The connectivity problem
Developer machines, home servers and office workstations usually sit behind NAT or a firewall. A cloud agent cannot safely dial those machines directly, and exposing SSH or a custom inbound API creates a new public attack surface.
The useful direction is reversed: a small Connector on the device establishes an outbound TLS connection to a known control plane. Outbound traffic is already compatible with most networks, and the device keeps its private identity locally.
Separate notification from state
A WebSocket should not become the task database. It only says that work may be available. The durable invocation, authorization decision, lease and receipt remain in PostgreSQL and are retrieved through signed HTTPS requests.
- A lost wake does not lose the task.
- A reconnect can safely ask for pending work again.
- Multiple signals collapse into the same atomic claim.
- Horizontal scaling can later replace the in-memory wake bus without changing dispatch semantics.
Design for sleep, restart and packet loss
Laptops sleep, reverse proxies reload and mobile networks change. A production Connector needs bounded reconnect backoff, an immediate catch-up poll after reconnect and a slower fallback poll while no wake is received.