Compatibility: Pactmark 0.1.x. Local evidence uses disposable PostgreSQL 17, covering migrations, concurrency, TLS and crash/resume.

​
Why you need it

The memory store is deterministic, tenant-scoped and ephemeral. It is excellent for tests and disqualifying for production. Readiness will tell you so:

​
Setting up

1

Apply ordered migrations

Migrations are ordered and forward-applied through the Pactmark migration manager. Do not hand-edit schema objects it owns.
2

Use a least-privilege role

The application role needs exactly the tables it uses. It does not need CREATE in production, and it certainly does not need superuser.
3

Require hostname-verified TLS

Not sslmode=require — verification. An unverified TLS connection authenticates nothing.
4

Operate the worker separately

The durable worker is its own process with its own lifecycle. Running it inside a request handler reintroduces exactly the coupling you moved to Postgres to remove.

​
What the schema guarantees

Tenant identity in every path

Every storage method takes tenant identity, and negative tests cover cross-tenant reads and mutations.

Append-only events

Events are truth. Projections are rebuildable caches with no authority of their own.

Atomic command units

Idempotency records, authority, events, reservations and wake-ups commit together or not at all.

Optimistic event sequencing

Concurrent appends conflict with KAF_RUNTIME_EVENT_SEQUENCE rather than interleaving silently.

​
Fenced leases

Figure 1. Leases use database time, not application time. A worker with a skewed clock cannot extend its own ownership, and a returning zombie cannot commit over a newer fence. The worker claims wake-ups with database-time leases and fencing tokens. The clock-skew tests exist because “my server’s clock is fine” is the assumption that fails at 3am.

​
Protected context

Resumable context is stored separately from run truth and is tenant-scoped and purpose-bound. Large protected references use bounded authenticated digests for uniqueness while retaining ciphertext for read verification — so a uniqueness index does not become a plaintext oracle.
Protected context supports execution and resume. It is not an audit log, and it may contain only admitted, purpose-bound context. Do not use it as a general-purpose key-value store.

​
Backups: back these up together

Backing up a subset produces a restore that cannot be reasoned about. Take them as one consistent set:
  • events
  • work orders
  • command records
  • effect ledgers
  • artifacts
  • protected stores
  • migration state
Then actually restore it. Test a representative upgrade, a projection rebuild, a rollback plan, a backup restore and old-run inspection before you assign an RPO or RTO number to anything.

​
Monitoring

Monitor active and parked work. A dashboard that only shows in-flight runs will report a healthy system while a queue of unresolved effects grows behind it.

​
What to test before you trust it

Reliability and recovery

RPO/RTO, uncertain effects and what local crash tests do not prove.

Node and container

Running the HTTP bridge beside the durable worker.