Automation & queues

A workspace is functions. A host admits each invocation into a one-shot worker and enforces an uninterrupted CPU-span limit, not a whole-function wall timeout. The worker and capacity slot live for the complete invocation, then return to zero. The infrastructure queue is a separate timer for integration and notification crons — not how functions run.

The infrastructure queue facility

The queue facility port carries integration imports, pulls, notifications, and conversation titles — authors do not choose this queue. Automations, agents, pages, and collection operations are admitted functions. See Facilities for the contract.

Dispatch

HTTP, a webhook, a cron, or a resume all enter the same admission path. A free slot starts one worker; otherwise the request waits and then runs. When tenant code awaits model, database, or another facility I/O, the worker and slot remain assigned while active CPU metering pauses, and the same invocation resumes when the facility replies. Explicit cursor continuation is a later invocation.

  HTTP / webhook / cron / resume
              │
              ▼
         HOST ADMIT
         CPU span = host policy
         slot? run now : wait, then run
              │
              ▼
         ONE-SHOT WORKER        (the guest)
         page · find · create · one chunk · one step
              │
       ┌──────┼──────────────────┐
       ▼      ▼                  ▼
    return   await facility    not done
             or model I/O      (more rows)
       │      │                  │
       ▼      ▼                  ▼
     reply   same invocation   save cursor
             resumes; slot +   later invocation
             worker retained

Host CPU span

Colony allows at most 2,000 ms of uninterrupted worker CPU before tenant code must yield. This is not a 2-second wall-clock timeout: cold start, queue time, and model or database facility waits do not consume that CPU span. Those waits still retain the invocation’s worker and capacity slot until it settles.

Guarantees

• The host admits concurrent one-shot workers up to the machine compute budget. When the machine is full, the next admission waits, then runs — or returns 503 if the queue is full.
• An invalid cron fails at boot, never silently at runtime.
• Exceeding the uninterrupted CPU span terminates the worker, and an uncommitted transaction rolls back. Completion, failure, or cancellation also terminates the worker; no tenant worker remains resident between invocations.

Dev vs production

In development an in-process interval queue is a timer for infrastructure crons. It loses work on process death. It is not how functions run. Colony uses a fresh worker thread for each artifact inspection or invocation; bolt start runs tenant functions in-process.