Versioned jobs and schedules

Status: the controlled Shared step 6 profile is validated in this private source checkpoint. Native evidence and limits live in the validation ledger. The jobs module owns the adapter, migrations and restricted-role instructions.

One execution chainCopy Anchor Link

PostgreSQL metadata admits authorized work and freezes its release/task definition, logical run ID and effect key. The existing transactional outbox delivers to pg-boss 12.38.0. The Go coordinator claims the exact operation with a renewable fence and invokes the isolated runtime. Untrusted task code never runs inside the trusted Node adapter or coordinator process.

pg-boss owns delivery, expiry, retry and cron scheduling. Its native receipt and the metadata operation fence serve different purposes: delivery deduplication cannot authorize a stale executor. Queue/controller restarts must retain both. An app's sleeping web process is not a job worker or scheduler.

Task interfaceCopy Anchor Link

astrogate.json declares jobs: {} and named tasks such as tasks.record.entrypoint: "tasks/record.mjs". A task module exports a definition with parse(input) and async run({payload, runId, idempotencyKey, services}). Infrastructure validates a registered task ID, input envelope, scoped caller, capacity and the frozen release. Payloads cannot select a host command, runtime authority or arbitrary entrypoint.

createJobsClient from @astrogate/sdk/server accepts a validated jobs binding, request-scoped session, typed task parsers and explicit transport budgets. run({task, payload}, {idempotencyKey, signal?}) returns an accepted operation/run reference. get(runId, {signal?}) exposes durable state, attempts and actionable error code. The server resolves active:<task> exactly once at admission; later releases cannot change a running/retried task's code.

Use the supplied effect key when calling an idempotent external service or the scoped file owner. Delivery is at least once. A successful rehearsal with one file effect does not establish universal exactly-once behavior for arbitrary email/payment/external effects.

Scheduling and retentionCopy Anchor Link

Schedule creation/update currently belongs to createManagement(...).schedules, not browser application credentials or a second native pg-boss API. A schedule explicitly selects the scoped jobs resource, pinned task definition, cron, IANA timezone, enabled state and offered concurrency/missed-run policies. Native timezone and DST behavior remain authoritative. Updating or disabling a schedule retains its logical identity and rejects stale delivery generations. Preview changes cannot activate Production schedules implicitly.

Configured profiles bound pending/concurrent work, payload size, execution duration and storage from reviewed policy or measured capacity. Exhaustion remains visible and cannot silently drop pending work. Runtime failures may retry under native queue policy; exhausted work remains an explicit failed/waiting operation for operator reconciliation.

Raw logs are separate from durable outcome/effect history. The rehearsal retains seven days of raw logs and ninety days of compact completed history. Cleanup protects artifacts still needed by running/retryable jobs, active schedules and recovery. Expired logs must not make retry or effect reconciliation impossible.

Read technical task output through management.operations.logs(operationId, "execution"). The existing operation owner resolves the pinned task run; callers cannot supply a host path. An unavailable/expired log segment is explicit, while the run's retained result and effect identity remain available. The selected native retry policy exhausted four attempts for both malformed task input and the actual 120-second runtime deadline in the isolated rehearsal. Those are recorded test-profile settings, not universal product restrictions.

Moves, restore and updatesCopy Anchor Link

An environment move closes admission, fences old task leases/processes and preserves run IDs, release references, schedules and effect keys. The accepted controlled profile retains an explicitly shared logical queue authority rather than cloning a writable scheduler per region. Independent operation and regional failover require additional evidence.

Operator restore includes native pg-boss state/receipts, metadata/outbox/job definitions, retained task artifacts and independent scoped secret dependencies. Fence the old executor and scheduler before activating replacements. Do not replay acknowledged external effects blindly. Customer export additionally requires authorized task/subject mappings and effect reconciliation; shared queue tables and platform credentials are not a tenant export.

Use native queue migrations with an owner, reapply restricted grants, then validate compatible existing jobs/schedules and rollback boundaries. See deployment, operations and safe updates.