DongHyeonkaandClaude Opus 5
701ba67456
Maps the 31-module plan onto the registry's 19 leaves as packages; the two edges the registry forbids (provider->httpclient, inbox->messaging) are replaced by application-owned ports. See docs/notification/module-mapping.md. Acceptance is not delivery: ProviderSubmissionResult refuses to carry a delivery outcome, and AMBIGUOUS is a first-class terminal state that blocks automatic retry and fallback until reconciliation resolves it. Providers: SES (SigV4 + SNS callback), Twilio (X-Twilio-Signature + reconciliation), FCM (FID-primary batch), APNs, Web Push (RFC 8030/8291/8292), SMTP and webhook. Contact points are AES-256-GCM encrypted with a separate HMAC lookup fingerprint; nothing raw reaches a log, metric tag or exception. Dispatch commits the attempt row, calls the provider with no transaction open, then records the outcome; the durable queue uses FOR UPDATE SKIP LOCKED. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1.6 KiB
1.6 KiB
Configuration reference
Dispatch
| Property | Meaning | Bound |
|---|---|---|
claim-batch-size |
Rows claimed per scheduler tick | 1..1000 |
lease-duration |
How long a claimed job stays owned | positive, finite |
max-global-concurrency |
Ceiling across all providers | positive |
max-queue-age |
Age at which a job is escalated | positive |
max-retry-concurrency |
Ceiling for retry work | positive |
scheduler-poll-interval |
Queue poll cadence | positive |
callback-worker-concurrency |
Callback projection workers | positive |
Every value is bounded. "Unlimited" is not an accepted configuration.
Provider profiles
A profile pins provider type, environment, credential profile, timeouts, concurrency, rate limit, retry policy and callback profile. Sender identity and credential profile are separate concerns.
Startup failures
Startup fails rather than degrading when:
- a payload or queue setting is unbounded
- a timeout is negative
- a TTL-required profile has no expiry source
- a callback signing secret is missing
- a production profile enables trust-all
- an APNs profile is missing its environment or topic
- a Web Push profile is missing its VAPID key
- two provider profiles share an id
- a route points only at disabled providers
- ambiguous fallback is enabled by default
Secrets
All key material arrives through SecretMaterialProvider. Nothing is read from source, from a
committed file, or from a plaintext log. Contact point encryption and lookup HMAC keys must be
distinct, and the encryption key must be exactly 256 bits.