Runtime event flow

What triggers what at runtime. An arrow here means "this event causes that to run" — not "this must be created before that". For build-order, see the Dependency map.

This page covers the main Terraform root. The automations department is a separate root with its own wake/dispatch mechanism — see Automations.

The upload lane, end to end

client → API GW  POST /auth/multipart/{create,part-url,complete,abort}
                 POST /session-started, /session-ended     → auth_presigned
       → PUT to s3_bucket.captures
       → [s3:ObjectCreated:*]                              → on_upload
       → [lambda:InvokeFunction async]                     → pipeline_l0
       ⇢ [AUTO_TRIGGER_PIPELINE + PREFECT_DEPLOYMENT_NAME] ⇢ Prefect Cloud

Reading the diagram

• Solid arrows are event triggers declared in Terraform: aws_s3_bucket_notification (S3 → Lambda), aws_api_gateway_integration joined through method and resource to give METHOD /path → Lambda, and IAM lambda:InvokeFunction (Lambda → Lambda).
• Dotted arrows are boot-time reads: what a GPU instance pulls when it starts — container image from ECR, model weights from S3, credentials from Secrets Manager.
• The parallelogram is the handoff out of AWS. on_upload carries AUTO_TRIGGER_PIPELINE=true and PREFECT_DEPLOYMENT_NAME="s3-batch-pipeline/s3-batch", so it calls Prefect Cloud. What Prefect does next is not described by this repository.

What this diagram refuses to guess

The video_indexing GPU has no AWS event trigger

There is no EventBridge rule, no Auto Scaling group, no event-source mapping, and no SQS/SNS anywhere in the main Terraform root. The video_indexing launch template's own Terraform output prints an aws ec2 run-instances … command — i.e. an operator starts it. Its user_data then pulls the image from ECR, s3 syncs the model weights, reads Supabase credentials from Secrets Manager, runs the pipeline, and self-terminates.

Nothing in the Terraform or in video_indexing_userdata.sh connects Prefect to that instance, so no such arrow is drawn. If that link exists in practice it lives outside this repository and should be documented here explicitly rather than inferred from proximity.

Contrast this with transcribe_gpu in the automations root, which does have a fully declared wake path — see Automations.

Client-side upload validation (RecordingArtifactValidator) happens in playroll-cpp before any of this — see Upload Validation Pipeline.