public path segment. The full URL is built from it where it is shown. */
+  endpointId: string;
+  name: string;
+  routineId: string | null;
+  agentId: string | null;
+  prompt: string | null;
+  enabled: boolean;
+  /** True until somebody has looked at a real delivery and confirmed it. */
+  verificationPending: boolean;
+  verifiedAt: string | null;
+  /** The first authenticated delivery, so the confirmation is an informed one. */
+  sample: Record<string, unknown> | null;
+  eventTypes: string[];
+  deliveryCount: number;
+  lastReceivedAt: string | null;
+  createdAt: string;
+};
+
+export const routineKeys = {
+  all: ["routines"] as const,
+  list: () => ["routines", "list"] as const,
+  runs: (routineId: string) => ["routines", "runs", routineId] as const,
+  triggers: () => ["routines", "triggers"] as const,
+};
+
+export function routineListQueryOptions() {
+  return queryOptions({
+    queryKey: routineKeys.list(),
+    /*
+     * Refetched while the page is open, because a routine's state changes without anybody on this
+     * screen doing anything: the clock fires, a run finishes, a delivery arrives. A page that only
+     * updated when you pressed something would show a run as still going for as long as you looked
+     * at it.
+     */
+    refetchInterval: 15_000,
+    queryFn: async (): Promise<Routine[]> => {
+      const response = await fetch("/api/routines", { credentials: "include" });
+      if (!response.ok) throw new Error("Routines could not be loaded.");
+      return ((await response.json()) as { routines: Routine[] }).routines;
+    },
+  });
+}
+
+export function routineRunsQueryOptions(routineId: string) {
+  return queryOptions({
+    queryKey: routineKeys.runs(routineId),
+    enabled: routineId.length > 0,
+    refetchInterval: 15_000,
+    queryFn: async (): Promise<RoutineRun[]> => {
+      const response = await fetch(
+        `/api/routines/${encodeURIComponent(routineId)}/runs`,
+        { credentials: "include" },
+      );
+      if (!response.ok) throw new Error("The run history could not be loaded.");
+      return ((await response.json()) as { runs: RoutineRun[] }).runs;
+    },
+  });
+}
+
+/**
+ * Every trigger in the deployment, which is what the administrators' page shows.
+ *
+ * Not this person's own, unlike the routines above. A trigger is a URL somebody outside can call,
+ * so the useful list is all of them; the server refuses this to anybody who is not an administrator.
+ */
+export function webhookTriggerQueryOptions() {
+  return queryOptions({
+    queryKey: routineKeys.triggers(),
+    queryFn: async (): Promise<WebhookTrigger[]> => {
+      const response = await fetch("/api/routines/triggers", {
+        credentials: "include",
+      });
+      if (!response.ok) throw new Error("Triggers could not be loaded.");
+      return ((await response.json()) as { triggers: WebhookTrigger[] })
+        .triggers;
+    },
+  });
+}
+
+/**
+ * Call the routines API and surface the server's own sentence when it refuses.
+ *
+ * The server refuses for reasons this page cannot check, and its wording is the only useful part of
+ * a failure. Paraphrasing it into "That did not work" throws away the sentence somebody needs.
+ */
+export async function callRoutines(
+  path: string,
+  init: RequestInit,
+): Promise<unknown> {
+  const response = await fetch(`/api/routines${path}`, {
+    credentials: "include",
+    headers: { "content-type": "application/json" },
+    ...init,
+  });
+  const body = (await response.json().catch(() => null)) as {
+    error?: string;
+    detail?: string;
+  } | null;
+  if (!response.ok) {
+    throw new Error(body?.error ?? body?.detail ?? "That did not work.");
+  }
+  return body;
+}
+
+/**
+ * How a schedule reads on screen.
+ *
+ * The same words as routines/schedule.ts on the server, written twice because the two sides share no
+ * module and the browser cannot import from the server's. Nothing enforces the agreement, so the
+ * cheap thing that can be done is done: the same normalisation, through `Date`, rather than a string
+ * slice that quietly disagrees the moment a schedule arrives spelled `+00:00` instead of `Z`.
+ */
+export function describeSchedule(schedule: RoutineSchedule): string {
+  if (schedule.type === "once") {
+    return `Once, at ${new Date(schedule.at).toISOString().replace("T", " ").slice(0, 16)} UTC`;
+  }
+  if (schedule.weekdays.length === 0) return "Never, no days are selected";
+  if (schedule.weekdays.length === 7)
+    return `Every day at ${schedule.time} UTC`;
+  return `${schedule.weekdays
+    .map((day) => DAY_NAMES[day] ?? String(day))
+    .join(", ")} at ${schedule.time} UTC`;
+}
+
+export const DAY_NAMES = [
+  "Sunday",
+  "Monday",
+  "Tuesday",
+  "Wednesday",
+  "Thursday",
+  "Friday",
+  "Saturday",
+] as const;
+
+/** Weekdays, as the button row offers them: Monday first, which is how people read a week. */
+export const WEEK = [1, 2, 3, 4, 5, 6, 0] as const;
diff --git a/app/src/routeTree.gen.ts b/app/src/routeTree.gen.ts
index 3feb12c..adc9020 100644
--- a/app/src/routeTree.gen.ts
+++ b/app/src/routeTree.gen.ts
@@ -16,6 +16,7 @@ import { Route as AuthedAdminRouteRouteImport } from './routes/_authed/admin/rou
 import { Route as AuthedSettingsRouteRouteImport } from './routes/_authed/settings/route'
 import { Route as AuthedAppIndexRouteImport } from './routes/_authed/_app/index'
 import { Route as AuthedAppBotRouteImport } from './routes/_authed/_app/bot'
+import { Route as AuthedAppRoutinesRouteImport } from './routes/_authed/_app/routines'
 import { Route as AuthedAppSkillsRouteImport } from './routes/_authed/_app/skills'
 import { Route as AuthedAdminIndexRouteImport } from './routes/_authed/admin/index'
 import { Route as AuthedAdminAuditRouteImport } from './routes/_authed/admin/audit'
@@ -26,6 +27,7 @@ import { Route as AuthedAdminConnectorsRouteImport } from './routes/_authed/admi
 import { Route as AuthedAdminCredentialsRouteImport } from './routes/_authed/admin/credentials'
 import { Route as AuthedAdminPlaygroundRouteImport } from './routes/_authed/admin/playground'
 import { Route as AuthedAdminPluginsRouteImport } from './routes/_authed/admin/plugins'
+import { Route as AuthedAdminWebhooksRouteImport } from './routes/_authed/admin/webhooks'
 import { Route as AuthedSettingsIndexRouteImport } from './routes/_authed/settings/index'
 import { Route as AuthedAppAgentsIndexRouteImport } from './routes/_authed/_app/agents/index'
 import { Route as AuthedAppChannelChannelIdRouteImport } from './routes/_authed/_app/channel/$channelId'
@@ -65,6 +67,11 @@ const AuthedAppBotRoute = AuthedAppBotRouteImport.update({
   path: '/bot',
   getParentRoute: () => AuthedAppRoute,
 } as any)
+const AuthedAppRoutinesRoute = AuthedAppRoutinesRouteImport.update({
+  id: '/routines',
+  path: '/routines',
+  getParentRoute: () => AuthedAppRoute,
+} as any)
 const AuthedAppSkillsRoute = AuthedAppSkillsRouteImport.update({
   id: '/skills',
   path: '/skills',
@@ -115,6 +122,11 @@ const AuthedAdminPluginsRoute = AuthedAdminPluginsRouteImport.update({
   path: '/plugins',
   getParentRoute: () => AuthedAdminRouteRoute,
 } as any)
+const AuthedAdminWebhooksRoute = AuthedAdminWebhooksRouteImport.update({
+  id: '/webhooks',
+  path: '/webhooks',
+  getParentRoute: () => AuthedAdminRouteRoute,
+} as any)
 const AuthedSettingsIndexRoute = AuthedSettingsIndexRouteImport.update({
   id: '/',
   path: '/',
@@ -149,6 +161,7 @@ export interface FileRoutesByFullPath {
   '/admin': typeof AuthedAdminRouteRouteWithChildren
   '/settings': typeof AuthedSettingsRouteRouteWithChildren
   '/bot': typeof AuthedAppBotRoute
+  '/routines': typeof AuthedAppRoutinesRoute
   '/skills': typeof AuthedAppSkillsRoute
   '/admin/audit': typeof AuthedAdminAuditRoute
   '/admin/boundaries': typeof AuthedAdminBoundariesRoute
@@ -158,6 +171,7 @@ export interface FileRoutesByFullPath {
   '/admin/credentials': typeof AuthedAdminCredentialsRoute
   '/admin/playground': typeof AuthedAdminPlaygroundRoute
   '/admin/plugins': typeof AuthedAdminPluginsRoute
+  '/admin/webhooks': typeof AuthedAdminWebhooksRoute
   '/admin/': typeof AuthedAdminIndexRoute
   '/settings/': typeof AuthedSettingsIndexRoute
   '/channel/$channelId': typeof AuthedAppChannelChannelIdRoute
@@ -169,6 +183,7 @@ export interface FileRoutesByTo {
   '/': typeof AuthedAppIndexRoute
   '/sign': typeof SignRoute
   '/bot': typeof AuthedAppBotRoute
+  '/routines': typeof AuthedAppRoutinesRoute
   '/skills': typeof AuthedAppSkillsRoute
   '/admin/audit': typeof AuthedAdminAuditRoute
   '/admin/boundaries': typeof AuthedAdminBoundariesRoute
@@ -178,6 +193,7 @@ export interface FileRoutesByTo {
   '/admin/credentials': typeof AuthedAdminCredentialsRoute
   '/admin/playground': typeof AuthedAdminPlaygroundRoute
   '/admin/plugins': typeof AuthedAdminPluginsRoute
+  '/admin/webhooks': typeof AuthedAdminWebhooksRoute
   '/admin': typeof AuthedAdminIndexRoute
   '/settings': typeof AuthedSettingsIndexRoute
   '/channel/$channelId': typeof AuthedAppChannelChannelIdRoute
@@ -193,6 +209,7 @@ export interface FileRoutesById {
   '/_authed/settings': typeof AuthedSettingsRouteRouteWithChildren
   '/_authed/_app': typeof AuthedAppRouteWithChildren
   '/_authed/_app/bot': typeof AuthedAppBotRoute
+  '/_authed/_app/routines': typeof AuthedAppRoutinesRoute
   '/_authed/_app/skills': typeof AuthedAppSkillsRoute
   '/_authed/admin/audit': typeof AuthedAdminAuditRoute
   '/_authed/admin/boundaries': typeof AuthedAdminBoundariesRoute
@@ -202,6 +219,7 @@ export interface FileRoutesById {
   '/_authed/admin/credentials': typeof AuthedAdminCredentialsRoute
   '/_authed/admin/playground': typeof AuthedAdminPlaygroundRoute
   '/_authed/admin/plugins': typeof AuthedAdminPluginsRoute
+  '/_authed/admin/webhooks': typeof AuthedAdminWebhooksRoute
   '/_authed/_app/': typeof AuthedAppIndexRoute
   '/_authed/admin/': typeof AuthedAdminIndexRoute
   '/_authed/settings/': typeof AuthedSettingsIndexRoute
@@ -218,6 +236,7 @@ export interface FileRouteTypes {
     | '/admin'
     | '/settings'
     | '/bot'
+    | '/routines'
     | '/skills'
     | '/admin/audit'
     | '/admin/boundaries'
@@ -227,6 +246,7 @@ export interface FileRouteTypes {
     | '/admin/credentials'
     | '/admin/playground'
     | '/admin/plugins'
+    | '/admin/webhooks'
     | '/admin/'
     | '/settings/'
     | '/channel/$channelId'
@@ -238,6 +258,7 @@ export interface FileRouteTypes {
     | '/'
     | '/sign'
     | '/bot'
+    | '/routines'
     | '/skills'
     | '/admin/audit'
     | '/admin/boundaries'
@@ -247,6 +268,7 @@ export interface FileRouteTypes {
     | '/admin/credentials'
     | '/admin/playground'
     | '/admin/plugins'
+    | '/admin/webhooks'
     | '/admin'
     | '/settings'
     | '/channel/$channelId'
@@ -261,6 +283,7 @@ export interface FileRouteTypes {
     | '/_authed/settings'
     | '/_authed/_app'
     | '/_authed/_app/bot'
+    | '/_authed/_app/routines'
     | '/_authed/_app/skills'
     | '/_authed/admin/audit'
     | '/_authed/admin/boundaries'
@@ -270,6 +293,7 @@ export interface FileRouteTypes {
     | '/_authed/admin/credentials'
     | '/_authed/admin/playground'
     | '/_authed/admin/plugins'
+    | '/_authed/admin/webhooks'
     | '/_authed/_app/'
     | '/_authed/admin/'
     | '/_authed/settings/'
@@ -335,6 +359,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthedAppBotRouteImport
       parentRoute: typeof AuthedAppRoute
     }
+    '/_authed/_app/routines': {
+      id: '/_authed/_app/routines'
+      path: '/routines'
+      fullPath: '/routines'
+      preLoaderRoute: typeof AuthedAppRoutinesRouteImport
+      parentRoute: typeof AuthedAppRoute
+    }
     '/_authed/_app/skills': {
       id: '/_authed/_app/skills'
       path: '/skills'
@@ -405,6 +436,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthedAdminPluginsRouteImport
       parentRoute: typeof AuthedAdminRouteRoute
     }
+    '/_authed/admin/webhooks': {
+      id: '/_authed/admin/webhooks'
+      path: '/webhooks'
+      fullPath: '/admin/webhooks'
+      preLoaderRoute: typeof AuthedAdminWebhooksRouteImport
+      parentRoute: typeof AuthedAdminRouteRoute
+    }
     '/_authed/settings/': {
       id: '/_authed/settings/'
       path: '/'
@@ -465,6 +503,7 @@ interface AuthedAdminRouteRouteChildren {
   AuthedAdminCredentialsRoute: typeof AuthedAdminCredentialsRoute
   AuthedAdminPlaygroundRoute: typeof AuthedAdminPlaygroundRoute
   AuthedAdminPluginsRoute: typeof AuthedAdminPluginsRoute
+  AuthedAdminWebhooksRoute: typeof AuthedAdminWebhooksRoute
   AuthedAdminIndexRoute: typeof AuthedAdminIndexRoute
 }
 
@@ -477,6 +516,7 @@ const AuthedAdminRouteRouteChildren: AuthedAdminRouteRouteChildren = {
   AuthedAdminCredentialsRoute: AuthedAdminCredentialsRoute,
   AuthedAdminPlaygroundRoute: AuthedAdminPlaygroundRoute,
   AuthedAdminPluginsRoute: AuthedAdminPluginsRoute,
+  AuthedAdminWebhooksRoute: AuthedAdminWebhooksRoute,
   AuthedAdminIndexRoute: AuthedAdminIndexRoute,
 }
 
@@ -496,6 +536,7 @@ const AuthedSettingsRouteRouteWithChildren =
 
 interface AuthedAppRouteChildren {
   AuthedAppBotRoute: typeof AuthedAppBotRoute
+  AuthedAppRoutinesRoute: typeof AuthedAppRoutinesRoute
   AuthedAppSkillsRoute: typeof AuthedAppSkillsRoute
   AuthedAppIndexRoute: typeof AuthedAppIndexRoute
   AuthedAppChannelChannelIdRoute: typeof AuthedAppChannelChannelIdRoute
@@ -505,6 +546,7 @@ interface AuthedAppRouteChildren {
 
 const AuthedAppRouteChildren: AuthedAppRouteChildren = {
   AuthedAppBotRoute: AuthedAppBotRoute,
+  AuthedAppRoutinesRoute: AuthedAppRoutinesRoute,
   AuthedAppSkillsRoute: AuthedAppSkillsRoute,
   AuthedAppIndexRoute: AuthedAppIndexRoute,
   AuthedAppChannelChannelIdRoute: AuthedAppChannelChannelIdRoute,
diff --git a/app/src/routes/_authed/_app/routines.tsx b/app/src/routes/_authed/_app/routines.tsx
new file mode 100644
index 0000000..13ec58d
--- /dev/null
+++ b/app/src/routes/_authed/_app/routines.tsx
@@ -0,0 +1,504 @@
+import { IconPlus } from "@tabler/icons-react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { createFileRoute } from "@tanstack/react-router";
+import { useState } from "react";
+import {
+  PageEmpty,
+  PageRows,
+  PageSection,
+  PageShell,
+} from "@/components/layout/page-shell";
+import { StaggerItem } from "@/components/layout/stagger";
+import { Button } from "@/components/ui/button";
+import {
+  Field,
+  FieldDescription,
+  FieldGroup,
+  FieldLabel,
+} from "@/components/ui/field";
+import { Input } from "@/components/ui/input";
+import {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemDescription,
+  ItemTitle,
+} from "@/components/ui/item";
+import { Separator } from "@/components/ui/separator";
+import { Textarea } from "@/components/ui/textarea";
+import { agentListQueryOptions } from "@/lib/agents/queries";
+import {
+  callRoutines,
+  DAY_NAMES,
+  describeSchedule,
+  type Routine,
+  type RoutineRun,
+  routineKeys,
+  routineListQueryOptions,
+  routineRunsQueryOptions,
+  WEEK,
+} from "@/lib/routines/queries";
+
+/**
+ * Work a Bot does without being asked.
+ *
+ * The page is built around one question that is easy to answer badly: what happened last time? A
+ * routine you are watching is not the point of a routine, so the row leads with when it is next due
+ * and what came of the last run, and the prompt, which is the part you already know, is behind the
+ * run history rather than in front of it.
+ *
+ * `missed` is drawn as its own thing rather than folded in with a failure. A deployment that was not
+ * running at eight o'clock did not do the eight o'clock work, and that is a fact about the machine
+ * rather than about the Bot: showing it as an error sends somebody to read a prompt that is fine.
+ */
+export const Route = createFileRoute("/_authed/_app/routines")({
+  component: RoutinesPage,
+});
+
+function RoutinesPage() {
+  const queryClient = useQueryClient();
+  const routines = useQuery(routineListQueryOptions());
+  const agents = useQuery(agentListQueryOptions());
+  const [error, setError] = useState<string | null>(null);
+  const [writing, setWriting] = useState(false);
+  /** Which routine's history is open. One at a time: this is a list, not a dashboard. */
+  const [open, setOpen] = useState<string | null>(null);
+
+  const act = useMutation({
+    mutationFn: (run: () => Promise<unknown>) => run(),
+    onError: (caught: Error) => setError(caught.message),
+    onSuccess: () => {
+      setError(null);
+      void queryClient.invalidateQueries({ queryKey: routineKeys.all });
+    },
+  });
+
+  const rows = routines.data ?? [];
+
+  return (
+    <PageShell
+      action={
+        <Button onClick={() => setWriting(true)} size="sm" variant="ghost">
+          <IconPlus />
+          New routine
+        </Button>
+      }
+      description="A routine is something a Bot does on its own, on a schedule. Nobody is watching a scheduled run, so it cannot ask you anything: everything it does goes through the same boundary as work you watch, and every action is in Audit."
+      title="Routines"
+    >
+      {error ? (
+        <p className="mt-4 text-destructive text-sm" role="alert">
+          {error}
+        </p>
+      ) : null}
+
+      {writing ? (
+        <NewRoutine
+          bots={(agents.data ?? []).map((agent) => ({
+            id: agent.id,
+            name: agent.name,
+          }))}
+          onCancel={() => setWriting(false)}
+          onCreate={async (values) => {
+            await act.mutateAsync(() =>
+              callRoutines("", {
+                method: "POST",
+                body: JSON.stringify(values),
+              }),
+            );
+            setWriting(false);
+          }}
+        />
+      ) : null}
+
+      <PageSection title="Yours">
+        {routines.isPending ? (
+          <PageEmpty>Loading your routines…</PageEmpty>
+        ) : routines.isError ? (
+          <p className="mt-4 text-destructive text-sm" role="alert">
+            Routines could not be loaded.
+          </p>
+        ) : rows.length === 0 ? (
+          <PageEmpty>
+            Nothing yet. A routine is a sentence you would otherwise type every
+            morning.
+          </PageEmpty>
+        ) : (
+          <PageRows>
+            {rows.map((routine, index) => (
+              <StaggerItem index={index} key={routine.id}>
+                <RoutineRow
+                  busy={act.isPending}
+                  onDelete={() =>
+                    act.mutate(() =>
+                      callRoutines(`/${routine.id}`, { method: "DELETE" }),
+                    )
+                  }
+                  onRunNow={() =>
+                    act.mutate(() =>
+                      callRoutines(`/${routine.id}/run`, { method: "POST" }),
+                    )
+                  }
+                  onToggle={() =>
+                    act.mutate(() =>
+                      callRoutines(`/${routine.id}`, {
+                        method: "PATCH",
+                        body: JSON.stringify({ enabled: !routine.enabled }),
+                      }),
+                    )
+                  }
+                  onOpen={() =>
+                    setOpen(open === routine.id ? null : routine.id)
+                  }
+                  opened={open === routine.id}
+                  routine={routine}
+                />
+                {index !== rows.length - 1 && <Separator />}
+              </StaggerItem>
+            ))}
+          </PageRows>
+        )}
+      </PageSection>
+    </PageShell>
+  );
+}
+
+function RoutineRow({
+  routine,
+  opened,
+  busy,
+  onOpen,
+  onRunNow,
+  onToggle,
+  onDelete,
+}: {
+  routine: Routine;
+  opened: boolean;
+  busy: boolean;
+  onOpen: () => void;
+  onRunNow: () => void;
+  onToggle: () => void;
+  onDelete: () => void;
+}) {
+  const runs = useQuery({
+    ...routineRunsQueryOptions(routine.id),
+    enabled: opened,
+  });
+
+  return (
+    <div className="px-4 py-3">
+      <Item className="p-0" size="sm">
+        <ItemContent>
+          <ItemTitle>
+            {routine.name}
+            {!routine.enabled ? (
+              <span className="ml-2 font-normal text-muted-foreground text-xs">
+                paused
+              </span>
+            ) : null}
+          </ItemTitle>
+          <ItemDescription>
+            {describeSchedule(routine.schedule)}
+            {/*
+             * Next due and last run, side by side, because they are the two things somebody opens
+             * this page to find out and reading them apart makes you hold one in your head.
+             */}
+            {routine.enabled && routine.nextDueAt ? (
+              <> · next {shortTime(routine.nextDueAt)}</>
+            ) : null}
+          </ItemDescription>
+          <p className="mt-1 text-xs">
+            <LastRun run={routine.lastRun} />
+          </p>
+        </ItemContent>
+        <ItemActions>
+          <Button
+            disabled={busy}
+            onClick={onRunNow}
+            size="sm"
+            variant="outline"
+          >
+            Run now
+          </Button>
+          <Button disabled={busy} onClick={onToggle} size="sm" variant="ghost">
+            {routine.enabled ? "Pause" : "Resume"}
+          </Button>
+          <Button onClick={onOpen} size="sm" variant="ghost">
+            {opened ? "Hide runs" : "Runs"}
+          </Button>
+        </ItemActions>
+      </Item>
+
+      {opened ? (
+        <div className="mt-3 rounded-md border border-border bg-background p-3">
+          {/*
+           * The prompt lives here rather than on the row. It is the part somebody already knows,
+           * and it is often several sentences; putting it in the list would make every row a
+           * paragraph and bury the two facts the list exists to show.
+           */}
+          <p className="text-muted-foreground text-xs">What it is told</p>
+          <p className="mt-1 whitespace-pre-wrap text-sm">{routine.prompt}</p>
+
+          <p className="mt-4 text-muted-foreground text-xs">Recent runs</p>
+          {runs.isPending ? (
+            <p className="mt-1 text-muted-foreground text-sm">Loading…</p>
+          ) : (runs.data?.length ?? 0) === 0 ? (
+            <p className="mt-1 text-muted-foreground text-sm">
+              It has not run yet.
+            </p>
+          ) : (
+            <ul className="mt-1 space-y-2">
+              {runs.data?.map((run) => (
+                <li className="text-sm" key={run.id}>
+                  <span className={STATUS_CLASS[run.status]}>
+                    {STATUS_LABEL[run.status]}
+                  </span>
+                  <span className="text-muted-foreground">
+                    {" "}
+                    · {shortTime(run.startedAt)} · {TRIGGER_LABEL[run.trigger]}
+                  </span>
+                  {run.summary ? (
+                    <p className="mt-0.5 whitespace-pre-wrap text-muted-foreground text-xs">
+                      {run.summary}
+                    </p>
+                  ) : null}
+                  {run.error ? (
+                    <p className="mt-0.5 text-destructive text-xs">
+                      {run.error}
+                    </p>
+                  ) : null}
+                </li>
+              ))}
+            </ul>
+          )}
+
+          <div className="mt-4">
+            {/*
+             * Deleting takes the run history with it and there is no undo, so it is down here rather
+             * than on the row, and it names the routine it destroys: a button pressed against the
+             * wrong row is the ordinary way this goes wrong.
+             */}
+            <Button onClick={onDelete} size="sm" variant="ghost">
+              Delete “{routine.name}” and its history
+            </Button>
+          </div>
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
+/** What became of the last run, in one line, or the honest absence of one. */
+function LastRun({ run }: { run: RoutineRun | null }) {
+  if (!run) {
+    return <span className="text-muted-foreground">Has not run yet</span>;
+  }
+  return (
+    <>
+      <span className={STATUS_CLASS[run.status]}>
+        {STATUS_LABEL[run.status]}
+      </span>
+      <span className="text-muted-foreground">
+        {" "}
+        · {shortTime(run.startedAt)}
+      </span>
+      {run.summary ? (
+        <span className="text-muted-foreground"> · {oneLine(run.summary)}</span>
+      ) : null}
+    </>
+  );
+}
+
+function NewRoutine({
+  bots,
+  onCreate,
+  onCancel,
+}: {
+  bots: { id: string; name: string }[];
+  onCreate: (values: {
+    agentId: string;
+    name: string;
+    prompt: string;
+    schedule: { type: "daily"; time: string; weekdays: number[] };
+  }) => Promise<void>;
+  onCancel: () => void;
+}) {
+  const [agentId, setAgentId] = useState(bots[0]?.id ?? "");
+  const [name, setName] = useState("");
+  const [prompt, setPrompt] = useState("");
+  const [time, setTime] = useState("08:00");
+  // Weekdays by default, because the routine everybody writes first is a working-day one.
+  const [weekdays, setWeekdays] = useState<number[]>([1, 2, 3, 4, 5]);
+
+  const toggleDay = (day: number) =>
+    setWeekdays((current) =>
+      current.includes(day)
+        ? current.filter((one) => one !== day)
+        : [...current, day].sort((left, right) => left - right),
+    );
+
+  return (
+    <PageSection title="New routine">
+      <form
+        className="mt-4 rounded-lg border border-border bg-card p-4"
+        noValidate
+        onSubmit={(event) => {
+          event.preventDefault();
+          void onCreate({
+            agentId,
+            name,
+            prompt,
+            schedule: { type: "daily", time, weekdays },
+          });
+        }}
+      >
+        <FieldGroup>
+          <Field>
+            <FieldLabel htmlFor="routine-bot">Bot</FieldLabel>
+            {/*
+             * A plain select rather than the styled one, because this list is the roster and it can
+             * be long; the native control is the one that behaves on a phone and with a keyboard.
+             */}
+            <select
+              className="h-9 rounded-md border border-input bg-transparent px-3 text-sm"
+              id="routine-bot"
+              onChange={(event) => setAgentId(event.target.value)}
+              value={agentId}
+            >
+              {bots.map((bot) => (
+                <option key={bot.id} value={bot.id}>
+                  {bot.name}
+                </option>
+              ))}
+            </select>
+            <FieldDescription>
+              It runs as you, and can reach what you can reach.
+            </FieldDescription>
+          </Field>
+
+          <Field>
+            <FieldLabel htmlFor="routine-name">Name</FieldLabel>
+            <Input
+              id="routine-name"
+              onChange={(event) => setName(event.target.value)}
+              placeholder="Overnight alerts"
+              value={name}
+            />
+          </Field>
+
+          <Field>
+            <FieldLabel htmlFor="routine-prompt">What to do</FieldLabel>
+            <Textarea
+              id="routine-prompt"
+              onChange={(event) => setPrompt(event.target.value)}
+              placeholder="Check the overnight alerts and write me a summary in alerts.md."
+              rows={4}
+              value={prompt}
+            />
+            <FieldDescription>
+              Write it as you would say it. Nobody will be there to answer a
+              question, so say where to leave the answer.
+            </FieldDescription>
+          </Field>
+
+          <Field>
+            <FieldLabel htmlFor="routine-time">Time</FieldLabel>
+            <Input
+              className="w-32"
+              id="routine-time"
+              onChange={(event) => setTime(event.target.value)}
+              placeholder="08:00"
+              value={time}
+            />
+            {/*
+             * UTC, said out loud. The arithmetic is in UTC and a routine that fired an hour early
+             * every winter would be a bug nobody could see from this form.
+             */}
+            <FieldDescription>
+              In UTC, as HH:MM. A routine at 08:00 runs at eight o'clock UTC
+              wherever you are.
+            </FieldDescription>
+          </Field>
+
+          <Field>
+            <FieldLabel>Days</FieldLabel>
+            <div className="flex flex-wrap gap-2">
+              {WEEK.map((day) => (
+                <Button
+                  aria-pressed={weekdays.includes(day)}
+                  className={
+                    weekdays.includes(day) ? "bg-foreground/5" : undefined
+                  }
+                  key={day}
+                  onClick={() => toggleDay(day)}
+                  size="sm"
+                  type="button"
+                  variant="outline"
+                >
+                  {DAY_NAMES[day]?.slice(0, 3)}
+                </Button>
+              ))}
+            </div>
+            {weekdays.length === 0 ? (
+              <FieldDescription>
+                No days selected, so it will never run on its own.
+              </FieldDescription>
+            ) : null}
+          </Field>
+
+          <div className="flex gap-2">
+            <Button
+              disabled={!agentId || !name.trim() || !prompt.trim()}
+              size="sm"
+              type="submit"
+            >
+              Save routine
+            </Button>
+            <Button onClick={onCancel} size="sm" type="button" variant="ghost">
+              Cancel
+            </Button>
+          </div>
+        </FieldGroup>
+      </form>
+    </PageSection>
+  );
+}
+
+/**
+ * `missed` reads as its own thing, not as a failure.
+ *
+ * A deployment that was asleep at eight o'clock did not do the eight o'clock work. That is a fact
+ * about the machine rather than about the Bot, and drawing it in red next to a genuine failure sends
+ * somebody to read a prompt that is fine.
+ */
+const STATUS_LABEL: Record<RoutineRun["status"], string> = {
+  queued: "Waiting",
+  running: "Running",
+  completed: "Ran",
+  failed: "Did not work",
+  missed: "Missed, nothing was running",
+};
+
+const STATUS_CLASS: Record<RoutineRun["status"], string> = {
+  queued: "text-muted-foreground",
+  running: "text-foreground",
+  completed: "text-foreground",
+  failed: "font-medium text-destructive",
+  missed: "font-medium text-amber-600 dark:text-amber-500",
+};
+
+const TRIGGER_LABEL: Record<RoutineRun["trigger"], string> = {
+  schedule: "on its schedule",
+  manual: "you pressed Run now",
+  webhook: "a delivery",
+};
+
+/** UTC, everywhere, because that is what the schedule means. */
+function shortTime(iso: string): string {
+  return `${iso.replace("T", " ").slice(0, 16)} UTC`;
+}
+
+function oneLine(text: string): string {
+  const first = text.trim().split("\n")[0] ?? "";
+  return first.length > 120 ? `${first.slice(0, 117)}…` : first;
+}
diff --git a/app/src/routes/_authed/admin/audit.tsx b/app/src/routes/_authed/admin/audit.tsx
index 84a7b80..2dd0249 100644
--- a/app/src/routes/_authed/admin/audit.tsx
+++ b/app/src/routes/_authed/admin/audit.tsx
@@ -321,6 +321,8 @@ const NAMED_TARGETS = new Set([
   "mcp_server",
   "skill",
   "credential",
+  "routine",
+  "webhook_trigger",
 ]);
 
 const DECISIONS: Record<string, string> = {
@@ -360,6 +362,27 @@ const DECISIONS: Record<string, string> = {
   "mcp.call_rejected": "Blocked",
   "mcp.call_failed": "The server did not answer",
 
+  "routine.created": "Routine created",
+  "routine.updated": "Routine changed",
+  "routine.deleted": "Routine deleted",
+  "routine.run_started": "A routine started running",
+  "routine.run_finished": "A routine finished",
+  "routine.run_failed": "A routine did not work",
+  // Not a failure of the Bot. The deployment was not running when the window came round, which is a
+  // fact about the machine, and reading it as an error sends somebody to check a prompt that is fine.
+  "routine.run_missed": "Missed: nothing was running",
+
+  "webhook.trigger_created": "Trigger created",
+  "webhook.trigger_rotated": "Trigger secret rotated",
+  "webhook.trigger_verified": "Trigger confirmed, and now runs work",
+  "webhook.trigger_updated": "Trigger changed",
+  "webhook.trigger_deleted": "Trigger deleted",
+  "webhook.received": "A delivery arrived",
+  // Not a refusal. This delivery had the right secret and was kept on purpose, as the sample
+  // somebody confirms before the trigger does any work.
+  "webhook.captured": "A delivery was kept as a sample",
+  "webhook.rejected": "A delivery was refused",
+
   "configuration.changed": "Configuration changed",
   "credential.created": "Credential saved",
 };
diff --git a/app/src/routes/_authed/admin/boundaries.tsx b/app/src/routes/_authed/admin/boundaries.tsx
index 7f7470c..3458533 100644
--- a/app/src/routes/_authed/admin/boundaries.tsx
+++ b/app/src/routes/_authed/admin/boundaries.tsx
@@ -42,6 +42,13 @@ const PRESETS: Preset[] = [
     rule: "repeat.count >= 10",
     cost: "Two calls count as the same call when the thing acted on is the same, whatever was typed into it, so a Bot running ten searches from one box, or reading one file ten times, is refused on the tenth. It misses the other way too: a Bot slow enough to spread its attempts wider than a few minutes is never caught, one that changes a single argument each time is ten different calls, and calls to another server's tools are not counted at all. Worth adding while a match is recorded and allowed, before it starts refusing anybody's work.",
   },
+  {
+    label: "Let a scheduled run look, never press",
+    // `run.unattended` is true for a routine on its schedule and for a webhook delivery, and false
+    // whenever somebody is at the screen, so the same Bot keeps working normally in a conversation.
+    rule: 'run.unattended && intent == "activate"',
+    cost: "A routine can browse, read and write notes, and cannot press anything at all — including a Next button it needs to get past a page it was only going to read.",
+  },
   {
     label: "Stay off social media",
     rule: 'intent == "navigate" && (contains(page.host, "facebook.com") || contains(page.host, "x.com"))',
diff --git a/app/src/routes/_authed/admin/index.tsx b/app/src/routes/_authed/admin/index.tsx
index ed7f488..4932f4f 100644
--- a/app/src/routes/_authed/admin/index.tsx
+++ b/app/src/routes/_authed/admin/index.tsx
@@ -8,6 +8,7 @@ import {
   IconPlugConnected,
   IconPuzzle,
   IconShieldCheck,
+  IconWebhook,
 } from "@tabler/icons-react";
 import {
   createFileRoute,
@@ -102,6 +103,12 @@ const SECTIONS: {
         icon: IconCode,
         linkOptions: { to: "/admin/playground" },
       },
+      {
+        title: "Webhooks",
+        description: "URLs another system can call to set a Bot working.",
+        icon: IconWebhook,
+        linkOptions: { to: "/admin/webhooks" },
+      },
     ],
   },
   {
diff --git a/app/src/routes/_authed/admin/webhooks.tsx b/app/src/routes/_authed/admin/webhooks.tsx
new file mode 100644
index 0000000..42b4597
--- /dev/null
+++ b/app/src/routes/_authed/admin/webhooks.tsx
@@ -0,0 +1,344 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { createFileRoute, Link } from "@tanstack/react-router";
+import { useState } from "react";
+import {
+  PageEmpty,
+  PageRows,
+  PageSection,
+  PageShell,
+} from "@/components/layout/page-shell";
+import { StaggerItem } from "@/components/layout/stagger";
+import { Button } from "@/components/ui/button";
+import {
+  Field,
+  FieldDescription,
+  FieldGroup,
+  FieldLabel,
+} from "@/components/ui/field";
+import { Input } from "@/components/ui/input";
+import {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemDescription,
+  ItemTitle,
+} from "@/components/ui/item";
+import { Separator } from "@/components/ui/separator";
+import {
+  callRoutines,
+  routineKeys,
+  routineListQueryOptions,
+  type WebhookTrigger,
+  webhookTriggerQueryOptions,
+} from "@/lib/routines/queries";
+
+/**
+ * The one door in this product that opens to somebody who has not signed in.
+ *
+ * The page is arranged around that. The secret is shown once, in a box that says so; a new trigger
+ * is drawn as unfinished until somebody has looked at a real delivery and confirmed it; and the
+ * endpoint's own port is stated rather than assumed, because it is not the port the rest of the API
+ * is on and a person copying a URL out of here needs to know that.
+ */
+export const Route = createFileRoute("/_authed/admin/webhooks")({
+  component: WebhooksPage,
+});
+
+function WebhooksPage() {
+  const queryClient = useQueryClient();
+  const triggers = useQuery(webhookTriggerQueryOptions());
+  const routines = useQuery(routineListQueryOptions());
+  const [error, setError] = useState<string | null>(null);
+  /**
+   * The secret, held only in this tab and only until the page is left.
+   *
+   * Never read back from the server, because the server does not have it: the row keeps a hash. This
+   * is the one moment it exists anywhere but in the caller's own configuration.
+   */
+  const [revealed, setRevealed] = useState<{
+    id: string;
+    secret: string;
+  } | null>(null);
+  const [name, setName] = useState("");
+  const [routineId, setRoutineId] = useState("");
+
+  const act = useMutation({
+    mutationFn: (run: () => Promise<unknown>) => run(),
+    onError: (caught: Error) => setError(caught.message),
+    onSuccess: () => {
+      setError(null);
+      void queryClient.invalidateQueries({ queryKey: routineKeys.all });
+    },
+  });
+
+  const rows = triggers.data ?? [];
+  const available = routines.data ?? [];
+
+  return (
+    <PageShell
+      description={
+        <>
+          A trigger is a URL another system can call to set a Bot working.
+          Deliveries arrive on their own listener, not on this one:{" "}
+          <code>ROUTINE_WEBHOOK_PORT</code>, which defaults to one above the
+          API's and serves nothing but these paths. Every trigger in this
+          deployment is listed here, whoever created it, because the question
+          this page answers is what can reach us from outside. Every delivery is
+          recorded in{" "}
+          <Link className="underline" to="/admin/audit">
+            Audit
+          </Link>
+          , including the ones that were refused.
+        </>
+      }
+      title="Webhook triggers"
+    >
+      {error ? (
+        <p className="mt-4 text-destructive text-sm" role="alert">
+          {error}
+        </p>
+      ) : null}
+
+      {revealed ? (
+        <PageSection title="The secret, this once">
+          <div className="mt-2 rounded-lg border border-amber-500/40 bg-amber-500/5 p-4">
+            <p className="text-sm">
+              Copy this into whatever will be calling the endpoint. It is not
+              stored, cannot be shown again, and leaving this page loses it. If
+              that happens, rotate the trigger and use the new one.
+            </p>
+            <code className="mt-3 block break-all rounded bg-background p-2 font-mono text-xs">
+              Authorization: Bearer {revealed.secret}
+            </code>
+            <Button
+              className="mt-3"
+              onClick={() => setRevealed(null)}
+              size="sm"
+              variant="outline"
+            >
+              I have copied it
+            </Button>
+          </div>
+        </PageSection>
+      ) : null}
+
+      <PageSection title="New trigger">
+        <form
+          className="mt-4 rounded-lg border border-border bg-card p-4"
+          noValidate
+          onSubmit={(event) => {
+            event.preventDefault();
+            act.mutate(async () => {
+              const created = (await callRoutines("/triggers", {
+                method: "POST",
+                body: JSON.stringify({ name, routineId }),
+              })) as { trigger: WebhookTrigger; secret: string };
+              setRevealed({
+                id: created.trigger.id,
+                secret: created.secret,
+              });
+              setName("");
+              return created;
+            });
+          }}
+        >
+          <FieldGroup>
+            <Field>
+              <FieldLabel htmlFor="trigger-name">Name</FieldLabel>
+              <Input
+                id="trigger-name"
+                onChange={(event) => setName(event.target.value)}
+                placeholder="Build finished"
+                value={name}
+              />
+            </Field>
+            <Field>
+              <FieldLabel htmlFor="trigger-routine">Runs</FieldLabel>
+              <select
+                className="h-9 rounded-md border border-input bg-transparent px-3 text-sm"
+                id="trigger-routine"
+                onChange={(event) => setRoutineId(event.target.value)}
+                value={routineId}
+              >
+                <option value="">Choose a routine…</option>
+                {available.map((routine) => (
+                  <option key={routine.id} value={routine.id}>
+                    {routine.name}
+                  </option>
+                ))}
+              </select>
+              <FieldDescription>
+                {/*
+                 * Routine-backed only from this form. A trigger that names a routine gets that
+                 * routine's run history and its one-at-a-time protection; one carrying a loose
+                 * prompt gets neither, and offering the weaker shape as the easy option here would
+                 * be a poor default.
+                 */}
+                The delivery is put underneath the routine's own instruction, so
+                the Bot sees what arrived.
+              </FieldDescription>
+            </Field>
+            <div>
+              <Button
+                disabled={!name.trim() || !routineId || act.isPending}
+                size="sm"
+                type="submit"
+              >
+                Create trigger
+              </Button>
+            </div>
+          </FieldGroup>
+        </form>
+      </PageSection>
+
+      <PageSection title="Triggers">
+        {triggers.isPending ? (
+          <PageEmpty>Loading…</PageEmpty>
+        ) : rows.length === 0 ? (
+          <PageEmpty>
+            None yet. A trigger is how another system asks a Bot to do
+            something.
+          </PageEmpty>
+        ) : (
+          <PageRows>
+            {rows.map((trigger, index) => (
+              <StaggerItem index={index} key={trigger.id}>
+                <TriggerRow
+                  busy={act.isPending}
+                  onConfirm={() =>
+                    act.mutate(() =>
+                      callRoutines(`/triggers/${trigger.id}/verify`, {
+                        method: "POST",
+                      }),
+                    )
+                  }
+                  onDelete={() =>
+                    act.mutate(() =>
+                      callRoutines(`/triggers/${trigger.id}`, {
+                        method: "DELETE",
+                      }),
+                    )
+                  }
+                  onRotate={() =>
+                    act.mutate(async () => {
+                      const rotated = (await callRoutines(
+                        `/triggers/${trigger.id}/rotate`,
+                        { method: "POST" },
+                      )) as { secret: string };
+                      setRevealed({ id: trigger.id, secret: rotated.secret });
+                      return rotated;
+                    })
+                  }
+                  onToggle={() =>
+                    act.mutate(() =>
+                      callRoutines(`/triggers/${trigger.id}`, {
+                        method: "PATCH",
+                        body: JSON.stringify({ enabled: !trigger.enabled }),
+                      }),
+                    )
+                  }
+                  trigger={trigger}
+                />
+                {index !== rows.length - 1 && <Separator />}
+              </StaggerItem>
+            ))}
+          </PageRows>
+        )}
+      </PageSection>
+    </PageShell>
+  );
+}
+
+function TriggerRow({
+  trigger,
+  busy,
+  onConfirm,
+  onRotate,
+  onToggle,
+  onDelete,
+}: {
+  trigger: WebhookTrigger;
+  busy: boolean;
+  onConfirm: () => void;
+  onRotate: () => void;
+  onToggle: () => void;
+  onDelete: () => void;
+}) {
+  return (
+    <div className="px-4 py-3">
+      <Item className="p-0" size="sm">
+        <ItemContent>
+          <ItemTitle>
+            {trigger.name}
+            {!trigger.enabled ? (
+              <span className="ml-2 font-normal text-muted-foreground text-xs">
+                off
+              </span>
+            ) : null}
+          </ItemTitle>
+          <ItemDescription>
+            {/*
+             * The path, not a full URL. This page has no way of knowing the address the endpoint is
+             * reachable at from outside — it is a different port and usually behind something — and
+             * printing this page's own origin with the webhook path on it would be a URL that does
+             * not work, which is worse than a path somebody has to complete.
+             */}
+            <code className="font-mono text-xs">
+              POST /hooks/{trigger.endpointId}
+            </code>
+            {" · "}
+            {trigger.deliveryCount === 0
+              ? "never called"
+              : `${trigger.deliveryCount} ${trigger.deliveryCount === 1 ? "delivery" : "deliveries"}`}
+            {trigger.eventTypes.length > 0
+              ? ` · only ${trigger.eventTypes.join(", ")}`
+              : null}
+          </ItemDescription>
+        </ItemContent>
+        <ItemActions>
+          <Button
+            disabled={busy}
+            onClick={onRotate}
+            size="sm"
+            variant="outline"
+          >
+            New secret
+          </Button>
+          <Button disabled={busy} onClick={onToggle} size="sm" variant="ghost">
+            {trigger.enabled ? "Turn off" : "Turn on"}
+          </Button>
+          <Button disabled={busy} onClick={onDelete} size="sm" variant="ghost">
+            Delete
+          </Button>
+        </ItemActions>
+      </Item>
+
+      {trigger.verificationPending ? (
+        <div className="mt-3 rounded-md border border-border bg-background p-3">
+          {/*
+           * The gate that catches a hook pointed at the wrong trigger. Until somebody has looked at
+           * a real delivery and said yes, this endpoint accepts calls and starts nothing.
+           */}
+          <p className="text-sm">
+            {trigger.sample
+              ? "This is the first delivery that arrived, kept as it came. Later ones are counted and do not replace it, so what you confirm is what you are reading. Nothing has run yet."
+              : "Nothing has arrived yet. Send one delivery to the endpoint above; it will be kept here and nothing will run."}
+          </p>
+          {trigger.sample ? (
+            <pre className="mt-2 max-h-48 overflow-auto rounded bg-card p-2 text-xs">
+              {JSON.stringify(trigger.sample, null, 2)}
+            </pre>
+          ) : null}
+          <Button
+            className="mt-3"
+            disabled={busy || !trigger.sample}
+            onClick={onConfirm}
+            size="sm"
+          >
+            This is right, start running it
+          </Button>
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/server/drizzle/0002_stale_ted_forrester.sql b/server/drizzle/0002_stale_ted_forrester.sql
new file mode 100644
index 0000000..1dc89a3
--- /dev/null
+++ b/server/drizzle/0002_stale_ted_forrester.sql
@@ -0,0 +1,58 @@
+CREATE TYPE "public"."routine_run_status" AS ENUM('queued', 'running', 'completed', 'failed', 'missed');--> statement-breakpoint
+CREATE TYPE "public"."routine_trigger" AS ENUM('schedule', 'manual', 'webhook');--> statement-breakpoint
+CREATE TABLE "routine_runs" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"routine_id" uuid NOT NULL,
+	"trigger" "routine_trigger" NOT NULL,
+	"status" "routine_run_status" NOT NULL,
+	"started_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"finished_at" timestamp with time zone,
+	"summary" text,
+	"error" text,
+	"thread_id" text
+);
+--> statement-breakpoint
+CREATE TABLE "routines" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"agent_id" text NOT NULL,
+	"owner_user_id" text NOT NULL,
+	"name" text NOT NULL,
+	"prompt" text NOT NULL,
+	"schedule" jsonb NOT NULL,
+	"enabled" boolean DEFAULT true NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "webhook_triggers" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"endpoint_id" text NOT NULL,
+	"name" text NOT NULL,
+	"owner_user_id" text NOT NULL,
+	"routine_id" uuid,
+	"agent_id" text,
+	"prompt" text,
+	"secret_hash" text NOT NULL,
+	"enabled" boolean DEFAULT true NOT NULL,
+	"verification_pending" boolean DEFAULT true NOT NULL,
+	"verified_at" timestamp with time zone,
+	"sample" jsonb,
+	"event_types" text[] DEFAULT '{}' NOT NULL,
+	"delivery_count" integer DEFAULT 0 NOT NULL,
+	"last_received_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "webhook_triggers_endpoint_id_unique" UNIQUE("endpoint_id")
+);
+--> statement-breakpoint
+ALTER TABLE "routine_runs" ADD CONSTRAINT "routine_runs_routine_id_routines_id_fk" FOREIGN KEY ("routine_id") REFERENCES "public"."routines"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "routines" ADD CONSTRAINT "routines_agent_id_agents_id_fk" FOREIGN KEY ("agent_id") REFERENCES "public"."agents"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "routines" ADD CONSTRAINT "routines_owner_user_id_users_id_fk" FOREIGN KEY ("owner_user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "webhook_triggers" ADD CONSTRAINT "webhook_triggers_owner_user_id_users_id_fk" FOREIGN KEY ("owner_user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "webhook_triggers" ADD CONSTRAINT "webhook_triggers_routine_id_routines_id_fk" FOREIGN KEY ("routine_id") REFERENCES "public"."routines"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "webhook_triggers" ADD CONSTRAINT "webhook_triggers_agent_id_agents_id_fk" FOREIGN KEY ("agent_id") REFERENCES "public"."agents"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "routine_runs_routine_started_idx" ON "routine_runs" USING btree ("routine_id","started_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "routine_runs_one_active_idx" ON "routine_runs" USING btree ("routine_id") WHERE status in ('queued', 'running');--> statement-breakpoint
+CREATE INDEX "routines_enabled_idx" ON "routines" USING btree ("enabled");--> statement-breakpoint
+CREATE INDEX "routines_owner_idx" ON "routines" USING btree ("owner_user_id");--> statement-breakpoint
+CREATE INDEX "webhook_triggers_owner_idx" ON "webhook_triggers" USING btree ("owner_user_id");
\ No newline at end of file
diff --git a/server/drizzle/meta/0002_snapshot.json b/server/drizzle/meta/0002_snapshot.json
new file mode 100644
index 0000000..658e3c0
--- /dev/null
+++ b/server/drizzle/meta/0002_snapshot.json
@@ -0,0 +1,2932 @@
+{
+  "id": "ca00c64b-d179-42ea-baca-43091d9a97b1",
+  "prevId": "c2caefc9-77dd-42f2-9d57-0cb3e87225d0",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.accounts": {
+      "name": "accounts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "accounts_provider_account_idx": {
+          "name": "accounts_provider_account_idx",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "accounts_user_id_users_id_fk": {
+          "name": "accounts_user_id_users_id_fk",
+          "tableFrom": "accounts",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agents": {
+      "name": "agents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "agent_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "configuration": {
+          "name": "configuration",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "package_id": {
+          "name": "package_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "override": {
+          "name": "override",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "agents_package_id_deployment_packages_id_fk": {
+          "name": "agents_package_id_deployment_packages_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "deployment_packages",
+          "columnsFrom": ["package_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.audit_events": {
+      "name": "audit_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "audit_events_created_at_idx": {
+          "name": "audit_events_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.channel_agents": {
+      "name": "channel_agents",
+      "schema": "",
+      "columns": {
+        "channel_id": {
+          "name": "channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "channel_agents_channel_id_channels_id_fk": {
+          "name": "channel_agents_channel_id_channels_id_fk",
+          "tableFrom": "channel_agents",
+          "tableTo": "channels",
+          "columnsFrom": ["channel_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "channel_agents_agent_id_agents_id_fk": {
+          "name": "channel_agents_agent_id_agents_id_fk",
+          "tableFrom": "channel_agents",
+          "tableTo": "agents",
+          "columnsFrom": ["agent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "channel_agents_channel_id_agent_id_pk": {
+          "name": "channel_agents_channel_id_agent_id_pk",
+          "columns": ["channel_id", "agent_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.channel_memberships": {
+      "name": "channel_memberships",
+      "schema": "",
+      "columns": {
+        "channel_id": {
+          "name": "channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "channel_memberships_channel_id_channels_id_fk": {
+          "name": "channel_memberships_channel_id_channels_id_fk",
+          "tableFrom": "channel_memberships",
+          "tableTo": "channels",
+          "columnsFrom": ["channel_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "channel_memberships_user_id_users_id_fk": {
+          "name": "channel_memberships_user_id_users_id_fk",
+          "tableFrom": "channel_memberships",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "channel_memberships_channel_id_user_id_pk": {
+          "name": "channel_memberships_channel_id_user_id_pk",
+          "columns": ["channel_id", "user_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.channels": {
+      "name": "channels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "suggested_prompts": {
+          "name": "suggested_prompts",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "allowed_groups": {
+          "name": "allowed_groups",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "package_id": {
+          "name": "package_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "override": {
+          "name": "override",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_message": {
+          "name": "last_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_message_at": {
+          "name": "last_message_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_message_agent_id": {
+          "name": "last_message_agent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "channels_recent_activity_idx": {
+          "name": "channels_recent_activity_idx",
+          "columns": [
+            {
+              "expression": "COALESCE(\"last_message_at\", \"created_at\") DESC",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "channels_package_id_deployment_packages_id_fk": {
+          "name": "channels_package_id_deployment_packages_id_fk",
+          "tableFrom": "channels",
+          "tableTo": "deployment_packages",
+          "columnsFrom": ["package_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "channels_last_message_agent_id_agents_id_fk": {
+          "name": "channels_last_message_agent_id_agents_id_fk",
+          "tableFrom": "channels",
+          "tableTo": "agents",
+          "columnsFrom": ["last_message_agent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.chunks": {
+      "name": "chunks",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "embedding": {
+          "name": "embedding",
+          "type": "vector(1536)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "chunks_document_position_idx": {
+          "name": "chunks_document_position_idx",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "chunks_document_idx": {
+          "name": "chunks_document_idx",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "chunks_document_id_documents_id_fk": {
+          "name": "chunks_document_id_documents_id_fk",
+          "tableFrom": "chunks",
+          "tableTo": "documents",
+          "columnsFrom": ["document_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.connector_cursors": {
+      "name": "connector_cursors",
+      "schema": "",
+      "columns": {
+        "connector_instance_id": {
+          "name": "connector_instance_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "cursor": {
+          "name": "cursor",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "connector_cursors_connector_instance_id_connector_instances_id_fk": {
+          "name": "connector_cursors_connector_instance_id_connector_instances_id_fk",
+          "tableFrom": "connector_cursors",
+          "tableTo": "connector_instances",
+          "columnsFrom": ["connector_instance_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.connector_instances": {
+      "name": "connector_instances",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "type": {
+          "name": "type",
+          "type": "connector_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "sync_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "source_metadata": {
+          "name": "source_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "connector_instances_credential_id_credentials_id_fk": {
+          "name": "connector_instances_credential_id_credentials_id_fk",
+          "tableFrom": "connector_instances",
+          "tableTo": "credentials",
+          "columnsFrom": ["credential_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.credentials": {
+      "name": "credentials",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "kind": {
+          "name": "kind",
+          "type": "credential_kind",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "encrypted_value": {
+          "name": "encrypted_value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_id": {
+          "name": "key_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.deployment_packages": {
+      "name": "deployment_packages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_path": {
+          "name": "source_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checksum": {
+          "name": "checksum",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "loaded_at": {
+          "name": "loaded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "deployment_packages_tenant_id_unique": {
+          "name": "deployment_packages_tenant_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["tenant_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_acls": {
+      "name": "document_acls",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal": {
+          "name": "principal",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect": {
+          "name": "effect",
+          "type": "acl_effect",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_acls_document_principal_effect_idx": {
+          "name": "document_acls_document_principal_effect_idx",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "effect",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_acls_principal_idx": {
+          "name": "document_acls_principal_idx",
+          "columns": [
+            {
+              "expression": "principal",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_acls_document_id_documents_id_fk": {
+          "name": "document_acls_document_id_documents_id_fk",
+          "tableFrom": "document_acls",
+          "tableTo": "documents",
+          "columnsFrom": ["document_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.documents": {
+      "name": "documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "connector_instance_id": {
+          "name": "connector_instance_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_url": {
+          "name": "canonical_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_hash": {
+          "name": "content_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "documents_connector_source_idx": {
+          "name": "documents_connector_source_idx",
+          "columns": [
+            {
+              "expression": "connector_instance_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_connector_deleted_idx": {
+          "name": "documents_connector_deleted_idx",
+          "columns": [
+            {
+              "expression": "connector_instance_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "documents_connector_instance_id_connector_instances_id_fk": {
+          "name": "documents_connector_instance_id_connector_instances_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "connector_instances",
+          "columnsFrom": ["connector_instance_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.intelligence_channel_mappings": {
+      "name": "intelligence_channel_mappings",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "channel_id": {
+          "name": "channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "intelligence_channel_mappings_thread_idx": {
+          "name": "intelligence_channel_mappings_thread_idx",
+          "columns": [
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "intelligence_channel_mappings_user_id_users_id_fk": {
+          "name": "intelligence_channel_mappings_user_id_users_id_fk",
+          "tableFrom": "intelligence_channel_mappings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "intelligence_channel_mappings_channel_id_channels_id_fk": {
+          "name": "intelligence_channel_mappings_channel_id_channels_id_fk",
+          "tableFrom": "intelligence_channel_mappings",
+          "tableTo": "channels",
+          "columnsFrom": ["channel_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "intelligence_channel_mappings_user_id_channel_id_pk": {
+          "name": "intelligence_channel_mappings_user_id_channel_id_pk",
+          "columns": ["user_id", "channel_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sessions": {
+      "name": "sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "sessions_user_id_users_id_fk": {
+          "name": "sessions_user_id_users_id_fk",
+          "tableFrom": "sessions",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "sessions_token_unique": {
+          "name": "sessions_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sync_runs": {
+      "name": "sync_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "connector_instance_id": {
+          "name": "connector_instance_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "sync_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stats": {
+          "name": "stats",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "sync_runs_connector_started_at_idx": {
+          "name": "sync_runs_connector_started_at_idx",
+          "columns": [
+            {
+              "expression": "connector_instance_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "sync_runs_connector_instance_id_connector_instances_id_fk": {
+          "name": "sync_runs_connector_instance_id_connector_instances_id_fk",
+          "tableFrom": "sync_runs",
+          "tableTo": "connector_instances",
+          "columnsFrom": ["connector_instance_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_roles": {
+      "name": "user_roles",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "role",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "user_roles_user_id_users_id_fk": {
+          "name": "user_roles_user_id_users_id_fk",
+          "tableFrom": "user_roles",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "user_roles_user_id_role_pk": {
+          "name": "user_roles_user_id_role_pk",
+          "columns": ["user_id", "role"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.users": {
+      "name": "users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "groups": {
+          "name": "groups",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "users_email_unique": {
+          "name": "users_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["email"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verifications": {
+      "name": "verifications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.webhook_subscriptions": {
+      "name": "webhook_subscriptions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "connector_instance_id": {
+          "name": "connector_instance_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_subscription_id": {
+          "name": "provider_subscription_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "webhook_subscriptions_connector_instance_id_connector_instances_id_fk": {
+          "name": "webhook_subscriptions_connector_instance_id_connector_instances_id_fk",
+          "tableFrom": "webhook_subscriptions",
+          "tableTo": "connector_instances",
+          "columnsFrom": ["connector_instance_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.action_policy": {
+      "name": "action_policy",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deny": {
+          "name": "deny",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ask": {
+          "name": "ask",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "allow": {
+          "name": "allow",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_preferences": {
+      "name": "agent_preferences",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hidden_at": {
+          "name": "hidden_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "agent_preferences_user_id_users_id_fk": {
+          "name": "agent_preferences_user_id_users_id_fk",
+          "tableFrom": "agent_preferences",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_preferences_agent_id_agents_id_fk": {
+          "name": "agent_preferences_agent_id_agents_id_fk",
+          "tableFrom": "agent_preferences",
+          "tableTo": "agents",
+          "columnsFrom": ["agent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "agent_preferences_user_id_agent_id_pk": {
+          "name": "agent_preferences_user_id_agent_id_pk",
+          "columns": ["user_id", "agent_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_profiles": {
+      "name": "agent_profiles",
+      "schema": "",
+      "columns": {
+        "agent_id": {
+          "name": "agent_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role_description": {
+          "name": "role_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "avatar_seed": {
+          "name": "avatar_seed",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "agent_visibility",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_profiles_visibility_deleted_idx": {
+          "name": "agent_profiles_visibility_deleted_idx",
+          "columns": [
+            {
+              "expression": "visibility",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_profiles_agent_id_agents_id_fk": {
+          "name": "agent_profiles_agent_id_agents_id_fk",
+          "tableFrom": "agent_profiles",
+          "tableTo": "agents",
+          "columnsFrom": ["agent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_profiles_owner_user_id_users_id_fk": {
+          "name": "agent_profiles_owner_user_id_users_id_fk",
+          "tableFrom": "agent_profiles",
+          "tableTo": "users",
+          "columnsFrom": ["owner_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_runs": {
+      "name": "routine_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "routine_trigger",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "routine_run_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "routine_runs_routine_started_idx": {
+          "name": "routine_runs_routine_started_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_one_active_idx": {
+          "name": "routine_runs_one_active_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "status in ('queued', 'running')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_runs_routine_id_routines_id_fk": {
+          "name": "routine_runs_routine_id_routines_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routines",
+          "columnsFrom": ["routine_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routines": {
+      "name": "routines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prompt": {
+          "name": "prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schedule": {
+          "name": "schedule",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routines_enabled_idx": {
+          "name": "routines_enabled_idx",
+          "columns": [
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_owner_idx": {
+          "name": "routines_owner_idx",
+          "columns": [
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routines_agent_id_agents_id_fk": {
+          "name": "routines_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": ["agent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_owner_user_id_users_id_fk": {
+          "name": "routines_owner_user_id_users_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "users",
+          "columnsFrom": ["owner_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.webhook_triggers": {
+      "name": "webhook_triggers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "endpoint_id": {
+          "name": "endpoint_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "prompt": {
+          "name": "prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_hash": {
+          "name": "secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "verification_pending": {
+          "name": "verification_pending",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sample": {
+          "name": "sample",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event_types": {
+          "name": "event_types",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "delivery_count": {
+          "name": "delivery_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_received_at": {
+          "name": "last_received_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "webhook_triggers_owner_idx": {
+          "name": "webhook_triggers_owner_idx",
+          "columns": [
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "webhook_triggers_owner_user_id_users_id_fk": {
+          "name": "webhook_triggers_owner_user_id_users_id_fk",
+          "tableFrom": "webhook_triggers",
+          "tableTo": "users",
+          "columnsFrom": ["owner_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "webhook_triggers_routine_id_routines_id_fk": {
+          "name": "webhook_triggers_routine_id_routines_id_fk",
+          "tableFrom": "webhook_triggers",
+          "tableTo": "routines",
+          "columnsFrom": ["routine_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "webhook_triggers_agent_id_agents_id_fk": {
+          "name": "webhook_triggers_agent_id_agents_id_fk",
+          "tableFrom": "webhook_triggers",
+          "tableTo": "agents",
+          "columnsFrom": ["agent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "webhook_triggers_endpoint_id_unique": {
+          "name": "webhook_triggers_endpoint_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["endpoint_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.component_exclusions": {
+      "name": "component_exclusions",
+      "schema": "",
+      "columns": {
+        "component_name": {
+          "name": "component_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "withheld_by": {
+          "name": "withheld_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "component_exclusions_component_name_components_name_fk": {
+          "name": "component_exclusions_component_name_components_name_fk",
+          "tableFrom": "component_exclusions",
+          "tableTo": "components",
+          "columnsFrom": ["component_name"],
+          "columnsTo": ["name"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "component_exclusions_agent_id_agents_id_fk": {
+          "name": "component_exclusions_agent_id_agents_id_fk",
+          "tableFrom": "component_exclusions",
+          "tableTo": "agents",
+          "columnsFrom": ["agent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "component_exclusions_component_name_agent_id_pk": {
+          "name": "component_exclusions_component_name_agent_id_pk",
+          "columns": ["component_name", "agent_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.component_functions": {
+      "name": "component_functions",
+      "schema": "",
+      "columns": {
+        "component_name": {
+          "name": "component_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "function_name": {
+          "name": "function_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "granted_by": {
+          "name": "granted_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "component_functions_component_name_components_name_fk": {
+          "name": "component_functions_component_name_components_name_fk",
+          "tableFrom": "component_functions",
+          "tableTo": "components",
+          "columnsFrom": ["component_name"],
+          "columnsTo": ["name"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "component_functions_component_name_function_name_pk": {
+          "name": "component_functions_component_name_function_name_pk",
+          "columns": ["component_name", "function_name"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.components": {
+      "name": "components",
+      "schema": "",
+      "columns": {
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "draft_description": {
+          "name": "draft_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "published_description": {
+          "name": "published_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "published": {
+          "name": "published",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "published_at": {
+          "name": "published_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mcp_servers": {
+      "name": "mcp_servers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vendor": {
+          "name": "vendor",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provenance": {
+          "name": "provenance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'first-party'"
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tools_refreshed_at": {
+          "name": "tools_refreshed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by": {
+          "name": "added_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mcp_tools": {
+      "name": "mcp_tools",
+      "schema": "",
+      "columns": {
+        "server_id": {
+          "name": "server_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "input_schema": {
+          "name": "input_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "mcp_tools_server_id_mcp_servers_id_fk": {
+          "name": "mcp_tools_server_id_mcp_servers_id_fk",
+          "tableFrom": "mcp_tools",
+          "tableTo": "mcp_servers",
+          "columnsFrom": ["server_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "mcp_tools_server_id_name_pk": {
+          "name": "mcp_tools_server_id_name_pk",
+          "columns": ["server_id", "name"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_grants": {
+      "name": "plugin_grants",
+      "schema": "",
+      "columns": {
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ref": {
+          "name": "ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "granted_by": {
+          "name": "granted_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_grants_agent_idx": {
+          "name": "plugin_grants_agent_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_grants_agent_id_agents_id_fk": {
+          "name": "plugin_grants_agent_id_agents_id_fk",
+          "tableFrom": "plugin_grants",
+          "tableTo": "agents",
+          "columnsFrom": ["agent_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "plugin_grants_kind_ref_agent_id_pk": {
+          "name": "plugin_grants_kind_ref_agent_id_pk",
+          "columns": ["kind", "ref", "agent_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.sandboxed_components": {
+      "name": "sandboxed_components",
+      "schema": "",
+      "columns": {
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "draft_description": {
+          "name": "draft_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "draft_html": {
+          "name": "draft_html",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "draft_css": {
+          "name": "draft_css",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "draft_js_functions": {
+          "name": "draft_js_functions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "draft_argument_schema": {
+          "name": "draft_argument_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "published_description": {
+          "name": "published_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "published_html": {
+          "name": "published_html",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "published_css": {
+          "name": "published_css",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "published_js_functions": {
+          "name": "published_js_functions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "published_argument_schema": {
+          "name": "published_argument_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sample_arguments": {
+          "name": "sample_arguments",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "published": {
+          "name": "published",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "published_at": {
+          "name": "published_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "authored_by": {
+          "name": "authored_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.skills": {
+      "name": "skills",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "instructions": {
+          "name": "instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin": {
+          "name": "origin",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'yours'"
+        },
+        "installed_by": {
+          "name": "installed_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "skills_slug_key": {
+          "name": "skills_slug_key",
+          "columns": [
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "skills_owner_idx": {
+          "name": "skills_owner_idx",
+          "columns": [
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "skills_owner_user_id_users_id_fk": {
+          "name": "skills_owner_user_id_users_id_fk",
+          "tableFrom": "skills",
+          "tableTo": "users",
+          "columnsFrom": ["owner_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "public.acl_effect": {
+      "name": "acl_effect",
+      "schema": "public",
+      "values": ["allow", "deny"]
+    },
+    "public.agent_type": {
+      "name": "agent_type",
+      "schema": "public",
+      "values": ["built_in", "remote_ag_ui"]
+    },
+    "public.connector_type": {
+      "name": "connector_type",
+      "schema": "public",
+      "values": ["google_drive", "onedrive"]
+    },
+    "public.credential_kind": {
+      "name": "credential_kind",
+      "schema": "public",
+      "values": ["model", "connector", "agent", "mcp"]
+    },
+    "public.role": {
+      "name": "role",
+      "schema": "public",
+      "values": ["admin", "user"]
+    },
+    "public.sync_status": {
+      "name": "sync_status",
+      "schema": "public",
+      "values": ["pending", "running", "succeeded", "failed"]
+    },
+    "public.agent_visibility": {
+      "name": "agent_visibility",
+      "schema": "public",
+      "values": ["public", "private"]
+    },
+    "public.routine_run_status": {
+      "name": "routine_run_status",
+      "schema": "public",
+      "values": ["queued", "running", "completed", "failed", "missed"]
+    },
+    "public.routine_trigger": {
+      "name": "routine_trigger",
+      "schema": "public",
+      "values": ["schedule", "manual", "webhook"]
+    }
+  },
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/server/drizzle/meta/_journal.json b/server/drizzle/meta/_journal.json
index 076f20a..832620c 100644
--- a/server/drizzle/meta/_journal.json
+++ b/server/drizzle/meta/_journal.json
@@ -15,6 +15,13 @@
       "when": 1787171220703,
       "tag": "0001_gigantic_sumo",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1787191337551,
+      "tag": "0002_stale_ted_forrester",
+      "breakpoints": true
     }
   ]
 }
diff --git a/server/src/app.ts b/server/src/app.ts
index 945f5ed..6ae230b 100644
--- a/server/src/app.ts
+++ b/server/src/app.ts
@@ -30,6 +30,9 @@ import type { ConnectorAdminService } from "./connectors";
 import type { CredentialAdminService, CredentialInput } from "./credentials";
 import { createPluginRoutes } from "./plugins/routes";
 import type { PluginStore } from "./plugins/store";
+import { createRoutineRoutes } from "./routines/routes";
+import type { Scheduler } from "./routines/scheduler";
+import type { RoutineStore } from "./routines/store";
 import type { PackageStatusReader } from "./tenant-package";
 
 export function createApp(
@@ -97,6 +100,19 @@ export function createApp(
    * says nothing about which deployment the conversation belongs to.
    */
   threadIdentity?: ThreadIdentity,
+  /**
+   * Work a Bot does without being asked, and the triggers other systems can start it with.
+   *
+   * Absent leaves the routes unmounted rather than mounted and failing, the same stance the computer
+   * takes: a capability this deployment does not have should be missing, not broken.
+   */
+  routineStore?: RoutineStore,
+  /**
+   * The clock. Absent when a deployment has switched it off, which leaves routines writable and Run
+   * now refusing in words rather than the page disappearing: somebody who wrote a routine should be
+   * told the deployment is not running them, not left wondering why nothing happens.
+   */
+  scheduler?: Scheduler,
   /**
    * Where the questions an `ask` rule raised wait for a person.
    *
@@ -374,6 +390,13 @@ export function createApp(
     app.route("/api/threads", createThreadRoutes(threadIdentity, requireUser));
   }
 
+  if (routineStore) {
+    app.route(
+      "/api/routines",
+      createRoutineRoutes(routineStore, scheduler, requireUser),
+    );
+  }
+
   return app;
 }
 
diff --git a/server/src/audit.ts b/server/src/audit.ts
index 69fe18c..cb51eea 100644
--- a/server/src/audit.ts
+++ b/server/src/audit.ts
@@ -194,6 +194,64 @@ export const auditEventTypes = [
   "component.function_called",
   "component.function_refused",
   "component.function_failed",
+
+  /*
+   * Standing work: who told a Bot to do something on its own, and when they changed their mind.
+   *
+   * A routine is a grant of unattended work. Every other grant in this trail records who made it,
+   * and this one has more reason to than most: the thing being granted is permission to act while
+   * nobody is watching, and the person who wrote it will not be there when it happens. The prompt is
+   * deliberately not in these payloads, for the same reason typed text is not in a computer action.
+   */
+  "routine.created",
+  "routine.updated",
+  "routine.deleted",
+
+  /*
+   * What actually happened at eight o'clock.
+   *
+   * Started and finished are separate rows because a run that took the process down with it would
+   * otherwise leave nothing behind, and "it never started" and "it started and we lost the end of
+   * it" are different facts about a Bot that was acting unsupervised.
+   *
+   * `routine.run_missed` is the one that would be easy to leave out and must not be. A deployment
+   * that was not running at eight o'clock did not do the eight o'clock work, and the two wrong
+   * answers are firing it at noon as though nothing had happened and recording nothing at all. A
+   * person reading a run history needs to be able to tell "it ran and found nothing" from "it never
+   * ran", and only this row can tell them.
+   */
+  "routine.run_started",
+  "routine.run_finished",
+  "routine.run_failed",
+  "routine.run_missed",
+
+  /*
+   * The one door in this product that opens to somebody who has not signed in.
+   *
+   * Every moment the door changes state is a row, because "when did this endpoint start working, and
+   * who made it" is the first question asked about a public URL that turned out to be doing
+   * something unexpected. Creating a trigger and rotating its secret are the two moments the key
+   * changes hands. Confirming one is the moment an inert endpoint starts setting a Bot working, which
+   * is the single most consequential thing anybody does to a trigger. Changing and deleting are the
+   * moments a door narrows or closes, and an administrator asking why deliveries stopped is owed an
+   * answer other than silence.
+   *
+   * `webhook.received`, `webhook.captured` and `webhook.rejected` are recorded for every delivery,
+   * including the refused ones, because an endpoint on the public internet gets probed and "this
+   * endpoint was called forty times last night with the wrong secret" is exactly what a trail exists
+   * to be able to say. Captured is its own row rather than a refusal: that delivery presented the
+   * right secret and was deliberately kept as the sample somebody is about to confirm, and calling
+   * it a refusal tells them their sample never arrived. No row carries the secret that was
+   * presented: a failed guess is still somebody's secret somewhere.
+   */
+  "webhook.trigger_created",
+  "webhook.trigger_rotated",
+  "webhook.trigger_verified",
+  "webhook.trigger_updated",
+  "webhook.trigger_deleted",
+  "webhook.received",
+  "webhook.captured",
+  "webhook.rejected",
 ] as const;
 
 export type AuditEventType = (typeof auditEventTypes)[number];
diff --git a/server/src/computer/gateway.ts b/server/src/computer/gateway.ts
index bbe3b71..9948b04 100644
--- a/server/src/computer/gateway.ts
+++ b/server/src/computer/gateway.ts
@@ -89,6 +89,15 @@ export type ActionActor = {
   id: string;
   /** Null unless this is a real row in `users`, because the audit table has a foreign key to it. */
   userId?: string;
+  /**
+   * True when nobody is watching: a routine on a schedule, or a webhook handing the Bot work.
+   *
+   * The person is still named above, because a routine belongs to somebody and the trail has to say
+   * whose authority the run carried. What this adds is that they are not present, which the boundary
+   * can be written against. Absent means attended, so every existing caller keeps meaning what it
+   * always meant.
+   */
+  unattended?: boolean;
 };
 
 export type ComputerGatewayOptions = {
@@ -255,6 +264,10 @@ export function createComputerGateway(options: ComputerGatewayOptions) {
       tool: { name: toolName },
       bot: { id: botId },
       actor: { id: actor.id },
+      // Stated on every action, attended or not, so a rule naming it is evaluable in both cases. See
+      // the note on PolicyContext.run: a field that is sometimes absent is a deny rule that
+      // sometimes refuses everything.
+      run: { unattended: actor.unattended === true },
       page: { url: pageUrl, host: hostOf(pageUrl) },
       repeat: { count: repetition.count },
       // Always a boolean, unlike `key`, so a rule about form submission needs no guard to stay
diff --git a/server/src/computer/policy.ts b/server/src/computer/policy.ts
index b453683..6f24127 100644
--- a/server/src/computer/policy.ts
+++ b/server/src/computer/policy.ts
@@ -91,6 +91,25 @@ export type PolicyContext = {
    * not a guarantee, which is the argument for trying a rule about it in `dry-run` first.
    */
   repeat: { count: number };
+  /**
+   * Whether anybody is watching this run.
+   *
+   * A scheduled or webhook-triggered run has no person at the screen: nobody can take the wheel,
+   * nobody can answer a question, and nobody notices the wrong button being pressed until the
+   * consequence arrives. That is a real difference in risk from the same action taken while somebody
+   * is sitting there, and until now the policy could not see it, so a deployment had to choose one
+   * boundary for both.
+   *
+   * With this a rule can be stricter about work nobody is supervising without being stricter about
+   * everything: `run.unattended && intent == "activate"` lets a routine read, browse and write
+   * notes, and forbids it pressing anything.
+   *
+   * Always present, never optional. This engine treats an expression it cannot evaluate as a match,
+   * which for a deny rule means refusing. A context that sometimes omitted this field would turn
+   * every rule naming it into a rule that refuses every attended action too, which is the opposite
+   * of what whoever wrote it meant. Same reasoning as the neutral values plugins/store.ts fills in.
+   */
+  run: { unattended: boolean };
   element?: {
     ref: string;
     role: string;
diff --git a/server/src/config.ts b/server/src/config.ts
index 18ad61f..1aa6afb 100644
--- a/server/src/config.ts
+++ b/server/src/config.ts
@@ -92,6 +92,37 @@ export type DeploymentConfig = {
      */
     repeatWindowMs?: number;
   };
+  /** Work a Bot does without being asked, and the port another system can ask for it on. */
+  routines: RoutineSettings;
+};
+
+export type RoutineSettings = {
+  /**
+   * Whether the clock runs.
+   *
+   * Off leaves routines writable, listable and runnable by hand, and stops anything firing on its
+   * own. That is the shape a second copy of a deployment needs: a developer with a database dump
+   * should not have somebody's real routines browsing their real systems at eight o'clock because
+   * they restored a backup. Off is a whole-deployment answer rather than a per-routine one for
+   * exactly that reason, and it is loud at boot.
+   */
+  schedulerEnabled: boolean;
+  /**
+   * Where deliveries arrive.
+   *
+   * A port of its own, not a path on the API. This is the one surface meant to be reachable by a
+   * third party, and the way to keep the rest of the API away from it is for the rest of the API not
+   * to be on it; see routines/receiver.ts. Defaults to one above `PORT` so a laptop needs no
+   * configuration and two ports are still obviously related.
+   */
+  webhookPort: number;
+  /**
+   * What it binds to. 127.0.0.1 unless a deployment says otherwise.
+   *
+   * The same posture as everything else here: a webhook endpoint reachable from the internet should
+   * be a decision somebody made, not one they inherited by starting the server.
+   */
+  webhookHost: string;
 };
 
 type Environment = Record<string, string | undefined>;
@@ -357,6 +388,39 @@ function actionPolicy(environment: Environment): ActionPolicy | undefined {
   return result.policy;
 }
 
+/**
+ * The routine settings, with the webhook port defaulting to one above the API's.
+ *
+ * A bad port refuses to start rather than falling back to the default. An operator who set
+ * ROUTINE_WEBHOOK_PORT meant to move the endpoint, and quietly serving it on the port they were
+ * moving it off is the one outcome that would surprise them at the worst moment. Same reasoning as
+ * the action policy above: configuration the product cannot honour belongs at the boot boundary.
+ */
+function routineSettings(environment: Environment): RoutineSettings {
+  const apiPort = Number.parseInt(environment.PORT ?? "3001", 10);
+  const configured = optional(environment, "ROUTINE_WEBHOOK_PORT");
+  let webhookPort = (Number.isFinite(apiPort) ? apiPort : 3001) + 1;
+
+  if (configured) {
+    const parsed = Number.parseInt(configured, 10);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65_535) {
+      throw new Error("ROUTINE_WEBHOOK_PORT must be a port number");
+    }
+    webhookPort = parsed;
+  }
+
+  const scheduler = optional(environment, "ROUTINE_SCHEDULER") ?? "on";
+  if (scheduler !== "on" && scheduler !== "off") {
+    throw new Error('ROUTINE_SCHEDULER must be "on" or "off"');
+  }
+
+  return {
+    schedulerEnabled: scheduler === "on",
+    webhookPort,
+    webhookHost: optional(environment, "ROUTINE_WEBHOOK_HOST") ?? "127.0.0.1",
+  };
+}
+
 /**
  * How long silence on a Bot's stream is allowed to last.
  *
@@ -403,5 +467,6 @@ export function loadConfig(
     auth: authConfig(environment, google),
     devNoAuth: devAuthEnabled(environment),
     computer: computerConfig(environment),
+    routines: routineSettings(environment),
   };
 }
diff --git a/server/src/db/schema/coworker.ts b/server/src/db/schema/coworker.ts
index 8438f33..43dc3cc 100644
--- a/server/src/db/schema/coworker.ts
+++ b/server/src/db/schema/coworker.ts
@@ -4,15 +4,23 @@
  * Split by owner so two people can add tables all day without touching the same lines. Add tables
  * here; never edit core.ts or computer.ts to do it.
  */
+import { sql } from "drizzle-orm";
 import {
+  boolean,
   index,
+  integer,
   pgEnum,
   pgTable,
   primaryKey,
   text,
   timestamp,
+  uniqueIndex,
+  uuid,
 } from "drizzle-orm/pg-core";
 import { agents, users } from "./core";
+// NOT drizzle's `jsonb`: that one serialises and so does the driver, so a schedule stored through it
+// lands as a JSON string and cannot be read back as an object. See ./json.ts.
+import { jsonb } from "./json";
 
 const createdAt = () =>
   timestamp("created_at", { withTimezone: true }).notNull().defaultNow();
@@ -62,3 +70,229 @@ export const agentPreferences = pgTable(
   },
   (table) => [primaryKey({ columns: [table.userId, table.agentId] })],
 );
+
+/**
+ * What set a run going.
+ *
+ * `schedule` is the clock coming round, `manual` is somebody pressing Run now, and `webhook` is
+ * another system handing the Bot a piece of work. Recorded per run because they are not equally
+ * surprising: a person watching their own Run now expects what follows, and nobody is watching the
+ * other two.
+ */
+export const routineTrigger = pgEnum("routine_trigger", [
+  "schedule",
+  "manual",
+  "webhook",
+]);
+
+/**
+ * What became of one run.
+ *
+ * `missed` is the one that earns its place. A laptop asleep at eight o'clock cannot run the eight
+ * o'clock routine, and the two things it must not do instead are fire it at noon as though nothing
+ * had happened, or show nothing at all. Recording the window as missed is the only answer that
+ * leaves a person able to tell "it ran and found nothing" from "it never ran".
+ */
+export const routineRunStatus = pgEnum("routine_run_status", [
+  "queued",
+  "running",
+  "completed",
+  "failed",
+  "missed",
+]);
+
+/**
+ * A standing instruction a Bot carries out without being asked.
+ *
+ * The prompt is stored rather than a script, because the thing being scheduled is a conversation
+ * turn: whatever the Bot would have done had somebody typed this at eight o'clock. That keeps a
+ * routine exactly as capable as the Bot is, and stops this table becoming a second, weaker way of
+ * describing work.
+ */
+export const routines = pgTable(
+  "routines",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    agentId: text("agent_id")
+      .notNull()
+      .references(() => agents.id, { onDelete: "cascade" }),
+    /**
+     * Whose routine it is, and whose authority it runs with.
+     *
+     * An unattended run still acts as somebody: the audit trail names them, and the Bots it may
+     * reach are the ones that person may see. A routine with no owner would be a run nobody is
+     * accountable for, which is the opposite of what this product is for.
+     */
+    ownerUserId: text("owner_user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    prompt: text("prompt").notNull(),
+    /**
+     * `{ type: "once", at }` or `{ type: "daily", time, weekdays }`, as JSON rather than as a cron
+     * string. Cron is a language an operator has to already know, and this has to be editable from a
+     * form by somebody who does not. What "due" means is decided in routines/schedule.ts, which has
+     * no clock of its own, so it is decided in one testable place rather than by whatever the
+     * database happened to think the time was.
+     */
+    schedule: jsonb("schedule").notNull(),
+    /**
+     * Off means the schedule is ignored and nothing fires on its own. Kept rather than deleted so
+     * somebody can stop a routine they are unsure about without losing what it said.
+     */
+    enabled: boolean("enabled").notNull().default(true),
+    createdAt: createdAt(),
+    updatedAt: updatedAt(),
+  },
+  (table) => [
+    // The scheduler's own query, run once a minute forever. Worth having for the deployment whose
+    // routines are mostly switched off, which is what a long-lived one drifts towards; it buys
+    // nothing while most rows are enabled, because a planner reading most of the table will read all
+    // of it and be right to.
+    index("routines_enabled_idx").on(table.enabled),
+    index("routines_owner_idx").on(table.ownerUserId),
+  ],
+);
+
+/**
+ * One attempt at a routine, whatever came of it.
+ *
+ * The row is written before the work starts, not after it finishes. A run that took the process down
+ * with it would otherwise leave no trace at all, and "nothing happened" and "something happened and
+ * we lost the record" look identical to the person reading the list.
+ *
+ * Deleted with its routine. A list of runs of something nobody can look at any more is not history
+ * worth keeping, and somebody deleting a routine is asking for it to be gone.
+ */
+export const routineRuns = pgTable(
+  "routine_runs",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    routineId: uuid("routine_id")
+      .notNull()
+      .references(() => routines.id, { onDelete: "cascade" }),
+    trigger: routineTrigger("trigger").notNull(),
+    status: routineRunStatus("status").notNull(),
+    startedAt: timestamp("started_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    finishedAt: timestamp("finished_at", { withTimezone: true }),
+    /** What the Bot said at the end, so the list answers "what did it find" without opening a thread. */
+    summary: text("summary"),
+    /** Why it did not work, in the words a person reads. Null unless the status is `failed`. */
+    error: text("error"),
+    /**
+     * The name given to the conversation this run had.
+     *
+     * A name, and deliberately described as one. It is minted in the same namespace every other
+     * conversation in this deployment is minted in, and it is what tells one run's turns apart from
+     * another run of the same routine wherever both are visible: the `routine.run_started` row
+     * carries it, and so does the run row.
+     *
+     * What it is not is a transcript. An unattended run speaks to the Bot directly rather than
+     * through the runtime that owns durable threads, so nothing writes the messages anywhere and
+     * opening this id would find an empty conversation. That is the honest state of it, and stating
+     * it here is the point: the alternative is a field that reads like a link to the whole
+     * conversation and is a link to nothing, which is worse than no field at all.
+     *
+     * What a person actually gets for an unattended run is the summary on this row and the audit
+     * rows for every action the Bot took, which the gateway writes whether anybody is watching or
+     * not. Persisting the turns themselves is the obvious next thing to add, and this column is
+     * where it would attach.
+     */
+    threadId: text("thread_id"),
+  },
+  (table) => [
+    index("routine_runs_routine_started_idx").on(
+      table.routineId,
+      table.startedAt,
+    ),
+    /**
+     * One live run per routine, enforced by the database rather than by the scheduler.
+     *
+     * Two ticks can overlap, and two processes can both be ticking. Either way the check-then-insert
+     * a careful loop would do has a gap in the middle, and what fits through that gap is a routine
+     * that runs twice: two emails sent, two forms filled in. A unique index closes it, because the
+     * second insert loses rather than races.
+     */
+    uniqueIndex("routine_runs_one_active_idx")
+      .on(table.routineId)
+      .where(sql`status in ('queued', 'running')`),
+  ],
+);
+
+/**
+ * A URL another system can hand a Bot a piece of work through.
+ *
+ * This is the one thing in the product meant to be reachable by somebody who has not signed in, so
+ * it is deliberately narrow: a random endpoint id, a bearer secret kept only as a hash, an optional
+ * list of event types, and an off switch. It is served by a separate process on a separate port; see
+ * routines/receiver.ts for why that is not a detail.
+ *
+ * A trigger either names a routine or carries a prompt of its own. Both exist because the two things
+ * people ask for are genuinely different: "run my morning briefing when the build finishes" reuses a
+ * routine, and "tell the Bot this happened" has no routine to reuse.
+ */
+export const webhookTriggers = pgTable(
+  "webhook_triggers",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    /**
+     * The public path segment, and the only part of this an outsider ever sees.
+     *
+     * Random rather than derived from the name, because a guessable path is one leaked secret away
+     * from a Bot doing work for a stranger, and a name is the part people paste into chat messages.
+     */
+    endpointId: text("endpoint_id").notNull().unique(),
+    name: text("name").notNull(),
+    ownerUserId: text("owner_user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    /** Set when this trigger reuses a routine. Null when it carries its own prompt below. */
+    routineId: uuid("routine_id").references(() => routines.id, {
+      onDelete: "cascade",
+    }),
+    /** Set together, and only when `routineId` is null: the work to do, with no routine to reuse. */
+    agentId: text("agent_id").references(() => agents.id, {
+      onDelete: "cascade",
+    }),
+    prompt: text("prompt"),
+    /**
+     * SHA-256 of the bearer secret.
+     *
+     * The secret itself is shown once, at creation and at rotation, and cannot be recovered
+     * afterwards. A secret this table could return is a secret that an administrator's screen, a
+     * backup and a database dump all hold, and the whole value of a bearer token is that only the
+     * caller has it.
+     */
+    secretHash: text("secret_hash").notNull(),
+    enabled: boolean("enabled").notNull().default(true),
+    /**
+     * True until somebody has looked at a real delivery and confirmed it.
+     *
+     * A newly created trigger accepts its first authenticated delivery, keeps it as a sample, and
+     * runs nothing. The failure this avoids is the quiet one: a hook pointed at the wrong trigger,
+     * or carrying a payload nothing like what was expected, starts real work on somebody's live
+     * systems and the first anybody hears of it is the result.
+     */
+    verificationPending: boolean("verification_pending")
+      .notNull()
+      .default(true),
+    verifiedAt: timestamp("verified_at", { withTimezone: true }),
+    /** The first authenticated delivery, kept so the confirmation above is an informed one. */
+    sample: jsonb("sample"),
+    /**
+     * Which event types this trigger will act on. Empty means every one.
+     *
+     * An allowlist rather than an instruction in the prompt, because "only act on
+     * deployment.succeeded" is a decision about what may reach the Bot at all, and a rule the model
+     * is merely asked to follow is not one.
+     */
+    eventTypes: text("event_types").array().notNull().default([]),
+    deliveryCount: integer("delivery_count").notNull().default(0),
+    lastReceivedAt: timestamp("last_received_at", { withTimezone: true }),
+    createdAt: createdAt(),
+    updatedAt: updatedAt(),
+  },
+  (table) => [index("webhook_triggers_owner_idx").on(table.ownerUserId)],
+);
diff --git a/server/src/index.ts b/server/src/index.ts
index 695d98f..067e857 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -32,6 +32,7 @@ import {
   type IdentifyActor,
   type IdentifyUser,
   mountCopilotRuntime,
+  resolveRuntimeAgents,
 } from "./copilot";
 import {
   createCredentialAdminService,
@@ -40,6 +41,10 @@ import {
 } from "./credentials";
 import { createDatabase } from "./db/client";
 import { createPluginStore } from "./plugins/store";
+import { startWebhookReceiver } from "./routines/receiver";
+import { createRoutineRunner } from "./routines/runner";
+import { createScheduler } from "./routines/scheduler";
+import { createRoutineStore } from "./routines/store";
 import {
   createPackageStatusReader,
   loadTenantPackage,
@@ -295,6 +300,121 @@ process.on("unhandledRejection", (reason) => {
   );
 });
 
+/**
+ * The only path to an acting call, held in a name rather than built inline.
+ *
+ * Two things need it now: the computer routes, which the browser calls, and the routine runner,
+ * which nothing calls because nobody is there. They must be the same gateway rather than two, or the
+ * boundary an administrator wrote would apply to one of them and not the other, and which one would
+ * depend on which object a call happened to be holding.
+ */
+const computerGateway = computerClient
+  ? createComputerGateway({
+      client: computerClient,
+      auditStore: bootAuditStore,
+      // Read on every decision rather than captured once, so a rule an administrator adds while the
+      // server is running applies to the very next action instead of after a restart.
+      policy: () => policyStore.get(),
+      // Stop, reset and the listing act on containers when there are containers to act on.
+      ...(supervisor ? { supervisor } : {}),
+      // Only when a deployment has said its Bots retry on a slower rhythm than the built-in window
+      // assumes. Otherwise the gateway makes its own and nobody has to know it exists.
+      ...(config.computer?.repeatWindowMs
+        ? {
+            repeat: createRepeatDetector({
+              windowMs: config.computer.repeatWindowMs,
+            }),
+          }
+        : {}),
+    })
+  : undefined;
+
+const routineStore = createRoutineStore(database, bootAuditStore);
+
+/**
+ * The unattended runner, and the clock that drives it.
+ *
+ * Both need a computer, because a routine that cannot browse or write a file is a routine that can
+ * only talk to itself. Without one they are absent and the routes say so, rather than existing and
+ * failing on the first tool call.
+ *
+ * The owner is resolved as an ordinary user, never as an administrator, whatever role they hold
+ * while signed in. A routine is work left running, and the Bots it may reach should be the ones its
+ * owner personally has: their own and the deployment's public ones. Nobody should be able to leave
+ * an elevated run going and then change job.
+ */
+const scheduler = computerGateway
+  ? createScheduler({
+      store: routineStore,
+      runner: createRoutineRunner({
+        gateway: computerGateway,
+        resolveAgent: async ({ agentId, actor }) => {
+          const agents = await resolveRuntimeAgents(
+            () => loadAgentsForActor({ id: actor.id, role: "user" }),
+            tenantPackage.model,
+            () =>
+              resolveModelApiKey({
+                encryptionKey: config.keyEncryptionKey,
+                reader: credentialStore,
+                provider: tenantPackage.model.provider,
+                keyId: tenantPackage.model.credentialSecretRef,
+                environment: process.env,
+              }),
+          );
+          return agents[agentId] ?? null;
+        },
+      }),
+      // The same namespace every other conversation is minted in, so an unattended run's id cannot
+      // be mistaken for another deployment's. It names the run's conversation; it does not create
+      // one. See the note on `routine_runs.thread_id`.
+      threadIdFor: () => threadIdentity.mint(),
+    })
+  : undefined;
+
+/**
+ * The scheduler, when this deployment runs unattended work at all.
+ *
+ * One value rather than the same condition written in three places, because three things have to
+ * agree about it: the clock, Run now, and the public port. ROUTINE_SCHEDULER=off is set by somebody
+ * who has restored a production dump onto a laptop, and what they are buying is that nothing in the
+ * restored database can set a Bot working. A switch that stopped the clock and left the door open
+ * would give them the opposite of what they asked for, quietly, because the triggers in that dump
+ * keep their endpoint ids and their secret hashes and the sender configured against them is still
+ * configured.
+ */
+const runningScheduler = config.routines.schedulerEnabled
+  ? scheduler
+  : undefined;
+
+if (runningScheduler) {
+  runningScheduler.start();
+} else {
+  // Said out loud at boot. A deployment whose routines never fire looks exactly like one whose
+  // routines all found nothing, and the difference is a variable nobody remembers setting.
+  console.warn(
+    scheduler
+      ? "ROUTINE_SCHEDULER is off: routines can be written and read, and nothing runs them. Not the clock, not Run now, and not a webhook delivery."
+      : "No computer is configured, so routines cannot run. Set AGENT_COMPUTER_URL to enable them.",
+  );
+}
+
+/**
+ * The public door, on its own listener.
+ *
+ * Started only when there is something for a delivery to start. A port that accepts deliveries and
+ * can do nothing with them is worse than a closed one: the sender is told 202 and the work never
+ * happens. The same reasoning is why the switch above closes it: a delivery does not go through the
+ * clock, so nothing about the interval being stopped would have stopped a run this port started.
+ */
+const webhookReceiver = runningScheduler
+  ? startWebhookReceiver({
+      port: config.routines.webhookPort,
+      hostname: config.routines.webhookHost,
+      store: routineStore,
+      dispatch: (work) => runningScheduler.runFromWebhook(work),
+    })
+  : undefined;
+
 /**
  * The watch on Bot streams, built once and shared by every run.
  *
@@ -348,28 +468,8 @@ const app = createApp(
     stallGuard,
   ),
   computerClient,
-  // The only path to an acting call.
-  computerClient
-    ? createComputerGateway({
-        client: computerClient,
-        auditStore: bootAuditStore,
-        // Read on every decision rather than captured once, so a rule an administrator adds while the
-        // server is running applies to the very next action instead of after a restart.
-        policy: () => policyStore.get(),
-        approvals,
-        // Stop, reset and the listing act on containers when there are containers to act on.
-        ...(supervisor ? { supervisor } : {}),
-        // Only when a deployment has said its Bots retry on a slower rhythm than the built-in window
-        // assumes. Otherwise the gateway makes its own and nobody has to know it exists.
-        ...(config.computer?.repeatWindowMs
-          ? {
-              repeat: createRepeatDetector({
-                windowMs: config.computer.repeatWindowMs,
-              }),
-            }
-          : {}),
-      })
-    : undefined,
+  // The only path to an acting call, shared with the unattended runner above.
+  computerGateway,
   policyStore,
   // Bots as durable objects, and the channels they run in.
   agentProfileStore,
@@ -386,6 +486,12 @@ const app = createApp(
   sandboxedStore,
   // How a thread that has no channel is named, so the direct Bot chat is in the same namespace.
   threadIdentity,
+  // Routines and their triggers. The store is mounted whether or not the clock is running, so a
+  // deployment with the scheduler off can still be looked at and edited.
+  routineStore,
+  // Passed only when this deployment runs routines at all, so Run now refuses in words rather than
+  // reporting success and doing nothing.
+  runningScheduler,
   // Where a person answers what the boundary stopped to ask, whichever half of the product asked.
   approvals,
 );
@@ -529,7 +635,14 @@ if (config.devNoAuth) {
 // way out, so a watch-mode restart does not leave one behind on every reload.
 for (const signal of ["SIGINT", "SIGTERM"] as const) {
   process.on(signal, () => {
-    void channelActivityListener.stop().finally(() => process.exit(0));
+    // The clock and the public port go down with the process rather than after it. A receiver left
+    // listening through a watch-mode restart takes the port with it, and the next boot fails on an
+    // address already in use for a reason nothing on screen explains.
+    scheduler?.stop();
+    void Promise.allSettled([
+      channelActivityListener.stop(),
+      webhookReceiver?.stop() ?? Promise.resolve(),
+    ]).finally(() => process.exit(0));
   });
 }
 
diff --git a/server/src/plugins/store.ts b/server/src/plugins/store.ts
index 9470678..4868a3a 100644
--- a/server/src/plugins/store.ts
+++ b/server/src/plugins/store.ts
@@ -919,6 +919,10 @@ export function createPluginStore(options: PluginStoreOptions) {
         tool: { name: toolNameFor(input.ref) },
         bot: { id: input.botId },
         actor: { id: input.actorId },
+        // Tool calls arrive from a person's browser; the unattended runner offers computer tools and
+        // nothing else. Said rather than left absent for the same reason as everything below it: an
+        // absent field makes any rule naming it unevaluable, and unevaluable reads as a match.
+        run: { unattended: false },
         page: { url: "", host: "" },
         // One, for the same reason as the empty strings, and with a cost worth naming: repetition is
         // counted by the computer gateway, and nothing counts a Bot calling the same MCP tool over
diff --git a/server/src/routines/receiver.ts b/server/src/routines/receiver.ts
new file mode 100644
index 0000000..e014070
--- /dev/null
+++ b/server/src/routines/receiver.ts
@@ -0,0 +1,307 @@
+/**
+ * The public door. A separate Bun server, on a separate port, that serves exactly two things.
+ *
+ * Everything else in this product is behind a session. This is the one surface meant to be reachable
+ * by a third party, and the way to keep the rest of the API away from it is for the rest of the API
+ * not to be on it. Not a route with a different guard, not a middleware that turns authentication
+ * off for one path: a different listener, so that a mistake in this file cannot expose
+ * `/api/admin/credentials`, because that route does not exist here to be reached.
+ *
+ * It answers `/health` and `/hooks/:endpointId` and it 404s everything else, including anything that
+ * looks like an API path. That is worth being deliberate about: an operator putting this behind a
+ * reverse proxy or a tunnel is exposing this port on purpose, and what they are exposing should be
+ * describable in one sentence.
+ *
+ * It binds to 127.0.0.1 unless told otherwise, the same posture as the rest of the product. A
+ * webhook endpoint that is reachable from the internet the moment somebody sets a variable is a
+ * decision, and it should be one somebody made rather than one they inherited.
+ *
+ * What it does NOT do is run the work. It decides, records and hands off; the run happens on the
+ * scheduler's side of the fence. A request from a stranger holding a socket open for the length of a
+ * browsing session is a way to be kept waiting by somebody else's timeout.
+ */
+import { serve } from "bun";
+import type { RoutineStore } from "./store";
+import { decideWebhookDelivery, eventTypeOf } from "./webhooks";
+
+/**
+ * The most a delivery body may be, in bytes.
+ *
+ * Somebody else's payload, so it needs a stated ceiling. Bytes rather than characters, and the
+ * difference is not pedantry: `"😀".repeat(400_000)` is 800,000 characters and 1.6MB of memory, so a
+ * ceiling measured in string length is a ceiling an emoji walks straight through.
+ *
+ * Enforced in three places for one reason each. Bun is told it at {@link startWebhookReceiver}, which
+ * is the only one that refuses before the body is in memory. The declared length is checked first in
+ * the handler, so a caller who announces an oversized body is answered in this product's own words
+ * rather than with Bun's bare 413. And what actually arrived is measured after reading, because a
+ * chunked request declares nothing at all.
+ */
+export const MAX_DELIVERY_BYTES = 1_000_000;
+
+export type WebhookReceiverOptions = {
+  port: number;
+  /** 127.0.0.1 unless a deployment says otherwise, on purpose. */
+  hostname?: string;
+  store: RoutineStore;
+  /**
+   * Start the work this delivery asks for.
+   *
+   * Handed the trigger and the delivery, not a finished prompt. Which instruction the Bot receives
+   * depends on whether the trigger names a routine, and looking that routine up is a database read
+   * that belongs on the side of the fence that already owns routines. This file's job is to decide
+   * whether a request is allowed in.
+   *
+   * Returns whether anything was started, so the sender can be told "accepted" or "that routine is
+   * already going" rather than a bare 202 that means neither.
+   */
+  dispatch: (work: {
+    triggerId: string;
+    routineId: string | null;
+    agentId: string | null;
+    prompt: string | null;
+    ownerUserId: string;
+    /** The delivery as it arrived, for the prompt the Bot is given. */
+    body: unknown;
+    eventType: string | null;
+  }) => Promise<boolean>;
+  log?: (entry: Record<string, unknown>) => void;
+};
+
+export type WebhookReceiver = {
+  port: number;
+  hostname: string;
+  stop: () => Promise<void>;
+};
+
+export function startWebhookReceiver(
+  options: WebhookReceiverOptions,
+): WebhookReceiver {
+  const hostname = options.hostname ?? "127.0.0.1";
+  const log = options.log ?? ((entry) => console.info(JSON.stringify(entry)));
+
+  const server = serve({
+    port: options.port,
+    hostname,
+    /*
+     * The only limit that means anything on a port a stranger can reach.
+     *
+     * Left unset, Bun buffers up to its own default of 128MB before the handler is called at all, so
+     * a check inside the handler is a check performed on memory that has already been allocated: a
+     * handful of concurrent unauthenticated posts is enough to take the process down, and none of
+     * them has presented a secret. Told the ceiling, Bun refuses the request on the socket and never
+     * calls the handler, which is the difference between a limit and a report.
+     */
+    maxRequestBodySize: MAX_DELIVERY_BYTES,
+    fetch: (request) => handle(request, options, log),
+  });
+
+  log({
+    type: "routine-webhook-receiver",
+    url: `http://${hostname}:${server.port}`,
+    serves: "/health and /hooks/:endpointId, and nothing else",
+  });
+
+  return {
+    // The port the listener actually took. Bun types it as optional because port 0 asks the kernel
+    // to pick one; it has picked by the time `serve` returns, and reporting the requested port
+    // instead would be a lie in exactly the case somebody would be reading this to find out.
+    port: server.port ?? options.port,
+    hostname,
+    stop: async () => {
+      await server.stop(true);
+    },
+  };
+}
+
+/**
+ * One request, from the top.
+ *
+ * Written as a flat sequence rather than as a router, because the routing table is two entries and a
+ * reader of this file should be able to see the entire public surface without following anything.
+ */
+async function handle(
+  request: Request,
+  options: WebhookReceiverOptions,
+  log: (entry: Record<string, unknown>) => void,
+): Promise<Response> {
+  const url = new URL(request.url);
+
+  if (url.pathname === "/health") {
+    return Response.json({ status: "ok" });
+  }
+
+  const endpointId = url.pathname.startsWith("/hooks/")
+    ? decodeURIComponent(url.pathname.slice("/hooks/".length))
+    : null;
+  // Anything with a further path segment is not an endpoint id. Rejected rather than trimmed, so
+  // `/hooks/abc/../../whatever` cannot become a lookup for something else.
+  if (!endpointId || endpointId.includes("/")) {
+    return new Response("Not found.", { status: 404 });
+  }
+  if (request.method !== "POST") {
+    return new Response("Deliveries are POSTed.", { status: 405 });
+  }
+
+  // Before anything is read. A sender that declares an oversized body is refused on the strength of
+  // its own header, which costs nothing and is the common case: the systems that send large payloads
+  // are the ones that know how large they are.
+  if (declaredTooLarge(request.headers.get("content-length"))) {
+    return tooLarge();
+  }
+
+  const raw = await request.text().catch(() => "");
+  // A chunked delivery declares no length, so what arrived is measured. Bytes, not characters: the
+  // string this returns can be half the size of the request that carried it.
+  if (Buffer.byteLength(raw, "utf8") > MAX_DELIVERY_BYTES) {
+    return tooLarge();
+  }
+  let body: unknown = null;
+  try {
+    body = raw ? JSON.parse(raw) : null;
+  } catch {
+    // Kept as text rather than refused. Plenty of systems send form encodings or plain strings, and
+    // the Bot can read what arrived either way; what matters is that the shape is not guessed at.
+    body = { text: raw };
+  }
+
+  const trigger = await options.store
+    .triggerByEndpoint(endpointId)
+    .catch(() => null);
+  const eventType = eventTypeOf(request.headers, body);
+  const decision = decideWebhookDelivery(
+    trigger
+      ? {
+          enabled: trigger.enabled,
+          verificationPending: trigger.verificationPending,
+          secretHash: trigger.secretHash,
+          eventTypes: trigger.eventTypes,
+        }
+      : null,
+    { authorization: request.headers.get("authorization"), eventType },
+  );
+
+  if (decision.outcome === "reject") {
+    /*
+     * Recorded, including the ones that were nothing. An endpoint on the public internet is probed,
+     * and "this endpoint was called forty times last night with the wrong secret" is exactly the
+     * sort of thing the trail exists to be able to say. The endpoint id is recorded; the secret that
+     * was presented is not, because a failed guess is still somebody's secret somewhere.
+     */
+    await options.store
+      .recordDeliveryEvent({
+        endpointId,
+        ...(trigger ? { triggerId: trigger.id } : {}),
+        outcome: "refused",
+        reason: decision.reason,
+        eventType,
+      })
+      .catch(() => undefined);
+    return Response.json(
+      { error: decision.reason },
+      { status: decision.status },
+    );
+  }
+
+  // Past the secret, so this is a real caller and the count is worth keeping either way.
+  await options.store
+    .recordDelivery({
+      id: trigger?.id ?? "",
+      body,
+      captureSample: decision.outcome === "capture",
+    })
+    .catch(() => undefined);
+
+  if (decision.outcome === "capture") {
+    // Its own outcome, not a refusal. This delivery presented the right secret and was deliberately
+    // kept, which is the one thing the whole verification gate exists to do; a trail that files it
+    // under "a delivery was refused" tells the person looking for their sample that it never came.
+    await options.store
+      .recordDeliveryEvent({
+        endpointId,
+        ...(trigger ? { triggerId: trigger.id } : {}),
+        outcome: "captured",
+        reason: decision.reason,
+        eventType,
+      })
+      .catch(() => undefined);
+    // 202, not 200. Something was accepted and nothing was done, and the sender is told which in
+    // words, because a hook that reports success while the Bot sits idle is how a misconfiguration
+    // survives a week.
+    return Response.json(
+      { status: "captured", detail: decision.reason },
+      { status: 202 },
+    );
+  }
+
+  if (!trigger) {
+    // Unreachable: `decideWebhookDelivery` refuses a null trigger. Stated rather than asserted, so
+    // that a future change to the decision cannot silently turn this into a crash on a public port.
+    return new Response("Not found.", { status: 404 });
+  }
+
+  const started = await options
+    .dispatch({
+      triggerId: trigger.id,
+      routineId: trigger.routineId,
+      agentId: trigger.agentId,
+      prompt: trigger.prompt,
+      ownerUserId: trigger.ownerUserId,
+      body,
+      eventType,
+    })
+    .catch((error: unknown) => {
+      log({
+        type: "routine-webhook-dispatch-failed",
+        endpoint: endpointId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return false;
+    });
+
+  await options.store
+    .recordDeliveryEvent({
+      endpointId,
+      triggerId: trigger.id,
+      outcome: started ? "ran" : "refused",
+      reason: started
+        ? "The delivery started a run."
+        : "The delivery arrived while the last one was still being worked on, so nothing was started.",
+      eventType,
+    })
+    .catch(() => undefined);
+
+  // 409 rather than an error, because nothing is wrong: the work this delivery asks for is already
+  // being done, and a sender that retries on a 5xx should not be encouraged to.
+  return started
+    ? Response.json({ status: "started" }, { status: 202 })
+    : Response.json(
+        {
+          status: "busy",
+          detail: "The last delivery to this trigger is still being worked on.",
+        },
+        { status: 409 },
+      );
+}
+
+/**
+ * Whether the caller has said, in its own header, that the body is too big.
+ *
+ * A header that is missing or is not a number is not a refusal. It means only that the caller did
+ * not say, which is what a chunked sender does, and what actually arrived is measured afterwards.
+ * Refusing on a malformed header would turn deliveries this endpoint can perfectly well accept into
+ * a failure the sender cannot see the cause of.
+ */
+function declaredTooLarge(header: string | null): boolean {
+  if (!header) return false;
+  const declared = Number.parseInt(header, 10);
+  return Number.isFinite(declared) && declared > MAX_DELIVERY_BYTES;
+}
+
+/** One sentence, whichever check caught it, so one problem has one answer. */
+function tooLarge(): Response {
+  return Response.json(
+    { error: "That delivery is larger than this endpoint accepts." },
+    { status: 413 },
+  );
+}
diff --git a/server/src/routines/routes.ts b/server/src/routines/routes.ts
new file mode 100644
index 0000000..4faf87a
--- /dev/null
+++ b/server/src/routines/routes.ts
@@ -0,0 +1,416 @@
+/**
+ * The signed-in surface for routines and webhook triggers.
+ *
+ * Two different things behind one prefix, and they are guarded differently because they belong to
+ * different people. A routine is somebody's own work: every route for one is scoped to the person
+ * asking, in the query rather than after it, because a routine carries a prompt they wrote about
+ * their own job and "we fetched it and then decided not to show it" is the shape most accidental
+ * disclosures take. A webhook trigger is a door in the side of the deployment, so it belongs to
+ * whoever answers for the deployment: the trigger routes require an administrator and are not scoped
+ * to a creator at all, because the question they exist to answer is "what can reach us from
+ * outside", which no per-person list answers correctly.
+ *
+ * The public side of a webhook is not here. It is a different process on a different port, see
+ * receiver.ts, and this file only ever manages the triggers rather than receiving anything.
+ */
+import type { MiddlewareHandler } from "hono";
+import { Hono } from "hono";
+import { type AppVariables, requireAdmin } from "../auth/guards";
+import { parseRoutineSchedule, type RoutineSchedule } from "./schedule";
+import type { Scheduler } from "./scheduler";
+import type { RoutineStore } from "./store";
+
+/**
+ * The actor, in the shape the store wants.
+ *
+ * The local development actor is a real row in `users`, unlike the situation the computer routes
+ * guard against, because a routine's owner is a foreign key to that table and the routine could not
+ * exist otherwise. So the id travels as both.
+ */
+function actorOf(context: { var: AppVariables }) {
+  return { id: context.var.actor.id, userId: context.var.actor.id };
+}
+
+export function createRoutineRoutes(
+  store: RoutineStore,
+  /** Absent when the scheduler is switched off: routines can still be written, nothing runs them. */
+  scheduler: Scheduler | undefined,
+  requireUser: MiddlewareHandler<{ Variables: AppVariables }>,
+) {
+  const routes = new Hono<{ Variables: AppVariables }>();
+
+  routes.get("/", requireUser, async (context) =>
+    context.json({ routines: await store.list(context.var.actor.id) }),
+  );
+
+  routes.post("/", requireUser, async (context) => {
+    const body = await context.req.json().catch(() => null);
+    const input = routineInput(body);
+    if ("error" in input) return context.json({ error: input.error }, 400);
+
+    return context.json(
+      {
+        routine: await store.create(
+          {
+            agentId: input.agentId,
+            ownerUserId: context.var.actor.id,
+            name: input.name,
+            prompt: input.prompt,
+            schedule: input.schedule,
+            ...(input.enabled !== undefined ? { enabled: input.enabled } : {}),
+          },
+          actorOf(context),
+        ),
+      },
+      201,
+    );
+  });
+
+  routes.patch("/:routineId", requireUser, async (context) => {
+    const body = (await context.req.json().catch(() => null)) as Record<
+      string,
+      unknown
+    > | null;
+    if (!body) return context.json({ error: "A change is required." }, 400);
+
+    const patch: {
+      name?: string;
+      prompt?: string;
+      schedule?: RoutineSchedule;
+      enabled?: boolean;
+    } = {};
+    if (body.name !== undefined) {
+      const name = trimmed(body.name);
+      if (!name) return context.json({ error: "A name is required." }, 400);
+      patch.name = name;
+    }
+    if (body.prompt !== undefined) {
+      const prompt = trimmed(body.prompt);
+      if (!prompt) {
+        return context.json(
+          { error: "Say what the Bot should do when this runs." },
+          400,
+        );
+      }
+      patch.prompt = prompt;
+    }
+    if (body.schedule !== undefined) {
+      const schedule = parseRoutineSchedule(body.schedule);
+      // Refused rather than repaired. A schedule is the thing that decides when a Bot acts on
+      // somebody's live systems, and "we accepted your schedule but not in the shape you wrote it"
+      // is the one behaviour that must never happen here.
+      if (!schedule) {
+        return context.json({ error: INVALID_SCHEDULE }, 400);
+      }
+      patch.schedule = schedule;
+    }
+    if (body.enabled !== undefined) {
+      if (typeof body.enabled !== "boolean") {
+        return context.json({ error: "enabled must be true or false." }, 400);
+      }
+      patch.enabled = body.enabled;
+    }
+
+    const routine = await store.update(
+      context.req.param("routineId"),
+      context.var.actor.id,
+      patch,
+      actorOf(context),
+    );
+    return routine
+      ? context.json({ routine })
+      : context.json({ error: "No such routine." }, 404);
+  });
+
+  routes.delete("/:routineId", requireUser, async (context) => {
+    const removed = await store.remove(
+      context.req.param("routineId"),
+      context.var.actor.id,
+      actorOf(context),
+    );
+    return removed
+      ? context.json({ deleted: true })
+      : context.json({ error: "No such routine." }, 404);
+  });
+
+  routes.get("/:routineId/runs", requireUser, async (context) => {
+    // The ownership check is the `get`, which is scoped. Listing runs without it would let anybody
+    // with a routine id read what somebody else's Bot found.
+    const routine = await store.get(
+      context.req.param("routineId"),
+      context.var.actor.id,
+    );
+    if (!routine) return context.json({ error: "No such routine." }, 404);
+    return context.json({ runs: await store.runs(routine.id) });
+  });
+
+  /**
+   * Run it now.
+   *
+   * The same path a scheduled run takes, on purpose: the same runner, the same gateway, the same
+   * rows. What differs is the `trigger` recorded on the run and, to the boundary, nothing at all,
+   * because a person who presses this then walks away is as absent as the clock is.
+   */
+  routes.post("/:routineId/run", requireUser, async (context) => {
+    const routine = await store.get(
+      context.req.param("routineId"),
+      context.var.actor.id,
+    );
+    if (!routine) return context.json({ error: "No such routine." }, 404);
+    if (!scheduler) {
+      return context.json(
+        {
+          error:
+            "Routines are switched off in this deployment, so nothing can be run.",
+        },
+        503,
+      );
+    }
+
+    const outcome = await scheduler.runNow(routine.id, actorOf(context));
+    if (outcome === "unknown") {
+      return context.json({ error: "No such routine." }, 404);
+    }
+    // 409 for busy, because nothing is wrong: the work is already being done. Reporting it as an
+    // error would teach somebody to press the button again.
+    return outcome === "busy"
+      ? context.json(
+          { status: "busy", detail: "This routine is already running." },
+          409,
+        )
+      : context.json({ status: "started" }, 202);
+  });
+
+  /*
+   * Everything below this line is an administrator's.
+   *
+   * A trigger is not somebody's own work the way a routine is. It is a URL on the public internet
+   * that sets a Bot working, which is a fact about the whole deployment, and the two halves of that
+   * have to agree about whose it is. They did not: the routes admitted any signed-in person and the
+   * only page that renders them is behind the administrator guard, so an ordinary user could mint a
+   * publicly reachable endpoint through the API and then had nowhere to see or revoke it, while an
+   * administrator opening the page to review this deployment's exposure was shown only the triggers
+   * they had personally created and could not shut a door anybody else had opened.
+   *
+   * So: an administrator, and every trigger, not their own. What it costs is that somebody who is
+   * not an administrator cannot give their routine a webhook at all, and has to ask. That is the
+   * right way round for the one surface in this product that answers to strangers.
+   */
+  routes.get("/triggers", requireUser, async (context) => {
+    const denied = requireAdmin(context);
+    if (denied) return denied;
+    return context.json({ triggers: await store.listTriggers() });
+  });
+
+  /**
+   * Make a trigger, and show its secret exactly once.
+   *
+   * The secret is in this response and nowhere else, ever. It is not in the list, not readable
+   * afterwards, and not recoverable: the row keeps a hash. Somebody who loses it rotates, which is
+   * one click and is the honest answer, rather than the product keeping a copy so it can be shown
+   * again on a screen anybody with the session can open.
+   */
+  routes.post("/triggers", requireUser, async (context) => {
+    const denied = requireAdmin(context);
+    if (denied) return denied;
+
+    const body = (await context.req.json().catch(() => null)) as Record<
+      string,
+      unknown
+    > | null;
+    const name = trimmed(body?.name);
+    if (!name) return context.json({ error: "A name is required." }, 400);
+
+    const routineId = trimmed(body?.routineId);
+    const agentId = trimmed(body?.agentId);
+    const prompt = trimmed(body?.prompt);
+
+    // One or the other, never both and never neither. A trigger that named a routine AND carried a
+    // prompt would have two answers to "what does this do", and the one it used would be whichever
+    // the code happened to check first.
+    if (Boolean(routineId) === Boolean(agentId && prompt)) {
+      return context.json(
+        {
+          error:
+            "A trigger either runs a routine, or names a Bot and what to tell it. Give one, not both.",
+        },
+        400,
+      );
+    }
+    if (routineId) {
+      // Their own routine, even here. An administrator may manage every door in the deployment, and
+      // that is not the same as being able to point a new one at somebody else's work: a routine
+      // runs with its owner's authority, so wiring a stranger's routine to a public URL would be
+      // handing out somebody else's access without their knowing.
+      const routine = await store.get(routineId, context.var.actor.id);
+      if (!routine) return context.json({ error: "No such routine." }, 404);
+    }
+
+    const eventTypes = stringList(body?.eventTypes);
+    if (eventTypes === null) {
+      return context.json(
+        { error: "eventTypes must be a list of names." },
+        400,
+      );
+    }
+
+    const created = await store.createTrigger(
+      {
+        name,
+        ownerUserId: context.var.actor.id,
+        ...(routineId ? { routineId } : {}),
+        ...(agentId ? { agentId } : {}),
+        ...(prompt ? { prompt } : {}),
+        eventTypes,
+      },
+      actorOf(context),
+    );
+    return context.json(created, 201);
+  });
+
+  routes.patch("/triggers/:triggerId", requireUser, async (context) => {
+    const denied = requireAdmin(context);
+    if (denied) return denied;
+
+    const body = (await context.req.json().catch(() => null)) as Record<
+      string,
+      unknown
+    > | null;
+    const patch: { enabled?: boolean; eventTypes?: string[] } = {};
+    if (body?.enabled !== undefined) {
+      if (typeof body.enabled !== "boolean") {
+        return context.json({ error: "enabled must be true or false." }, 400);
+      }
+      patch.enabled = body.enabled;
+    }
+    if (body?.eventTypes !== undefined) {
+      const eventTypes = stringList(body.eventTypes);
+      if (eventTypes === null) {
+        return context.json(
+          { error: "eventTypes must be a list of names." },
+          400,
+        );
+      }
+      patch.eventTypes = eventTypes;
+    }
+
+    const trigger = await store.updateTrigger(
+      context.req.param("triggerId"),
+      patch,
+      actorOf(context),
+    );
+    return trigger
+      ? context.json({ trigger })
+      : context.json({ error: "No such trigger." }, 404);
+  });
+
+  /**
+   * Confirm what actually arrived, so the trigger starts doing work.
+   *
+   * Refused when nothing has arrived yet. Confirming a trigger nothing has ever called confirms
+   * nothing, and would turn the one gate that catches a misdirected hook into a box somebody ticks
+   * on their way past.
+   */
+  routes.post("/triggers/:triggerId/verify", requireUser, async (context) => {
+    const denied = requireAdmin(context);
+    if (denied) return denied;
+
+    const trigger = await store.verifyTrigger(
+      context.req.param("triggerId"),
+      actorOf(context),
+    );
+    return trigger
+      ? context.json({ trigger })
+      : context.json(
+          {
+            error:
+              "There is nothing to confirm yet. Send a delivery to this endpoint first, then look at what arrived.",
+          },
+          409,
+        );
+  });
+
+  routes.post("/triggers/:triggerId/rotate", requireUser, async (context) => {
+    const denied = requireAdmin(context);
+    if (denied) return denied;
+
+    const rotated = await store.rotateTriggerSecret(
+      context.req.param("triggerId"),
+      actorOf(context),
+    );
+    return rotated
+      ? context.json(rotated)
+      : context.json({ error: "No such trigger." }, 404);
+  });
+
+  routes.delete("/triggers/:triggerId", requireUser, async (context) => {
+    const denied = requireAdmin(context);
+    if (denied) return denied;
+
+    const removed = await store.deleteTrigger(
+      context.req.param("triggerId"),
+      actorOf(context),
+    );
+    return removed
+      ? context.json({ deleted: true })
+      : context.json({ error: "No such trigger." }, 404);
+  });
+
+  return routes;
+}
+
+const INVALID_SCHEDULE =
+  'A schedule is either {"type":"once","at":"<ISO time>"} or ' +
+  '{"type":"daily","time":"HH:MM","weekdays":[1,2,3,4,5]}, in UTC, with 0 for Sunday.';
+
+type RoutineInput = {
+  agentId: string;
+  name: string;
+  prompt: string;
+  schedule: RoutineSchedule;
+  enabled?: boolean;
+};
+
+function routineInput(value: unknown): RoutineInput | { error: string } {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { error: "A routine is required." };
+  }
+  const body = value as Record<string, unknown>;
+
+  const agentId = trimmed(body.agentId);
+  if (!agentId) return { error: "Choose a Bot to run this." };
+  const name = trimmed(body.name);
+  if (!name) return { error: "A name is required." };
+  const prompt = trimmed(body.prompt);
+  if (!prompt) return { error: "Say what the Bot should do when this runs." };
+  const schedule = parseRoutineSchedule(body.schedule);
+  if (!schedule) return { error: INVALID_SCHEDULE };
+  if (body.enabled !== undefined && typeof body.enabled !== "boolean") {
+    return { error: "enabled must be true or false." };
+  }
+
+  return {
+    agentId,
+    name,
+    prompt,
+    schedule,
+    ...(body.enabled !== undefined ? { enabled: body.enabled as boolean } : {}),
+  };
+}
+
+function trimmed(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+/** A list of names, or null for something that was sent but is not one. Absent means empty. */
+function stringList(value: unknown): string[] | null {
+  if (value === undefined || value === null) return [];
+  if (!Array.isArray(value)) return null;
+  const names: string[] = [];
+  for (const entry of value) {
+    if (typeof entry !== "string") return null;
+    const name = entry.trim();
+    if (name && !names.includes(name)) names.push(name);
+  }
+  return names;
+}
diff --git a/server/src/routines/runner.ts b/server/src/routines/runner.ts
new file mode 100644
index 0000000..a0ac7e8
--- /dev/null
+++ b/server/src/routines/runner.ts
@@ -0,0 +1,774 @@
+/**
+ * One turn of a Bot, run on the server with nobody watching.
+ *
+ * A scheduled run is an unattended run. Nobody is looking at the screen, nobody can take the wheel,
+ * and nobody can answer a question. That is exactly the condition a boundary exists for, so the
+ * thing this module must not do is invent a quieter path to the computer for work nobody is
+ * supervising.
+ *
+ * It does not. The browser normally executes the computer tools, see
+ * app/src/lib/copilot/computer-tools.tsx, but that is a rendering arrangement and never was where
+ * anything was decided: the tool handler there is a `fetch` to this server, and the policy decision,
+ * the audit row and the action itself have always happened here, in the gateway. So an unattended
+ * run does not need a weaker path. It needs the same one, and it gets it: every tool call below goes
+ * through {@link ComputerGateway}, is judged by the same rules an attended click is judged by, and
+ * leaves the same rows behind. The only difference visible to a rule is `run.unattended`, which is
+ * there so a deployment can be stricter about work nobody is watching rather than more permissive.
+ *
+ * What is deliberately absent is the human. `computer_request_help`, `computer_request_secret` and
+ * the take-the-wheel handover are not offered, because they are all requests for a person who is
+ * not there, and a tool that waits ten minutes for an answer nobody will give turns an unattended
+ * run into an unattended hang. A model that reaches for one is told plainly that it is unavailable
+ * rather than having the call quietly dropped: a tool call that vanishes leaves a model repeating
+ * itself, and a model that is told is a model that can say what it could not finish.
+ */
+import type { AbstractAgent, BaseEvent, Message, Tool } from "@ag-ui/client";
+import { EventType } from "@ag-ui/client";
+import type { ActionActor, ComputerGateway } from "../computer/gateway";
+import { ActionRefusedError } from "../computer/gateway";
+
+/**
+ * How many times the model may act before the run is stopped.
+ *
+ * A cap rather than a timeout, because the thing that runs away is a loop, not a long call: a model
+ * that keeps re-snapshotting a page that never changes will do it as fast as the computer answers.
+ * Twenty is generous for the work a routine actually describes and small enough that a stuck run
+ * costs minutes rather than a night.
+ */
+export const DEFAULT_MAX_TURNS = 20;
+
+/**
+ * How long the whole run may take, however many turns that is.
+ *
+ * The turn cap above stops a loop; this stops a stall, and they are different failures. A cap counts
+ * things that finish, and the shape that has to be survived here is a call that never finishes at
+ * all: a remote AG-UI Bot whose connection drops without the stream erroring, or any agent that
+ * hands back an observable which neither completes nor fails. `collectOneTurn` waits on `complete` or
+ * `error`, so a stream that does neither leaves it waiting forever, and forever is not an
+ * exaggeration — there is no socket timeout underneath it and nothing else watching.
+ *
+ * What that costs without a deadline is not one lost run. The run row stays `running`, which holds
+ * the one-live-run index, and the routine never fires again by any route: the tick skips it, Run now
+ * answers "already running", every delivery answers the same, and the only cure in the product is
+ * deleting the routine and its whole history. A deadline turns all of that into an ordinary failed
+ * run that says what happened.
+ *
+ * Fifteen minutes is generous for the work a routine describes and short enough that a stuck run
+ * costs a quarter of an hour rather than a night. A routine that genuinely needs longer is a routine
+ * that should be split, because nothing is watching this one.
+ */
+export const DEFAULT_RUN_DEADLINE_MS = 15 * 60_000;
+
+export type RoutineRunRequest = {
+  /** Which Bot. Resolved to an agent by the caller's loader, so visibility rules still apply. */
+  agentId: string;
+  /** What the routine says, put to the Bot exactly as a person would have typed it. */
+  prompt: string;
+  /**
+   * The name this run's conversation is given.
+   *
+   * Passed to the agent and written on the run row, so one run's turns are told apart from another's
+   * by anything that sees both. It is a name and not a stored transcript: nothing here persists the
+   * conversation. See the note on `routine_runs.thread_id`.
+   */
+  threadId: string;
+  /** Who it runs as. The gateway records this and the boundary can read it. */
+  actor: ActionActor;
+};
+
+export type RoutineRunOutcome = {
+  /** What the Bot said last, which is what the run history shows. */
+  summary: string;
+  /** How many times the model was asked, for the operator wondering why a run took a while. */
+  turns: number;
+  /** True when the cap stopped it rather than the model finishing. */
+  stoppedAtCap: boolean;
+};
+
+export type RoutineRunnerOptions = {
+  /** The only path to an acting call, unattended or not. */
+  gateway: ComputerGateway;
+  /**
+   * Resolve the Bot to an agent that can be run.
+   *
+   * A function rather than a map, because who may run which Bot is decided per person and a routine
+   * belongs to one. Handing the runner a prebuilt map would mean a routine kept working after its
+   * owner lost access to the Bot, which is a quiet way to leave a deleted colleague's work running.
+   */
+  resolveAgent: (request: {
+    agentId: string;
+    actor: ActionActor;
+  }) => Promise<AbstractAgent | null>;
+  maxTurns?: number;
+  /** The wall clock a run is held to. See {@link DEFAULT_RUN_DEADLINE_MS}. */
+  deadlineMs?: number;
+};
+
+export type RoutineRunner = {
+  run: (request: RoutineRunRequest) => Promise<RoutineRunOutcome>;
+};
+
+/** A run that never started, as opposed to one that started and went wrong. Told apart in the trail. */
+export class RoutineBotUnavailableError extends Error {
+  constructor(agentId: string) {
+    super(
+      `${agentId} is not a Bot this routine's owner can run. It may have been deleted or made private.`,
+    );
+    this.name = "RoutineBotUnavailableError";
+  }
+}
+
+/**
+ * A run that was still going when its time ran out.
+ *
+ * Its own class rather than a plain Error, following computer/client.ts: this is not the Bot failing
+ * at the work, it is the work not ending, and somebody reading a run history needs to be able to
+ * tell a Bot that could not do the job from one that never came back.
+ */
+export class RoutineRunDeadlineError extends Error {
+  constructor(deadlineMs: number) {
+    super(
+      `The run was still going after ${Math.round(deadlineMs / 60_000)} minutes and was stopped. The Bot may have been waiting on something that never answered.`,
+    );
+    this.name = "RoutineRunDeadlineError";
+  }
+}
+
+export function createRoutineRunner(
+  options: RoutineRunnerOptions,
+): RoutineRunner {
+  const maxTurns = options.maxTurns ?? DEFAULT_MAX_TURNS;
+  const deadlineMs = options.deadlineMs ?? DEFAULT_RUN_DEADLINE_MS;
+
+  return {
+    run: async (request) => {
+      /*
+       * One deadline for the run, spent across however many turns it takes, rather than one per
+       * turn. A per-turn timeout would let twenty turns of fourteen minutes each add up to nearly
+       * five hours while every individual turn looked well behaved, which is precisely the run
+       * nobody is watching.
+       */
+      const expiresAt = Date.now() + deadlineMs;
+      const agent = await options.resolveAgent({
+        agentId: request.agentId,
+        actor: request.actor,
+      });
+      if (!agent) throw new RoutineBotUnavailableError(request.agentId);
+
+      const messages: Message[] = [
+        {
+          id: `routine-prompt-${crypto.randomUUID()}`,
+          role: "user",
+          content: request.prompt,
+        },
+      ];
+
+      let said = "";
+      for (let turn = 1; turn <= maxTurns; turn += 1) {
+        // Raised rather than returned. A run that ran out of time did not finish the work, and a
+        // summary is the shape of an answer; the scheduler writes this as a failed run, which
+        // releases the routine's one-live-run claim and says why on the page.
+        if (Date.now() >= expiresAt)
+          throw new RoutineRunDeadlineError(deadlineMs);
+
+        const spoke = await collectOneTurn(agent, {
+          threadId: request.threadId,
+          messages,
+          // What is left of the run's own clock, so a turn that never settles cannot outlive it.
+          remainingMs: expiresAt - Date.now(),
+          deadlineMs,
+        });
+        if (spoke.text.trim()) said = spoke.text.trim();
+
+        messages.push({
+          id: spoke.messageId,
+          role: "assistant",
+          ...(spoke.text ? { content: spoke.text } : {}),
+          ...(spoke.toolCalls.length
+            ? {
+                toolCalls: spoke.toolCalls.map((call) => ({
+                  id: call.id,
+                  type: "function" as const,
+                  function: { name: call.name, arguments: call.args },
+                })),
+              }
+            : {}),
+        });
+
+        if (spoke.toolCalls.length === 0) {
+          return { summary: said, turns: turn, stoppedAtCap: false };
+        }
+
+        for (const call of spoke.toolCalls) {
+          messages.push({
+            id: `routine-tool-${call.id}`,
+            role: "tool",
+            toolCallId: call.id,
+            content: await executeToolCall(options.gateway, request, call),
+          });
+        }
+      }
+
+      return {
+        // Said out loud in the summary rather than only in a field, because the run history is read
+        // as prose and "it stopped because it ran out of turns" is the part a person needs to see.
+        summary: said
+          ? `${said}\n\n(The run was stopped after ${maxTurns} turns.)`
+          : `The run was stopped after ${maxTurns} turns without the Bot finishing.`,
+        turns: maxTurns,
+        stoppedAtCap: true,
+      };
+    },
+  };
+}
+
+/** One tool call the model made, reassembled from the streamed events. */
+type PendingToolCall = { id: string; name: string; args: string };
+
+type TurnResult = {
+  messageId: string;
+  text: string;
+  toolCalls: PendingToolCall[];
+};
+
+/**
+ * Drive one `run()` to completion and reduce the event stream back into a message.
+ *
+ * The stream is the protocol's own shape, deltas of text and deltas of tool arguments, and putting
+ * it back together is what the browser SDK does for an attended run. Doing it here rather than
+ * reaching for a client helper keeps the runner testable against a fake agent that emits events,
+ * which is the only way the interesting cases, an unknown tool, a refused action, a model that says
+ * nothing at all, can be written down as tests rather than acted out against a live model.
+ *
+ * BOTH SPELLINGS OF THE STREAM ARE HANDLED, and that is not defensiveness. The protocol carries text
+ * either as START/CONTENT/END or as a single CHUNK, and tool calls the same way, and which one
+ * arrives depends on the agent: the built-in Bot emits chunks, and a remote AG-UI endpoint on some
+ * other framework may well emit the split form. Reading only one of them produces a run that
+ * completes, records success, and has an empty summary, which is the worst shape a failure can take
+ * because nothing anywhere says it went wrong.
+ *
+ * A `RUN_ERROR` is raised as an exception rather than returned as text. It means the model or its
+ * transport failed, which is a failed run and not a turn with a disappointing answer, and the two
+ * have to be distinguishable in the run history or a person cannot tell a broken Bot from a quiet one.
+ */
+async function collectOneTurn(
+  agent: AbstractAgent,
+  input: {
+    threadId: string;
+    messages: Message[];
+    /** What is left of the run's deadline. */
+    remainingMs: number;
+    /** The whole run's allowance, for the sentence a person reads. */
+    deadlineMs: number;
+  },
+): Promise<TurnResult> {
+  const messageId = `routine-said-${crypto.randomUUID()}`;
+  let text = "";
+  const calls = new Map<string, PendingToolCall>();
+  const order: string[] = [];
+  let failure: string | null = null;
+
+  /** Start a call, or return the one already open. Both spellings arrive here. */
+  const beginCall = (id: string, name: string) => {
+    const existing = calls.get(id);
+    if (existing) {
+      // A chunk may repeat the name without meaning a second call. Kept, rather than blanked by a
+      // later chunk that carries only a delta.
+      if (name) existing.name = name;
+      return existing;
+    }
+    const call: PendingToolCall = { id, name, args: "" };
+    calls.set(id, call);
+    order.push(id);
+    return call;
+  };
+
+  await new Promise<void>((resolve, reject) => {
+    let subscription: { unsubscribe: () => void } | undefined;
+    /*
+     * The turn's share of the run's clock, and the only thing that ends a stream which does neither.
+     *
+     * Held here rather than around the whole loop because this is where the waiting happens: a
+     * promise that settles on `complete` or `error` and nothing else settles never, and every layer
+     * above it is then waiting on a promise, not on a socket. Cleared on both ways out so a finished
+     * turn does not leave a timer keeping anything alive.
+     */
+    const expiry = setTimeout(
+      () => {
+        // Safe to reach for the subscription from in here, unlike the error path below: this callback
+        // cannot run in the same tick that created it, so the binding exists by the time it does. The
+        // stream is dropped rather than left running, because an agent that is still emitting into a
+        // turn nobody is waiting for is an agent still spending somebody's model budget.
+        subscription?.unsubscribe();
+        reject(new RoutineRunDeadlineError(input.deadlineMs));
+      },
+      Math.max(0, input.remainingMs),
+    );
+
+    const events = agent.run({
+      threadId: input.threadId,
+      runId: crypto.randomUUID(),
+      state: {},
+      messages: input.messages,
+      tools: UNATTENDED_TOOLS,
+      context: [],
+      forwardedProps: {},
+    });
+
+    subscription = events.subscribe({
+      next: (event: BaseEvent) => {
+        switch (event.type) {
+          case EventType.TEXT_MESSAGE_CONTENT:
+            text += (event as unknown as { delta: string }).delta;
+            break;
+          case EventType.TEXT_MESSAGE_CHUNK:
+            text += (event as unknown as { delta?: string }).delta ?? "";
+            break;
+          case EventType.TOOL_CALL_START: {
+            const started = event as unknown as {
+              toolCallId: string;
+              toolCallName: string;
+            };
+            beginCall(started.toolCallId, started.toolCallName);
+            break;
+          }
+          case EventType.TOOL_CALL_ARGS: {
+            const arrived = event as unknown as {
+              toolCallId: string;
+              delta: string;
+            };
+            const call = calls.get(arrived.toolCallId);
+            if (call) call.args += arrived.delta;
+            break;
+          }
+          case EventType.TOOL_CALL_CHUNK: {
+            /*
+             * Every field is optional in a chunk. An id-less chunk is a continuation of the call
+             * already open, which is why the last one started is remembered: dropping those deltas
+             * would leave a tool call with truncated JSON, and truncated JSON is a call the runner
+             * refuses for a reason that would look like the model's fault.
+             */
+            const chunk = event as unknown as {
+              toolCallId?: string;
+              toolCallName?: string;
+              delta?: string;
+            };
+            const id = chunk.toolCallId ?? order.at(-1);
+            if (!id) break;
+            const call = beginCall(id, chunk.toolCallName ?? "");
+            call.args += chunk.delta ?? "";
+            break;
+          }
+          case EventType.RUN_ERROR:
+            failure = (event as unknown as { message: string }).message;
+            break;
+          default:
+            break;
+        }
+      },
+      // Nothing is unsubscribed here on purpose. An observable that errors is already finished, and
+      // reaching for the subscription from inside the callback that created it is a reference to a
+      // binding that does not exist yet when the failure is synchronous, which is exactly the case a
+      // broken agent produces.
+      error: (caught: unknown) => {
+        clearTimeout(expiry);
+        reject(caught instanceof Error ? caught : new Error(String(caught)));
+      },
+      complete: () => {
+        clearTimeout(expiry);
+        resolve();
+      },
+    });
+  });
+
+  if (failure) throw new Error(failure);
+
+  return {
+    messageId,
+    text,
+    toolCalls: order
+      .map((id) => calls.get(id))
+      .filter((call): call is PendingToolCall => call !== undefined),
+  };
+}
+
+/**
+ * Carry out one tool call, and always answer.
+ *
+ * Every outcome comes back as text for the model, including the failures, because a tool result is
+ * the only channel a model has for finding out what happened. A refusal in particular has to arrive
+ * as words: a Bot told "this deployment's policy does not allow that" can say so in its summary and
+ * stop, whereas a Bot handed an empty result will try the same thing a different way, which is the
+ * behaviour a boundary is meant to prevent rather than provoke.
+ */
+async function executeToolCall(
+  gateway: ComputerGateway,
+  request: RoutineRunRequest,
+  call: PendingToolCall,
+): Promise<string> {
+  let args: Record<string, unknown>;
+  try {
+    const parsed: unknown = call.args.trim() ? JSON.parse(call.args) : {};
+    args =
+      parsed && typeof parsed === "object" && !Array.isArray(parsed)
+        ? (parsed as Record<string, unknown>)
+        : {};
+  } catch {
+    return answer({
+      ok: false,
+      reason: `The arguments to ${call.name} were not valid JSON, so nothing was done.`,
+    });
+  }
+
+  const botId = request.agentId;
+  const actor = request.actor;
+
+  try {
+    switch (call.name) {
+      case "computer_navigate": {
+        const url = text(args.url);
+        if (!url)
+          return answer({ ok: false, reason: "A web address is required." });
+        return answer({
+          ok: true,
+          ...(await gateway.navigate(botId, botId, actor, url)),
+        });
+      }
+      case "computer_read":
+        return answer({ ok: true, ...(await gateway.read(botId)) });
+      case "computer_snapshot":
+        return answer({ ok: true, ...(await gateway.snapshot(botId)) });
+      case "computer_click": {
+        const target = actionTarget(args);
+        if (!target) return answer(NEEDS_A_SNAPSHOT);
+        return answer({
+          ok: true,
+          ...(await gateway.click(botId, botId, actor, target)),
+        });
+      }
+      case "computer_type": {
+        const target = actionTarget(args);
+        if (!target) return answer(NEEDS_A_SNAPSHOT);
+        if (typeof args.text !== "string") {
+          return answer({
+            ok: false,
+            reason: "The text to enter is required.",
+          });
+        }
+        return answer({
+          ok: true,
+          ...(await gateway.type(botId, botId, actor, {
+            ...target,
+            text: args.text,
+            submit: args.submit === true,
+          })),
+        });
+      }
+      case "computer_key": {
+        const key = text(args.key);
+        if (!key) {
+          return answer({
+            ok: false,
+            reason: "A key name is required, such as Enter or Tab.",
+          });
+        }
+        const target = actionTarget(args);
+        return answer({
+          ok: true,
+          ...(await gateway.key(botId, botId, actor, {
+            key,
+            ...(target ?? {}),
+          })),
+        });
+      }
+      case "computer_scroll":
+        return answer({
+          ok: true,
+          ...(await gateway.scroll(botId, botId, actor, {
+            ...(typeof args.deltaY === "number" ? { deltaY: args.deltaY } : {}),
+          })),
+        });
+      case "computer_list_files":
+        return answer({
+          ok: true,
+          ...(await gateway.listFiles(botId, botId, actor, {
+            ...(text(args.path) ? { path: text(args.path) as string } : {}),
+          })),
+        });
+      case "computer_read_file": {
+        const path = text(args.path);
+        if (!path)
+          return answer({ ok: false, reason: "A file path is required." });
+        return answer({
+          ok: true,
+          ...(await gateway.readFile(botId, botId, actor, { path })),
+        });
+      }
+      case "computer_write_file": {
+        const path = text(args.path);
+        if (!path)
+          return answer({ ok: false, reason: "A file path is required." });
+        if (typeof args.contents !== "string") {
+          return answer({
+            ok: false,
+            reason: "The contents to write are required.",
+          });
+        }
+        return answer({
+          ok: true,
+          ...(await gateway.writeFile(botId, botId, actor, {
+            path,
+            contents: args.contents,
+            append: args.append === true,
+          })),
+        });
+      }
+      default:
+        // A chunked stream can in principle deliver a call whose name never arrived. It is still
+        // answered, with a name a sentence can be built around, because the rule is that no tool
+        // call goes unanswered rather than that no NAMED tool call does.
+        return answer(unavailable(call.name || "That tool"));
+    }
+  } catch (error) {
+    if (error instanceof ActionRefusedError) {
+      // The rule travels with the refusal, exactly as it does to the browser, so a Bot writing a
+      // summary can say which boundary stopped it rather than reporting a vague failure.
+      return answer({
+        ok: false,
+        refused: true,
+        reason: error.message,
+        rule: error.rule,
+      });
+    }
+    return answer({
+      ok: false,
+      reason: error instanceof Error ? error.message : "That did not work.",
+    });
+  }
+}
+
+/**
+ * What the model is told about a tool this run does not have.
+ *
+ * Named in the message, and the reason is given. A model that asked for help and is told only "tool
+ * not found" concludes it made a mistake and tries a synonym; one that is told nobody is watching
+ * concludes correctly that it should write down what it could not do and stop.
+ */
+function unavailable(toolName: string) {
+  return {
+    ok: false,
+    reason:
+      `${toolName} is not available in an unattended run. This run has no person watching it, ` +
+      "so nothing that needs one can happen: say in your answer what you could not do and why, " +
+      "rather than looking for another way round it.",
+  };
+}
+
+const NEEDS_A_SNAPSHOT = {
+  ok: false,
+  reason:
+    "A ref and the snapshotId it came from are both required. Take a snapshot first.",
+};
+
+/** The model reads JSON, the same shape the browser hands it, so a Bot behaves the same either way. */
+function answer(value: Record<string, unknown>): string {
+  return JSON.stringify(value);
+}
+
+function text(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+function actionTarget(
+  args: Record<string, unknown>,
+): { ref: string; snapshotId: number } | undefined {
+  if (typeof args.ref !== "string" || !args.ref) return undefined;
+  if (typeof args.snapshotId !== "number") return undefined;
+  return { ref: args.ref, snapshotId: args.snapshotId };
+}
+
+/**
+ * The tools an unattended run offers, described the way the attended ones are.
+ *
+ * The descriptions are close copies of the browser registrations on purpose. They are what the model
+ * reads, and a Bot that behaves differently at eight in the morning than it does when somebody is
+ * talking to it is a Bot nobody can reason about. Where they differ they say so: there is nobody to
+ * ask, so the wording never suggests asking.
+ */
+export const UNATTENDED_TOOLS: Tool[] = [
+  {
+    name: "computer_navigate",
+    description:
+      "Open a web page on your own computer. Returns the page title and its readable text, so " +
+      "answer from what comes back. Nobody is watching this run, so never tell anyone to go and look.",
+    parameters: {
+      type: "object",
+      properties: {
+        url: {
+          type: "string",
+          description: "Full web address to open, including https://",
+        },
+      },
+      required: ["url"],
+    },
+  },
+  {
+    name: "computer_read",
+    description:
+      "Read the page currently open on your computer, without opening anything. Use this after an " +
+      "action that changes the page, to find out what it now says.",
+    parameters: { type: "object", properties: {} },
+  },
+  {
+    name: "computer_snapshot",
+    description:
+      "List the things on the current page you can act on: fields, buttons, links and checkboxes, " +
+      "each with a ref, its label and its current value. Call this BEFORE clicking or typing, and " +
+      "use the refs it returns. Always send back the snapshotId it gives you. If an action reports " +
+      "that your refs are stale, the page changed: call this again and use the new refs.",
+    parameters: { type: "object", properties: {} },
+  },
+  {
+    name: "computer_click",
+    description:
+      "Click something on the page: a button, a link, a checkbox or a radio option. Give the ref " +
+      "from your most recent snapshot and the snapshotId it came from.",
+    parameters: {
+      type: "object",
+      properties: {
+        ref: {
+          type: "string",
+          description:
+            "Ref of the element to click, from your most recent snapshot",
+        },
+        snapshotId: {
+          type: "number",
+          description: "The snapshotId that ref came from",
+        },
+      },
+      required: ["ref", "snapshotId"],
+    },
+  },
+  {
+    name: "computer_type",
+    description:
+      "Enter text into a field on the page. Give the ref of the field from your most recent " +
+      "snapshot and the snapshotId it came from. This replaces whatever the field already contains. " +
+      "Set submit to true to press Enter afterwards.",
+    parameters: {
+      type: "object",
+      properties: {
+        ref: {
+          type: "string",
+          description: "Ref of the field, from your most recent snapshot",
+        },
+        snapshotId: {
+          type: "number",
+          description: "The snapshotId that ref came from",
+        },
+        text: { type: "string", description: "The text to enter" },
+        submit: {
+          type: "boolean",
+          description:
+            "Press Enter after typing, to submit a single-field form",
+        },
+      },
+      required: ["ref", "snapshotId", "text"],
+    },
+  },
+  {
+    name: "computer_key",
+    description:
+      "Press a key, such as Enter, Tab or Escape. Give a ref to press it while a particular field " +
+      "is focused, or omit the ref to press it on the page.",
+    parameters: {
+      type: "object",
+      properties: {
+        key: {
+          type: "string",
+          description: "Key name, such as Enter, Tab or Escape",
+        },
+        ref: {
+          type: "string",
+          description: "Optional ref to press the key on",
+        },
+        snapshotId: {
+          type: "number",
+          description:
+            "The snapshotId the ref came from, required if ref is given",
+        },
+      },
+      required: ["key"],
+    },
+  },
+  {
+    name: "computer_scroll",
+    description:
+      "Scroll the page down, or up with a negative amount, to bring more of a long page into view.",
+    parameters: {
+      type: "object",
+      properties: {
+        deltaY: {
+          type: "number",
+          description: "Pixels to scroll; positive is down. Defaults to 600.",
+        },
+      },
+    },
+  },
+  {
+    name: "computer_list_files",
+    description:
+      "List what is in your workspace: every file and folder you have saved, with sizes. Call this " +
+      "FIRST when you need a file whose exact name you are not sure of. Never guess a filename.",
+    parameters: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "Optional folder to list. Omit for the whole workspace.",
+        },
+      },
+    },
+  },
+  {
+    name: "computer_read_file",
+    description:
+      "Read a file you saved earlier in your own workspace. Paths are relative to your workspace, " +
+      "such as notes.md or reports/august.csv. Your workspace survives between runs, so use this to " +
+      "pick up what a previous run of this routine left for you.",
+    parameters: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "Path relative to your workspace, such as notes.md",
+        },
+      },
+      required: ["path"],
+    },
+  },
+  {
+    name: "computer_write_file",
+    description:
+      "Save a file in your own workspace so you still have it later. Paths are relative to your " +
+      "workspace and folders are created as needed. Set append to true to add to the end of an " +
+      "existing file rather than replacing it. Text only. This is how a run leaves something behind " +
+      "for the next one, since nobody is reading this conversation as it happens.",
+    parameters: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description:
+            "Path relative to your workspace, such as reports/august.csv",
+        },
+        contents: { type: "string", description: "The text to save" },
+        append: {
+          type: "boolean",
+          description: "Add to the end of the file instead of replacing it",
+        },
+      },
+      required: ["path", "contents"],
+    },
+  },
+];
diff --git a/server/src/routines/schedule.ts b/server/src/routines/schedule.ts
new file mode 100644
index 0000000..9187bb2
--- /dev/null
+++ b/server/src/routines/schedule.ts
@@ -0,0 +1,292 @@
+/**
+ * When a routine is next due, whether it is due now, and whether a window went by unrun.
+ *
+ * Every function here takes `now` as an argument and reads no clock of its own. That is the whole
+ * design: a scheduler that asks the current time in the middle of deciding is a scheduler whose
+ * interesting cases, the eight o'clock that fell on a Sunday, the laptop that was shut at eight and
+ * opened at noon, can only be reproduced by waiting for them. Passed in, all of it is a table of
+ * inputs and expected answers.
+ *
+ * Times are UTC. A daily routine at `08:00` fires at eight o'clock UTC wherever its owner is, and
+ * every surface that shows a time says so rather than letting somebody assume otherwise. A timezone
+ * per routine would be the kinder answer and is the obvious next thing to add; what it must not do
+ * is be inferred from the server's own locale, because then the same routine means two different
+ * times on two machines and neither of them is written down anywhere.
+ */
+
+/** A single moment, and then never again. `at` is an ISO instant. */
+export type OnceSchedule = { type: "once"; at: string };
+
+/**
+ * The same time on a set of weekdays.
+ *
+ * `time` is `HH:MM` in UTC. `weekdays` uses JavaScript's own numbering, 0 for Sunday through 6 for
+ * Saturday, rather than a friendlier one of our own: this number is compared against
+ * `Date.getUTCDay()` in one place, and a second numbering would exist only to be translated wrongly.
+ * An empty set is legal and means never, which is what a form with nothing ticked should do rather
+ * than silently meaning every day.
+ */
+export type DailySchedule = {
+  type: "daily";
+  time: string;
+  weekdays: number[];
+};
+
+export type RoutineSchedule = OnceSchedule | DailySchedule;
+
+/**
+ * How late a window may be picked up and still run.
+ *
+ * A tick that arrives thirty seconds after eight should run the eight o'clock routine; a process
+ * that starts at noon should not. Ten minutes is wide enough to cover a slow tick, a restart or a
+ * machine that was briefly busy, and narrow enough that "the overnight alerts" are still overnight
+ * when the Bot reads them. Beyond it the window is recorded as missed instead, which is a fact the
+ * person can act on rather than a stale run they have to notice.
+ */
+export const DEFAULT_GRACE_MS = 10 * 60_000;
+
+const HHMM = /^([01]\d|2[0-3]):([0-5]\d)$/;
+const DAY_MS = 86_400_000;
+
+/**
+ * Read a schedule that arrived from the database or over HTTP.
+ *
+ * Returns null rather than throwing or repairing. A schedule is the thing that decides when a Bot
+ * acts on somebody's live systems, and the two behaviours that must never happen here are guessing
+ * at what a malformed value meant and letting it through unexamined. The caller decides what to do
+ * with a null: a route refuses the request, and the scheduler skips the routine and leaves it
+ * visible rather than firing something it does not understand.
+ */
+export function parseRoutineSchedule(value: unknown): RoutineSchedule | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value as Record<string, unknown>;
+
+  if (candidate.type === "once") {
+    if (typeof candidate.at !== "string") return null;
+    const at = new Date(candidate.at);
+    if (Number.isNaN(at.getTime())) return null;
+    // Normalised on the way in, so two spellings of the same instant are one value in the database
+    // and a test comparing schedules compares what was meant rather than how it was typed.
+    return { type: "once", at: at.toISOString() };
+  }
+
+  if (candidate.type === "daily") {
+    if (typeof candidate.time !== "string" || !HHMM.test(candidate.time)) {
+      return null;
+    }
+    if (!Array.isArray(candidate.weekdays)) return null;
+    const weekdays: number[] = [];
+    for (const day of candidate.weekdays) {
+      if (typeof day !== "number" || !Number.isInteger(day)) return null;
+      if (day < 0 || day > 6) return null;
+      if (!weekdays.includes(day)) weekdays.push(day);
+    }
+    return {
+      type: "daily",
+      time: candidate.time,
+      weekdays: weekdays.sort((left, right) => left - right),
+    };
+  }
+
+  return null;
+}
+
+/**
+ * The most recent moment this schedule called for, at or before `at`.
+ *
+ * Null means it has never called for one yet, which is the honest answer for a `once` scheduled for
+ * next Tuesday and for a daily routine on a weekday set that has not come round since it was
+ * written.
+ */
+export function lastOccurrenceOnOrBefore(
+  schedule: RoutineSchedule,
+  at: Date,
+): Date | null {
+  if (schedule.type === "once") {
+    const fires = new Date(schedule.at);
+    return fires.getTime() <= at.getTime() ? fires : null;
+  }
+  if (schedule.weekdays.length === 0) return null;
+
+  // Walk backwards a day at a time rather than solving for the weekday arithmetically. Eight
+  // iterations at most, and it is obviously correct across a week boundary, a leap day and the ends
+  // of a month, which the arithmetic version is not.
+  for (let back = 0; back <= 7; back += 1) {
+    const candidate = atTimeOnUtcDay(schedule.time, addDays(at, -back));
+    if (
+      candidate.getTime() <= at.getTime() &&
+      schedule.weekdays.includes(candidate.getUTCDay())
+    ) {
+      return candidate;
+    }
+  }
+  return null;
+}
+
+/**
+ * The first moment this schedule calls for strictly after `at`.
+ *
+ * Strictly after, so asking at exactly eight o'clock returns tomorrow's eight rather than this one.
+ * The caller that wants to know whether now is due asks {@link lastOccurrenceOnOrBefore}; this one
+ * answers "and when next", which is what the list on screen shows.
+ */
+export function nextOccurrenceAfter(
+  schedule: RoutineSchedule,
+  at: Date,
+): Date | null {
+  if (schedule.type === "once") {
+    const fires = new Date(schedule.at);
+    return fires.getTime() > at.getTime() ? fires : null;
+  }
+  if (schedule.weekdays.length === 0) return null;
+
+  for (let forward = 0; forward <= 7; forward += 1) {
+    const candidate = atTimeOnUtcDay(schedule.time, addDays(at, forward));
+    if (
+      candidate.getTime() > at.getTime() &&
+      schedule.weekdays.includes(candidate.getUTCDay())
+    ) {
+      return candidate;
+    }
+  }
+  return null;
+}
+
+/**
+ * When this routine is next expected to act, for the person reading the list.
+ *
+ * A `once` whose moment has passed and which has not run is still expected: it says so rather than
+ * saying nothing, because a routine that was set for nine this morning and did not run is exactly
+ * the thing somebody wants the page to admit to. Once it has run, a `once` is finished and this is
+ * null, which the surface renders as such rather than as a date it will never reach.
+ */
+export function nextDueAt(
+  schedule: RoutineSchedule,
+  options: { now: Date; lastRunAt: Date | null },
+): Date | null {
+  if (schedule.type === "once") {
+    if (options.lastRunAt) return null;
+    return new Date(schedule.at);
+  }
+  return nextOccurrenceAfter(schedule, options.now);
+}
+
+export type ScheduleDecision =
+  /** The window is open and nobody has taken it. `dueAt` is the window, not the moment asked about. */
+  | { action: "run"; dueAt: Date }
+  /** The window came and went unrun. Recorded rather than run late; see DEFAULT_GRACE_MS. */
+  | { action: "missed"; dueAt: Date }
+  /** Nothing to do. `nextDueAt` is null for a schedule that will never call again. */
+  | { action: "wait"; nextDueAt: Date | null };
+
+/**
+ * The one decision the scheduler makes, made here where it can be tested.
+ *
+ * Three answers rather than a boolean, because "not due" is two different situations and collapsing
+ * them is the bug this table exists to prevent. A window nobody was awake for must be recorded, or
+ * the person is left reading a list that says nothing happened at eight and cannot tell whether that
+ * means the Bot found nothing or the machine was asleep.
+ *
+ * `lastRunAt` is the start of the most recent run of any kind, including a manual one. That is
+ * deliberate: somebody who pressed Run now at 07:58 does not want it again at 08:00, and treating a
+ * manual run as unrelated would give them two.
+ *
+ * `createdAt` is what stops a brand new routine being told off for a morning it did not exist for.
+ * Somebody who writes "every weekday at eight" at three in the afternoon has a schedule whose most
+ * recent window is seven hours old and has never been run, which without this reads as a window the
+ * deployment slept through: within a minute they are looking at a history that says "Missed, nothing
+ * was running", and at an audit row agreeing with it, about a machine that was running perfectly
+ * well. It is the most ordinary path there is, and the answer given on it has to be true or the
+ * distinction the whole feature is built on — "it ran and found nothing" against "it never ran" — is
+ * worth nothing. A window inside the grace period still runs, because somebody writing that schedule
+ * at three minutes past eight has just said what they want and would be puzzled to wait a day.
+ *
+ * What that costs is a `once` written for a moment that had already gone: it never fires and is
+ * never recorded, and the list goes on showing it as expected. That is the same answer given to a
+ * time somebody typed wrongly and to one they typed a day late, and it is preferred to the
+ * alternative, which is a run history asserting that this deployment was asleep when it was not.
+ */
+export function decideScheduleAction(
+  schedule: RoutineSchedule,
+  options: {
+    now: Date;
+    lastRunAt: Date | null;
+    /** When the routine came into existence. Optional so a caller reasoning about a schedule alone
+     * need not invent one; the scheduler always has it. */
+    createdAt?: Date;
+    graceMs?: number;
+  },
+): ScheduleDecision {
+  const graceMs = options.graceMs ?? DEFAULT_GRACE_MS;
+  const window = lastOccurrenceOnOrBefore(schedule, options.now);
+
+  if (!window) {
+    return { action: "wait", nextDueAt: nextDueAt(schedule, options) };
+  }
+
+  // Already taken. A run that started at or after the window is that window's run, however long it
+  // then took, so a routine mid-flight does not get a second one on the next tick.
+  if (options.lastRunAt && options.lastRunAt.getTime() >= window.getTime()) {
+    return { action: "wait", nextDueAt: nextDueAt(schedule, options) };
+  }
+
+  if (options.now.getTime() - window.getTime() > graceMs) {
+    // A window older than the routine is not a window anybody missed. Nothing is recorded and
+    // nothing is run: there was no routine at eight o'clock, so nothing happened at eight o'clock.
+    if (options.createdAt && window.getTime() < options.createdAt.getTime()) {
+      return { action: "wait", nextDueAt: nextDueAt(schedule, options) };
+    }
+    return { action: "missed", dueAt: window };
+  }
+  return { action: "run", dueAt: window };
+}
+
+/** The same wall-clock time on the UTC day `day` falls in. */
+function atTimeOnUtcDay(time: string, day: Date): Date {
+  const [hours, minutes] = time.split(":").map(Number) as [number, number];
+  return new Date(
+    Date.UTC(
+      day.getUTCFullYear(),
+      day.getUTCMonth(),
+      day.getUTCDate(),
+      hours,
+      minutes,
+      0,
+      0,
+    ),
+  );
+}
+
+/**
+ * Move by whole days.
+ *
+ * On the millisecond value rather than on the calendar fields, so it cannot be tripped by a month
+ * with 28 days in it. Every calculation here is in UTC, where a day is always 86,400,000ms, so the
+ * daylight-saving hazard that makes this wrong in local time does not apply.
+ */
+function addDays(from: Date, days: number): Date {
+  return new Date(from.getTime() + days * DAY_MS);
+}
+
+/** How a schedule reads on screen, in one place so the list and the run history agree. */
+export function describeSchedule(schedule: RoutineSchedule): string {
+  if (schedule.type === "once") {
+    return `Once, at ${new Date(schedule.at).toISOString().replace("T", " ").slice(0, 16)} UTC`;
+  }
+  if (schedule.weekdays.length === 0) return "Never, no days are selected";
+  if (schedule.weekdays.length === 7) {
+    return `Every day at ${schedule.time} UTC`;
+  }
+  const names = schedule.weekdays.map((day) => DAY_NAMES[day] ?? String(day));
+  return `${names.join(", ")} at ${schedule.time} UTC`;
+}
+
+const DAY_NAMES = [
+  "Sunday",
+  "Monday",
+  "Tuesday",
+  "Wednesday",
+  "Thursday",
+  "Friday",
+  "Saturday",
+] as const;
diff --git a/server/src/routines/scheduler.ts b/server/src/routines/scheduler.ts
new file mode 100644
index 0000000..b8ba6fb
--- /dev/null
+++ b/server/src/routines/scheduler.ts
@@ -0,0 +1,374 @@
+/**
+ * The clock. Once a minute it asks every enabled routine whether its moment has come.
+ *
+ * A minute, not a second, because the smallest thing a routine can be scheduled for is a minute and
+ * a tighter loop would only buy precision nobody asked for at the cost of a query per second for the
+ * life of the process. It does mean a routine fires within a minute of its time rather than on it,
+ * which is stated here rather than discovered: a schedule of "eight o'clock" is a promise about the
+ * hour, not about the second.
+ *
+ * Three things this has to survive, none of them exceptional:
+ *
+ *  - Two ticks overlapping. A run that takes longer than a minute is ordinary, and the tick that
+ *    lands while it is going must not start a second one. The claim is a database write with a
+ *    unique index behind it, so the loser of a race is told rather than left guessing.
+ *  - A routine deleted mid-run. The rows go with it, the finishing write updates nothing, and this
+ *    carries on. A person deleting a routine has asked for it to be gone; the process must not
+ *    disagree by failing.
+ *  - A window nobody was awake for. Recorded as missed rather than run late. See schedule.ts.
+ *
+ * Errors are logged and swallowed at the tick boundary. One routine that cannot resolve its Bot, or
+ * one database blip, must not stop every other routine in the deployment from ever running again,
+ * which is what an unhandled rejection in a `setInterval` amounts to.
+ */
+import type { RoutineRunner } from "./runner";
+import { decideScheduleAction } from "./schedule";
+import type { DueCandidate, RoutineStore, RoutineTrigger } from "./store";
+import { deliveryPrompt } from "./webhooks";
+
+/** A minute. Long enough to be cheap, short enough that "eight o'clock" means eight o'clock. */
+export const DEFAULT_TICK_MS = 60_000;
+
+/**
+ * How long a run may have been going before this process concludes nobody is coming back for it.
+ *
+ * The runner stops a run of its own accord long before this, so the only rows this can reach are
+ * ones whose process is gone: killed mid-browse, rolled during a deploy, a machine that lost power.
+ * Such a row keeps the one-live-run index for its routine forever, and a routine holding that index
+ * never runs again by any route at all.
+ *
+ * An hour rather than something tighter because the cost of being wrong is asymmetric. Too long and
+ * a wedged routine stays wedged for an extra half hour; too short and this deployment starts
+ * declaring its own healthy long runs dead while they are still working, which would be a fault
+ * invented by the thing meant to be repairing one.
+ */
+export const STALE_RUN_MS = 60 * 60_000;
+
+export type SchedulerOptions = {
+  store: RoutineStore;
+  runner: RoutineRunner;
+  tickMs?: number;
+  /** How old a run must be before it is treated as abandoned. See {@link STALE_RUN_MS}. */
+  staleRunMs?: number;
+  /**
+   * How a run's conversation is named.
+   *
+   * Supplied rather than generated here so an unattended run's id comes from the same namespace as
+   * everything else this deployment mints and cannot be confused with another deployment's. It names
+   * the conversation; it does not create or keep one. See channels/thread-identity.ts, and the note
+   * on `routine_runs.thread_id` for what an unattended run does and does not leave behind.
+   */
+  threadIdFor: (routineId: string) => string;
+  /** Said out loud, in one place, so a deployment's log has one shape for scheduler news. */
+  log?: (entry: Record<string, unknown>) => void;
+};
+
+/**
+ * What became of an attempt to start something.
+ *
+ * `busy` is not a failure and is not reported as one. A routine that is already running is the
+ * correct outcome of pressing Run now twice, and of a webhook that fires while the last delivery is
+ * still being worked on; the caller says so plainly rather than showing an error or, worse, starting
+ * a second run.
+ */
+export type StartOutcome = "started" | "busy" | "unknown";
+
+export type Scheduler = {
+  /** One pass. Exported so a test can drive the clock instead of waiting for it. */
+  tick: (now?: Date) => Promise<void>;
+  start: () => void;
+  stop: () => void;
+  /** Run one routine now, on somebody's say-so. */
+  runNow: (
+    routineId: string,
+    actor: { id: string; userId?: string },
+  ) => Promise<StartOutcome>;
+  /**
+   * Run what a delivery asked for.
+   *
+   * The one place the two shapes of trigger are told apart, so the receiver does not have to know
+   * about routines and the routes do not have to know about deliveries.
+   */
+  runFromWebhook: (work: {
+    triggerId: string;
+    routineId: string | null;
+    agentId: string | null;
+    prompt: string | null;
+    ownerUserId: string;
+    body: unknown;
+    eventType: string | null;
+  }) => Promise<boolean>;
+};
+
+export function createScheduler(options: SchedulerOptions): Scheduler {
+  const tickMs = options.tickMs ?? DEFAULT_TICK_MS;
+  const staleRunMs = options.staleRunMs ?? STALE_RUN_MS;
+  const log = options.log ?? defaultLog;
+  let timer: ReturnType<typeof setInterval> | undefined;
+  /**
+   * Which prompt-carrying triggers are being worked on right now.
+   *
+   * These are the deliveries with no routine behind them and therefore no run row, which means the
+   * unique index that serialises everything else in this file has nothing to hold. Without something
+   * here, a sender retrying in a loop starts one unattended agent run per delivery, each holding a
+   * model stream and driving a browser, with nothing anywhere in the product to stop it.
+   *
+   * In this process only, and that limit is real: two server processes sharing a database would each
+   * allow one. It is still the right shape, because it is the same promise the routine-backed path
+   * makes — one at a time, and a delivery that arrives while the last one is going is told so — and
+   * because the alternative to an imperfect ceiling here is no ceiling at all.
+   */
+  const runningTriggers = new Set<string>();
+  /**
+   * Whether a tick is still going.
+   *
+   * A guard on top of the database's, not instead of it. This one stops a slow pass being overtaken
+   * by the next interval inside this process; the unique index is what holds when there are two
+   * processes, which is the case this flag cannot see and must not be relied on for.
+   */
+  let ticking = false;
+
+  /**
+   * Start the work and let it finish on its own.
+   *
+   * Deliberately not awaited by the tick. A routine that browses for four minutes would otherwise
+   * hold the tick open and stop every other routine's window being noticed, which turns one slow
+   * routine into a deployment whose schedule quietly stops working.
+   */
+  async function begin(
+    routine: DueCandidate,
+    trigger: RoutineTrigger,
+    actor: { id: string; userId?: string },
+    /** What to put to the Bot, when it is not simply the routine's own prompt. */
+    prompt = routine.prompt,
+  ): Promise<boolean> {
+    const threadId = options.threadIdFor(routine.id);
+    const run = await options.store.startRun({
+      routineId: routine.id,
+      trigger,
+      threadId,
+      actor,
+    });
+    // Somebody else has it. The ordinary outcome of two ticks overlapping, and not a failure.
+    if (!run) return false;
+
+    void (async () => {
+      try {
+        const outcome = await options.runner.run({
+          agentId: routine.agentId,
+          prompt,
+          threadId,
+          // The owner's authority, and nobody watching. Both facts travel to the gateway: the trail
+          // names the person, and a rule can refuse the action because they are not there.
+          actor: {
+            id: routine.ownerUserId,
+            userId: routine.ownerUserId,
+            unattended: true,
+          },
+        });
+        await options.store.finishRun({
+          runId: run.id,
+          routineId: routine.id,
+          status: "completed",
+          summary: outcome.summary,
+          actor,
+        });
+      } catch (error) {
+        const reason =
+          error instanceof Error ? error.message : "The run did not finish.";
+        log({
+          type: "routine-run-failed",
+          routine: routine.id,
+          name: routine.name,
+          error: reason,
+        });
+        // Recorded as failed rather than left running forever. A run stuck in `running` holds the
+        // one-at-a-time index and the routine never fires again, so the failure has to be written
+        // even when writing it is the second thing that has gone wrong.
+        await options.store
+          .finishRun({
+            runId: run.id,
+            routineId: routine.id,
+            status: "failed",
+            error: reason,
+            actor,
+          })
+          .catch((writeFailure: unknown) => {
+            log({
+              type: "routine-run-not-recorded",
+              routine: routine.id,
+              error:
+                writeFailure instanceof Error
+                  ? writeFailure.message
+                  : String(writeFailure),
+              note: "The run failed and the failure could not be written down.",
+            });
+          });
+      }
+    })();
+    return true;
+  }
+
+  async function tick(now: Date = new Date()): Promise<void> {
+    if (ticking) return;
+    ticking = true;
+    try {
+      /*
+       * Before anything is decided, because a routine wedged by a dead process is a routine this
+       * pass would otherwise skip in silence for the rest of the deployment's life. Its own actor,
+       * so the trail says the clock closed the row rather than naming somebody who was not there.
+       */
+      const reaped = await options.store.reapStaleRuns({
+        startedBefore: new Date(now.getTime() - staleRunMs),
+        actor: { id: "scheduler" },
+      });
+      if (reaped > 0) {
+        log({
+          type: "routine-runs-reaped",
+          runs: reaped,
+          note: "Runs left behind by a process that stopped. The routines they held can run again.",
+        });
+      }
+
+      const candidates = await options.store.dueCandidates();
+      for (const routine of candidates) {
+        if (!routine.schedule) {
+          // A schedule nothing can read is left alone rather than guessed at. The routine stays
+          // visible on the page so its owner can fix or delete it, and nothing fires meanwhile.
+          log({
+            type: "routine-schedule-unreadable",
+            routine: routine.id,
+            name: routine.name,
+          });
+          continue;
+        }
+        // A run already in flight takes its window with it. Skipping here saves a doomed insert;
+        // the index is what actually guarantees it.
+        if (routine.activeRun) continue;
+
+        const decision = decideScheduleAction(routine.schedule, {
+          now,
+          lastRunAt: routine.lastRunAt,
+          // A routine cannot have missed a window it did not exist for. Without this every routine
+          // written after its own time of day records a miss within a minute of being created.
+          createdAt: routine.createdAt,
+        });
+        // The scheduler acts on its own behalf, so the trail says the clock did this rather than
+        // attributing it to a person who was asleep. The owner is still named on every action the
+        // run takes, because that is whose authority it carries.
+        const actor = { id: "scheduler", userId: routine.ownerUserId };
+
+        if (decision.action === "missed") {
+          await options.store.recordMissed({
+            routineId: routine.id,
+            dueAt: decision.dueAt,
+            actor,
+          });
+          continue;
+        }
+        if (decision.action === "run") {
+          await begin(routine, "schedule", actor);
+        }
+      }
+    } catch (error) {
+      // One bad pass, not the end of the loop. The interval is still running and the next tick tries
+      // again; a rejection escaping here would take the whole schedule down for the life of the
+      // process and leave nothing but an unhandled-rejection line to explain it.
+      log({
+        type: "routine-tick-failed",
+        error: error instanceof Error ? error.message : String(error),
+      });
+    } finally {
+      ticking = false;
+    }
+  }
+
+  return {
+    tick,
+    start: () => {
+      if (timer) return;
+      timer = setInterval(() => void tick(), tickMs);
+      // The loop must not be the reason the process stays alive. Without this a scheduler would keep
+      // a finished process from exiting, which is the sort of thing that is discovered in a
+      // container that will not shut down.
+      timer.unref?.();
+    },
+    stop: () => {
+      if (timer) clearInterval(timer);
+      timer = undefined;
+    },
+
+    runNow: async (routineId, actor) => {
+      const routine = await options.store.candidate(routineId);
+      // `unknown` rather than a thrown error, because the routine may simply have been deleted
+      // between the page being drawn and the button being pressed, which is not an incident.
+      if (!routine) return "unknown";
+      return (await begin(routine, "manual", actor)) ? "started" : "busy";
+    },
+
+    runFromWebhook: async (work) => {
+      const actor = { id: "webhook", userId: work.ownerUserId };
+
+      if (work.routineId) {
+        const routine = await options.store.candidate(work.routineId);
+        if (!routine) return false;
+        return begin(
+          routine,
+          "webhook",
+          actor,
+          deliveryPrompt(routine.prompt, work.body, work.eventType),
+        );
+      }
+
+      /*
+       * A trigger that carries its own prompt has no routine, so it has no run row.
+       *
+       * The table's foreign key is not the reason; the reason is that there is nothing for a run to
+       * be a run OF. What this costs is worth naming: these deliveries have no entry in the run
+       * history, so a person cannot look up what happened the way they can for a routine. What they
+       * do have is the audit trail, which records the delivery and then every action the Bot takes,
+       * so nothing is invisible. A trigger that needs history should name a routine.
+       *
+       * They are serialised all the same. One at a time per trigger, held in this process because
+       * there is no row to hold it: whoever has the secret can otherwise post in a loop and start an
+       * unattended agent run per delivery, and the honest description of that is a public URL that
+       * spends this deployment's model budget and drives its browser as fast as it can be called.
+       * The sender is told 409 rather than being ignored, so a retry means something.
+       */
+      if (!work.agentId || !work.prompt) return false;
+      if (runningTriggers.has(work.triggerId)) return false;
+      runningTriggers.add(work.triggerId);
+
+      const threadId = options.threadIdFor(work.triggerId);
+      void options.runner
+        .run({
+          agentId: work.agentId,
+          prompt: deliveryPrompt(work.prompt, work.body, work.eventType),
+          threadId,
+          actor: {
+            id: work.ownerUserId,
+            userId: work.ownerUserId,
+            unattended: true,
+          },
+        })
+        .catch((error: unknown) => {
+          log({
+            type: "routine-webhook-run-failed",
+            trigger: work.triggerId,
+            error: error instanceof Error ? error.message : String(error),
+          });
+        })
+        // Released however the run ended, including the ways it ended badly. A failure that left the
+        // trigger marked busy would answer every later delivery with 409 for the life of the
+        // process, which is the wedged routine this file works to avoid, wearing a different hat.
+        .finally(() => {
+          runningTriggers.delete(work.triggerId);
+        });
+      return true;
+    },
+  };
+}
+
+function defaultLog(entry: Record<string, unknown>) {
+  console.error(JSON.stringify(entry));
+}
diff --git a/server/src/routines/store.ts b/server/src/routines/store.ts
new file mode 100644
index 0000000..3d81c3f
--- /dev/null
+++ b/server/src/routines/store.ts
@@ -0,0 +1,990 @@
+/**
+ * Routines, their run history and their webhook triggers, as the rest of the product sees them.
+ *
+ * Everything that writes a routine writes an audit row through here, for the same reason every
+ * computer action does: a routine is a standing grant of work to a Bot that nobody will be watching
+ * carry it out, so who created it, who changed it and who deleted it are exactly the questions
+ * somebody asks afterwards. The trail is the thing the change goes through, not a report written
+ * beside it.
+ *
+ * Two shapes of writing that look similar and are not. A run is claimed, which can fail because
+ * another run of the same routine is already in flight; the database decides that with a unique
+ * index and this returns null rather than pretending. A delivery is counted, which cannot fail and
+ * must not stop the work if it does.
+ */
+import { and, desc, eq, inArray, lt, max, sql } from "drizzle-orm";
+import { type AuditStore, recordAuditEvent } from "../audit";
+import type { Database } from "../db/client";
+import { routineRuns, routines, webhookTriggers } from "../db/schema";
+import {
+  type RoutineSchedule,
+  nextDueAt,
+  parseRoutineSchedule,
+} from "./schedule";
+import { mintEndpointId, mintWebhookSecret } from "./webhooks";
+
+export type RoutineTrigger = "schedule" | "manual" | "webhook";
+
+export type RoutineRunStatus =
+  | "queued"
+  | "running"
+  | "completed"
+  | "failed"
+  | "missed";
+
+export type RoutineRunRecord = {
+  id: string;
+  routineId: string;
+  trigger: RoutineTrigger;
+  status: RoutineRunStatus;
+  startedAt: string;
+  finishedAt: string | null;
+  summary: string | null;
+  error: string | null;
+  threadId: string | null;
+};
+
+export type RoutineRecord = {
+  id: string;
+  agentId: string;
+  ownerUserId: string;
+  name: string;
+  prompt: string;
+  schedule: RoutineSchedule;
+  enabled: boolean;
+  createdAt: string;
+  updatedAt: string;
+  /**
+   * When it is next expected to act, or null for a schedule that will never call again.
+   *
+   * Computed on read rather than stored. A stored next-due is a value that is wrong the moment
+   * somebody edits the schedule or the process is down when it passes, and a list that quietly shows
+   * a time that already went by is worse than one that recomputes.
+   */
+  nextDueAt: string | null;
+  lastRun: RoutineRunRecord | null;
+};
+
+/** What the surfaces are allowed to see. The secret hash is not on it, and never leaves this file. */
+export type WebhookTriggerRecord = {
+  id: string;
+  endpointId: string;
+  name: string;
+  ownerUserId: string;
+  routineId: string | null;
+  agentId: string | null;
+  prompt: string | null;
+  enabled: boolean;
+  verificationPending: boolean;
+  verifiedAt: string | null;
+  sample: Record<string, unknown> | null;
+  eventTypes: string[];
+  deliveryCount: number;
+  lastReceivedAt: string | null;
+  createdAt: string;
+};
+
+/** The receiver's view: the same trigger, plus the one field it needs and nobody else may have. */
+export type WebhookTriggerWithSecret = WebhookTriggerRecord & {
+  secretHash: string;
+};
+
+export type CreateRoutineInput = {
+  agentId: string;
+  ownerUserId: string;
+  name: string;
+  prompt: string;
+  schedule: RoutineSchedule;
+  enabled?: boolean;
+};
+
+export type UpdateRoutineInput = {
+  name?: string;
+  prompt?: string;
+  schedule?: RoutineSchedule;
+  enabled?: boolean;
+};
+
+export type CreateWebhookTriggerInput = {
+  name: string;
+  ownerUserId: string;
+  /** Either this, reusing a routine… */
+  routineId?: string;
+  /** …or these two, carrying work of their own. The route decides; this stores what it decided. */
+  agentId?: string;
+  prompt?: string;
+  eventTypes?: string[];
+};
+
+/**
+ * A routine the scheduler might act on, with the two facts the decision needs.
+ *
+ * `activeRun` is separate from `lastRunAt` because they answer different questions: one is "has this
+ * window been taken", the other is "is one still going". A long run that overruns its next window
+ * must not be joined by a second, and a routine whose last run finished hours ago is free.
+ */
+export type DueCandidate = {
+  id: string;
+  agentId: string;
+  ownerUserId: string;
+  name: string;
+  prompt: string;
+  schedule: RoutineSchedule | null;
+  /**
+   * When the routine came into existence.
+   *
+   * Carried because a window before this moment is not a window this routine had. Without it the
+   * first tick after somebody writes "every weekday at eight" at three in the afternoon records a
+   * run that says the deployment was asleep at eight, which is false and is the one thing the
+   * missed row exists to be trusted about. See decideScheduleAction.
+   */
+  createdAt: Date;
+  lastRunAt: Date | null;
+  activeRun: boolean;
+};
+
+export type RoutineStore = ReturnType<typeof createRoutineStore>;
+
+export function createRoutineStore(
+  database: Database,
+  /** Absent is not offered. A routine nobody can account for is not a routine worth having. */
+  auditStore: AuditStore,
+) {
+  /**
+   * The most recent run of each routine, one row per routine.
+   *
+   * `distinct on` rather than reading every run and keeping the first of each in JavaScript. The
+   * difference is the whole life of a deployment: the run history of a daily routine grows by one
+   * row a day forever, this backs the routines page, and the page refetches every fifteen seconds
+   * while somebody has it open. Reading all of it would mean ten routines and two years costing
+   * seven thousand rows fetched and discarded to produce ten values, and getting worse every week.
+   *
+   * The (routine_id, started_at) index is what makes it cheap: the ordering this asks for is the
+   * order the index is already in, so the database walks to the newest of each and stops.
+   */
+  async function latestRuns(routineIds: string[]) {
+    if (routineIds.length === 0) return new Map<string, RoutineRunRecord>();
+    const rows = await database
+      .selectDistinctOn([routineRuns.routineId])
+      .from(routineRuns)
+      .where(inArray(routineRuns.routineId, routineIds))
+      .orderBy(routineRuns.routineId, desc(routineRuns.startedAt));
+
+    return new Map(rows.map((row) => [row.routineId, asRun(row)] as const));
+  }
+
+  async function decorate(
+    rows: (typeof routines.$inferSelect)[],
+    now: Date,
+  ): Promise<RoutineRecord[]> {
+    const latest = await latestRuns(rows.map((row) => row.id));
+    return rows.map((row) => {
+      const schedule = parseRoutineSchedule(row.schedule);
+      const lastRun = latest.get(row.id) ?? null;
+      return {
+        id: row.id,
+        agentId: row.agentId,
+        ownerUserId: row.ownerUserId,
+        name: row.name,
+        prompt: row.prompt,
+        // A schedule that will not parse is shown as a `once` in the past rather than crashing the
+        // page. It cannot fire, the scheduler skips it for the same reason, and the person can see
+        // the routine in order to fix or delete it, which they cannot do if the list refuses to load.
+        schedule: schedule ?? { type: "once", at: new Date(0).toISOString() },
+        enabled: row.enabled,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+        nextDueAt:
+          schedule && row.enabled
+            ? (nextDueAt(schedule, {
+                now,
+                lastRunAt: lastRun ? new Date(lastRun.startedAt) : null,
+              })?.toISOString() ?? null)
+            : null,
+        lastRun,
+      };
+    });
+  }
+
+  return {
+    /** Everything one person owns. Somebody else's routine is never read into the process at all. */
+    list: async (
+      ownerUserId: string,
+      now: Date = new Date(),
+    ): Promise<RoutineRecord[]> => {
+      const rows = await database
+        .select()
+        .from(routines)
+        .where(eq(routines.ownerUserId, ownerUserId))
+        .orderBy(desc(routines.createdAt));
+      return decorate(rows, now);
+    },
+
+    /**
+     * One routine, and only for the person who owns it.
+     *
+     * The owner is part of the query rather than checked afterwards. "We fetched it and then decided
+     * not to show it" is the shape most accidental disclosures take, and a routine carries a prompt
+     * somebody wrote about their own work.
+     */
+    get: async (
+      id: string,
+      ownerUserId: string,
+      now: Date = new Date(),
+    ): Promise<RoutineRecord | null> => {
+      const rows = await database
+        .select()
+        .from(routines)
+        .where(and(eq(routines.id, id), eq(routines.ownerUserId, ownerUserId)))
+        .limit(1);
+      return (await decorate(rows, now))[0] ?? null;
+    },
+
+    create: async (
+      input: CreateRoutineInput,
+      actor: { id: string; userId?: string },
+    ): Promise<RoutineRecord> => {
+      const [row] = await database
+        .insert(routines)
+        .values({
+          agentId: input.agentId,
+          ownerUserId: input.ownerUserId,
+          name: input.name,
+          prompt: input.prompt,
+          schedule: input.schedule as unknown as Record<string, unknown>,
+          enabled: input.enabled ?? true,
+        })
+        .returning();
+      if (!row) throw new Error("The routine could not be created.");
+
+      await writeRoutineEvent(auditStore, "routine.created", row, actor);
+      return (await decorate([row], new Date()))[0] as RoutineRecord;
+    },
+
+    update: async (
+      id: string,
+      ownerUserId: string,
+      patch: UpdateRoutineInput,
+      actor: { id: string; userId?: string },
+    ): Promise<RoutineRecord | null> => {
+      const [row] = await database
+        .update(routines)
+        .set({
+          ...(patch.name !== undefined ? { name: patch.name } : {}),
+          ...(patch.prompt !== undefined ? { prompt: patch.prompt } : {}),
+          ...(patch.schedule !== undefined
+            ? {
+                schedule: patch.schedule as unknown as Record<string, unknown>,
+              }
+            : {}),
+          ...(patch.enabled !== undefined ? { enabled: patch.enabled } : {}),
+          updatedAt: new Date(),
+        })
+        .where(and(eq(routines.id, id), eq(routines.ownerUserId, ownerUserId)))
+        .returning();
+      if (!row) return null;
+
+      await writeRoutineEvent(auditStore, "routine.updated", row, actor);
+      return (await decorate([row], new Date()))[0] as RoutineRecord;
+    },
+
+    remove: async (
+      id: string,
+      ownerUserId: string,
+      actor: { id: string; userId?: string },
+    ): Promise<boolean> => {
+      const [row] = await database
+        .delete(routines)
+        .where(and(eq(routines.id, id), eq(routines.ownerUserId, ownerUserId)))
+        .returning();
+      if (!row) return false;
+      await writeRoutineEvent(auditStore, "routine.deleted", row, actor);
+      return true;
+    },
+
+    runs: async (
+      routineId: string,
+      limit = 25,
+    ): Promise<RoutineRunRecord[]> => {
+      const rows = await database
+        .select()
+        .from(routineRuns)
+        .where(eq(routineRuns.routineId, routineId))
+        .orderBy(desc(routineRuns.startedAt))
+        .limit(limit);
+      return rows.map(asRun);
+    },
+
+    /**
+     * Take the next run of this routine, or find that somebody else already has.
+     *
+     * Null is an ordinary answer, not an error. Two ticks overlapping and a person pressing Run now
+     * while the schedule fires are both normal, and both must end with one run rather than two. The
+     * unique index decides it; this reads the rejection and reports that the routine is busy.
+     */
+    startRun: async (input: {
+      routineId: string;
+      trigger: RoutineTrigger;
+      threadId: string;
+      /** For a missed window, the moment it should have run. Now, for everything else. */
+      startedAt?: Date;
+      actor: { id: string; userId?: string };
+    }): Promise<RoutineRunRecord | null> => {
+      let row: typeof routineRuns.$inferSelect | undefined;
+      try {
+        [row] = await database
+          .insert(routineRuns)
+          .values({
+            routineId: input.routineId,
+            trigger: input.trigger,
+            status: "running",
+            threadId: input.threadId,
+            ...(input.startedAt ? { startedAt: input.startedAt } : {}),
+          })
+          .returning();
+      } catch (error) {
+        if (isUniqueViolation(error)) return null;
+        throw error;
+      }
+      if (!row) return null;
+
+      await recordAuditEvent(auditStore, {
+        eventType: "routine.run_started",
+        targetType: "routine",
+        targetId: input.routineId,
+        ...(input.actor.userId ? { actorUserId: input.actor.userId } : {}),
+        payload: {
+          actor: input.actor.id,
+          run: row.id,
+          trigger: input.trigger,
+          thread: input.threadId,
+        },
+      });
+      return asRun(row);
+    },
+
+    /**
+     * Close a run out.
+     *
+     * Tolerates the row having gone. A routine deleted while one of its runs is in flight takes the
+     * run row with it, and the runner finishing a moment later must not turn that into an unhandled
+     * failure: the person got what they asked for, which was the routine gone.
+     */
+    finishRun: async (input: {
+      runId: string;
+      routineId: string;
+      status: Extract<RoutineRunStatus, "completed" | "failed">;
+      summary?: string;
+      error?: string;
+      actor: { id: string; userId?: string };
+    }): Promise<void> => {
+      await database
+        .update(routineRuns)
+        .set({
+          status: input.status,
+          finishedAt: new Date(),
+          ...(input.summary !== undefined ? { summary: input.summary } : {}),
+          ...(input.error !== undefined ? { error: input.error } : {}),
+        })
+        .where(eq(routineRuns.id, input.runId));
+
+      await recordAuditEvent(auditStore, {
+        eventType:
+          input.status === "failed"
+            ? "routine.run_failed"
+            : "routine.run_finished",
+        targetType: "routine",
+        targetId: input.routineId,
+        ...(input.actor.userId ? { actorUserId: input.actor.userId } : {}),
+        payload: {
+          actor: input.actor.id,
+          run: input.runId,
+          ...(input.error ? { failure: input.error } : {}),
+        },
+      });
+    },
+
+    /**
+     * Close out runs that nothing is coming back for.
+     *
+     * A run row is claimed before the work starts and closed when it ends, which leaves one shape of
+     * row nothing else in this file can clear: the process that owned the run died between the two.
+     * A killed container, a machine that lost power, a deploy that rolled while a Bot was browsing.
+     * The row stays `running` forever, it holds the one-live-run index, and the routine never fires
+     * again — not from the clock, not from Run now, not from a delivery — with nothing on the page
+     * to say why and no way to fix it short of deleting the routine and its whole history.
+     *
+     * So the next process to tick puts them down. `startedBefore` is what makes that safe: a ceiling
+     * comfortably longer than any run the runner will allow means anything older than it belongs to
+     * a process that is not alive to finish it. A shorter one would be this deployment shooting its
+     * own healthy long runs.
+     *
+     * Recorded as failed rather than deleted, and the error says what is actually known, which is
+     * that how the run ended is not known. A run that vanished from the history would leave the
+     * person who reads it believing nothing was started, and something was.
+     */
+    reapStaleRuns: async (input: {
+      startedBefore: Date;
+      actor: { id: string; userId?: string };
+    }): Promise<number> => {
+      const rows = await database
+        .update(routineRuns)
+        .set({
+          status: "failed",
+          finishedAt: new Date(),
+          error:
+            "This deployment stopped while the run was going, so how it ended is not known. The run was closed out so the routine can run again.",
+        })
+        .where(
+          and(
+            inArray(routineRuns.status, ["queued", "running"]),
+            lt(routineRuns.startedAt, input.startedBefore),
+          ),
+        )
+        .returning();
+
+      for (const row of rows) {
+        await recordAuditEvent(auditStore, {
+          eventType: "routine.run_failed",
+          targetType: "routine",
+          targetId: row.routineId,
+          ...(input.actor.userId ? { actorUserId: input.actor.userId } : {}),
+          payload: {
+            actor: input.actor.id,
+            run: row.id,
+            failure: row.error,
+            started: row.startedAt.toISOString(),
+          },
+        });
+      }
+      return rows.length;
+    },
+
+    /**
+     * Record a window that came and went with nobody awake for it.
+     *
+     * Stamped with the window's own time rather than with now. That makes it idempotent: the next
+     * tick sees a run at or after the window and decides there is nothing to do, instead of writing
+     * the same miss again once a minute until the following window comes round.
+     *
+     * One row per gap, not one per window in it. `lastOccurrenceOnOrBefore` returns only the most
+     * recent occurrence, so a laptop shut for a week records a miss for Friday and says nothing
+     * about Monday to Thursday. That is the deliberate choice: the fact somebody needs is that the
+     * routine has not been running, and four more rows saying the same thing on four consecutive
+     * mornings would bury it rather than sharpen it.
+     */
+    recordMissed: async (input: {
+      routineId: string;
+      dueAt: Date;
+      actor: { id: string; userId?: string };
+    }): Promise<void> => {
+      const [row] = await database
+        .insert(routineRuns)
+        .values({
+          routineId: input.routineId,
+          trigger: "schedule",
+          status: "missed",
+          startedAt: input.dueAt,
+          finishedAt: new Date(),
+          summary:
+            "This deployment was not running when the routine was due, so it did not happen.",
+        })
+        .returning();
+
+      await recordAuditEvent(auditStore, {
+        eventType: "routine.run_missed",
+        targetType: "routine",
+        targetId: input.routineId,
+        ...(input.actor.userId ? { actorUserId: input.actor.userId } : {}),
+        payload: {
+          actor: input.actor.id,
+          ...(row ? { run: row.id } : {}),
+          due: input.dueAt.toISOString(),
+        },
+      });
+    },
+
+    /**
+     * Every enabled routine, with what the scheduler needs to decide about it.
+     *
+     * All of them, every tick, rather than a query that tries to select the due ones in SQL. What
+     * "due" means is weekday sets and grace windows, and expressing that twice, once in schedule.ts
+     * and once in a WHERE clause, guarantees the two disagree the first time either is changed.
+     */
+    dueCandidates: async (): Promise<DueCandidate[]> => {
+      const rows = await database
+        .select()
+        .from(routines)
+        .where(eq(routines.enabled, true));
+      if (rows.length === 0) return [];
+
+      /*
+       * The two facts, aggregated by the database rather than by reading every run.
+       *
+       * A grouped query rather than a correlated subquery per routine, because the run history of a
+       * daily routine grows by one row a day forever and a tick that reads all of them is a tick
+       * that gets slower every week this deployment stays up.
+       */
+      const summary = await database
+        .select({
+          routineId: routineRuns.routineId,
+          lastRunAt: max(routineRuns.startedAt),
+          activeRun: sql<boolean>`bool_or(${routineRuns.status} in ('queued', 'running'))`,
+        })
+        .from(routineRuns)
+        .where(
+          inArray(
+            routineRuns.routineId,
+            rows.map((row) => row.id),
+          ),
+        )
+        .groupBy(routineRuns.routineId);
+
+      const byRoutine = new Map(
+        summary.map((entry) => [entry.routineId, entry] as const),
+      );
+
+      return rows.map((row) => {
+        const runs = byRoutine.get(row.id);
+        return {
+          id: row.id,
+          agentId: row.agentId,
+          ownerUserId: row.ownerUserId,
+          name: row.name,
+          prompt: row.prompt,
+          schedule: parseRoutineSchedule(row.schedule),
+          createdAt: row.createdAt,
+          lastRunAt: runs?.lastRunAt ? new Date(runs.lastRunAt) : null,
+          activeRun: runs?.activeRun === true,
+        };
+      });
+    },
+
+    /**
+     * One routine in the shape the scheduler works in.
+     *
+     * Not scoped to an owner, because the two callers are the scheduler and a delivery from another
+     * system, and neither is a person. Whoever hands a routine id to this has already established
+     * that they are entitled to it: the routes do it with an ownership check before they call, and
+     * the receiver does it with a secret.
+     */
+    candidate: async (id: string): Promise<DueCandidate | null> => {
+      const [row] = await database
+        .select()
+        .from(routines)
+        .where(eq(routines.id, id))
+        .limit(1);
+      if (!row) return null;
+      return {
+        id: row.id,
+        agentId: row.agentId,
+        ownerUserId: row.ownerUserId,
+        name: row.name,
+        prompt: row.prompt,
+        schedule: parseRoutineSchedule(row.schedule),
+        createdAt: row.createdAt,
+        lastRunAt: null,
+        activeRun: false,
+      };
+    },
+
+    /**
+     * Every trigger in this deployment, not one person's.
+     *
+     * Deliberately not scoped the way routines are, and the difference is what a trigger is. A
+     * routine is somebody's own work and nobody else's business. A trigger is a URL on the public
+     * internet that sets a Bot working, which is a fact about the deployment rather than about the
+     * person who happened to create it, and the question an administrator opens this page to ask is
+     * "what is reachable from outside here" — a question a per-person list answers wrongly and
+     * confidently. An administrator who could see only their own triggers could not shut a door
+     * somebody else opened, which is exactly the moment somebody needs to.
+     *
+     * The routes are what keep this away from everybody else: the whole trigger surface requires an
+     * administrator. See routines/routes.ts.
+     */
+    listTriggers: async (): Promise<WebhookTriggerRecord[]> => {
+      const rows = await database
+        .select()
+        .from(webhookTriggers)
+        .orderBy(desc(webhookTriggers.createdAt));
+      return rows.map(asTrigger);
+    },
+
+    /**
+     * Create a trigger and hand back its secret, once.
+     *
+     * The secret is in the return value and nowhere else. It is not written to the audit payload, not
+     * logged, and cannot be read back: the row keeps a SHA-256 of it, which is enough to check a
+     * delivery and not enough to make one.
+     */
+    createTrigger: async (
+      input: CreateWebhookTriggerInput,
+      actor: { id: string; userId?: string },
+    ): Promise<{ trigger: WebhookTriggerRecord; secret: string }> => {
+      const minted = mintWebhookSecret();
+      const [row] = await database
+        .insert(webhookTriggers)
+        .values({
+          endpointId: mintEndpointId(),
+          name: input.name,
+          ownerUserId: input.ownerUserId,
+          routineId: input.routineId ?? null,
+          agentId: input.agentId ?? null,
+          prompt: input.prompt ?? null,
+          secretHash: minted.hash,
+          eventTypes: input.eventTypes ?? [],
+        })
+        .returning();
+      if (!row) throw new Error("The trigger could not be created.");
+
+      await recordAuditEvent(auditStore, {
+        eventType: "webhook.trigger_created",
+        targetType: "webhook_trigger",
+        targetId: row.id,
+        ...(actor.userId ? { actorUserId: actor.userId } : {}),
+        payload: {
+          actor: actor.id,
+          name: row.name,
+          endpoint: row.endpointId,
+          runs: row.routineId
+            ? `routine ${row.routineId}`
+            : `bot ${row.agentId}`,
+          eventTypes: row.eventTypes,
+        },
+      });
+      return { trigger: asTrigger(row), secret: minted.secret };
+    },
+
+    /**
+     * A new secret for an existing trigger.
+     *
+     * The old one stops working the instant this returns, with no overlap. An overlap window is the
+     * usual kindness for a rotating credential and it is the wrong call here: the reason somebody
+     * rotates a webhook secret is that they think the old one leaked, and a grace period is a
+     * grace period for whoever has it.
+     */
+    rotateTriggerSecret: async (
+      id: string,
+      actor: { id: string; userId?: string },
+    ): Promise<{ trigger: WebhookTriggerRecord; secret: string } | null> => {
+      const minted = mintWebhookSecret();
+      const [row] = await database
+        .update(webhookTriggers)
+        .set({ secretHash: minted.hash, updatedAt: new Date() })
+        .where(eq(webhookTriggers.id, id))
+        .returning();
+      if (!row) return null;
+
+      await recordAuditEvent(auditStore, {
+        eventType: "webhook.trigger_rotated",
+        targetType: "webhook_trigger",
+        targetId: row.id,
+        ...(actor.userId ? { actorUserId: actor.userId } : {}),
+        payload: {
+          actor: actor.id,
+          name: row.name,
+          endpoint: row.endpointId,
+          note: "The previous secret stopped working immediately.",
+        },
+      });
+      return { trigger: asTrigger(row), secret: minted.secret };
+    },
+
+    /**
+     * Narrow a trigger, or switch it off.
+     *
+     * Recorded, unlike most edits in this product, because both things this can do are things a
+     * public endpoint stops accepting: an administrator who finds that deliveries stopped last
+     * Tuesday is owed the row that says who did it and when, and "somebody turned it off" is not an
+     * answer a database can give afterwards from the row alone.
+     */
+    updateTrigger: async (
+      id: string,
+      patch: { enabled?: boolean; eventTypes?: string[] },
+      actor: { id: string; userId?: string },
+    ): Promise<WebhookTriggerRecord | null> => {
+      const [row] = await database
+        .update(webhookTriggers)
+        .set({
+          ...(patch.enabled !== undefined ? { enabled: patch.enabled } : {}),
+          ...(patch.eventTypes !== undefined
+            ? { eventTypes: patch.eventTypes }
+            : {}),
+          updatedAt: new Date(),
+        })
+        .where(eq(webhookTriggers.id, id))
+        .returning();
+      if (!row) return null;
+
+      await recordAuditEvent(auditStore, {
+        eventType: "webhook.trigger_updated",
+        targetType: "webhook_trigger",
+        targetId: row.id,
+        ...(actor.userId ? { actorUserId: actor.userId } : {}),
+        payload: {
+          actor: actor.id,
+          name: row.name,
+          endpoint: row.endpointId,
+          enabled: row.enabled,
+          eventTypes: row.eventTypes,
+        },
+      });
+      return asTrigger(row);
+    },
+
+    /**
+     * Confirm a captured sample, so this trigger starts doing work.
+     *
+     * Refused unless a sample has actually arrived. Confirming a trigger nothing has ever called is
+     * confirming nothing, and it would turn the one gate that catches a misdirected hook into a
+     * checkbox somebody ticks on the way past.
+     *
+     * The row it leaves is the most important one in this file. Every delivery before this point ran
+     * nothing; every delivery after it sets a Bot working on somebody's live systems, and the trail
+     * has to be able to say who moved the endpoint from one state to the other.
+     */
+    verifyTrigger: async (
+      id: string,
+      actor: { id: string; userId?: string },
+    ): Promise<WebhookTriggerRecord | null> => {
+      const [row] = await database
+        .update(webhookTriggers)
+        .set({
+          verificationPending: false,
+          verifiedAt: new Date(),
+          updatedAt: new Date(),
+        })
+        .where(
+          and(
+            eq(webhookTriggers.id, id),
+            sql`${webhookTriggers.sample} is not null`,
+          ),
+        )
+        .returning();
+      if (!row) return null;
+
+      await recordAuditEvent(auditStore, {
+        eventType: "webhook.trigger_verified",
+        targetType: "webhook_trigger",
+        targetId: row.id,
+        ...(actor.userId ? { actorUserId: actor.userId } : {}),
+        payload: {
+          actor: actor.id,
+          name: row.name,
+          endpoint: row.endpointId,
+          note: "Deliveries to this endpoint now run work.",
+        },
+      });
+      return asTrigger(row);
+    },
+
+    deleteTrigger: async (
+      id: string,
+      actor: { id: string; userId?: string },
+    ): Promise<boolean> => {
+      const [row] = await database
+        .delete(webhookTriggers)
+        .where(eq(webhookTriggers.id, id))
+        .returning();
+      if (!row) return false;
+
+      // The row outlives the trigger on purpose. A deleted endpoint is one that stops answering, and
+      // the deletion is the only place that fact can be written down: the table it was in no longer
+      // has anything to say about it.
+      await recordAuditEvent(auditStore, {
+        eventType: "webhook.trigger_deleted",
+        targetType: "webhook_trigger",
+        targetId: row.id,
+        ...(actor.userId ? { actorUserId: actor.userId } : {}),
+        payload: {
+          actor: actor.id,
+          name: row.name,
+          endpoint: row.endpointId,
+        },
+      });
+      return true;
+    },
+
+    /** The receiver's lookup. Carries the hash, which is why it is not the shape the routes return. */
+    triggerByEndpoint: async (
+      endpointId: string,
+    ): Promise<WebhookTriggerWithSecret | null> => {
+      const [row] = await database
+        .select()
+        .from(webhookTriggers)
+        .where(eq(webhookTriggers.endpointId, endpointId))
+        .limit(1);
+      return row ? { ...asTrigger(row), secretHash: row.secretHash } : null;
+    },
+
+    /**
+     * Note that a delivery arrived, and keep the FIRST one.
+     *
+     * First, not latest, and the database is what decides that rather than the caller: the sample is
+     * only ever written where there is not one already. Every delivery that arrives before somebody
+     * confirms the trigger is a delivery this may be called for, and a `set` would leave the row
+     * holding whichever one landed last. That is the failure the verification gate is built to
+     * prevent, wearing the gate's own clothes: the person opens the page, reads the delivery that is
+     * there, presses "this is right, start running it", and confirms a payload they never saw
+     * because another one arrived while they were reading.
+     *
+     * The sample is written only while verification is pending, so a trigger in use does not
+     * accumulate somebody else's payloads in this deployment's database. What it keeps afterwards is
+     * a count and a timestamp, which is enough to answer "is this thing actually being called".
+     */
+    recordDelivery: async (input: {
+      id: string;
+      body: unknown;
+      captureSample: boolean;
+    }): Promise<void> => {
+      await database
+        .update(webhookTriggers)
+        .set({
+          deliveryCount: sql`${webhookTriggers.deliveryCount} + 1`,
+          lastReceivedAt: new Date(),
+          ...(input.captureSample
+            ? {
+                // The delivery travels as a bound parameter and the column keeps the first
+                // non-null, so two deliveries arriving a second apart cannot race over the sample
+                // either: whichever statement runs second finds a value there and leaves it.
+                sample: sql`coalesce(${webhookTriggers.sample}, ${asSample(input.body)}::jsonb)`,
+              }
+            : {}),
+        })
+        .where(eq(webhookTriggers.id, input.id));
+    },
+
+    /**
+     * One row for a delivery that was answered, whichever way it was answered.
+     *
+     * Three outcomes rather than a boolean. A captured delivery is not a refused one: it presented
+     * the right secret and was deliberately kept, and a trail that files it under "refused" answers
+     * "did my sample arrive" with the word no.
+     */
+    recordDeliveryEvent: async (input: {
+      endpointId: string;
+      triggerId?: string;
+      outcome: "ran" | "captured" | "refused";
+      reason: string;
+      eventType: string | null;
+    }): Promise<void> => {
+      await recordAuditEvent(auditStore, {
+        eventType:
+          input.outcome === "ran"
+            ? "webhook.received"
+            : input.outcome === "captured"
+              ? "webhook.captured"
+              : "webhook.rejected",
+        targetType: "webhook_trigger",
+        targetId: input.triggerId ?? input.endpointId,
+        payload: {
+          endpoint: input.endpointId,
+          reason: input.reason,
+          ...(input.eventType ? { event: input.eventType } : {}),
+        },
+      });
+    },
+  };
+}
+
+/**
+ * One row for a change somebody made to a routine.
+ *
+ * The prompt is not in the payload. It is the instruction a person wrote about their own work, it
+ * can name customers, systems and amounts, and `audit.ts` would redact a key called `prompt` anyway,
+ * so putting it there would only mean having placed it somewhere it had to be caught on the way
+ * past. The name, the Bot and the schedule are what a reader needs.
+ */
+async function writeRoutineEvent(
+  auditStore: AuditStore,
+  eventType: "routine.created" | "routine.updated" | "routine.deleted",
+  row: typeof routines.$inferSelect,
+  actor: { id: string; userId?: string },
+) {
+  await recordAuditEvent(auditStore, {
+    eventType,
+    targetType: "routine",
+    targetId: row.id,
+    ...(actor.userId ? { actorUserId: actor.userId } : {}),
+    payload: {
+      actor: actor.id,
+      name: row.name,
+      bot: row.agentId,
+      schedule: row.schedule,
+      enabled: row.enabled,
+    },
+  });
+}
+
+function asRun(row: typeof routineRuns.$inferSelect): RoutineRunRecord {
+  return {
+    id: row.id,
+    routineId: row.routineId,
+    trigger: row.trigger,
+    status: row.status,
+    startedAt: row.startedAt.toISOString(),
+    finishedAt: row.finishedAt?.toISOString() ?? null,
+    summary: row.summary,
+    error: row.error,
+    threadId: row.threadId,
+  };
+}
+
+function asTrigger(
+  row: typeof webhookTriggers.$inferSelect,
+): WebhookTriggerRecord {
+  return {
+    id: row.id,
+    endpointId: row.endpointId,
+    name: row.name,
+    ownerUserId: row.ownerUserId,
+    routineId: row.routineId,
+    agentId: row.agentId,
+    prompt: row.prompt,
+    enabled: row.enabled,
+    verificationPending: row.verificationPending,
+    verifiedAt: row.verifiedAt?.toISOString() ?? null,
+    sample: row.sample,
+    eventTypes: [...row.eventTypes],
+    deliveryCount: row.deliveryCount,
+    lastReceivedAt: row.lastReceivedAt?.toISOString() ?? null,
+    createdAt: row.createdAt.toISOString(),
+  };
+}
+
+/**
+ * A delivery, in the shape a `jsonb` column takes.
+ *
+ * A body that is an array or a bare string is wrapped rather than rejected. The column holds an
+ * object, and a sample nobody can look at because the payload was a JSON array is a sample that
+ * defeats the point of capturing one.
+ */
+function asSample(body: unknown): Record<string, unknown> {
+  return body && typeof body === "object" && !Array.isArray(body)
+    ? (body as Record<string, unknown>)
+    : { body: body ?? null };
+}
+
+/**
+ * Whether the database refused a write because something equivalent already existed.
+ *
+ * Matched on PostgreSQL's own SQLSTATE rather than on the message, which is localised and rephrased
+ * between versions. Bun's driver puts the SQLSTATE in `errno` and its own name in `code`, which is
+ * the opposite of what most Postgres clients do, so both are read and any wrapping cause is read
+ * too. Anything this cannot positively identify as a duplicate is rethrown: a claim that failed for
+ * a reason nobody understood must not be reported as "another run has it".
+ */
+function isUniqueViolation(error: unknown): boolean {
+  const UNIQUE_VIOLATION = "23505";
+  const matches = (value: unknown): boolean => {
+    if (!value || typeof value !== "object") return false;
+    const fields = value as { code?: unknown; errno?: unknown };
+    return (
+      String(fields.code) === UNIQUE_VIOLATION ||
+      String(fields.errno) === UNIQUE_VIOLATION
+    );
+  };
+  return (
+    matches(error) || matches(error instanceof Error ? error.cause : undefined)
+  );
+}
diff --git a/server/src/routines/webhooks.ts b/server/src/routines/webhooks.ts
new file mode 100644
index 0000000..82b1ce7
--- /dev/null
+++ b/server/src/routines/webhooks.ts
@@ -0,0 +1,235 @@
+/**
+ * Whether a delivery that arrived on the public port may set a Bot working.
+ *
+ * Everything here is a pure decision about one request. The receiver does the listening and the
+ * store does the writing; this decides, so that "an unverified trigger does not run anything" is a
+ * sentence with a test next to it rather than a branch buried in a request handler.
+ *
+ * Three separate gates, in this order, because they fail for three different reasons and a caller
+ * deserves to be told which:
+ *
+ *  1. The secret. Wrong, missing or malformed, and nothing else is even looked at.
+ *  2. Verification. A brand new trigger keeps the first authenticated delivery as a sample and runs
+ *     nothing at all. Somebody looks at what actually arrived and confirms it. This is the gate that
+ *     catches a hook pointed at the wrong trigger, which is otherwise discovered by its results.
+ *  3. The event type, when the trigger names any. An allowlist, because "only act on
+ *     deployment.succeeded" is a decision about what may reach the Bot, not a request to the model.
+ */
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+
+/**
+ * The prefix every webhook secret carries.
+ *
+ * Present so a secret is recognisable on sight in a log somebody is about to paste into a ticket,
+ * and so the secret scanners that watch public repositories have something to match. It is not a
+ * security property; the entropy after it is.
+ */
+export const WEBHOOK_SECRET_PREFIX = "obw_";
+
+/** 32 bytes of randomness. Long enough that guessing is not a strategy and short enough to paste. */
+const SECRET_BYTES = 32;
+
+/** 18 bytes, base64url. The public path segment: unguessable, and short enough to read aloud. */
+const ENDPOINT_BYTES = 18;
+
+export type MintedSecret = {
+  /**
+   * The only time this value exists outside the caller's own configuration.
+   *
+   * Returned once, at creation and at rotation, and never stored. A secret the product can show
+   * again is a secret held by a screen, a backup and a database dump, and the entire value of a
+   * bearer token is that only the caller has it.
+   */
+  secret: string;
+  /** What goes in the table. */
+  hash: string;
+};
+
+export function mintWebhookSecret(): MintedSecret {
+  const secret = `${WEBHOOK_SECRET_PREFIX}${randomBytes(SECRET_BYTES).toString("base64url")}`;
+  return { secret, hash: hashWebhookSecret(secret) };
+}
+
+export function mintEndpointId(): string {
+  return randomBytes(ENDPOINT_BYTES).toString("base64url");
+}
+
+export function hashWebhookSecret(secret: string): string {
+  return createHash("sha256").update(secret, "utf8").digest("hex");
+}
+
+/**
+ * Compare a presented secret against a stored hash without leaking how close it was.
+ *
+ * Both sides are hashed first, which does two things. It makes the comparison fixed-width, so
+ * `timingSafeEqual` can be used at all, it throws on buffers of different lengths and a caller can
+ * present a secret of any length they like. And it means the timing of the comparison carries no
+ * information about the secret, only about its digest, which tells an attacker nothing they can walk
+ * towards.
+ *
+ * The naive version of this, `presented === stored`, returns early at the first differing byte. That
+ * is a real attack against a value an attacker can retry against as fast as the network allows,
+ * which is precisely the situation a public endpoint is in.
+ */
+export function webhookSecretMatches(
+  presented: string,
+  storedHash: string,
+): boolean {
+  const candidate = Buffer.from(hashWebhookSecret(presented), "hex");
+  let expected: Buffer;
+  try {
+    expected = Buffer.from(storedHash, "hex");
+  } catch {
+    return false;
+  }
+  // A stored value that is not a SHA-256 digest cannot match anything. Checked rather than assumed,
+  // because reaching timingSafeEqual with mismatched lengths throws, and an exception on the public
+  // port would be answered with a 500 that says more about the deployment than a 401 does.
+  if (expected.byteLength !== candidate.byteLength) return false;
+  return timingSafeEqual(candidate, expected);
+}
+
+/**
+ * Pull the secret out of an Authorization header.
+ *
+ * Bearer only, and the scheme is matched case-insensitively because that is what the specification
+ * says and what the systems calling this actually send. Anything else returns null and is refused
+ * as an unauthenticated delivery rather than being interpreted generously.
+ */
+export function bearerSecret(header: string | null | undefined): string | null {
+  if (!header) return null;
+  const match = header.match(/^Bearer\s+(\S+)$/i);
+  return match?.[1] ?? null;
+}
+
+/** What a trigger looks like to this decision. Deliberately not the whole row. */
+export type WebhookTriggerFacts = {
+  enabled: boolean;
+  verificationPending: boolean;
+  secretHash: string;
+  /** Empty means every event type is acceptable. */
+  eventTypes: string[];
+};
+
+export type WebhookDecision =
+  /** Run the work. */
+  | { outcome: "run" }
+  /** Authenticated, and deliberately not run: this is the first delivery and it becomes the sample. */
+  | { outcome: "capture"; reason: string }
+  /** Refused. `status` is what the caller is told, `reason` is what the trail records. */
+  | { outcome: "reject"; status: 401 | 403 | 404; reason: string };
+
+/**
+ * Decide what to do with one delivery.
+ *
+ * A disabled trigger answers 404, not 403. The distinction matters on a public endpoint: 403 confirms
+ * that this endpoint id exists and is merely switched off, which is more than an unauthenticated
+ * caller has earned. A wrong secret answers 401 for the same reason it always does, and says nothing
+ * about whether the endpoint is real.
+ */
+export function decideWebhookDelivery(
+  trigger: WebhookTriggerFacts | null,
+  delivery: { authorization: string | null; eventType: string | null },
+): WebhookDecision {
+  if (!trigger?.enabled) {
+    return {
+      outcome: "reject",
+      status: 404,
+      reason: "No trigger is listening on that endpoint.",
+    };
+  }
+
+  const presented = bearerSecret(delivery.authorization);
+  if (!presented || !webhookSecretMatches(presented, trigger.secretHash)) {
+    return {
+      outcome: "reject",
+      status: 401,
+      reason: "The delivery did not present this trigger's secret.",
+    };
+  }
+
+  if (trigger.verificationPending) {
+    return {
+      outcome: "capture",
+      reason:
+        "The first delivery to a new trigger is kept as a sample and runs nothing. " +
+        "Confirm it in Admin once you have looked at what arrived.",
+    };
+  }
+
+  if (
+    trigger.eventTypes.length > 0 &&
+    (!delivery.eventType || !trigger.eventTypes.includes(delivery.eventType))
+  ) {
+    return {
+      outcome: "reject",
+      status: 403,
+      reason: delivery.eventType
+        ? `This trigger does not act on ${delivery.eventType}.`
+        : "This trigger only acts on named event types, and the delivery named none.",
+    };
+  }
+
+  return { outcome: "run" };
+}
+
+/**
+ * Where the event type is read from.
+ *
+ * The header first, because the systems that have one send it there and it is the part a person can
+ * see without opening the body. Then two field names in the body, which are what the rest send. A
+ * delivery that names its event type in some fourth way is treated as naming none, which an
+ * allowlist then refuses: guessing at a field would mean a trigger silently acting on events it was
+ * told not to.
+ */
+export function eventTypeOf(
+  headers: { get(name: string): string | null },
+  body: unknown,
+): string | null {
+  const header =
+    headers.get("x-openbot-event") ?? headers.get("x-event-type") ?? null;
+  if (header?.trim()) return header.trim();
+  if (body && typeof body === "object" && !Array.isArray(body)) {
+    const record = body as Record<string, unknown>;
+    for (const field of ["event", "eventType", "type"]) {
+      const value = record[field];
+      if (typeof value === "string" && value.trim()) return value.trim();
+    }
+  }
+  return null;
+}
+
+/**
+ * What the Bot is told a webhook said.
+ *
+ * The body is handed over as JSON inside a sentence rather than as a bare payload, because the Bot
+ * is being asked to do a job and the delivery is evidence for it, not the instruction. Truncated,
+ * because a delivery is somebody else's payload and can be any size at all, and a prompt that grows
+ * without limit is a run that fails for a reason nobody can see from the routine.
+ */
+export const MAX_DELIVERY_CHARACTERS = 8_000;
+
+export function deliveryPrompt(
+  instruction: string,
+  body: unknown,
+  eventType: string | null,
+): string {
+  let rendered: string;
+  try {
+    rendered = JSON.stringify(body ?? null, null, 2) ?? "null";
+  } catch {
+    rendered = "(the delivery could not be rendered as JSON)";
+  }
+  const truncated =
+    rendered.length > MAX_DELIVERY_CHARACTERS
+      ? `${rendered.slice(0, MAX_DELIVERY_CHARACTERS)}\n… (truncated)`
+      : rendered;
+
+  return [
+    instruction,
+    eventType
+      ? `This was triggered by an incoming ${eventType} delivery:`
+      : "This was triggered by an incoming delivery:",
+    truncated,
+  ].join("\n\n");
+}
diff --git a/server/tests/computer-gateway.test.ts b/server/tests/computer-gateway.test.ts
index 6de1937..d358623 100644
--- a/server/tests/computer-gateway.test.ts
+++ b/server/tests/computer-gateway.test.ts
@@ -420,6 +420,37 @@ describe("the computer gateway", () => {
     // could not identify what was touched, rather than omitting the field.
     expect(rows[0]?.payload.element).toBe("not in the current snapshot");
   });
+
+  /*
+   * The end of the chain a routine's actions travel down. The runner marks its actor as unattended,
+   * the gateway puts that in the policy context, and a rule can refuse on it. Asserted here rather
+   * than only in the policy tests because the gateway is where the two meet, and a context that
+   * simply never set the field would leave both halves passing and the boundary inert.
+   */
+  test("a rule can refuse an action because nobody is watching", async () => {
+    const { gateway, calls } = await gatewayWith({
+      ...PERMISSIVE,
+      deny: ['run.unattended && intent == "activate"'],
+    });
+
+    await expect(
+      gateway.click(
+        "default",
+        "bot-1",
+        { ...ACTOR, unattended: true },
+        { ref: "e9", snapshotId: 7 },
+      ),
+    ).rejects.toThrow(ActionRefusedError);
+    expect(calls).toEqual([]);
+
+    // And the same click, by the same person, with somebody at the screen, goes through. A rule that
+    // could not tell those apart would be a rule nobody could switch on.
+    await gateway.click("default", "bot-1", ACTOR, {
+      ref: "e9",
+      snapshotId: 7,
+    });
+    expect(calls).toEqual(["click"]);
+  });
 });
 
 /**
diff --git a/server/tests/computer-policy.test.ts b/server/tests/computer-policy.test.ts
index d9bb383..7e16e86 100644
--- a/server/tests/computer-policy.test.ts
+++ b/server/tests/computer-policy.test.ts
@@ -20,6 +20,10 @@ function context(overrides: Partial<PolicyContext> = {}): PolicyContext {
     tool: { name: "computer_click" },
     bot: { id: "risk-analyst" },
     actor: { id: "dev-local-user" },
+    // Somebody is at the screen unless a case says otherwise. Present on every context here for the
+    // reason the field exists: an absent one makes any rule naming it unevaluable, and this engine
+    // reads unevaluable as a match.
+    run: { unattended: false },
     page: { url: "https://example.com/order", host: "example.com" },
     // The first time this Bot has made this call, which is what a context with nothing to say about
     // repetition means. Always present: an absent field throws inside CEL, and a throwing deny rule
@@ -301,6 +305,7 @@ describe("a rule written about what an action does", () => {
     tool: { name: "computer_click" },
     bot: { id: "b" },
     actor: { id: "a" },
+    run: { unattended: false },
     page: { url: "https://example.com/", host: "example.com" },
     repeat: { count: 1 },
     intent: "activate",
@@ -393,6 +398,7 @@ describe("a rule that names an identifier only some actions carry", () => {
     tool: { name: "computer_navigate" },
     bot: { id: "b" },
     actor: { id: "a" },
+    run: { unattended: false },
     page: { url: "https://httpbin.org/forms/post", host: "httpbin.org" },
     repeat: { count: 1 },
     intent: "navigate",
@@ -650,3 +656,45 @@ describe("a rule about a Bot repeating itself", () => {
     ).toBe(false);
   });
 });
+
+/**
+ * A boundary that can be stricter about work nobody is watching.
+ *
+ * The second case is the one that matters. `run.unattended` is only useful if the same rule leaves
+ * an attended click alone, and that is not automatic: this engine treats an expression it cannot
+ * evaluate as a match, so a context that sometimes omitted the field would turn a rule about
+ * routines into a rule that refuses everybody.
+ */
+describe("a rule about whether anybody is watching", () => {
+  const rule = 'run.unattended && intent == "activate"';
+  const policy: ActionPolicy = {
+    mode: "enforce",
+    deny: [rule],
+    allow: ["true"],
+  };
+
+  test("refuses a scheduled run pressing a button", () => {
+    const decision = evaluateActionPolicy(
+      policy,
+      context({ intent: "activate", run: { unattended: true } }),
+    );
+    expect(decision.allowed).toBe(false);
+    expect(decision.matched).toBe(rule);
+  });
+
+  test("leaves the same click alone when somebody is at the screen", () => {
+    const decision = evaluateActionPolicy(
+      policy,
+      context({ intent: "activate", run: { unattended: false } }),
+    );
+    expect(decision.allowed).toBe(true);
+  });
+
+  test("still lets the scheduled run read the page", () => {
+    const decision = evaluateActionPolicy(
+      policy,
+      context({ intent: "read", run: { unattended: true } }),
+    );
+    expect(decision.allowed).toBe(true);
+  });
+});
diff --git a/server/tests/config.test.ts b/server/tests/config.test.ts
index d784e5d..44141ff 100644
--- a/server/tests/config.test.ts
+++ b/server/tests/config.test.ts
@@ -219,4 +219,46 @@ describe("deployment configuration", () => {
       ).toThrow("COMPUTER_REPEAT_WINDOW_MS");
     },
   );
+
+  /*
+   * The routine settings decide two things somebody can be surprised by: whether this deployment
+   * runs unattended work at all, and which port a stranger's delivery arrives on. Both are read at
+   * boot and never again, so a value the product cannot honour has to stop the boot rather than be
+   * quietly replaced by a default.
+   */
+  test("runs routines by default, on the port above the API's", () => {
+    const config = loadConfig({ ...baseEnvironment, PORT: "3001" });
+
+    expect(config.routines.schedulerEnabled).toBe(true);
+    expect(config.routines.webhookPort).toBe(3002);
+    // Localhost unless a deployment says otherwise. A webhook endpoint reachable from the internet
+    // the moment somebody sets a variable is a decision, not something to inherit.
+    expect(config.routines.webhookHost).toBe("127.0.0.1");
+  });
+
+  test("the switch that stops everything is spelled on or off, and nothing else", () => {
+    expect(
+      loadConfig({ ...baseEnvironment, ROUTINE_SCHEDULER: "off" }).routines
+        .schedulerEnabled,
+    ).toBe(false);
+    // Not "false", not "0", not "no". A misspelling that quietly meant "on" would leave somebody
+    // who restored a production dump onto a laptop with a deployment that runs their real work.
+    expect(() =>
+      loadConfig({ ...baseEnvironment, ROUTINE_SCHEDULER: "false" }),
+    ).toThrow('ROUTINE_SCHEDULER must be "on" or "off"');
+  });
+
+  test("a webhook port that is not a port refuses to start", () => {
+    expect(
+      loadConfig({ ...baseEnvironment, ROUTINE_WEBHOOK_PORT: "9100" }).routines
+        .webhookPort,
+    ).toBe(9100);
+    // Falling back to the default here would serve the endpoint on the very port the operator was
+    // moving it off, which is the one outcome that would surprise them at the worst moment.
+    for (const port of ["not-a-port", "0", "70000"]) {
+      expect(() =>
+        loadConfig({ ...baseEnvironment, ROUTINE_WEBHOOK_PORT: port }),
+      ).toThrow("ROUTINE_WEBHOOK_PORT must be a port number");
+    }
+  });
 });
diff --git a/server/tests/routine-receiver.test.ts b/server/tests/routine-receiver.test.ts
new file mode 100644
index 0000000..39f3725
--- /dev/null
+++ b/server/tests/routine-receiver.test.ts
@@ -0,0 +1,257 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  MAX_DELIVERY_BYTES,
+  startWebhookReceiver,
+  type WebhookReceiver,
+} from "../src/routines/receiver";
+import type {
+  RoutineStore,
+  WebhookTriggerWithSecret,
+} from "../src/routines/store";
+import { hashWebhookSecret } from "../src/routines/webhooks";
+
+/**
+ * The public surface, driven over a real socket.
+ *
+ * webhook-trigger.test.ts owns the decision — whether a delivery may run anything — and this owns
+ * everything around it: what this port answers, what it refuses to answer, and what it will read
+ * before it has any idea who is calling. Those are separate concerns and the second one is the
+ * dangerous one, because it happens before authentication and therefore for everybody, including
+ * whoever is scanning the internet for open ports this afternoon.
+ *
+ * A real listener rather than a call into `handle`, because two of the properties below are not
+ * properties of the handler at all. The body ceiling is enforced by the server, before the handler
+ * exists to be called; and the 404 for everything that is not one of the two paths is worth asserting
+ * against something that has actually parsed a URL, since the whole design of this port is that a
+ * mistake in it cannot reach the rest of the API.
+ */
+
+const secret = "obw_test_secret_value";
+
+const trigger: WebhookTriggerWithSecret = {
+  id: "trigger-1",
+  endpointId: "endpoint-1",
+  name: "Build finished",
+  ownerUserId: "someone",
+  routineId: "routine-1",
+  agentId: null,
+  prompt: null,
+  enabled: true,
+  verificationPending: false,
+  verifiedAt: new Date(0).toISOString(),
+  sample: null,
+  eventTypes: [],
+  deliveryCount: 0,
+  lastReceivedAt: null,
+  createdAt: new Date(0).toISOString(),
+  secretHash: hashWebhookSecret(secret),
+};
+
+/** What the receiver asks of the store, and nothing else it happens to have. */
+function fakeStore(overrides: Partial<WebhookTriggerWithSecret> = {}) {
+  const deliveries: { id: string; captureSample: boolean }[] = [];
+  const events: { outcome: string; endpointId: string }[] = [];
+  const store = {
+    triggerByEndpoint: async (endpointId: string) =>
+      endpointId === trigger.endpointId ? { ...trigger, ...overrides } : null,
+    recordDelivery: async (input: { id: string; captureSample: boolean }) => {
+      deliveries.push({ id: input.id, captureSample: input.captureSample });
+    },
+    recordDeliveryEvent: async (input: {
+      outcome: string;
+      endpointId: string;
+    }) => {
+      events.push({ outcome: input.outcome, endpointId: input.endpointId });
+    },
+  } as unknown as RoutineStore;
+  return { store, deliveries, events };
+}
+
+let receiver: WebhookReceiver;
+let dispatched: { triggerId: string; body: unknown }[] = [];
+let started = true;
+const state = fakeStore();
+
+beforeAll(() => {
+  receiver = startWebhookReceiver({
+    // The kernel picks, so this suite cannot collide with a deployment or with another test file.
+    port: 0,
+    store: state.store,
+    dispatch: async (work) => {
+      dispatched.push({ triggerId: work.triggerId, body: work.body });
+      return started;
+    },
+    log: () => undefined,
+  });
+});
+
+afterAll(async () => {
+  await receiver.stop();
+});
+
+const url = (path: string) =>
+  `http://${receiver.hostname}:${receiver.port}${path}`;
+
+const post = (path: string, init: RequestInit = {}) =>
+  fetch(url(path), { method: "POST", ...init });
+
+describe("what this port serves", () => {
+  test("answers health, and nothing else outside /hooks", async () => {
+    expect((await fetch(url("/health"))).status).toBe(200);
+
+    // The point of a separate listener: these routes are not merely guarded here, they are absent.
+    for (const path of ["/", "/api/admin/credentials", "/api/routines"]) {
+      expect((await fetch(url(path))).status).toBe(404);
+    }
+  });
+
+  test("a further path segment is not an endpoint id", async () => {
+    // Refused rather than trimmed, so `/hooks/abc/../../whatever` cannot become a lookup for
+    // something else.
+    expect((await post("/hooks/endpoint-1/extra")).status).toBe(404);
+    expect((await post("/hooks/endpoint-1/../other")).status).toBe(404);
+    expect((await post("/hooks/")).status).toBe(404);
+  });
+
+  test("deliveries are POSTed, and a GET is told so", async () => {
+    expect((await fetch(url("/hooks/endpoint-1"))).status).toBe(405);
+  });
+});
+
+/*
+ * The check that happens before anybody has proved anything. Everything else on this port is behind
+ * a secret; this is not, so it is the one thing a stranger can spend this deployment's memory on.
+ */
+describe("the delivery ceiling", () => {
+  test("a body larger than the ceiling is refused", async () => {
+    const response = await post("/hooks/endpoint-1", {
+      body: "a".repeat(MAX_DELIVERY_BYTES + 1_000),
+    });
+    expect(response.status).toBe(413);
+  });
+
+  test("an unauthenticated caller cannot make this port hold megabytes", async () => {
+    // No such endpoint, no secret, nothing: the request is refused on its size before the lookup
+    // that would have refused it anyway. The failure this prevents is a handful of concurrent posts
+    // of a hundred megabytes each, none of which has presented a secret.
+    const response = await post("/hooks/whatever", {
+      body: "a".repeat(4 * MAX_DELIVERY_BYTES),
+    });
+    expect(response.status).toBe(413);
+  });
+
+  test("the ceiling is bytes, not characters", async () => {
+    /*
+     * `"😀"` is one character to JavaScript's `length` and four bytes on the wire. A ceiling measured
+     * in string length is one an emoji walks straight through, which is not a hypothetical: a
+     * delivery is somebody else's payload and plenty of them are full of them.
+     */
+    const emoji = "😀".repeat(Math.ceil(MAX_DELIVERY_BYTES / 3));
+    expect(emoji.length).toBeLessThan(MAX_DELIVERY_BYTES);
+    expect((await post("/hooks/endpoint-1", { body: emoji })).status).toBe(413);
+  });
+
+  test("an ordinary delivery is not refused", async () => {
+    const response = await post("/hooks/endpoint-1", {
+      headers: { authorization: `Bearer ${secret}` },
+      body: JSON.stringify({ event: "build.finished" }),
+    });
+    expect(response.status).toBe(202);
+  });
+});
+
+describe("what a sender is told", () => {
+  test("a delivery with no secret is refused, and says nothing about the endpoint", async () => {
+    const response = await post("/hooks/endpoint-1", {
+      body: JSON.stringify({ event: "build.finished" }),
+    });
+    expect(response.status).toBe(401);
+  });
+
+  test("an endpoint nobody is listening on is a 404, not a 403", async () => {
+    // 403 would confirm that this endpoint id exists and is merely switched off, which is more than
+    // an unauthenticated caller has earned.
+    const response = await post("/hooks/nothing-here", {
+      headers: { authorization: `Bearer ${secret}` },
+      body: "{}",
+    });
+    expect(response.status).toBe(404);
+  });
+
+  test("a delivery that started a run is accepted, and one that could not is not an error", async () => {
+    dispatched = [];
+    started = true;
+    const accepted = await post("/hooks/endpoint-1", {
+      headers: { authorization: `Bearer ${secret}` },
+      body: JSON.stringify({ branch: "main" }),
+    });
+    expect(accepted.status).toBe(202);
+    expect(dispatched).toHaveLength(1);
+    expect(dispatched[0]?.body).toEqual({ branch: "main" });
+
+    started = false;
+    const busy = await post("/hooks/endpoint-1", {
+      headers: { authorization: `Bearer ${secret}` },
+      body: JSON.stringify({ branch: "main" }),
+    });
+    // 409 rather than a 5xx, because nothing is wrong: the work is already being done, and a sender
+    // that retries on a server error should not be encouraged to.
+    expect(busy.status).toBe(409);
+    started = true;
+  });
+
+  test("a body that is not JSON is kept as text rather than refused", async () => {
+    dispatched = [];
+    const response = await post("/hooks/endpoint-1", {
+      headers: { authorization: `Bearer ${secret}` },
+      body: "branch=main&status=green",
+    });
+    expect(response.status).toBe(202);
+    expect(dispatched[0]?.body).toEqual({ text: "branch=main&status=green" });
+  });
+});
+
+/*
+ * The gate the whole feature is built around: a new trigger keeps a delivery and runs nothing until
+ * a person has looked at what actually arrived.
+ */
+describe("a trigger nobody has confirmed yet", () => {
+  test("keeps the delivery, starts nothing, and says which", async () => {
+    const pending = fakeStore();
+    const listener = startWebhookReceiver({
+      port: 0,
+      store: {
+        ...pending.store,
+        triggerByEndpoint: async () => ({
+          ...trigger,
+          verificationPending: true,
+        }),
+      } as unknown as RoutineStore,
+      dispatch: async () => {
+        throw new Error("an unconfirmed trigger must not reach the runner");
+      },
+      log: () => undefined,
+    });
+
+    const response = await fetch(
+      `http://${listener.hostname}:${listener.port}/hooks/endpoint-1`,
+      {
+        method: "POST",
+        headers: { authorization: `Bearer ${secret}` },
+        body: JSON.stringify({ event: "build.finished" }),
+      },
+    );
+
+    // 202 with words, not 200. A hook that reports plain success while the Bot sits idle is how a
+    // misconfiguration survives a week.
+    expect(response.status).toBe(202);
+    expect(await response.json()).toMatchObject({ status: "captured" });
+    expect(pending.deliveries).toEqual([
+      { id: trigger.id, captureSample: true },
+    ]);
+    // Its own outcome in the trail. A person looking for their sample must not read "refused".
+    expect(pending.events.map((entry) => entry.outcome)).toEqual(["captured"]);
+
+    await listener.stop();
+  });
+});
diff --git a/server/tests/routine-routes.test.ts b/server/tests/routine-routes.test.ts
new file mode 100644
index 0000000..050aa05
--- /dev/null
+++ b/server/tests/routine-routes.test.ts
@@ -0,0 +1,177 @@
+import { describe, expect, test } from "bun:test";
+import type { MiddlewareHandler } from "hono";
+import type { AppVariables } from "../src/auth/guards";
+import { createRoutineRoutes } from "../src/routines/routes";
+import type { RoutineStore } from "../src/routines/store";
+
+/**
+ * Who may do what with a routine, and who may do what with a door onto the public internet.
+ *
+ * The two halves of this file are guarded differently and the difference is the point. A routine is
+ * somebody's own work, so every route for one is scoped to the person asking. A webhook trigger is a
+ * URL a stranger can call, which is a fact about the deployment rather than about whoever typed it,
+ * so those routes want an administrator and are not scoped to a creator at all.
+ *
+ * Worth a test rather than a comment, because the failure is silent in both directions: a surface
+ * that admits everybody looks exactly like one that does not until somebody tries, and a page that
+ * shows one person's triggers looks exactly like one showing every trigger when a deployment has
+ * only ever had one.
+ */
+
+function signedInAs(
+  id: string,
+  role: "user" | "admin",
+): MiddlewareHandler<{ Variables: AppVariables }> {
+  return async (context, next) => {
+    context.set("actor", {
+      id,
+      email: `${id}@openbot.test`,
+      role,
+    });
+    await next();
+  };
+}
+
+/** Only what these routes reach for. A fuller fake would only be more to keep true. */
+function fakeStore() {
+  const created: { name: string; ownerUserId: string }[] = [];
+  const store = {
+    list: async () => [],
+    listTriggers: async () => [
+      { id: "trigger-1", name: "Somebody else's", ownerUserId: "another" },
+    ],
+    get: async (id: string, ownerUserId: string) =>
+      ownerUserId === "owner" ? { id, name: "Overnight alerts" } : null,
+    createTrigger: async (input: { name: string; ownerUserId: string }) => {
+      created.push({ name: input.name, ownerUserId: input.ownerUserId });
+      return {
+        trigger: { id: "trigger-2", name: input.name },
+        secret: "obw_the_only_time_this_exists",
+      };
+    },
+    deleteTrigger: async () => true,
+  } as unknown as RoutineStore;
+  return { store, created };
+}
+
+const json = (body: unknown) => ({
+  method: "POST",
+  headers: { "content-type": "application/json" },
+  body: JSON.stringify(body),
+});
+
+describe("a routine belongs to the person who wrote it", () => {
+  test("an ordinary user reaches their own routines", async () => {
+    const { store } = fakeStore();
+    const routes = createRoutineRoutes(
+      store,
+      undefined,
+      signedInAs("owner", "user"),
+    );
+
+    expect((await routes.request("/")).status).toBe(200);
+  });
+
+  /*
+   * The switch a person meets when a deployment has ROUTINE_SCHEDULER=off. Refusing in words is the
+   * whole reason the routes are mounted without a scheduler: somebody who wrote a routine should be
+   * told this deployment is not running them, rather than pressing a button that reports success.
+   */
+  test("Run now says so when this deployment does not run routines", async () => {
+    const { store } = fakeStore();
+    const routes = createRoutineRoutes(
+      store,
+      undefined,
+      signedInAs("owner", "user"),
+    );
+
+    const response = await routes.request("/routine-1/run", { method: "POST" });
+    expect(response.status).toBe(503);
+    expect(await response.json()).toMatchObject({
+      error:
+        "Routines are switched off in this deployment, so nothing can be run.",
+    });
+  });
+});
+
+describe("a trigger belongs to the deployment", () => {
+  /*
+   * The consequence this prevents: an ordinary user minting a publicly reachable endpoint that sets
+   * a Bot working, through an API whose only page they cannot open, and so having nowhere to see or
+   * revoke it afterwards.
+   */
+  test("a signed-in user who is not an administrator cannot see or make one", async () => {
+    const { store, created } = fakeStore();
+    const routes = createRoutineRoutes(
+      store,
+      undefined,
+      signedInAs("owner", "user"),
+    );
+
+    expect((await routes.request("/triggers")).status).toBe(403);
+    expect(
+      (await routes.request("/triggers", json({ name: "Build finished" })))
+        .status,
+    ).toBe(403);
+    expect(
+      (await routes.request("/triggers/trigger-1", { method: "DELETE" }))
+        .status,
+    ).toBe(403);
+    expect(created).toEqual([]);
+  });
+
+  test("an administrator sees every door, including ones they did not open", async () => {
+    const { store } = fakeStore();
+    const routes = createRoutineRoutes(
+      store,
+      undefined,
+      signedInAs("keeper", "admin"),
+    );
+
+    const response = await routes.request("/triggers");
+    expect(response.status).toBe(200);
+    // Not scoped to the administrator asking. An administrator who could see only their own could
+    // not shut a door somebody else opened, which is the moment somebody needs to.
+    expect(await response.json()).toEqual({
+      triggers: [
+        { id: "trigger-1", name: "Somebody else's", ownerUserId: "another" },
+      ],
+    });
+  });
+
+  test("a trigger may only be pointed at a routine the administrator owns", async () => {
+    const { store, created } = fakeStore();
+    const routes = createRoutineRoutes(
+      store,
+      undefined,
+      signedInAs("keeper", "admin"),
+    );
+
+    // A routine runs with its owner's authority, so wiring somebody else's to a public URL would be
+    // handing out their access without their knowing.
+    const refused = await routes.request(
+      "/triggers",
+      json({ name: "Build finished", routineId: "routine-1" }),
+    );
+    expect(refused.status).toBe(404);
+    expect(created).toEqual([]);
+  });
+
+  test("the secret is in the creation response and nowhere else", async () => {
+    const { store } = fakeStore();
+    const routes = createRoutineRoutes(
+      store,
+      undefined,
+      signedInAs("owner", "admin"),
+    );
+
+    const response = await routes.request(
+      "/triggers",
+      json({ name: "Build finished", routineId: "routine-1" }),
+    );
+    expect(response.status).toBe(201);
+    expect(await response.json()).toMatchObject({
+      secret: "obw_the_only_time_this_exists",
+    });
+  });
+});
diff --git a/server/tests/routine-runner.test.ts b/server/tests/routine-runner.test.ts
new file mode 100644
index 0000000..4ab49ba
--- /dev/null
+++ b/server/tests/routine-runner.test.ts
@@ -0,0 +1,662 @@
+import { describe, expect, test } from "bun:test";
+import type {
+  AbstractAgent,
+  BaseEvent,
+  Message,
+  Observable,
+} from "@ag-ui/client";
+import { EventType } from "@ag-ui/client";
+import { ActionRefusedError } from "../src/computer/gateway";
+import type { ComputerGateway } from "../src/computer/gateway";
+import {
+  createRoutineRunner,
+  RoutineBotUnavailableError,
+  RoutineRunDeadlineError,
+  UNATTENDED_TOOLS,
+} from "../src/routines/runner";
+
+/**
+ * What an unattended run must do, tested as properties rather than as a transcript.
+ *
+ * The four that matter, and none of them are visible from a green typecheck:
+ *  - a tool call reaches the GATEWAY, so the same policy and the same audit row apply to work
+ *    nobody is watching
+ *  - every call carries `unattended`, which is the only thing a rule about routines has to go on
+ *  - a tool the run does not provide is ANSWERED, never silently dropped
+ *  - a run that goes wrong reaches the caller as a failure, not as a summary that reads like success
+ *
+ * The agent is a fake that emits AG-UI events, because every interesting case here is about what the
+ * runner does with what a model asked for, and a real model cannot be made to ask for a tool that
+ * does not exist on demand.
+ */
+
+/**
+ * The observable the runner actually consumes, which is `subscribe` and nothing else.
+ *
+ * Hand-rolled rather than built with rxjs so this file depends on the same package the server does
+ * and no more. Emitting synchronously inside `subscribe` is deliberate: it is the shape that catches
+ * a runner reaching for its own subscription from inside the callback that creates it.
+ */
+function stream(events: BaseEvent[], failure?: Error): Observable<BaseEvent> {
+  return {
+    subscribe(observer: {
+      next?: (event: BaseEvent) => void;
+      error?: (caught: unknown) => void;
+      complete?: () => void;
+    }) {
+      if (failure) {
+        observer.error?.(failure);
+      } else {
+        for (const event of events) observer.next?.(event);
+        observer.complete?.();
+      }
+      return { unsubscribe: () => undefined };
+    },
+  } as unknown as Observable<BaseEvent>;
+}
+
+/**
+ * A stream that takes a while, and can be cancelled.
+ *
+ * Needed for the deadline: a turn that returns instantly can never run out of time, and the shape
+ * being guarded against is one that takes longer than the run has left.
+ */
+function slowStream(
+  events: BaseEvent[],
+  afterMs: number,
+): Observable<BaseEvent> {
+  return {
+    subscribe(observer: {
+      next?: (event: BaseEvent) => void;
+      complete?: () => void;
+    }) {
+      const timer = setTimeout(() => {
+        for (const event of events) observer.next?.(event);
+        observer.complete?.();
+      }, afterMs);
+      return { unsubscribe: () => clearTimeout(timer) };
+    },
+  } as unknown as Observable<BaseEvent>;
+}
+
+/** A scripted model: one array of events per turn, in order. */
+function scriptedAgent(turns: BaseEvent[][]): AbstractAgent {
+  let turn = 0;
+  return {
+    run: () => {
+      const events = turns[turn] ?? [];
+      turn += 1;
+      return stream(events);
+    },
+  } as unknown as AbstractAgent;
+}
+
+/**
+ * A scripted model that also keeps what it was handed.
+ *
+ * The answer to a tool call is not in the run's outcome; it is in the messages the runner passes to
+ * the NEXT turn. Anything asserting about what a model was told has to read it from there.
+ */
+function recordingAgent(turns: BaseEvent[][]) {
+  let turn = 0;
+  const toolMessages: string[][] = [];
+  const agent = {
+    run: (input: { messages: Message[] }) => {
+      toolMessages.push(
+        input.messages
+          .filter((message) => message.role === "tool")
+          .map((message) => (message as { content: string }).content),
+      );
+      const events = turns[turn] ?? [];
+      turn += 1;
+      return stream(events);
+    },
+  } as unknown as AbstractAgent;
+  return { agent, toolMessages };
+}
+
+/**
+ * The split form of a message: START, one or more CONTENT deltas, END.
+ *
+ * See `chunked` below for the other spelling. Both are in the protocol and both are tested, because
+ * which one arrives depends on the agent rather than on anything the runner controls.
+ */
+const says = (delta: string): BaseEvent[] => [
+  { type: EventType.TEXT_MESSAGE_START, messageId: "m1" } as BaseEvent,
+  {
+    type: EventType.TEXT_MESSAGE_CONTENT,
+    messageId: "m1",
+    delta,
+  } as unknown as BaseEvent,
+  { type: EventType.TEXT_MESSAGE_END, messageId: "m1" } as BaseEvent,
+];
+
+/** The chunk form, which is what the built-in Bot actually emits. */
+const chunked = (delta: string): BaseEvent[] => [
+  {
+    type: EventType.TEXT_MESSAGE_CHUNK,
+    role: "assistant",
+    messageId: "m1",
+    delta,
+  } as unknown as BaseEvent,
+];
+
+const calls = (
+  id: string,
+  name: string,
+  args: Record<string, unknown>,
+): BaseEvent[] => [
+  {
+    type: EventType.TOOL_CALL_START,
+    toolCallId: id,
+    toolCallName: name,
+  } as unknown as BaseEvent,
+  {
+    type: EventType.TOOL_CALL_ARGS,
+    toolCallId: id,
+    delta: JSON.stringify(args),
+  } as unknown as BaseEvent,
+  { type: EventType.TOOL_CALL_END, toolCallId: id } as unknown as BaseEvent,
+];
+
+/** A gateway that records what reached it, so "went through the gateway" is checkable. */
+function fakeGateway() {
+  const seen: {
+    method: string;
+    botId: string;
+    unattended: boolean | undefined;
+    input: unknown;
+  }[] = [];
+  const record =
+    (method: string, result: Record<string, unknown>) =>
+    (
+      _computerId: string,
+      botId: string,
+      actor: { unattended?: boolean },
+      input?: unknown,
+    ) => {
+      seen.push({ method, botId, unattended: actor.unattended, input });
+      return Promise.resolve(result);
+    };
+
+  const gateway = {
+    snapshot: (botId: string) => {
+      seen.push({
+        method: "snapshot",
+        botId,
+        unattended: undefined,
+        input: undefined,
+      });
+      return Promise.resolve({
+        snapshotId: 3,
+        url: "https://example.com/",
+        title: "Example",
+        truncated: false,
+        elements: [{ ref: "e1", role: "button", name: "Send" }],
+      });
+    },
+    read: (botId: string) => {
+      seen.push({
+        method: "read",
+        botId,
+        unattended: undefined,
+        input: undefined,
+      });
+      return Promise.resolve({
+        url: "https://example.com/",
+        title: "Example",
+        text: "hello",
+        truncated: false,
+      });
+    },
+    navigate: record("navigate", { url: "https://example.com/", title: "E" }),
+    click: record("click", { action: "click" }),
+    type: record("type", { action: "type" }),
+    key: record("key", { action: "key" }),
+    scroll: record("scroll", { action: "scroll" }),
+    readFile: record("readFile", { path: "notes.md", text: "kept" }),
+    writeFile: record("writeFile", { path: "notes.md", bytes: 4 }),
+    listFiles: record("listFiles", { path: ".", entries: [] }),
+  } as unknown as ComputerGateway;
+  return { gateway, seen };
+}
+
+const REQUEST = {
+  agentId: "risk-analyst",
+  prompt: "Check the overnight alerts.",
+  threadId: "thread-1",
+  actor: { id: "someone", userId: "someone", unattended: true },
+};
+
+describe("running a routine with nobody watching", () => {
+  test("puts the routine's prompt to the Bot and reports what it said", async () => {
+    const { gateway } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () => scriptedAgent([says("Nothing overnight.")]),
+    });
+
+    const outcome = await runner.run(REQUEST);
+    expect(outcome.summary).toBe("Nothing overnight.");
+    expect(outcome.turns).toBe(1);
+    expect(outcome.stoppedAtCap).toBe(false);
+  });
+
+  /*
+   * The failure this prevents is the quietest one there is: a run that completes, is recorded as
+   * successful, and has an empty summary. Nothing anywhere says it went wrong, and the person reads
+   * "it ran and found nothing". Text arrives as a single CHUNK from the built-in Bot and as
+   * START/CONTENT/END from other agents, and reading only one spelling produces exactly that.
+   */
+  test("reads a message that arrives as one chunk, not only as split events", async () => {
+    const { gateway } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () => scriptedAgent([chunked("Nothing overnight.")]),
+    });
+
+    expect((await runner.run(REQUEST)).summary).toBe("Nothing overnight.");
+  });
+
+  test("reads a tool call that arrives as chunks", async () => {
+    const { gateway, seen } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () =>
+        scriptedAgent([
+          [
+            {
+              type: EventType.TOOL_CALL_CHUNK,
+              toolCallId: "t1",
+              toolCallName: "computer_click",
+              delta: '{"ref":"e1",',
+            } as unknown as BaseEvent,
+            // A continuation carrying neither an id nor a name, which is legal and is where the
+            // arguments get truncated if the reducer forgets which call is open.
+            {
+              type: EventType.TOOL_CALL_CHUNK,
+              delta: '"snapshotId":3}',
+            } as unknown as BaseEvent,
+          ],
+          chunked("Pressed it."),
+        ]),
+    });
+
+    await runner.run(REQUEST);
+    expect(seen).toHaveLength(1);
+    expect(seen[0]?.method).toBe("click");
+    expect(seen[0]?.input).toEqual({ ref: "e1", snapshotId: 3 });
+  });
+
+  test("the prompt reaches the model as the person's own message", async () => {
+    const { gateway } = fakeGateway();
+    let firstMessage: Message | undefined;
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () =>
+        ({
+          run: (input: { messages: Message[] }) => {
+            firstMessage = input.messages[0];
+            return stream(says("Done."));
+          },
+        }) as unknown as AbstractAgent,
+    });
+
+    await runner.run(REQUEST);
+    expect(firstMessage?.role).toBe("user");
+    expect((firstMessage as { content: string }).content).toBe(
+      "Check the overnight alerts.",
+    );
+  });
+
+  /*
+   * The whole point of the design. The browser executes these tools so that it can render them; the
+   * decision, the audit row and the action have always happened on the server. An unattended run
+   * therefore does not need a weaker path, and this asserts that it does not have one.
+   */
+  test("every tool call goes through the gateway, marked unattended", async () => {
+    const { gateway, seen } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () =>
+        scriptedAgent([
+          calls("t1", "computer_snapshot", {}),
+          calls("t2", "computer_click", { ref: "e1", snapshotId: 3 }),
+          says("Sent."),
+        ]),
+    });
+
+    await runner.run(REQUEST);
+
+    expect(seen.map((call) => call.method)).toEqual(["snapshot", "click"]);
+    const click = seen[1];
+    expect(click?.botId).toBe("risk-analyst");
+    // The one fact a boundary has to go on. Without it `run.unattended` is always false and a rule
+    // written about routines never matches anything.
+    expect(click?.unattended).toBe(true);
+    expect(click?.input).toEqual({ ref: "e1", snapshotId: 3 });
+  });
+
+  test("the file tools reach the gateway too, not the computer directly", async () => {
+    const { gateway, seen } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () =>
+        scriptedAgent([
+          calls("t1", "computer_write_file", {
+            path: "alerts.md",
+            contents: "nothing",
+          }),
+          says("Written."),
+        ]),
+    });
+
+    await runner.run(REQUEST);
+    expect(seen[0]?.method).toBe("writeFile");
+    expect(seen[0]?.unattended).toBe(true);
+  });
+
+  /*
+   * A refusal has to arrive as words. A Bot told which boundary stopped it can say so and stop; one
+   * handed an empty result tries the same thing another way, which is the behaviour a boundary is
+   * meant to prevent rather than provoke.
+   */
+  test("a refusal comes back to the model with the rule that caused it", async () => {
+    const { gateway } = fakeGateway();
+    const rule = 'run.unattended && intent == "activate"';
+    const refusing = {
+      ...gateway,
+      click: () => {
+        throw new ActionRefusedError(
+          "This deployment's policy does not allow that.",
+          rule,
+        );
+      },
+    } as unknown as ComputerGateway;
+
+    const { agent, toolMessages } = recordingAgent([
+      calls("t1", "computer_click", { ref: "e1", snapshotId: 3 }),
+      says("I was not allowed to press it."),
+    ]);
+    const runner = createRoutineRunner({
+      gateway: refusing,
+      resolveAgent: async () => agent,
+    });
+
+    const outcome = await runner.run(REQUEST);
+    const answer = toolMessages[1]?.[0] ?? "";
+    expect(JSON.parse(answer)).toEqual({
+      ok: false,
+      refused: true,
+      reason: "This deployment's policy does not allow that.",
+      rule,
+    });
+    expect(outcome.summary).toBe("I was not allowed to press it.");
+  });
+
+  test("an ordinary failure is reported without claiming a boundary refused it", async () => {
+    const { gateway } = fakeGateway();
+    const breaking = {
+      ...gateway,
+      navigate: () => {
+        throw new Error("The assistant's computer could not be reached.");
+      },
+    } as unknown as ComputerGateway;
+
+    const { agent, toolMessages } = recordingAgent([
+      calls("t1", "computer_navigate", { url: "https://example.com/" }),
+      says("The page would not open."),
+    ]);
+    const runner = createRoutineRunner({
+      gateway: breaking,
+      resolveAgent: async () => agent,
+    });
+
+    await runner.run(REQUEST);
+    const answer = JSON.parse(toolMessages[1]?.[0] ?? "{}") as {
+      ok: boolean;
+      refused?: boolean;
+      reason: string;
+    };
+    expect(answer.ok).toBe(false);
+    // Not a refusal. Reporting a broken computer as a policy decision sends somebody to edit a rule
+    // that had nothing to do with it.
+    expect(answer.refused).toBeUndefined();
+    expect(answer.reason).toContain("could not be reached");
+  });
+
+  /*
+   * The requirement that is easiest to fail by doing nothing. A tool call that vanishes leaves the
+   * model waiting for a result it will never get, and the usual symptom is a run that repeats itself
+   * until the turn cap stops it.
+   */
+  test("a tool this run does not have is answered, not dropped", async () => {
+    const { gateway, seen } = fakeGateway();
+    const { agent, toolMessages } = recordingAgent([
+      calls("t1", "computer_request_help", { reason: "sign me in" }),
+      says("I could not sign in and nobody was there to help."),
+    ]);
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () => agent,
+    });
+
+    const outcome = await runner.run(REQUEST);
+
+    // Nothing reached the gateway: there is no gateway method for asking a person a question.
+    expect(seen).toEqual([]);
+    const answer = toolMessages[1]?.[0] ?? "";
+    expect(answer).toContain("computer_request_help");
+    expect(answer).toContain("not available in an unattended run");
+    expect(outcome.summary).toBe(
+      "I could not sign in and nobody was there to help.",
+    );
+  });
+
+  test("a Bot the owner cannot run is refused before anything is attempted", async () => {
+    const { gateway, seen } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () => null,
+    });
+
+    await expect(runner.run(REQUEST)).rejects.toBeInstanceOf(
+      RoutineBotUnavailableError,
+    );
+    expect(seen).toEqual([]);
+  });
+
+  /*
+   * A failed model or a broken transport is a failed RUN. It has to reach the caller as an exception
+   * so the run is recorded as failed, rather than being folded into a summary that reads like an
+   * answer and leaves somebody believing the routine worked.
+   */
+  test("a run error is raised rather than summarised", async () => {
+    const { gateway } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () =>
+        scriptedAgent([
+          [
+            {
+              type: EventType.RUN_ERROR,
+              message: "the model is unreachable",
+            } as unknown as BaseEvent,
+          ],
+        ]),
+    });
+
+    await expect(runner.run(REQUEST)).rejects.toThrow(
+      "the model is unreachable",
+    );
+  });
+
+  test("a stream that errors synchronously is a failed run too", async () => {
+    const { gateway } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () =>
+        ({
+          run: () => stream([], new Error("the connection closed")),
+        }) as unknown as AbstractAgent,
+    });
+
+    await expect(runner.run(REQUEST)).rejects.toThrow("the connection closed");
+  });
+
+  /*
+   * The failure the turn cap cannot see: a stream that never completes and never errors. A remote
+   * AG-UI Bot whose connection drops does exactly this, and the promise underneath waits on
+   * `complete` or `error`, so without a deadline the run waits forever. Forever is not a figure of
+   * speech here — the run row stays `running`, holds the one-live-run index, and the routine never
+   * fires again from the clock, from Run now or from a delivery.
+   */
+  test("a stream that never settles ends the run rather than hanging on it", async () => {
+    const { gateway } = fakeGateway();
+    let unsubscribed = false;
+    const runner = createRoutineRunner({
+      gateway,
+      deadlineMs: 20,
+      resolveAgent: async () =>
+        ({
+          run: () =>
+            ({
+              subscribe: () => ({
+                unsubscribe: () => {
+                  unsubscribed = true;
+                },
+              }),
+            }) as unknown as Observable<BaseEvent>,
+        }) as unknown as AbstractAgent,
+    });
+
+    await expect(runner.run(REQUEST)).rejects.toThrow(RoutineRunDeadlineError);
+    // And the stream is dropped rather than left running: an agent still emitting into a turn
+    // nobody is waiting for is an agent still spending somebody's model budget.
+    expect(unsubscribed).toBe(true);
+  });
+
+  /*
+   * One deadline for the whole run, not one per turn. Twenty turns of fourteen minutes each would
+   * otherwise add up to nearly five hours with every individual turn looking well behaved.
+   */
+  test("the deadline covers the whole run, not each turn", async () => {
+    const { gateway, seen } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      deadlineMs: 60,
+      // Twenty turns are allowed, so nothing here is stopped by the cap.
+      maxTurns: 20,
+      resolveAgent: async () =>
+        ({
+          run: () => slowStream(calls("t1", "computer_snapshot", {}), 20),
+        }) as unknown as AbstractAgent,
+    });
+
+    await expect(runner.run(REQUEST)).rejects.toThrow(RoutineRunDeadlineError);
+    // A handful of turns, each of them perfectly well behaved on its own.
+    expect(seen.length).toBeLessThan(20);
+  });
+
+  /*
+   * A model that keeps re-snapshotting a page that never changes will do it as fast as the computer
+   * answers. The cap turns that from a night into a few minutes, and it has to be visible in the
+   * summary or the run history claims the routine finished.
+   */
+  test("stops at the turn cap and says so", async () => {
+    const { gateway, seen } = fakeGateway();
+    const runner = createRoutineRunner({
+      gateway,
+      maxTurns: 3,
+      resolveAgent: async () =>
+        ({
+          run: () => stream(calls("t1", "computer_snapshot", {})),
+        }) as unknown as AbstractAgent,
+    });
+
+    const outcome = await runner.run(REQUEST);
+    expect(outcome.stoppedAtCap).toBe(true);
+    expect(outcome.turns).toBe(3);
+    expect(outcome.summary).toContain("stopped after 3 turns");
+    expect(seen).toHaveLength(3);
+  });
+
+  test("arguments that are not JSON are refused rather than guessed at", async () => {
+    const { gateway, seen } = fakeGateway();
+    const { agent, toolMessages } = recordingAgent([
+      [
+        {
+          type: EventType.TOOL_CALL_START,
+          toolCallId: "t1",
+          toolCallName: "computer_navigate",
+        } as unknown as BaseEvent,
+        {
+          type: EventType.TOOL_CALL_ARGS,
+          toolCallId: "t1",
+          delta: "{not json",
+        } as unknown as BaseEvent,
+      ],
+      says("I could not read my own request."),
+    ]);
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () => agent,
+    });
+
+    await runner.run(REQUEST);
+    expect(seen).toEqual([]);
+    expect(toolMessages[1]?.[0] ?? "").toContain("not valid JSON");
+  });
+
+  test("a click without a snapshotId is answered rather than attempted", async () => {
+    const { gateway, seen } = fakeGateway();
+    const { agent, toolMessages } = recordingAgent([
+      calls("t1", "computer_click", { ref: "e1" }),
+      says("I need to take a snapshot first."),
+    ]);
+    const runner = createRoutineRunner({
+      gateway,
+      resolveAgent: async () => agent,
+    });
+
+    await runner.run(REQUEST);
+    expect(seen).toEqual([]);
+    expect(toolMessages[1]?.[0] ?? "").toContain("Take a snapshot first");
+  });
+});
+
+describe("the tools an unattended run offers", () => {
+  /*
+   * These three are all requests for a person, and there is no person. Offering them would produce a
+   * run that waits ten minutes for an answer nobody will give, which is the difference between a
+   * routine that finishes and one that hangs until its cap.
+   */
+  test.each([
+    "computer_request_help",
+    "computer_request_secret",
+    "report_refusal",
+  ])("does not offer %s", (name) => {
+    expect(UNATTENDED_TOOLS.map((tool) => tool.name)).not.toContain(name);
+  });
+
+  test("offers every tool that maps onto a gateway method", () => {
+    expect(UNATTENDED_TOOLS.map((tool) => tool.name).sort()).toEqual([
+      "computer_click",
+      "computer_key",
+      "computer_list_files",
+      "computer_navigate",
+      "computer_read",
+      "computer_read_file",
+      "computer_scroll",
+      "computer_snapshot",
+      "computer_type",
+      "computer_write_file",
+    ]);
+  });
+
+  test("every tool describes itself, because the model has nothing else to go on", () => {
+    for (const tool of UNATTENDED_TOOLS) {
+      expect(tool.description.length).toBeGreaterThan(40);
+    }
+  });
+});
diff --git a/server/tests/routine-schedule.test.ts b/server/tests/routine-schedule.test.ts
new file mode 100644
index 0000000..84efbae
--- /dev/null
+++ b/server/tests/routine-schedule.test.ts
@@ -0,0 +1,423 @@
+import { describe, expect, test } from "bun:test";
+import {
+  DEFAULT_GRACE_MS,
+  decideScheduleAction,
+  describeSchedule,
+  lastOccurrenceOnOrBefore,
+  nextDueAt,
+  nextOccurrenceAfter,
+  parseRoutineSchedule,
+  type RoutineSchedule,
+} from "../src/routines/schedule";
+
+/**
+ * The arithmetic, which is where the mistakes live.
+ *
+ * Every case here is one a deployment actually meets, and several of them have an obvious answer
+ * that is wrong. A daily time that has already passed today must not fire again today. A weekday set
+ * that excludes today must skip to the next day it does include, across the end of the week. A
+ * machine that was asleep must record the window rather than run it four hours late. None of these
+ * can be seen from a green typecheck, and none of them would be caught by a test that only checked
+ * that a schedule at nine o'clock fires at nine o'clock.
+ *
+ * The clock is an argument everywhere, so the eight o'clock that fell on a Sunday is a line of test
+ * rather than something to wait for.
+ */
+
+/**
+ * Thursday, 13 August 2026, midnight UTC.
+ *
+ * A real date rather than a relative one, so a reader can check the weekday arithmetic by eye and a
+ * failing test means the arithmetic changed rather than that the week did.
+ */
+const THURSDAY = "2026-08-13T00:00:00.000Z";
+const at = (iso: string) => new Date(iso);
+
+const weekdaysAtEight: RoutineSchedule = {
+  type: "daily",
+  time: "08:00",
+  weekdays: [1, 2, 3, 4, 5],
+};
+
+describe("reading a schedule", () => {
+  test("accepts a once and normalises the instant", () => {
+    expect(
+      parseRoutineSchedule({ type: "once", at: "2026-08-13T08:00:00Z" }),
+    ).toEqual({ type: "once", at: "2026-08-13T08:00:00.000Z" });
+  });
+
+  test("accepts a daily and sorts and de-duplicates its days", () => {
+    expect(
+      parseRoutineSchedule({
+        type: "daily",
+        time: "08:00",
+        weekdays: [5, 1, 1, 3],
+      }),
+    ).toEqual({ type: "daily", time: "08:00", weekdays: [1, 3, 5] });
+  });
+
+  test("an empty weekday set is legal, and means never", () => {
+    const schedule = parseRoutineSchedule({
+      type: "daily",
+      time: "08:00",
+      weekdays: [],
+    });
+    expect(schedule).toEqual({ type: "daily", time: "08:00", weekdays: [] });
+    // A form with nothing ticked must not quietly mean every day. Nothing ticked means nothing runs.
+    expect(
+      nextOccurrenceAfter(schedule as RoutineSchedule, at(THURSDAY)),
+    ).toBeNull();
+  });
+
+  /*
+   * Every one of these is refused rather than repaired. A schedule decides when a Bot acts on
+   * somebody's live systems, and accepting a value in a shape other than the one it was written in
+   * is the single behaviour that must never happen here.
+   */
+  test.each([
+    ["a time with no minutes", { type: "daily", time: "08", weekdays: [1] }],
+    ["a 24th hour", { type: "daily", time: "24:00", weekdays: [1] }],
+    ["a 60th minute", { type: "daily", time: "08:60", weekdays: [1] }],
+    ["a weekday out of range", { type: "daily", time: "08:00", weekdays: [7] }],
+    ["a fractional weekday", { type: "daily", time: "08:00", weekdays: [1.5] }],
+    [
+      "weekdays that are not a list",
+      { type: "daily", time: "08:00", weekdays: 1 },
+    ],
+    ["an unparseable instant", { type: "once", at: "next Tuesday" }],
+    ["a type nobody implements", { type: "hourly", minute: 0 }],
+    ["nothing at all", null],
+    ["a list", [{ type: "once", at: THURSDAY }]],
+  ])("refuses %s", (_label, value) => {
+    expect(parseRoutineSchedule(value)).toBeNull();
+  });
+});
+
+describe("a daily schedule on weekdays", () => {
+  test("the next occurrence after Thursday midnight is Thursday morning", () => {
+    expect(
+      nextOccurrenceAfter(weekdaysAtEight, at(THURSDAY))?.toISOString(),
+    ).toBe("2026-08-13T08:00:00.000Z");
+  });
+
+  test("a time that has already passed today goes to tomorrow, not round again", () => {
+    // The obvious wrong answer is today's eight o'clock, which is behind us.
+    expect(
+      nextOccurrenceAfter(
+        weekdaysAtEight,
+        at("2026-08-13T09:00:00.000Z"),
+      )?.toISOString(),
+    ).toBe("2026-08-14T08:00:00.000Z");
+  });
+
+  test("asked at exactly the hour, the next one is tomorrow", () => {
+    expect(
+      nextOccurrenceAfter(
+        weekdaysAtEight,
+        at("2026-08-13T08:00:00.000Z"),
+      )?.toISOString(),
+    ).toBe("2026-08-14T08:00:00.000Z");
+  });
+
+  test("Friday evening skips the weekend and lands on Monday", () => {
+    expect(
+      nextOccurrenceAfter(
+        weekdaysAtEight,
+        at("2026-08-14T20:00:00.000Z"),
+      )?.toISOString(),
+    ).toBe("2026-08-17T08:00:00.000Z");
+  });
+
+  test("the most recent window on a Sunday is the Friday before it", () => {
+    expect(
+      lastOccurrenceOnOrBefore(
+        weekdaysAtEight,
+        at("2026-08-16T12:00:00.000Z"),
+      )?.toISOString(),
+    ).toBe("2026-08-14T08:00:00.000Z");
+  });
+
+  test("before the first hour of the day, the most recent window is yesterday's", () => {
+    expect(
+      lastOccurrenceOnOrBefore(
+        weekdaysAtEight,
+        at("2026-08-13T07:59:00.000Z"),
+      )?.toISOString(),
+    ).toBe("2026-08-12T08:00:00.000Z");
+  });
+
+  test("a Sunday-only schedule crosses the week boundary in both directions", () => {
+    const sundays: RoutineSchedule = {
+      type: "daily",
+      time: "23:30",
+      weekdays: [0],
+    };
+    expect(
+      nextOccurrenceAfter(
+        sundays,
+        at("2026-08-17T00:00:00.000Z"),
+      )?.toISOString(),
+    ).toBe("2026-08-23T23:30:00.000Z");
+    expect(
+      lastOccurrenceOnOrBefore(
+        sundays,
+        at("2026-08-17T00:00:00.000Z"),
+      )?.toISOString(),
+    ).toBe("2026-08-16T23:30:00.000Z");
+  });
+
+  test("crossing the end of a month is ordinary", () => {
+    expect(
+      nextOccurrenceAfter(
+        { type: "daily", time: "06:15", weekdays: [0, 1, 2, 3, 4, 5, 6] },
+        at("2026-08-31T23:00:00.000Z"),
+      )?.toISOString(),
+    ).toBe("2026-09-01T06:15:00.000Z");
+  });
+});
+
+describe("deciding what to do about a daily routine", () => {
+  test("runs it when the window has just opened and nobody has taken it", () => {
+    expect(
+      decideScheduleAction(weekdaysAtEight, {
+        now: at("2026-08-13T08:00:30.000Z"),
+        lastRunAt: null,
+      }),
+    ).toEqual({ action: "run", dueAt: at("2026-08-13T08:00:00.000Z") });
+  });
+
+  test("does not run it twice when a run already covers the window", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: at("2026-08-13T08:03:00.000Z"),
+      lastRunAt: at("2026-08-13T08:00:10.000Z"),
+    });
+    expect(decision.action).toBe("wait");
+  });
+
+  /*
+   * A person who pressed Run now at two minutes to eight does not want it again at eight. Manual
+   * runs are not a separate history for exactly this reason: a run is a run, and the routine has
+   * just done its work.
+   */
+  test("a manual run just before the window takes the window with it", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: at("2026-08-13T08:01:00.000Z"),
+      lastRunAt: at("2026-08-13T08:00:30.000Z"),
+    });
+    expect(decision.action).toBe("wait");
+  });
+
+  test("a run from before the window does not count as having taken it", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: at("2026-08-13T08:01:00.000Z"),
+      lastRunAt: at("2026-08-12T08:00:10.000Z"),
+    });
+    expect(decision.action).toBe("run");
+  });
+
+  test("a window older than the grace period is missed, not run late", () => {
+    // The laptop was shut at eight and opened at noon. Firing now would send the overnight summary
+    // at lunchtime, and saying nothing would leave the person unable to tell that from a quiet night.
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: at("2026-08-13T12:00:00.000Z"),
+      lastRunAt: null,
+    });
+    expect(decision).toEqual({
+      action: "missed",
+      dueAt: at("2026-08-13T08:00:00.000Z"),
+    });
+  });
+
+  test("the grace period's own edge runs rather than misses", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: new Date(
+        at("2026-08-13T08:00:00.000Z").getTime() + DEFAULT_GRACE_MS,
+      ),
+      lastRunAt: null,
+    });
+    expect(decision.action).toBe("run");
+  });
+
+  test("one millisecond past it misses", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: new Date(
+        at("2026-08-13T08:00:00.000Z").getTime() + DEFAULT_GRACE_MS + 1,
+      ),
+      lastRunAt: null,
+    });
+    expect(decision.action).toBe("missed");
+  });
+
+  /*
+   * Recording a miss stamps the run with the window's own time, so this is what the next tick sees.
+   * Without that, the same window would be recorded as missed once a minute until the next one came
+   * round, and the history would be four hundred identical rows.
+   */
+  test("a recorded miss stops the same window being recorded again", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: at("2026-08-13T12:01:00.000Z"),
+      lastRunAt: at("2026-08-13T08:00:00.000Z"),
+    });
+    expect(decision.action).toBe("wait");
+  });
+
+  test("waits on a Sunday, when the last window is Friday's and was taken", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: at("2026-08-16T09:00:00.000Z"),
+      lastRunAt: at("2026-08-14T08:00:05.000Z"),
+    });
+    expect(decision).toEqual({
+      action: "wait",
+      nextDueAt: at("2026-08-17T08:00:00.000Z"),
+    });
+  });
+
+  /*
+   * The most ordinary path there is: somebody writes "overnight alerts, eight o'clock, weekdays" at
+   * three in the afternoon. The most recent window is seven hours old and has never been run, which
+   * without the routine's own age reads as a window the deployment slept through — and within a
+   * minute they are looking at a run history saying nothing was running, about a machine that was
+   * running perfectly well.
+   */
+  test("a window older than the routine is neither run nor recorded as missed", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: at("2026-08-13T15:00:30.000Z"),
+      lastRunAt: null,
+      createdAt: at("2026-08-13T15:00:00.000Z"),
+    });
+    expect(decision).toEqual({
+      action: "wait",
+      nextDueAt: at("2026-08-14T08:00:00.000Z"),
+    });
+  });
+
+  /*
+   * The other side of it. A routine that existed at eight and did not run is a routine whose window
+   * this deployment genuinely slept through, and that has to keep being recorded or the distinction
+   * the whole run history rests on is worth nothing.
+   */
+  test("a window after the routine was written is still recorded as missed", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: at("2026-08-13T15:00:30.000Z"),
+      lastRunAt: null,
+      createdAt: at("2026-08-01T09:00:00.000Z"),
+    });
+    expect(decision).toEqual({
+      action: "missed",
+      dueAt: at("2026-08-13T08:00:00.000Z"),
+    });
+  });
+
+  /*
+   * Inside the grace period it still runs, whatever its age. Somebody writing that schedule at three
+   * minutes past eight has just said what they want, and would be puzzled to wait a day for it.
+   */
+  test("a window inside the grace period runs even for a routine written after it", () => {
+    const decision = decideScheduleAction(weekdaysAtEight, {
+      now: at("2026-08-13T08:03:00.000Z"),
+      lastRunAt: null,
+      createdAt: at("2026-08-13T08:02:00.000Z"),
+    });
+    expect(decision).toEqual({
+      action: "run",
+      dueAt: at("2026-08-13T08:00:00.000Z"),
+    });
+  });
+
+  test("a schedule with no days never runs and never misses", () => {
+    const decision = decideScheduleAction(
+      { type: "daily", time: "08:00", weekdays: [] },
+      { now: at("2026-08-13T23:00:00.000Z"), lastRunAt: null },
+    );
+    expect(decision).toEqual({ action: "wait", nextDueAt: null });
+  });
+});
+
+describe("a once schedule", () => {
+  const once: RoutineSchedule = {
+    type: "once",
+    at: "2026-08-13T08:00:00.000Z",
+  };
+
+  test("waits while its moment is still ahead", () => {
+    expect(
+      decideScheduleAction(once, {
+        now: at("2026-08-12T08:00:00.000Z"),
+        lastRunAt: null,
+      }),
+    ).toEqual({ action: "wait", nextDueAt: at("2026-08-13T08:00:00.000Z") });
+  });
+
+  test("runs when its moment arrives", () => {
+    expect(
+      decideScheduleAction(once, {
+        now: at("2026-08-13T08:00:00.000Z"),
+        lastRunAt: null,
+      }).action,
+    ).toBe("run");
+  });
+
+  test("is missed rather than fired late when nothing was running for it", () => {
+    expect(
+      decideScheduleAction(once, {
+        now: at("2026-08-14T08:00:00.000Z"),
+        lastRunAt: null,
+      }),
+    ).toEqual({ action: "missed", dueAt: at("2026-08-13T08:00:00.000Z") });
+  });
+
+  /*
+   * The one that would be easy to get wrong. A `once` that has fired is finished, and a decision
+   * function that only compared times would fire it again on every tick for the rest of the
+   * deployment's life.
+   */
+  test("never runs a second time once it has run", () => {
+    expect(
+      decideScheduleAction(once, {
+        now: at("2026-09-01T08:00:00.000Z"),
+        lastRunAt: at("2026-08-13T08:00:01.000Z"),
+      }),
+    ).toEqual({ action: "wait", nextDueAt: null });
+  });
+
+  test("an overdue once still says when it was expected", () => {
+    // Null here would render as "nothing scheduled", which is exactly wrong for a routine that was
+    // set for this morning and did not happen.
+    expect(
+      nextDueAt(once, {
+        now: at("2026-08-14T08:00:00.000Z"),
+        lastRunAt: null,
+      })?.toISOString(),
+    ).toBe("2026-08-13T08:00:00.000Z");
+  });
+});
+
+describe("how a schedule reads", () => {
+  test("names the days when only some are chosen", () => {
+    expect(describeSchedule(weekdaysAtEight)).toBe(
+      "Monday, Tuesday, Wednesday, Thursday, Friday at 08:00 UTC",
+    );
+  });
+
+  test("says every day rather than listing seven", () => {
+    expect(
+      describeSchedule({
+        type: "daily",
+        time: "06:15",
+        weekdays: [0, 1, 2, 3, 4, 5, 6],
+      }),
+    ).toBe("Every day at 06:15 UTC");
+  });
+
+  test("admits when nothing is selected", () => {
+    expect(
+      describeSchedule({ type: "daily", time: "08:00", weekdays: [] }),
+    ).toBe("Never, no days are selected");
+  });
+
+  test("every description says UTC, because the arithmetic is", () => {
+    expect(
+      describeSchedule({ type: "once", at: "2026-08-13T08:00:00.000Z" }),
+    ).toContain("UTC");
+  });
+});
diff --git a/server/tests/routine-scheduler.test.ts b/server/tests/routine-scheduler.test.ts
new file mode 100644
index 0000000..3b785bc
--- /dev/null
+++ b/server/tests/routine-scheduler.test.ts
@@ -0,0 +1,519 @@
+import { describe, expect, test } from "bun:test";
+import type { RoutineRunner } from "../src/routines/runner";
+import { createScheduler } from "../src/routines/scheduler";
+import type {
+  DueCandidate,
+  RoutineRunRecord,
+  RoutineStore,
+} from "../src/routines/store";
+
+/**
+ * What the tick has to get right, with the clock as an argument.
+ *
+ * The store is faked, but the ONE thing it does not fake is the claim: `startRun` here refuses a
+ * second live run exactly as the unique index does, because every property below depends on that
+ * being the shape the scheduler is written against. A scheduler that assumed claims always succeed
+ * would pass a test with a permissive fake and start two runs in production.
+ *
+ * Errors are the other half. A routine whose Bot cannot be resolved, a run that throws, a database
+ * blip: none of them may stop the loop, because an unhandled rejection inside an interval takes the
+ * whole deployment's schedule down for the life of the process.
+ */
+
+const weekdaysAtEight = {
+  type: "daily" as const,
+  time: "08:00",
+  weekdays: [1, 2, 3, 4, 5],
+};
+
+/** Thursday. See routine-schedule.test.ts, which owns the weekday arithmetic. */
+const EIGHT = new Date("2026-08-13T08:00:20.000Z");
+const NOON = new Date("2026-08-13T12:00:00.000Z");
+
+function fakeStore(candidates: DueCandidate[]) {
+  const started: { routineId: string; trigger: string }[] = [];
+  const finished: { runId: string; status: string; error?: string }[] = [];
+  const missed: { routineId: string; dueAt: Date }[] = [];
+  const reaped: { startedBefore: Date }[] = [];
+  /** Which routines currently hold a live run, which is what the unique index really enforces. */
+  const live = new Set<string>();
+  let runNumber = 0;
+
+  const store = {
+    dueCandidates: async () => candidates,
+    candidate: async (id: string) =>
+      candidates.find((entry) => entry.id === id) ?? null,
+    startRun: async (input: { routineId: string; trigger: string }) => {
+      if (live.has(input.routineId)) return null;
+      live.add(input.routineId);
+      runNumber += 1;
+      started.push({ routineId: input.routineId, trigger: input.trigger });
+      return { id: `run-${runNumber}` } as RoutineRunRecord;
+    },
+    finishRun: async (input: {
+      runId: string;
+      routineId: string;
+      status: string;
+      error?: string;
+    }) => {
+      live.delete(input.routineId);
+      finished.push({
+        runId: input.runId,
+        status: input.status,
+        ...(input.error ? { error: input.error } : {}),
+      });
+    },
+    recordMissed: async (input: { routineId: string; dueAt: Date }) => {
+      missed.push({ routineId: input.routineId, dueAt: input.dueAt });
+    },
+    reapStaleRuns: async (input: { startedBefore: Date }) => {
+      reaped.push({ startedBefore: input.startedBefore });
+      return 0;
+    },
+  } as unknown as RoutineStore;
+
+  return { store, started, finished, missed, reaped, live };
+}
+
+const routine = (overrides: Partial<DueCandidate> = {}): DueCandidate => ({
+  id: "routine-1",
+  agentId: "risk-analyst",
+  ownerUserId: "someone",
+  name: "Overnight alerts",
+  prompt: "Check the overnight alerts.",
+  schedule: weekdaysAtEight,
+  // Long before any window these tests ask about, so the routine existed for all of them. The one
+  // test that cares about creation time sets its own.
+  createdAt: new Date("2026-07-01T00:00:00.000Z"),
+  lastRunAt: null,
+  activeRun: false,
+  ...overrides,
+});
+
+/** A runner whose completion the test decides, so an in-flight run can actually be in flight. */
+function heldRunner() {
+  let release: (() => void) | undefined;
+  const runner: RoutineRunner = {
+    run: () =>
+      new Promise((resolve) => {
+        release = () =>
+          resolve({ summary: "Done.", turns: 1, stoppedAtCap: false });
+      }),
+  };
+  return { runner, release: () => release?.() };
+}
+
+/** Let the fire-and-forget run settle. The tick deliberately does not await it; see scheduler.ts. */
+const settle = async () => {
+  for (let turn = 0; turn < 5; turn += 1) await Promise.resolve();
+};
+
+describe("the tick", () => {
+  test("starts a run when the window has just opened", async () => {
+    const { store, started } = fakeStore([routine()]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => ({ summary: "Done.", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    await scheduler.tick(EIGHT);
+    await settle();
+
+    expect(started).toEqual([{ routineId: "routine-1", trigger: "schedule" }]);
+  });
+
+  test("records a window nobody was awake for rather than running it four hours late", async () => {
+    const { store, started, missed } = fakeStore([routine()]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => ({ summary: "", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    await scheduler.tick(NOON);
+    await settle();
+
+    expect(started).toEqual([]);
+    expect(missed).toEqual([
+      { routineId: "routine-1", dueAt: new Date("2026-08-13T08:00:00.000Z") },
+    ]);
+  });
+
+  /*
+   * The window before the routine existed. A person writing "every weekday at eight" at three in the
+   * afternoon is the most ordinary path there is, and within a minute the old behaviour told them
+   * the deployment had not been running at eight, which is false and is the one thing a missed row
+   * has to be trusted about.
+   */
+  test("does not record a miss for a window that predates the routine", async () => {
+    const { store, started, missed } = fakeStore([
+      routine({ createdAt: new Date("2026-08-13T15:00:00.000Z") }),
+    ]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => ({ summary: "", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    await scheduler.tick(new Date("2026-08-13T15:00:30.000Z"));
+    await settle();
+
+    expect(missed).toEqual([]);
+    expect(started).toEqual([]);
+  });
+
+  /*
+   * A process killed mid-run leaves a row that says `running` and nothing that will ever finish it.
+   * The row holds the one-live-run index, so the routine never fires again by any route, and the
+   * only cure in the product without this is deleting the routine and its whole history.
+   */
+  test("closes out runs left behind by a process that stopped, before deciding anything else", async () => {
+    const { store, reaped } = fakeStore([routine()]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => ({ summary: "", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+      staleRunMs: 60_000,
+    });
+
+    await scheduler.tick(EIGHT);
+    await settle();
+
+    expect(reaped).toEqual([
+      { startedBefore: new Date(EIGHT.getTime() - 60_000) },
+    ]);
+  });
+
+  /*
+   * A run that takes longer than a minute is ordinary, and the tick that lands while it is going
+   * must not start a second. Two emails sent is the failure this prevents.
+   */
+  test("does not start a second run while one is still going", async () => {
+    const held = heldRunner();
+    const { store, started } = fakeStore([routine()]);
+    const scheduler = createScheduler({
+      store,
+      runner: held.runner,
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    await scheduler.tick(EIGHT);
+    await settle();
+    await scheduler.tick(new Date("2026-08-13T08:01:20.000Z"));
+    await settle();
+
+    expect(started).toHaveLength(1);
+    held.release();
+    await settle();
+  });
+
+  test("a routine the store already reports as running is skipped before the claim", async () => {
+    const { store, started } = fakeStore([routine({ activeRun: true })]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => ({ summary: "", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    await scheduler.tick(EIGHT);
+    await settle();
+    expect(started).toEqual([]);
+  });
+
+  /*
+   * A schedule nothing can read is left alone rather than guessed at. The routine stays visible so
+   * its owner can fix or delete it, and nothing fires meanwhile.
+   */
+  test("a routine with an unreadable schedule is skipped, loudly and without firing", async () => {
+    const logged: Record<string, unknown>[] = [];
+    const { store, started, missed } = fakeStore([routine({ schedule: null })]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => ({ summary: "", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+      log: (entry) => logged.push(entry),
+    });
+
+    await scheduler.tick(EIGHT);
+    await settle();
+
+    expect(started).toEqual([]);
+    expect(missed).toEqual([]);
+    expect(logged[0]?.type).toBe("routine-schedule-unreadable");
+  });
+
+  test("a run that throws is recorded as failed rather than left running forever", async () => {
+    const logged: Record<string, unknown>[] = [];
+    const { store, finished, live } = fakeStore([routine()]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => {
+          throw new Error("that Bot has been deleted");
+        },
+      },
+      threadIdFor: (id) => `thread-${id}`,
+      log: (entry) => logged.push(entry),
+    });
+
+    await scheduler.tick(EIGHT);
+    await settle();
+
+    expect(finished).toEqual([
+      { runId: "run-1", status: "failed", error: "that Bot has been deleted" },
+    ]);
+    // A run stuck in `running` holds the one-at-a-time claim and the routine never fires again, so
+    // writing the failure matters even when it is the second thing to have gone wrong.
+    expect(live.size).toBe(0);
+    expect(logged[0]?.type).toBe("routine-run-failed");
+  });
+
+  /*
+   * A person deleting a routine has asked for it to be gone. The finishing write finds nothing, and
+   * that must not become an unhandled rejection that takes the schedule down with it.
+   */
+  test("survives the routine being deleted while its run is in flight", async () => {
+    const logged: Record<string, unknown>[] = [];
+    const { store } = fakeStore([routine()]);
+    const deleting = {
+      ...store,
+      finishRun: async () => {
+        throw new Error("the routine no longer exists");
+      },
+    } as unknown as RoutineStore;
+    const scheduler = createScheduler({
+      store: deleting,
+      runner: {
+        run: async () => {
+          throw new Error("the routine no longer exists");
+        },
+      },
+      threadIdFor: (id) => `thread-${id}`,
+      log: (entry) => logged.push(entry),
+    });
+
+    await scheduler.tick(EIGHT);
+    await settle();
+
+    expect(logged.map((entry) => entry.type)).toContain(
+      "routine-run-not-recorded",
+    );
+  });
+
+  test("a store that cannot be reached ends the pass, not the loop", async () => {
+    const logged: Record<string, unknown>[] = [];
+    const scheduler = createScheduler({
+      store: {
+        dueCandidates: async () => {
+          throw new Error("the database is unreachable");
+        },
+      } as unknown as RoutineStore,
+      runner: {
+        run: async () => ({ summary: "", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+      log: (entry) => logged.push(entry),
+    });
+
+    // No rejection reaches the caller: an interval that rejects takes the whole schedule with it.
+    await scheduler.tick(EIGHT);
+    expect(logged[0]?.type).toBe("routine-tick-failed");
+
+    // And the next pass still works, which is the property that matters.
+    await scheduler.tick(EIGHT);
+    expect(logged).toHaveLength(2);
+  });
+});
+
+describe("running one on somebody's say-so", () => {
+  test("records the trigger as manual, not as the clock", async () => {
+    const { store, started } = fakeStore([routine()]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => ({ summary: "Done.", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    expect(await scheduler.runNow("routine-1", { id: "someone" })).toBe(
+      "started",
+    );
+    await settle();
+    expect(started).toEqual([{ routineId: "routine-1", trigger: "manual" }]);
+  });
+
+  test("says busy rather than starting a second run", async () => {
+    const held = heldRunner();
+    const { store } = fakeStore([routine()]);
+    const scheduler = createScheduler({
+      store,
+      runner: held.runner,
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    expect(await scheduler.runNow("routine-1", { id: "someone" })).toBe(
+      "started",
+    );
+    await settle();
+    // Pressing the button twice is ordinary, and is not an error. It is also not two runs.
+    expect(await scheduler.runNow("routine-1", { id: "someone" })).toBe("busy");
+
+    held.release();
+    await settle();
+  });
+
+  test("says so when the routine has gone", async () => {
+    const { store } = fakeStore([]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => ({ summary: "", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    expect(await scheduler.runNow("routine-9", { id: "someone" })).toBe(
+      "unknown",
+    );
+  });
+});
+
+describe("running what a delivery asked for", () => {
+  test("puts the delivery underneath the routine's own prompt", async () => {
+    let seen = "";
+    const { store, started } = fakeStore([routine()]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async (request) => {
+          seen = request.prompt;
+          return { summary: "Done.", turns: 1, stoppedAtCap: false };
+        },
+      },
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    const started_ = await scheduler.runFromWebhook({
+      triggerId: "trigger-1",
+      routineId: "routine-1",
+      agentId: null,
+      prompt: null,
+      ownerUserId: "someone",
+      body: { branch: "main" },
+      eventType: "build.finished",
+    });
+    await settle();
+
+    expect(started_).toBe(true);
+    expect(started).toEqual([{ routineId: "routine-1", trigger: "webhook" }]);
+    expect(seen.startsWith("Check the overnight alerts.")).toBe(true);
+    expect(seen).toContain("build.finished");
+    expect(seen).toContain('"branch": "main"');
+  });
+
+  test("a trigger carrying its own prompt runs it without a routine", async () => {
+    let seen = "";
+    const { store, started } = fakeStore([]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async (request) => {
+          seen = request.prompt;
+          return { summary: "Done.", turns: 1, stoppedAtCap: false };
+        },
+      },
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    expect(
+      await scheduler.runFromWebhook({
+        triggerId: "trigger-1",
+        routineId: null,
+        agentId: "risk-analyst",
+        prompt: "Tell me what broke.",
+        ownerUserId: "someone",
+        body: { branch: "main" },
+        eventType: null,
+      }),
+    ).toBe(true);
+    await settle();
+
+    // No routine, so no run row: these deliveries live in the audit trail rather than in the run
+    // history. Stated here as much as in the code, because it is the cost of the shape.
+    expect(started).toEqual([]);
+    expect(seen.startsWith("Tell me what broke.")).toBe(true);
+  });
+
+  /*
+   * The routine-backed path is serialised by a unique index on a row. A prompt-carrying trigger has
+   * no row, so without something holding it, whoever has the secret can start one unattended agent
+   * run per delivery by posting in a loop.
+   */
+  test("a second delivery to a prompt-carrying trigger, while the first is still going, starts nothing", async () => {
+    const held = heldRunner();
+    const { store } = fakeStore([]);
+    const scheduler = createScheduler({
+      store,
+      runner: held.runner,
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    const delivery = {
+      triggerId: "trigger-1",
+      routineId: null,
+      agentId: "risk-analyst",
+      prompt: "Tell me what broke.",
+      ownerUserId: "someone",
+      body: {},
+      eventType: null,
+    };
+
+    expect(await scheduler.runFromWebhook(delivery)).toBe(true);
+    await settle();
+    expect(await scheduler.runFromWebhook(delivery)).toBe(false);
+
+    // And released when the run ends, so the trigger is not busy for the life of the process.
+    held.release();
+    await settle();
+    expect(await scheduler.runFromWebhook(delivery)).toBe(true);
+    held.release();
+    await settle();
+  });
+
+  test("a delivery for a routine that has gone starts nothing", async () => {
+    const { store } = fakeStore([]);
+    const scheduler = createScheduler({
+      store,
+      runner: {
+        run: async () => ({ summary: "", turns: 1, stoppedAtCap: false }),
+      },
+      threadIdFor: (id) => `thread-${id}`,
+    });
+
+    expect(
+      await scheduler.runFromWebhook({
+        triggerId: "trigger-1",
+        routineId: "routine-9",
+        agentId: null,
+        prompt: null,
+        ownerUserId: "someone",
+        body: {},
+        eventType: null,
+      }),
+    ).toBe(false);
+  });
+});
diff --git a/server/tests/routine-store.integration.test.ts b/server/tests/routine-store.integration.test.ts
new file mode 100644
index 0000000..3f6db55
--- /dev/null
+++ b/server/tests/routine-store.integration.test.ts
@@ -0,0 +1,635 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { and, eq, inArray } from "drizzle-orm";
+import { createAuditStore } from "../src/audit";
+import { createDatabase } from "../src/db/client";
+import { agents, auditEvents, routineRuns, users } from "../src/db/schema";
+import { createRoutineStore } from "../src/routines/store";
+import { hashWebhookSecret } from "../src/routines/webhooks";
+import { TEST_POOL } from "./support/database";
+
+/**
+ * What the storage has to guarantee, against a real database.
+ *
+ * Three of these cannot be tested any other way, because the guarantee is the database's:
+ *
+ *  - one live run per routine, which is a unique index rather than a check in the scheduler, so a
+ *    second claim has to LOSE rather than race
+ *  - a routine deleted mid-run takes its runs with it, and the finishing write afterwards is a
+ *    no-op rather than a crash
+ *  - a missed window is stamped with the window's own time, which is what stops the same miss being
+ *    recorded once a minute until the next one comes round
+ *
+ * The rest is ownership: somebody else's routine is not readable, not editable and not deletable,
+ * and the scoping is in the query rather than applied afterwards.
+ */
+
+const database = createDatabase(
+  process.env.DATABASE_URL ??
+    "postgres://openbot:openbot@localhost:5432/openbot",
+  TEST_POOL,
+);
+
+const suite = randomUUID().slice(0, 8);
+const botId = `agent_routine_${suite}`;
+const ownerId = `user_routine_owner_${suite}`;
+const strangerId = `user_routine_stranger_${suite}`;
+
+const store = createRoutineStore(database, createAuditStore(database));
+const owner = { id: ownerId, userId: ownerId };
+
+const dailySchedule = {
+  type: "daily" as const,
+  time: "08:00",
+  weekdays: [1, 2, 3, 4, 5],
+};
+
+async function makeRoutine(name = "Overnight alerts") {
+  return store.create(
+    {
+      agentId: botId,
+      ownerUserId: ownerId,
+      name,
+      prompt: "Check the overnight alerts and write me a summary.",
+      schedule: dailySchedule,
+    },
+    owner,
+  );
+}
+
+beforeAll(async () => {
+  for (const id of [ownerId, strangerId]) {
+    await database
+      .insert(users)
+      .values({ id, email: `${id}@example.test`, name: id })
+      .onConflictDoNothing();
+  }
+  await database
+    .insert(agents)
+    .values({
+      id: botId,
+      name: "Risk analyst",
+      type: "built_in",
+      configuration: { systemPrompt: "You are a risk analyst." },
+    })
+    .onConflictDoNothing();
+});
+
+afterAll(async () => {
+  // The agent and the users cascade to everything this file made, so removing them is enough.
+  await database.delete(agents).where(eq(agents.id, botId));
+  await database.delete(users).where(inArray(users.id, [ownerId, strangerId]));
+});
+
+describe("keeping routines", () => {
+  test("a created routine comes back with its schedule and its next due time", async () => {
+    const routine = await makeRoutine();
+    expect(routine.schedule).toEqual(dailySchedule);
+    expect(routine.enabled).toBe(true);
+    // Computed on read. A stored next-due is wrong the moment somebody edits the schedule.
+    expect(routine.nextDueAt).not.toBeNull();
+    expect(routine.lastRun).toBeNull();
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  test("a disabled routine has no next due time, because nothing will fire", async () => {
+    const routine = await makeRoutine();
+    const updated = await store.update(
+      routine.id,
+      ownerId,
+      { enabled: false },
+      owner,
+    );
+    expect(updated?.nextDueAt).toBeNull();
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  /*
+   * The scoping is in the query, not applied after it. A routine carries a prompt somebody wrote
+   * about their own work, and "we fetched it and then decided not to show it" is the shape most
+   * accidental disclosures take.
+   */
+  test("somebody else's routine is not readable, editable or deletable", async () => {
+    const routine = await makeRoutine("Private morning check");
+
+    expect(await store.get(routine.id, strangerId)).toBeNull();
+    expect(
+      await store.update(routine.id, strangerId, { name: "Mine now" }, owner),
+    ).toBeNull();
+    expect(await store.remove(routine.id, strangerId, owner)).toBe(false);
+    // Still there, and still saying what its owner wrote.
+    expect((await store.get(routine.id, ownerId))?.name).toBe(
+      "Private morning check",
+    );
+    expect(await store.list(strangerId)).toEqual([]);
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  test("creating, changing and deleting a routine each leave a row, and none carries the prompt", async () => {
+    const routine = await makeRoutine("Audited routine");
+    await store.update(routine.id, ownerId, { name: "Renamed" }, owner);
+    await store.remove(routine.id, ownerId, owner);
+
+    const rows = await database
+      .select()
+      .from(auditEvents)
+      .where(
+        and(
+          eq(auditEvents.targetType, "routine"),
+          eq(auditEvents.targetId, routine.id),
+        ),
+      );
+    expect(rows.map((row) => row.eventType).sort()).toEqual([
+      "routine.created",
+      "routine.deleted",
+      "routine.updated",
+    ]);
+    // The instruction a person wrote about their own work is not in the trail. It can name
+    // customers, systems and amounts, and the name, the Bot and the schedule are what a reader needs.
+    for (const row of rows) {
+      expect(JSON.stringify(row.payload)).not.toContain("overnight alerts");
+    }
+  });
+});
+
+describe("claiming a run", () => {
+  test("the second claim loses rather than starting a second run", async () => {
+    const routine = await makeRoutine();
+
+    const first = await store.startRun({
+      routineId: routine.id,
+      trigger: "schedule",
+      threadId: "thread-a",
+      actor: owner,
+    });
+    // Two ticks overlapping is ordinary. What must not happen is two emails sent.
+    const second = await store.startRun({
+      routineId: routine.id,
+      trigger: "manual",
+      threadId: "thread-b",
+      actor: owner,
+    });
+
+    expect(first).not.toBeNull();
+    expect(second).toBeNull();
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  test("a finished run frees the routine for the next one", async () => {
+    const routine = await makeRoutine();
+    const first = await store.startRun({
+      routineId: routine.id,
+      trigger: "schedule",
+      threadId: "thread-a",
+      actor: owner,
+    });
+    await store.finishRun({
+      runId: first?.id as string,
+      routineId: routine.id,
+      status: "completed",
+      summary: "Nothing overnight.",
+      actor: owner,
+    });
+
+    const second = await store.startRun({
+      routineId: routine.id,
+      trigger: "manual",
+      threadId: "thread-b",
+      actor: owner,
+    });
+    expect(second).not.toBeNull();
+
+    const history = await store.runs(routine.id);
+    expect(history).toHaveLength(2);
+    expect(history.at(-1)?.summary).toBe("Nothing overnight.");
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  test("a failed run is recorded as failed, with the reason", async () => {
+    const routine = await makeRoutine();
+    const run = await store.startRun({
+      routineId: routine.id,
+      trigger: "schedule",
+      threadId: "thread-a",
+      actor: owner,
+    });
+    await store.finishRun({
+      runId: run?.id as string,
+      routineId: routine.id,
+      status: "failed",
+      error: "The model is unreachable.",
+      actor: owner,
+    });
+
+    const [recorded] = await store.runs(routine.id);
+    expect(recorded?.status).toBe("failed");
+    expect(recorded?.error).toBe("The model is unreachable.");
+
+    const rows = await database
+      .select()
+      .from(auditEvents)
+      .where(
+        and(
+          eq(auditEvents.targetType, "routine"),
+          eq(auditEvents.targetId, routine.id),
+          eq(auditEvents.eventType, "routine.run_failed"),
+        ),
+      );
+    expect(rows).toHaveLength(1);
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  /*
+   * The row nothing else in the store can clear: the process that owned the run died between
+   * claiming it and finishing it. It holds the one-live-run index, so the routine never fires again
+   * by any route at all, and the only cure without this is deleting the routine and its history.
+   */
+  test("a run left behind by a process that stopped is closed out, and the routine can run again", async () => {
+    const routine = await makeRoutine();
+    const abandoned = await store.startRun({
+      routineId: routine.id,
+      trigger: "schedule",
+      threadId: "thread-a",
+      // Claimed an hour and a half ago, by a process that is no longer here to finish it.
+      startedAt: new Date(Date.now() - 90 * 60_000),
+      actor: owner,
+    });
+    expect(
+      await store.startRun({
+        routineId: routine.id,
+        trigger: "manual",
+        threadId: "thread-b",
+        actor: owner,
+      }),
+    ).toBeNull();
+
+    const reaped = await store.reapStaleRuns({
+      startedBefore: new Date(Date.now() - 60 * 60_000),
+      actor: { id: "scheduler" },
+    });
+    expect(reaped).toBeGreaterThanOrEqual(1);
+
+    const [closed] = await store.runs(routine.id);
+    expect(closed?.id).toBe(abandoned?.id as string);
+    expect(closed?.status).toBe("failed");
+    // Says what is actually known, which is that how it ended is not known. A row that vanished
+    // would leave the person reading the history believing nothing had been started, and it was.
+    expect(closed?.error).toContain("stopped while the run was going");
+
+    expect(
+      await store.startRun({
+        routineId: routine.id,
+        trigger: "manual",
+        threadId: "thread-c",
+        actor: owner,
+      }),
+    ).not.toBeNull();
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  /*
+   * The routines page refetches every fifteen seconds while it is open, and a daily routine's
+   * history grows by one row a day forever. What it needs is the newest run of each, which the
+   * database returns; reading the whole history to find it is a page that gets slower every week.
+   */
+  test("the list carries the newest run of each routine, and only that one", async () => {
+    const routine = await makeRoutine();
+    for (const [index, summary] of ["older", "newer"].entries()) {
+      const run = await store.startRun({
+        routineId: routine.id,
+        trigger: "schedule",
+        threadId: `thread-${index}`,
+        startedAt: new Date(Date.now() - (10 - index) * 60_000),
+        actor: owner,
+      });
+      await store.finishRun({
+        runId: run?.id as string,
+        routineId: routine.id,
+        status: "completed",
+        summary,
+        actor: owner,
+      });
+    }
+
+    const listed = (await store.list(ownerId)).find(
+      (entry) => entry.id === routine.id,
+    );
+    expect(listed?.lastRun?.summary).toBe("newer");
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  /*
+   * A person deleting a routine has asked for it to be gone. The runner finishing a moment later
+   * must not turn that into an unhandled failure, and the run rows must not outlive the thing they
+   * were runs of.
+   */
+  test("a routine deleted mid-run takes its runs with it, and finishing is a no-op", async () => {
+    const routine = await makeRoutine();
+    const run = await store.startRun({
+      routineId: routine.id,
+      trigger: "schedule",
+      threadId: "thread-a",
+      actor: owner,
+    });
+
+    await store.remove(routine.id, ownerId, owner);
+
+    await store.finishRun({
+      runId: run?.id as string,
+      routineId: routine.id,
+      status: "completed",
+      summary: "Finished after the routine was deleted.",
+      actor: owner,
+    });
+
+    const orphans = await database
+      .select()
+      .from(routineRuns)
+      .where(eq(routineRuns.id, run?.id as string));
+    expect(orphans).toEqual([]);
+  });
+});
+
+describe("a window nobody was awake for", () => {
+  test("is stamped with its own time, so the next tick does not record it again", async () => {
+    const routine = await makeRoutine();
+    const dueAt = new Date("2026-08-13T08:00:00.000Z");
+
+    await store.recordMissed({ routineId: routine.id, dueAt, actor: owner });
+
+    const [missed] = await store.runs(routine.id);
+    expect(missed?.status).toBe("missed");
+    // Not `now`. Stamping it with the window is what makes recording a miss idempotent: the
+    // scheduler then sees a run at or after the window and decides there is nothing to do.
+    expect(missed?.startedAt).toBe(dueAt.toISOString());
+
+    const [candidate] = (await store.dueCandidates()).filter(
+      (entry) => entry.id === routine.id,
+    );
+    expect(candidate?.lastRunAt?.toISOString()).toBe(dueAt.toISOString());
+    expect(candidate?.activeRun).toBe(false);
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  test("a disabled routine is not offered to the scheduler at all", async () => {
+    const routine = await makeRoutine();
+    await store.update(routine.id, ownerId, { enabled: false }, owner);
+
+    const offered = (await store.dueCandidates()).map((entry) => entry.id);
+    expect(offered).not.toContain(routine.id);
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  test("a run in flight is reported as such, so the tick skips it", async () => {
+    const routine = await makeRoutine();
+    await store.startRun({
+      routineId: routine.id,
+      trigger: "schedule",
+      threadId: "thread-a",
+      actor: owner,
+    });
+
+    const [candidate] = (await store.dueCandidates()).filter(
+      (entry) => entry.id === routine.id,
+    );
+    expect(candidate?.activeRun).toBe(true);
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+});
+
+describe("webhook triggers", () => {
+  test("the secret is returned once and is not on the record afterwards", async () => {
+    const routine = await makeRoutine();
+    const created = await store.createTrigger(
+      { name: "Build finished", ownerUserId: ownerId, routineId: routine.id },
+      owner,
+    );
+
+    expect(created.secret).toBeTruthy();
+    expect(JSON.stringify(created.trigger)).not.toContain(created.secret);
+    expect(created.trigger.verificationPending).toBe(true);
+
+    // The lookup the receiver uses carries the hash and only the hash.
+    const found = await store.triggerByEndpoint(created.trigger.endpointId);
+    expect(found?.secretHash).toBe(hashWebhookSecret(created.secret));
+
+    const listed = await store.listTriggers();
+    expect(JSON.stringify(listed)).not.toContain(created.secret);
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  test("rotating replaces the secret, and the old one stops matching", async () => {
+    const routine = await makeRoutine();
+    const created = await store.createTrigger(
+      { name: "Build finished", ownerUserId: ownerId, routineId: routine.id },
+      owner,
+    );
+    const rotated = await store.rotateTriggerSecret(created.trigger.id, owner);
+
+    expect(rotated?.secret).not.toBe(created.secret);
+    const found = await store.triggerByEndpoint(created.trigger.endpointId);
+    // No overlap window. Somebody rotates because they think the old secret leaked, and a grace
+    // period is a grace period for whoever has it.
+    expect(found?.secretHash).not.toBe(hashWebhookSecret(created.secret));
+    expect(found?.secretHash).toBe(
+      hashWebhookSecret(rotated?.secret as string),
+    );
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  /*
+   * The gate that catches a hook pointed at the wrong trigger. Confirming a trigger nothing has ever
+   * called confirms nothing, so it is refused rather than allowed as a formality.
+   */
+  test("a trigger cannot be confirmed until a delivery has actually arrived", async () => {
+    const routine = await makeRoutine();
+    const created = await store.createTrigger(
+      { name: "Build finished", ownerUserId: ownerId, routineId: routine.id },
+      owner,
+    );
+
+    expect(await store.verifyTrigger(created.trigger.id, owner)).toBeNull();
+
+    await store.recordDelivery({
+      id: created.trigger.id,
+      body: { event: "build.finished", branch: "main" },
+      captureSample: true,
+    });
+
+    const verified = await store.verifyTrigger(created.trigger.id, owner);
+    expect(verified?.verificationPending).toBe(false);
+    expect(verified?.verifiedAt).not.toBeNull();
+    expect(verified?.sample).toEqual({
+      event: "build.finished",
+      branch: "main",
+    });
+    expect(verified?.deliveryCount).toBe(1);
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  test("later deliveries are counted and do not overwrite the sample", async () => {
+    const routine = await makeRoutine();
+    const created = await store.createTrigger(
+      { name: "Build finished", ownerUserId: ownerId, routineId: routine.id },
+      owner,
+    );
+    /*
+     * Both deliveries ask for the sample, which is what the receiver actually does: the decision is
+     * "capture" for every delivery that arrives while verification is pending, and a CI system given
+     * the secret starts posting every minute. What must not happen is the person reading sample A on
+     * the page and confirming sample B.
+     */
+    await store.recordDelivery({
+      id: created.trigger.id,
+      body: { event: "first" },
+      captureSample: true,
+    });
+    await store.recordDelivery({
+      id: created.trigger.id,
+      body: { event: "second" },
+      captureSample: true,
+    });
+
+    const beforeConfirming = (await store.listTriggers()).find(
+      (entry) => entry.id === created.trigger.id,
+    );
+    expect(beforeConfirming?.sample).toEqual({ event: "first" });
+
+    await store.verifyTrigger(created.trigger.id, owner);
+    await store.recordDelivery({
+      id: created.trigger.id,
+      body: { event: "third" },
+      captureSample: false,
+    });
+
+    const listed = (await store.listTriggers()).find(
+      (entry) => entry.id === created.trigger.id,
+    );
+    expect(listed?.deliveryCount).toBe(3);
+    // A trigger in use must not accumulate somebody else's payloads in this deployment's database.
+    expect(listed?.sample).toEqual({ event: "first" });
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  /*
+   * Not scoped to whoever created it, unlike everything about a routine. A trigger is a URL on the
+   * public internet, the page that lists them is the administrators' one, and an administrator who
+   * could only shut the doors they personally opened could not answer the question they came to the
+   * page with. The routes are what keep this away from everybody else; see routines/routes.ts.
+   */
+  test("a trigger somebody else created can still be listed, confirmed and shut off", async () => {
+    const routine = await makeRoutine();
+    const created = await store.createTrigger(
+      { name: "Build finished", ownerUserId: ownerId, routineId: routine.id },
+      owner,
+    );
+    const other = { id: strangerId, userId: strangerId };
+
+    expect(
+      (await store.listTriggers()).some(
+        (entry) => entry.id === created.trigger.id,
+      ),
+    ).toBe(true);
+
+    await store.recordDelivery({
+      id: created.trigger.id,
+      body: { event: "build.finished" },
+      captureSample: true,
+    });
+    expect(
+      (await store.verifyTrigger(created.trigger.id, other))
+        ?.verificationPending,
+    ).toBe(false);
+    expect(
+      (await store.updateTrigger(created.trigger.id, { enabled: false }, other))
+        ?.enabled,
+    ).toBe(false);
+    expect(await store.deleteTrigger(created.trigger.id, other)).toBe(true);
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  /*
+   * Confirming a trigger is the moment an inert endpoint starts setting a Bot working, and turning
+   * one off or deleting it are the moments a door closes. An administrator asking why deliveries
+   * stopped last Tuesday is owed an answer other than silence.
+   */
+  test("confirming, changing and deleting a trigger each leave a row", async () => {
+    const routine = await makeRoutine();
+    const created = await store.createTrigger(
+      { name: "Build finished", ownerUserId: ownerId, routineId: routine.id },
+      owner,
+    );
+    await store.recordDelivery({
+      id: created.trigger.id,
+      body: { event: "build.finished" },
+      captureSample: true,
+    });
+    // Its own event, not a refusal: this delivery had the right secret and was kept on purpose.
+    await store.recordDeliveryEvent({
+      endpointId: created.trigger.endpointId,
+      triggerId: created.trigger.id,
+      outcome: "captured",
+      reason: "The first delivery to a new trigger is kept as a sample.",
+      eventType: "build.finished",
+    });
+    await store.verifyTrigger(created.trigger.id, owner);
+    await store.updateTrigger(created.trigger.id, { enabled: false }, owner);
+    await store.deleteTrigger(created.trigger.id, owner);
+
+    const rows = await database
+      .select()
+      .from(auditEvents)
+      .where(
+        and(
+          eq(auditEvents.targetType, "webhook_trigger"),
+          eq(auditEvents.targetId, created.trigger.id),
+        ),
+      );
+    expect(rows.map((row) => row.eventType).sort()).toEqual([
+      "webhook.captured",
+      "webhook.trigger_created",
+      "webhook.trigger_deleted",
+      "webhook.trigger_updated",
+      "webhook.trigger_verified",
+    ]);
+    // The secret is in none of them. A trail that could hand somebody the key is a trail that has
+    // to be guarded as closely as the endpoint.
+    for (const row of rows) {
+      expect(JSON.stringify(row.payload)).not.toContain(created.secret);
+    }
+
+    await store.remove(routine.id, ownerId, owner);
+  });
+
+  test("deleting a routine takes its triggers with it", async () => {
+    const routine = await makeRoutine();
+    const created = await store.createTrigger(
+      { name: "Build finished", ownerUserId: ownerId, routineId: routine.id },
+      owner,
+    );
+
+    await store.remove(routine.id, ownerId, owner);
+
+    // A door that opens onto nothing is worse than a closed one: the sender is told the delivery was
+    // accepted and no work ever happens.
+    expect(
+      await store.triggerByEndpoint(created.trigger.endpointId),
+    ).toBeNull();
+  });
+});
diff --git a/server/tests/webhook-trigger.test.ts b/server/tests/webhook-trigger.test.ts
new file mode 100644
index 0000000..27f5a1a
--- /dev/null
+++ b/server/tests/webhook-trigger.test.ts
@@ -0,0 +1,275 @@
+import { describe, expect, test } from "bun:test";
+import {
+  bearerSecret,
+  decideWebhookDelivery,
+  deliveryPrompt,
+  eventTypeOf,
+  hashWebhookSecret,
+  MAX_DELIVERY_CHARACTERS,
+  mintEndpointId,
+  mintWebhookSecret,
+  webhookSecretMatches,
+  WEBHOOK_SECRET_PREFIX,
+  type WebhookTriggerFacts,
+} from "../src/routines/webhooks";
+
+/**
+ * The door that opens to somebody who has not signed in, and the three gates behind it.
+ *
+ * These are the tests where a pass is not the interesting result. Every case below is one where the
+ * wrong behaviour is plausible: a delivery with no secret at all, a brand new trigger that would
+ * happily start real work on its first call, an event type the trigger was told not to act on. Each
+ * of them is a way for somebody else's system to make a Bot do something on somebody's live
+ * accounts, so each of them has a test rather than a comment.
+ */
+
+const secret = mintWebhookSecret();
+
+const verified: WebhookTriggerFacts = {
+  enabled: true,
+  verificationPending: false,
+  secretHash: secret.hash,
+  eventTypes: [],
+};
+
+describe("the secret", () => {
+  test("is recognisable and is not what gets stored", () => {
+    expect(secret.secret.startsWith(WEBHOOK_SECRET_PREFIX)).toBe(true);
+    // The row keeps a digest. A table that could return the secret is a table that has put it on an
+    // administrator's screen, in a backup and in every database dump since.
+    expect(secret.hash).not.toContain(secret.secret);
+    expect(secret.hash).toBe(hashWebhookSecret(secret.secret));
+  });
+
+  test("is different every time", () => {
+    expect(mintWebhookSecret().secret).not.toBe(mintWebhookSecret().secret);
+    expect(mintEndpointId()).not.toBe(mintEndpointId());
+  });
+
+  test("matches itself and nothing else", () => {
+    expect(webhookSecretMatches(secret.secret, secret.hash)).toBe(true);
+    expect(webhookSecretMatches(`${secret.secret}x`, secret.hash)).toBe(false);
+    expect(webhookSecretMatches("", secret.hash)).toBe(false);
+  });
+
+  /*
+   * The comparison is over digests, not over the secrets. That is what makes a constant-time compare
+   * possible at all: `timingSafeEqual` throws on buffers of different lengths, and a caller can
+   * present a value of any length they like. Hashing first fixes the width, so a one-character guess
+   * and a ten-thousand-character one take the same path and neither of them throws.
+   *
+   * The naive alternative, `presented === stored`, returns at the first differing byte, which is a
+   * real attack against a value somebody can retry as fast as the network allows.
+   */
+  test.each([
+    ["a single character", "x"],
+    ["something enormous", "x".repeat(10_000)],
+    ["something that looks like hex", "a".repeat(64)],
+    ["a near miss", `${WEBHOOK_SECRET_PREFIX}${"A".repeat(43)}`],
+  ])("rejects %s without throwing", (_label, candidate) => {
+    expect(webhookSecretMatches(candidate, secret.hash)).toBe(false);
+  });
+
+  test("a stored value that is not a digest matches nothing", () => {
+    expect(webhookSecretMatches(secret.secret, "not-a-digest")).toBe(false);
+    expect(webhookSecretMatches(secret.secret, "")).toBe(false);
+  });
+
+  test("reads a bearer header, and only a bearer header", () => {
+    expect(bearerSecret("Bearer abc")).toBe("abc");
+    expect(bearerSecret("bearer abc")).toBe("abc");
+    expect(bearerSecret("Basic abc")).toBeNull();
+    expect(bearerSecret("abc")).toBeNull();
+    expect(bearerSecret(null)).toBeNull();
+  });
+});
+
+describe("deciding what to do with a delivery", () => {
+  test("runs an authenticated delivery to a verified trigger", () => {
+    expect(
+      decideWebhookDelivery(verified, {
+        authorization: `Bearer ${secret.secret}`,
+        eventType: null,
+      }),
+    ).toEqual({ outcome: "run" });
+  });
+
+  test("a wrong secret is refused, and nothing else is looked at", () => {
+    const decision = decideWebhookDelivery(verified, {
+      authorization: "Bearer wrong",
+      eventType: null,
+    });
+    expect(decision).toMatchObject({ outcome: "reject", status: 401 });
+  });
+
+  test("no secret at all is refused", () => {
+    expect(
+      decideWebhookDelivery(verified, {
+        authorization: null,
+        eventType: null,
+      }),
+    ).toMatchObject({ outcome: "reject", status: 401 });
+  });
+
+  /*
+   * 404 rather than 403, deliberately. On a public endpoint a 403 confirms that this endpoint id
+   * exists and is merely switched off, which is more than an unauthenticated caller has earned.
+   */
+  test("a trigger that is switched off answers as though it were not there", () => {
+    expect(
+      decideWebhookDelivery(
+        { ...verified, enabled: false },
+        { authorization: `Bearer ${secret.secret}`, eventType: null },
+      ),
+    ).toMatchObject({ outcome: "reject", status: 404 });
+  });
+
+  test("an endpoint nobody is listening on answers the same way", () => {
+    expect(
+      decideWebhookDelivery(null, {
+        authorization: `Bearer ${secret.secret}`,
+        eventType: null,
+      }),
+    ).toMatchObject({ outcome: "reject", status: 404 });
+  });
+
+  /*
+   * The gate this feature exists for. A hook pointed at the wrong trigger, or carrying a payload
+   * nothing like what was expected, must not start real work; the first anybody would hear of it is
+   * the result. The first authenticated delivery is kept and nothing runs.
+   */
+  test("a new trigger captures its first delivery and runs nothing", () => {
+    const decision = decideWebhookDelivery(
+      { ...verified, verificationPending: true },
+      { authorization: `Bearer ${secret.secret}`, eventType: "build.finished" },
+    );
+    expect(decision.outcome).toBe("capture");
+  });
+
+  test("the secret is still checked before anything is captured", () => {
+    // Otherwise the sample is whatever the last stranger sent, and confirming it confirms theirs.
+    expect(
+      decideWebhookDelivery(
+        { ...verified, verificationPending: true },
+        { authorization: "Bearer wrong", eventType: null },
+      ),
+    ).toMatchObject({ outcome: "reject", status: 401 });
+  });
+
+  test("an event type on the list is run", () => {
+    expect(
+      decideWebhookDelivery(
+        { ...verified, eventTypes: ["deployment.succeeded"] },
+        {
+          authorization: `Bearer ${secret.secret}`,
+          eventType: "deployment.succeeded",
+        },
+      ),
+    ).toEqual({ outcome: "run" });
+  });
+
+  test("an event type that is not on the list is refused", () => {
+    const decision = decideWebhookDelivery(
+      { ...verified, eventTypes: ["deployment.succeeded"] },
+      {
+        authorization: `Bearer ${secret.secret}`,
+        eventType: "deployment.failed",
+      },
+    );
+    expect(decision).toMatchObject({ outcome: "reject", status: 403 });
+    expect((decision as { reason: string }).reason).toContain(
+      "deployment.failed",
+    );
+  });
+
+  /*
+   * A delivery that names nothing must not slip past a list. An allowlist that only refuses the
+   * types it has heard of is not an allowlist.
+   */
+  test("a delivery naming no event type is refused when a list exists", () => {
+    expect(
+      decideWebhookDelivery(
+        { ...verified, eventTypes: ["deployment.succeeded"] },
+        { authorization: `Bearer ${secret.secret}`, eventType: null },
+      ),
+    ).toMatchObject({ outcome: "reject", status: 403 });
+  });
+
+  test("an empty list means every type", () => {
+    expect(
+      decideWebhookDelivery(verified, {
+        authorization: `Bearer ${secret.secret}`,
+        eventType: "anything.at.all",
+      }),
+    ).toEqual({ outcome: "run" });
+  });
+});
+
+describe("finding the event type", () => {
+  const headers = (values: Record<string, string>) => ({
+    get: (name: string) => values[name.toLowerCase()] ?? null,
+  });
+
+  test("prefers the header, which is the part a person can see", () => {
+    expect(
+      eventTypeOf(headers({ "x-openbot-event": "build.finished" }), {
+        event: "something.else",
+      }),
+    ).toBe("build.finished");
+  });
+
+  test.each([["event"], ["eventType"], ["type"]])(
+    "falls back to a %s field in the body",
+    (field) => {
+      expect(eventTypeOf(headers({}), { [field]: "build.finished" })).toBe(
+        "build.finished",
+      );
+    },
+  );
+
+  /*
+   * A delivery that names its type in some fourth way is treated as naming none, which an allowlist
+   * then refuses. Guessing at a field would mean a trigger quietly acting on events it was told not
+   * to, which is the failure the allowlist exists to prevent.
+   */
+  test("names nothing when it is somewhere else entirely", () => {
+    expect(eventTypeOf(headers({}), { kind: "build.finished" })).toBeNull();
+    expect(eventTypeOf(headers({}), null)).toBeNull();
+    expect(eventTypeOf(headers({}), [1, 2, 3])).toBeNull();
+  });
+});
+
+describe("what the Bot is told a delivery said", () => {
+  test("puts the instruction first and the payload underneath it", () => {
+    const prompt = deliveryPrompt(
+      "Summarise the failing build.",
+      { branch: "main" },
+      "build.failed",
+    );
+    expect(prompt.startsWith("Summarise the failing build.")).toBe(true);
+    expect(prompt).toContain("build.failed");
+    expect(prompt).toContain('"branch": "main"');
+  });
+
+  /*
+   * The body is somebody else's payload and can be any size at all. A prompt that grows without
+   * limit is a run that fails somewhere the routine cannot explain.
+   */
+  test("truncates an enormous payload and says that it did", () => {
+    const prompt = deliveryPrompt(
+      "Look at this.",
+      { blob: "x".repeat(50_000) },
+      null,
+    );
+    expect(prompt.length).toBeLessThan(MAX_DELIVERY_CHARACTERS + 500);
+    expect(prompt).toContain("truncated");
+  });
+
+  test("a payload that cannot be rendered still produces a usable prompt", () => {
+    const circular: Record<string, unknown> = {};
+    circular.self = circular;
+    const prompt = deliveryPrompt("Look at this.", circular, null);
+    expect(prompt.startsWith("Look at this.")).toBe(true);
+    expect(prompt).toContain("could not be rendered");
+  });
+});