Skip to main content
Version: 0.1.0-alpha.4 (alpha)

Ingress and trigger architecture

Capsules never own listeners, queue-consumer loops, or timer threads. Shared ingress adapters and trigger sources translate external activity into activation envelopes.

The node exposes direct invocation RPC on its authenticated loopback listener. It also provides bounded local service calls, shared NATS trigger delivery, and the bounded HTTP application mapping, durable HTTP routes and an optional shared HTTP/TLS listener. HTTP selection pins the publication, revision and policy snapshot before normal admission. Finite connection, exchange, input, output and cleanup ownership applies to all routes. Durable workflow timers and blob-trigger adapters are not implemented. See the invocation service for available calls.

Ingress adapters​

An adapter terminates one protocol, authenticates or extracts a principal, maps protocol metadata to an invocation target, applies payload limits, and converts the activation outcome back into a protocol response.

Protocol classes are HTTP, direct RPC, events, queues, timers, blobs, and internal calls. Declaring a class does not install its adapter. Current NATS triggers use shared durable consumer ownership; current HTTP application types use a bounded collector/invocation/delivery owner, preserve repeated headers and obtain identity from host context. Capsules own no protocol listener.

Browser-facing HTTP also enforces the closed same-origin and hydration policy. It shares the existing transport/asset/cache owners; browser origin metadata is neither RPC authentication nor a tenant/publication grant.

Trigger lifecycle​

trigger resource
  → shared source adapter
  → source position / acknowledgement state
  → trigger event
  → activation mapping
  → activation dispatch
  → source acknowledgement

Acknowledgement occurs only according to the trigger's delivery contract. Trigger events carry stable event and idempotency identifiers so duplicate delivery is safe where component logic supports it. A broker's durable consumer position does not provide an LSF state/effect transaction or exactly-once external execution.

Planned durable timers​

A timer is durable metadata interpreted by a shared timer source. Waiting does not retain an activation, cell, component instance, or thread.

Backpressure​

Ingress must reject, defer, or pause sources when admission queues are full. It must not create new service-specific workers to absorb overload.