Maraschi & Collina's WUR model quantifies durable workflow upgrade risk
No dry-runs needed: a Bayesian model predicts migration safety from telemetry alone.
Durable workflow engines replay event logs to reconstruct state, but any code deployment can break in-flight runs started under an older version. Existing mitigations like side-by-side deployment or draining are impractical for workflows that sleep for weeks. Luca Maraschi and Matteo Collina's arXiv preprint (2607.13617) introduces a closed-form probabilistic model—the Workflow Upgrade Risk (WUR) score—that quantifies migration danger using only a static structural diff and telemetry the system already persists (event logs, step payloads, historical paths). No dry-run, sandbox, or shadow execution is required.
Risk decomposes along three axes: protocol, interface, and state migration. The model combines an exact backward (rehydration) term computed on recorded prefixes (modulo trace equivalence of concurrent completions) with a probabilistic forward term from hitting probabilities in an empirically estimated Markov model of control flow. Bayesian estimation provides a credible interval, so thin telemetry surfaces as uncertainty. The authors prove that a zero backward-risk verdict certifies safe rehydration. They also drop inter-run independence by modeling coupling through hooks, hierarchy, and shared resources via an empirical coupling graph, computing the fleet-wide migrate/pin partition as a minimum s-t cut.
- Model uses only static diffs and existing telemetry (event logs, step payloads, historical paths) — no dry-runs or sandboxes needed.
- Risk decomposes into three axes: protocol, interface, and state migration; Bayesian estimation provides credible intervals for uncertainty.
- Zero backward-risk verdict mathematically guarantees safe rehydration; coupled workflows handled via minimum s-t cut partitioning.
Why It Matters
Enables safe, zero-downtime upgrades for weeks-long workflows without costly draining or side-by-side deployments.