EVO-70 Tier 1: emailOutbox AFTER INSERT FOR EACH STATEMENT trigger → pg_net wake marker to drain route
EVO-70 fleet Tier-1 target, gated on Tier-0 (MARS-519) landing + audit feasibility PASS (already given). AFTER INSERT FOR EACH STATEMENT trigger on emailOutbox (transition table, nonempty check — NOT row-level: mars drain claims a BATCH of 10 via FOR UPDATE SKIP LOCKED at email-outbox.ts:246, so one statement-wake drains all due rows; row-level would re-create N-fire burst). Trigger fn POSTs a signed WAKE MARKER (never row/email content) to the drain route via net.http_post (post-commit, transactional — rollback=zero phantom send). Guardrails: fn owned by postgres, SET search_path='', net.-qualified call, SECURITY DEFINER only if needed, REVOKE EXECUTE FROM PUBLIC/anon/authenticated; drain URL+secret from VAULT inside fn (never pg_proc source/cron.command/payload/migration); short pg_net timeout; EXISTS-guard before http_post (same predicate as T0) so loop-INSERT redundant fires cost an index probe not HTTP. Worker keeps own secret check + SKIP LOCKED + lease + idempotency. Tier-0 cron STAYS permanent (pg_net UNLOGGED/beta = latency accelerator not durability). Rollout: add trigger alongside existing after() → prove dup-safe (commit=1 wake, rollback=0, multi-row stmt=1, empty cron=0 net rows, due-retry=1, concurrent trigger/after/cron=1 send) → coder retires app-level after() initiators (NOT the cron). Observability: log wake/worker failures + processed counts, alert on oldest-eligible-pending age + dead-letter count.
Questions
Activity
-
parent=#2186
-
Held (EVO-70 Tier-1 sequencing, Elazar-greenlit 2026-07-19): venus VENUS-287 proves the trigger-wake pattern end-to-end first as fleet proving ground. Release gated on pmmaster's call after venus's full duplicate-safety proof set PASSes (commit=1 wake, rollback=0, multi-row stmt=1, empty cron=0 net rows, due-retry=1, concurrent trigger/after/cron=1 send). Then replicate proven INVOKER + statement-level + Vault shape: trigger ALONGSIDE existing after()/cron, retire app after() only after mars proves dup-safe; Tier-0 guarded cron permanent.
-
EVO-70 Tier 1 RELEASED (pmmaster 2026-07-19): venus proving ground fully PASS (venus52, SHA fc49c6d/v1.2.3, all 6 dup-safety proofs + real-inbox e2e green). Mars T0 (MARS-519) live = gate satisfied. Dispatching db-mars-cc to replicate venus52 shape.
-
EVO-70 Tier-1 trigger-wake LIVE (migration 071, SHA d81eba7, v2.44.0, audit PASS:d81eba7). AFTER INSERT FOR EACH STATEMENT trigger on emailOutbox → transition-table nonempty EXISTS → net.http_get to drain route (mars route is GET-only), reusing 069's drain_email_outbox_if_due() as URL/method/auth SSOT. SECURITY INVOKER (app-pool role=postgres holds vault SELECT), non-silent fail-open. Fires alongside after() + T0 cron; retires nothing. 6 dup-safety proofs green + real-inbox e2e (~5s claim, attemptCount=1, status=sent).