System
Multi-tenancy
Events, deliveries, dead letters and replay records are associated with tenant IDs. Rate limiting and dispatch selection separate busy tenants’ budgets.
Independent rate budgets
Redis token buckets use distinct ingestion and delivery keys for each tenant. Both default to a burst capacity of 10 and a refill rate of 10 tokens per second. One tenant’s ingestion budget is independent of another tenant and of its delivery budget.
The API returns 429 with Retry-After when ingestion is limited. A delivery limit defers the existing queue message without consuming an HTTP attempt.
Fair publication and dispatch
The outbox query rotates across tenants, selects pending rows in tenant rounds and preserves selection order. Workers use bounded receive cycles and limit each tenant to 10 dispatch selections per cycle.
This bounds a busy tenant’s selections; it does not promise a fixed latency, exactly-once delivery or strict per-tenant FIFO processing.
Current boundaries
Read queries filter by tenant and bind pagination cursors to that tenant. This is query isolation, not caller authorization. Authentication remains unimplemented for API callers.
Signing secrets are tenant-specific, while RECEIVER_URL is configured per worker process. The included local receiver accepts only its one configured tenant. Destination registration and an authenticated tenant dashboard are not implemented.