Docs
Policy Jobs
policy_jobs is the durable audit + retry queue for any policy activity:
domain verify, IP publish, apply-policy, etc.
Schema (key columns)
| Column | Type | Purpose |
|---|---|---|
id |
uuid PK | Job id |
workspace_id |
uuid | Tenant |
kind |
text check | apply_policy today |
status |
text check | `queued |
payload |
jsonb | Source / params (e.g. { source: 'domain.verify', domain_id }) |
result |
jsonb | Kumo response / epoch number |
created_at / started_at / finished_at |
timestamptz | Timing |
Endpoints
POST /v1/panel/jobs/apply-policy → 200 { ok, job: {id, status} }.
GET /v1/panel/jobs lists latest N jobs. Both operator+. Admin can see
across all members with requireMembership(userId, 'admin') — read-only
audit role.
Worker
policyWorker.ts (POLICY_WORKER=1 or
infra/systemd/postmta-hosted-policy-worker.service) drains the queue.
Per apps/api/src/policyWorker.test.ts + policyWorker.live.test.ts, the
worker observes FOR UPDATE SKIP LOCKED semantics so multi-process drain is
safe.
Related
- docs/build/shaping.md — user-facing apply.
- docs/operate/POLICY.md — render/apply honesty.
Last verified: Sat Jul 11 2026 17:00:00 GMT-0700 (Pacific Daylight Time). Cross-link maintained byscripts/check-docs-drift.sh (M54).