jb/eden
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add durable asset synchronization worker

Browse Source
This commit is contained in:
jb
2026-09-19 22:15:23 -04:00
parent 2675ea8114
commit fe7d218195
36 changed files with 2218 additions and 189 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/parallel-worktrees.md
+16 -11
View File
@@ -8,17 +8,20 @@
**Planning baseline:** `fdcc486` (`Initial Commit`). The roadmap records an earlier 97-test gate; each prototype change reruns the current local suite. Existing `jobs`, `userPreferences` and `referenceSyncMetadata` tables are placeholders, not services.
**T06 evidence:** The centralized ESI client now has fixed typed asset, asset-name,
**T06/T07 evidence:** The centralized ESI client has fixed typed asset, asset-name,
asset-location, wallet-balance, and market-read strategies with bounded response
bytes/rows/pages, bounded retries, abort-first cleanup, validators, canonical int64
helper bodies, complete scoped authority-context cache identity, cooldown queries,
and runtime schemas. Asset snapshots report bounded non-atomic coverage; page-one
revalidation is not presented as a transaction. T07 durable scheduling/worker
orchestration, T08 location/service orchestration, and T13 wallet persistence/UI/
service orchestration remain unimplemented; production-readiness gates remain
deferred. The narrow `beginSync` expected-authority fence is part of T06's atomic
bridge contract: it prevents transport cache authority from being published under
a different T05 grant/revision/credential fence; it is not T07 durable worker orchestration.
and runtime schemas. T07 durable scheduling/worker orchestration is implemented as
a local prototype: the current full suite records 204 passing tests, including the
bundled dedicated worker, durable leases, fencing, cancellation/recovery, refresh
coordination and restricted startup. T08 location/service orchestration and T13
wallet persistence/UI/service orchestration remain pending; T07/T08 integration is
not complete and production-readiness gates remain deferred. No deployed/live ESI
claim is made here. The narrow `beginSync` expected-authority fence is part of T06's
atomic bridge contract: it prevents transport cache authority from being published
under a different T05 grant/revision/credential fence; it is not T07 durable worker
orchestration.
## Execution model
@@ -138,13 +141,15 @@ Implement the prototype identity enforcement needed by the pipeline: revalidate
### T07 — Durable asset queue and worker
**Own:** proposed `workers/sync.ts`, feature-local job/credential modules, job schema/store operations, `/api/sync` and replacement of request-bound sync orchestration; Compose wiring follows T01.
**Status:** implemented local prototype; no deployment, live ESI, or production-readiness claim.
**Own:** `workers/sync.ts`, feature-local job/credential modules, job schema/store operations, `/api/sync` and replacement of request-bound sync orchestration; Compose wiring and restricted operator startup.
**Deliver:** enqueue/status instead of long-running request work; typed deduplicated jobs, bounded attempts/due times, cancellation, fair scheduling/backpressure, shared cooldown/error budgets, renewable leases and fenced success **and failure** publication. Stage/validate assets before active-generation publication and retain validated `isSingleton` facts throughout ingestion.
Share a per-character refresh lease across web and workers, retaining token CAS. At-least-once delivery is not exactly-once remote refresh: an uncertain rotated result produces actionable reauthorization instead of automatic replay. Keep reference extraction separate and minimize worker secrets. Public feeds must be coordinated rather than independently refreshed per process.
Share a per-character refresh lease across web and workers, retaining token CAS. At-least-once delivery is not exactly-once remote refresh: an uncertain rotated result produces actionable reauthorization instead of automatic replay. Keep reference extraction separate and minimize worker secrets. Public feeds must be coordinated rather than independently refreshed per process. The worker requires the distinct `CONVEX_SYNC_WORKER_SECRET`; standalone startup uses a worker-only environment and Compose startup uses the explicit `worker` profile.
**Done:** process kill/restart, long paging beyond the old five-minute lease, duplicate delivery, cancellation, scope loss, stale-worker completion/failure, refresh races and uncertain rotation preserve the newest valid generation. Caps fail visibly. User-supplied jobs cannot gain system authority. Isolated migration/rollback and minimal worker configuration are exercised.
**Verified locally:** process kill/restart, long paging beyond the old five-minute lease, duplicate delivery, cancellation, scope loss, stale-worker completion/failure, refresh races, uncertain rotation, restricted runtime startup and configuration boundaries. The full suite currently records 204 passing tests. T08 enrichment integration at the post-assets/pre-publication seam remains pending; production migration/release evidence remains deferred.
### T08 — Private locations, custom names and containment