Ingestion pipeline

The pipeline is intentionally boring and visible. Payloads are encrypted inside your process before they leave it; errorcore stores what it receives and decrypts only in the isolated worker.

SDK captures and scrubs the failure in your process
down
SDK encrypts the payload (AES-256-GCM) and signs the envelope
down
bounded TLS request reaches the ingest API
down
API key authenticates and scopes the request
down
envelope shape, project key, and outer signature verify
down
distributed rate limit check
down
one admission transaction: idempotency, quota reservation, storage, job
down
encrypted envelope is stored exactly as received
down
worker claims the job with a fencing generation
down
worker unwraps the project key, verifies, decrypts, and inflates within bounds
down
safe metadata is extracted and scrubbed again server-side
down
case is grouped and indexed
down
developer sees context

Admissions answer whether an envelope was accepted. Envelopes show the raw encrypted storage. Jobs show reconstruction progress. DLQ shows stuck work. Cases show grouped failures created from safe metadata.

Which checks cost what:

• An unknown key id or a failed envelope signature is a 403 that consumes no allowance.
• A rate-limited request (429) persists nothing and consumes no allowance.
• A replayed envelope returns the original receipt (202, duplicate: true) and consumes no allowance.
• Exactly one newly accepted error envelope consumes one allowance unit, reserved atomically inside the admission transaction. Errors count separately even when they later join the same case. Payload blobs consume no unit once their parent error is admitted.

The API cannot read service or traceId before decryption, so Admissions shows a "pending decryption" state until the worker backfills those fields.

The API and worker run as separate containers from the same immutable image digest. Delivery is at least once; durable event idempotency, leases, and fencing make processing effects repeat-safe. Production never uses an in-memory queue, local filesystem, SQLite database, or static envelope key.