Flow
How my flag check answers, and what the job does next
1Flag on
The paid job runs, from any of the six starting points.
2Flag off
Hooks skip it, sweeps skip it, workers that have their key stop before the paid call.
3Worker has no key
No check at all. As far as I can tell, the paid job runs for everyone.
4Provider down, nothing cached
An empty flag list comes back and reads as off. One error is logged and nothing retries.
5Provider down, old answer cached
The old answer is used no matter how old it is.
The priciest job in my app got a spending gate, and on the worker side it only works when it can find its key.
The pricey job: when a coding session ends, a language model reads it and pulls out a summary of what happened. Each run costs money. Who got it used to depend on their plan. Now it depends on a flag I set per organization in my login provider. Flag on, it runs. Flag off, it doesn't, no matter what they pay.
Six ways to start one paid job
The job can start from six places: two hooks that fire when a session ends or a sync finishes, two tasks in my workflow runner, and a cron job with its own sweep. I put the same flag check in all six. The hooks check before they queue work. The workers check again before the paid call, because a flag can change while a job waits.
The check asks the provider for the flag list, keeps it for a few minutes, and answers yes or no.
The workers skip the check without a key
The workers only build a provider client if a key is set in the environment. No key, no client, no check, and the job runs.
The job stops only when a client exists and says no. With no client, nothing stops it.
I think I did that on purpose so I could run it on my laptop. But production runs the same code. As far as I can tell, one missing setting would send every organization down the paid path, and no log would say so.
The hooks do the opposite. If the request has no provider ID for the organization, they skip. So an unclear answer means no at the front and yes at the back.
An outage looks like a no
If the provider call fails and nothing is cached, the check returns an empty flag list. That looks just like an organization with no flags. The work is dropped, one error is logged, and nothing tries again. If an old answer is cached, it gets used no matter how old it is, so a flag I turn off could keep working through a long outage.
My job table got three things wrong
Crashed jobs stayed stuck as "processing". I made them show as failed, then put the error in the wrong field, then fixed that the next time I committed. The cron sweep also counted jobs it never created, and now it counts only real ones.