🤖 AI Summary
This work addresses the challenge of state replay failures and silent corruption during version upgrades of long-running workflows, a problem inadequately handled by existing conservative and non-scalable approaches. The authors propose a probabilistic risk assessment model grounded in telemetry data that quantifies upgrade risk using only workflow structural differences and event logs—eliminating the need for sandboxing or shadow execution. Key innovations include the first provably replay-safe migration framework, a coupling graph to model cross-workflow dependencies enabling exact migration strategy partitioning via minimum cut, and an integrated methodology combining static structure comparison, a Bayesian-enhanced Markovian control-flow model, trace-equivalence replay analysis, and fixed-point computation of fault propagation. The system outputs a Workflow Upgrade Risk (WUR) score with confidence intervals, automatically classifying instances into migrate, review, or retain categories, thereby significantly enhancing both safety and efficiency of workflow upgrades.
📝 Abstract
Durable workflow engines reconstruct execution state by deterministically replaying an immutable event log, coupling every in-flight run to the code version that produced its history: a new deployment can invalidate the replay of runs started under the old version, silently corrupting state or halting progress. Existing mitigations -- pinning, patch gates, side-by-side deployment -- treat every change as maximally dangerous and drain old versions, untenable for workflows that sleep for weeks.
We present a closed-form probabilistic model that quantifies the risk of upgrading in-flight runs from workflow version $V_1$ to $V_2$ using only a static structural diff and telemetry the protocol already persists -- event logs, step payloads, historical paths -- with no dry-run, sandbox, or shadow execution. Risk decomposes along three axes (protocol, interface, state migration) and combines an exact backward (rehydration) term, computed on recorded prefixes modulo trace equivalence of concurrent completions, with a probabilistic forward term from hitting probabilities in an empirically estimated Markov model of control flow. Estimation is Bayesian throughout, so the Workflow Upgrade Risk (WUR) score carries a credible interval and thin telemetry surfaces as uncertainty. We prove that a zero backward-risk verdict certifies safe rehydration under the new version, and derive a policy partitioning runs into migrate, review, and pin classes. Finally we drop the inter-run independence assumption: coupling through hooks, hierarchy, and shared resources is captured by an empirical coupling graph, fleet risk becomes the least fixpoint of a failure-contagion operator, and the coupling-aware migrate/pin partition is computed exactly as a minimum s-t cut.