Machine-Checked Contracts for Workflow Persistence

Summary & Methodology Analysis

The paper addresses the lack of a standardized, machine-checkable contract for workflow persistence layers. Inconsistent semantics across agent workflow frameworks regarding checkpointing, interruption, and resumption lead to behavioral divergence and system failures. To solve this, the authors defined a Resume Contract comprising six properties: prefix continuation, effect exactly-once, fork determinism, checkpoint validity, consume-once, and recovery determinism. They formalized an abstract model using TLA+, a formal specification language used to design, model, documentation, and verification of concurrent systems, to verify the reference semantics exhaustively. Furthermore, they constructed a fault matrix by systematically introducing six violation classes into the TLA+ model to map property independence and failure footprints.

To test real-world implementations, the authors built a deterministic conformance harness using Python to execute protocol sequences across framework APIs, including LangGraph, LlamaIndex Workflows, CrewAI, pydantic-graph, and AutoGen AgentChat. They measured framework behavior through effect counters and external ledger cross-checking during simulated crashes and interrupts. Their results showed significant deviations. LangGraph 1.2.9 exhibits a live fork violation and a silent validity violation while failing to implement exactly-once semantics across interrupts. CrewAI 1.15.2 re-executes completed effect-bearing methods during checkpoint restoration, contradicting its documentation. Additionally, consume-once properties hold sequentially but fail under concurrent delivery, showing saturation levels of 1.0 in 36 of 40 cells. To address these issues, they developed the Remit reference sequencer, which uses a Verus, a verification tool for Rust code, verified recovery core to implement a fork-intent filter at the read path and a validity gate for persistent state.

Despite these contributions, the work has specific limitations. The authors do not claim that their specific property set is complete or that their findings represent the entire ecosystem. The verification of the Remit sequencer covers only the recovery-decision core and does not extend to the entire composite package or binary refinement. Finally, the fork determinism and consume-once impossibility is informational, arising from the lack of a branch discriminator in the protocol rather than a specific implementation defect. The paper does not specify any financial costs, hardware requirements, or latency figures beyond the behavioral metrics mentioned.