Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a probabilistic model to quantify the risks associated with upgrading durable workflow executions, addressing the challenges posed by immutable event logs and version changes. By leveraging static structural diffs and existing telemetry data, the model decomposes risk into three axes—protocol, interface, and state migration—while employing Bayesian estimation to provide credible intervals for the Workflow Upgrade Risk (WUR) score. The findings reveal that a zero backward-risk verdict ensures safe rehydration under new versions, facilitating informed decision-making for workflow upgrades without the need for extensive dry-runs or shadow executions.
Upgrading workflow engines can now be quantified with a probabilistic model that reveals when it's safe to proceed, transforming how we approach version changes in long-running processes.
Durable workflow engines reconstruct execution state by deterministically replaying an immutable event log, coupling every in-flight run to the code version that produced its history: a new deployment can invalidate the replay of runs started under the old version, silently corrupting state or halting progress. Existing mitigations -- pinning, patch gates, side-by-side deployment -- treat every change as maximally dangerous and drain old versions, untenable for workflows that sleep for weeks. We present a closed-form probabilistic model that quantifies the risk of upgrading in-flight runs from workflow version $V_1$ to $V_2$ using only a static structural diff and telemetry the protocol already persists -- event logs, step payloads, historical paths -- with no dry-run, sandbox, or shadow execution. Risk decomposes along three axes (protocol, interface, state migration) and combines an exact backward (rehydration) term, computed on recorded prefixes modulo trace equivalence of concurrent completions, with a probabilistic forward term from hitting probabilities in an empirically estimated Markov model of control flow. Estimation is Bayesian throughout, so the Workflow Upgrade Risk (WUR) score carries a credible interval and thin telemetry surfaces as uncertainty. We prove that a zero backward-risk verdict certifies safe rehydration under the new version, and derive a policy partitioning runs into migrate, review, and pin classes. Finally we drop the inter-run independence assumption: coupling through hooks, hierarchy, and shared resources is captured by an empirical coupling graph, fleet risk becomes the least fixpoint of a failure-contagion operator, and the coupling-aware migrate/pin partition is computed exactly as a minimum s-t cut.