Rules for application code¶

Code that follows these rules lets the layout move a service with no change to the code.

1. Messages are frozen structs of immutable fields; myxo check enforces it.
2. A service imports another only through its interface module, which stays light; myxo check enforces it, except between services in one module.
3. No registration by import side effect: use entry points or explicit calls.
4. Every call can fail with Unavailable, so retry it where the operation allows. RemoteError is a bug.
5. Event handlers are idempotent and do not assume an order across groups. A handler shares the publisher's transaction only when it must commit with it.
6. No state in a process's memory that another process needs: sessions, locks, rate limits and caches of permissions go in the database or the shared cache.
7. Work that must run once uses a schedule's leader or the queue's claims.
8. Long or untrusted work goes on the queue, out of the request, in a process with reduced privileges.
9. Design every interface as if remote: a timeout on every call, and no shared memory.

The failures page explains rule 4, the events guide rule 5, and the jobs guide rules 7 and 8.