mirror of
https://github.com/block/buzz.git
synced 2026-10-30 22:11:36 +00:00
83b60e5e05
Add node C of the workflow-delivery DAG: the complete dormant DB
transition system for workflow messages addressed to managed agents,
built on B's canonical delivery protocol vocabulary.
Migration 0035 creates workflow_agent_deliveries: one canonical binding
per (community, run, step, target) with a pending -> claimed ->
finished | failed status enum, a monotonic lease_generation fence,
decomposed WorkflowDeliveryCause identity columns guarded by a CHECK
that makes an ambiguous or absent cause unrepresentable, cascading FKs
to workflows/workflow_runs/events, and the community write fence. The
desired-state schema.sql mirrors it inline.
The buzz-db module persists B's WorkflowDeliveryBinding verbatim (no
duplicate tuple spelling) and owns only the lifecycle around it:
- lock_workflow_agent_delivery_identity + commit_workflow_agent_deliveries:
the ONLY insert path, atomic per step, idempotent across producer
retries via ON CONFLICT DO NOTHING.
- claim_workflow_agent_delivery: FOR UPDATE SKIP LOCKED, scoped to the
authenticated target and community; an optional expected binding must
match every supplied field (workflow/run/step/definition/message and
the full decomposed cause) so a forged or stale wake is a miss, never
an alternate authority path. The winning row bumps its fence token.
- renew / finish: fenced by lease_generation; a reaped or superseded
holder matches zero rows and fails closed. finish is terminal-once and
reconciles uncertain completion to a single terminal idempotently.
- reap_expired_workflow_agent_deliveries: fleet-wide, filtered through
community_write_allowed exactly like the scheduler prune scan, so a
quiescing/fenced/deleted tenant is skipped before its write fence can
abort healthy tenants in the same statement.
No producer, runtime, API, or ACP reachability: dormant by contract.
Fresh-Postgres invariant matrix (#[ignore]) proves create idempotency,
community/target claim isolation, mismatched-binding rejection (incl.
cause- and workflow-only disagreement), lease fencing by generation,
reap + prior-holder fencing, terminal-once/idempotent reconciliation,
the fleet-wide lifecycle fence, run-deletion cascade, and commit
rollback. migration.rs asserts len 35, the 0035 contract, and fence
parity.
Co-authored-by: Mongo <89eda16aff8223982a0d928ccc850c50a22abc23babd9f890dc8d6d5431876fb@buzz.block.builderlab.xyz>
Signed-off-by: Logan Johnson <loganj@squareup.com>