Skip to main content

​
The path of an incoming message

​
Tenancy

Tenant context is a runtime coordinate, not an option.
  • Tenant context is mandatory; runtime code fails fast without it
  • There is one runtime model, with no deployment mode to branch on
  • Context switching is encapsulated by the Tenancy domain
  • User data lives in tenant schemas
See Tenant-aware execution.

​
Flow engine

  • A flow is stored as a JSON graph
  • The execution loop is deterministic
  • Handlers resolve by (type, version)
  • Registries are built at boot, with no database lookup on the hot path
A handler is graph-unaware: it returns a sourceHandle, and the engine resolves the next node from the flow’s edges. See Handler contract.

​
Concurrency

Incoming message processing has three protection layers, and they guard different failures: A lock that cannot be acquired (three attempts, two seconds apart) produces a busy notice, and the message is dropped — it is reported as lock_timeout, and there is no backoff queue behind it.

​
Webhook routing

The URL is /webhook/{channel}/{public_hash}, and public_hash resolves through Redis (webhook:{hash}). The processed:{id} idempotency key is set by the webhook controller before the job is dispatched.
The landlord database must not participate in a routing hot path. Resolution is a Redis lookup precisely so that inbound traffic never waits on platform-level storage. The one exception is a registry miss: every request that misses reads the landlord database. A short warming:{hash} leader lock only decides which request writes the entry back to Redis; it does not stop the others from querying.
Inbound messages are handed to IncomingMessageJob and resolved through the tenant-aware routing pipeline.

​
Queues

Queues are separated by purpose, not by convenience — see Queues for the full list and the reasoning.

​
Ingress

Webhook ingress is served by PHP-FPM, or — when volume justifies it — by the Go webhook gateway in front of it. Core runs no long-lived PHP request runtime. Queue workers, however, are long-lived: one Horizon process handles many jobs. See Long-lived worker safety for what that forbids.