Capsid
The store, the queue, and the credentials every other project runs through.
mcp.dustinedwards.info · github.com/DrDustinEdwards/capsid · capsid.dustinedwards.info/s/capsid
Used by 3
- Carrel writes to
- capsid-bench writes to
- Capsid backups reads
Inside Capsid
Runs
MCP Worker
Cloudflare Worker
Serves MCP, the operator routes, /health and the Portal's API.
writes to capsid writes to capsid-media writes to app KV writes to OAuth KV serves Portal serves Agents writes to GitHub reads GitHub
Portal
React, served by the Worker
The admin view, behind Cloudflare Access.
Five-minute tick
Workers cron trigger
Lease sweep, auto-merge, the watcher and the daily passes.
reads GitHub writes to GitHub writes to capsid writes to app KV
Stores
capsid
D1 with FTS5
Documents, jobs, agents and the audit log.
capsid-media
R2
Media and the daily backups.
app KV
Workers KV
Caches, rate-limit counters and computed documents.
OAuth KV
Workers KV
The OAuth provider's grants and tokens, kept apart from the app KV.
Outside
Agents
Coding sessions over MCP
The sessions that post, claim and work jobs.
GitHub
Repos, pull requests, Actions
Where the code, the pull requests and CI live. Capsid reaches it through its GitHub App.
deploys MCP Worker watches MCP Worker
Uses 15
- d1-dump installs
- devkit installs
- site-runtime installs
- Capsomer installs, coordinates
- Germomics coordinates
- dustinedwards.info coordinates
- TXASM coordinates
- julieedwards.info coordinates
- Foxing coordinates
- Foxhound coordinates
- Carrel coordinates
- Enarratio coordinates, installs
- Writing coordinates
- Skills coordinates
- capsid-bench coordinates
Step by step
A job's life
One job from the moment it is posted to the moment GitHub's record is checked against what its agent claimed.
- Posted: a session posts a job over MCP. The Worker checks the caller's grant, picks the model, signs the body and stores the job.
- Claimed: an agent claims it. The Worker verifies the body's signature first and records who holds the job.
- Worked: the agent works on one branch of one repo.
- Blocked: at a push, a deploy, a secret or a merge the agent stops. The job waits with the exact command a person or the signed policy must approve, and resume hands it back.
- Pull request: the pull request opens through Capsid's GitHub App, and CI runs on it.
- Merged: the five-minute tick merges a pull request whose CI is green on its exact head under the signed auto-merge policy, or the session that opened it merges it on green.
- Deployed: the merge to master runs CI on GitHub Actions, which deploys the Worker.
- Verified: CI's live gate reads the Worker's /health and checks it reports the commit that was merged.
- Claims checked: when the job completes, the Worker reads the pull request, its commits and CI from GitHub and records each claim beside what GitHub says.
The nightly backup
Once a day the Worker copies the whole store to R2, keeps a graduated set of copies, trims old history only once a copy holds it, and the watcher checks that the copy kept off the account is fresh.
- Dumped: at 09:00 UTC a daily cron in the Worker dumps every table to R2 with d1-dump, one JSON file each plus the schema.
- Marked complete: a completion marker is written last, and only when the dumped tables match the ones the migrations create. A run without it is never counted as a backup.
- Mirrored: every document body is written beside the dump as plain markdown, one file per document.
- Pruned: the newest complete run of each of the last 14 days, 8 weeks and 6 months is kept, and every other run is deleted whole. The newest complete run is never deleted.
- Trimmed: document versions older than 90 days and audit rows older than 180 are pruned, after the dump, so every pruned row is in a kept copy.
- Stamped: the run records its success, and /health warns once that stamp is more than 26 hours old.
- Watched: every half hour the watcher reads the newest copy kept off the Cloudflare account and files a finding once it is more than 36 hours old.
Public model, 2026-10-23. Markdown