How it works
From an agent's task to a number you can trust
Postgres holds the truth. Redis only carries jobs, and a job that cannot reach Redis waits in Postgres until it can. Every part below links to the file that implements it.
Hover or click any part or connection. Dashed means planned.
Send a task through
Follow one task from the agent to the report, step by step. Switch on Break Redis first to see the outbox hold the job until Redis returns.
api (FastAPI)
What it does
Validates every request against the schema, drops identity attributes (email, account and organisation ids), and drops prompt and output text unless the agent has content capture switched on. That rule is enforced here, not trusted to the sender.
POST /v1/tasks response (201 created, 200 updated)
{"task": {"id": "0b9e…", "external_id": "ticket-4812"},
"created": true,
"grade_job_id": "5d1a…",
"grade_job_published": true}Failure it handles
Bearer token compared with secrets.compare_digest, so timing reveals nothing. /readyz returns 503 when Postgres or Redis is unreachable, so Kubernetes stops sending traffic without restarting the pod.
In the repository
On Kubernetes
The Helm chart runs the same pieces in one namespace. Data stays in the cluster: the only way out is the judge endpoint you allow.
namespace: project-eval
Deployment + Service + Ingress
api
Stateless, so it scales sideways. Liveness on /livez, readiness on /readyz.
deploy/helm/project-eval/templates/api.yamlDeployment
worker
Runs the grading loop and the periodic outbox relay.
deploy/helm/project-eval/templates/worker.yamlStatefulSets
postgres, redis
Each with its own persistent volume. Redis runs with append-only persistence.
deploy/helm/project-eval/templates/postgres.yamlJob
migrate
Applies database migrations before the api and worker start.
deploy/helm/project-eval/templates/migrate-job.yamlKEDA ScaledObject
worker
Scales workers from 1 to 5 on the consumer group's pending entries in eval:jobs (redis-streams trigger). Off by default; needs KEDA installed.
deploy/helm/project-eval/templates/worker.yamlNetworkPolicy
egress
Default deny for egress: pods may reach DNS, each other, and the judge endpoint you list. Nothing else.
deploy/helm/project-eval/templates/networkpolicy.yamlTest · planned
egress test
Checks from inside the cluster that a pod can reach the judge and cannot reach the internet.
docs/DESIGN-v1.md