Lucim isolates workloads by trust boundary and resource profile.

Ordinary worker

The ordinary ARQ worker runs source capture and diffing, history backfill, signal publication, webhook delivery, replay probes, prose judging, Firecrawl acquisition, source discovery, and artifact cleanup. Scheduled work includes:
  • due source captures and replay probes every 15 minutes;
  • Firecrawl reconciliation and pending discovery every minute;
  • source reconciliation at a configured interval;
  • expired artifact cleanup daily;
  • forecast resolution on its scheduled minute.
Its short-lived heartbeat prevents a dead worker from leaving readiness green.

Repository scanner

The dedicated lucim:repository-scanner queue runs with concurrency one. It acquires hostile repository input, performs a non-executing scan, publishes dependency-evidence operational snapshots, and performs weekly connection reconciliation. Never route repository scan jobs through the ordinary worker.

Sandbox worker

The dedicated lucim:sandbox queue runs approved isolated jobs and cancellation. A frequent reconciliation sweep repairs committed dispatch and cancellation edges. Concurrency is bounded by SANDBOX_WORKER_MAX_JOBS and must remain below the provider quota.

Dependency analysis workers

Optional dependency-evidence producers and the Joern worker have separate queues, immutable tool identities, resource limits, and readiness controls. Enable each layer independently after its parity or conformance gate.

Queue incident priorities

1

Identify the queue

Separate ordinary acquisition backlog from scanner, sandbox, and dependency-analysis pressure.
2

Check the heartbeat

A stale heartbeat means scaling the queue will not help until the worker starts successfully.
3

Inspect durable state

Compare ARQ failures with monitor runs, acquisition jobs, sandbox runs, or scan rows. Durable state is authoritative.
4

Reduce admission

Use the narrowest provider or capability kill switch before disabling unrelated deterministic work.