flow-worker
Responsibility
Section titled “Responsibility”flow-worker consumes RawStoredEventV1, loads the authoritative raw row by
its composite ID, and rejects mismatched tenant, device, device type,
idempotency key, or payload hash. Its first processing attempt pins the active
released flow version and resolved parameter snapshot. Retries reuse both.
The worker executes built-in nodes and pinned custom-script dependencies in deterministic topological order. Custom scripts use bounded NATS request/reply to the sandbox; checksum, manifest and schema dependencies are revalidated at runtime. It then commits measurements, action jobs, action-outbox rows, and successful execution status in one database transaction. Graph execution never performs an external side effect.
Delivery behavior
Section titled “Delivery behavior”Invalid event contracts, missing retained Raw rows, and event/Raw mismatches are terminal. Temporary database, broker and sandbox-availability failures are negatively acknowledged with bounded backoff. Script timeout, resource limit, script error and invalid output are terminal. A completed execution is idempotently recognized on redelivery.
The same process runs Replay consumption, the Action and Dead Letter outbox
relays, and the Dead Letter recorder. Relays claim rows with FOR UPDATE SKIP LOCKED and wait for JetStream publish acknowledgements. Replay executions are
already queued and pinned by the API; they write complete measurement revisions
and tombstones but cannot create Actions. Max-delivery publishes one idempotent
Dead Letter before the original message is terminated.
Operations
Section titled “Operations”/healthz, /readyz, /metrics, and /version are exposed on the configured
operations port. Readiness covers TimescaleDB, Raw Stored, Replay and Dead Letter
consumers, and outbox relays. Logs carry correlation, Raw-message, and execution context
but never raw payloads or parameter values.