The effectful backends the mirror worker closes over, read through the WorkerM reader.

The per-ecosystem bundle every job is dispatched through. Its resolver, rules, and gates are the serve path's own, so ingest and serve reach one decision over one policy.

The bundles keyed by a job's package ecosystem. A job whose ecosystem is absent is fail-closed: dropped, never mirrored unvetted.

A reader over the WorkerRuntime on katip's logging context. That base is a reader, never a StateT, so the context behaves across the loop.

Run a WorkerM at the caller's katip environment, so the application owns the log stream and the trace-correlation identity every line carries.

The continuous consume loop: long-poll, process, repeat, under the supervision policy. The heartbeat advances only on progress, so a persistently faulting receive goes stale on /livez.

Process one batch sequentially under a lease on every receipt in it. The heartbeat advances per job, so workerHeartbeatStaleAfter covers one job.

Decide one job, re-checking current policy before publishing, because the queue wait is unbounded and mirrored bytes bypass every later rule.

The terminal outcome of processing one mirror job. It decides whether the worker acks the message or leaves it to redeliver.

Which leg a transient failure gave up on. The realisation half reads it to decide whether to reset the message's visibility, so the two legs cannot be conflated at the queue handle.

Worker progress and its startup allowance, separate from HTTP readiness.

Build a fresh WorkerHeartbeat with no poll yet recorded (lastPoll is Nothing until the worker's first successful receive).

Stamp the heartbeat with the given instant, recording a unit of worker progress. The worker calls it through recordWorkerProgress.

The instant of the worker's last recorded progress, a successful poll or a completed job, or Nothing before its first.

How long one long job step may run: uploading the largest artifact the memory plan admits (512 MiB) over a 2 MiB-per-second link. Renewing a receipt's visibility never extends it.

Startup and progress allowance: a fetch and a publish of that largest artifact plus a minute, so a slow job never restarts the process.

Judge progress at now, using startup time only until the first successful progress.

What /livez answers from: the health verdict, plus the instant the checked loop last recorded progress so an orchestrator can judge staleness rather than only pass or fail.

The verdict of a role with no background loop to stall: live, with nothing to report.

Read the worker heartbeat and judge it against the current wall clock, keeping the instant judged. Both the embedded and the dedicated worker answer /livez through this.

Whether fetched bytes may enter the mirror, with a refusal detail for the operator.

Verify the strongest selected digest, allowing only its same-algorithm SRI alternatives. A weaker match or an uncomputable selected algorithm never permits publication.