The Omni-Dispatcher
The message that matters arrives — whichever channel it takes to get there.
The incident
The password-reset email bounced. There was no fallback, so the user was simply locked out — of an account they were trying to pay with. Meanwhile the same system happily sent that user four marketing pushes that week. The infrastructure could reach them. It just wasn't wired to try.
Why the obvious approach fails
Hardcoding 'send email' into business logic couples a critical outcome to the most fragile link in the chain. Every channel fails routinely — emails bounce, SMS gateways choke at peak, push tokens expire silently — and a single-channel design turns each routine failure into a stranded user. The inverse failure is just as real: without central throttling, every team's 'important' notification stacks up into fatigue, and users turn everything off. Delivery is a routing decision with priorities and budgets. Business logic should state intent — notify this user about this event — and let one dispatch layer decide how.
The standard
- Business logic emits intent, never channel calls; all outbound messaging flows through the dispatcher.
- Critical messages cascade with failover: push first, then WhatsApp, then SMS — each escalation on a declared timeout or failure signal.
- Templates are managed per channel centrally; the same intent renders correctly everywhere.
- Fatigue caps are enforced globally: non-critical messages respect per-user daily budgets, and critical messages bypass them by explicit class, not by whoever shouted loudest.
- Delivery outcomes are tracked per channel — bounce, failure, and open rates are dashboards, not mysteries.
How Cortex validates it
At plan time
every notification in the blueprint declares its class (critical/transactional/marketing), cascade, and budget.
At validation
assert: outbound_messages.via == dispatcher (direct SDK calls == 0)assert: critical_class → cascade_definedassert: marketing_class.respects(fatigue_cap)Assertion syntax is illustrative.
At review
the approver sees the failover drill: primary channel forced down, critical messages arriving via fallback, marketing messages correctly capped.