Site search

Find architecture, research, and terms

Start typing to search the editorial index.

Production practiceAdvanced

Durable Execution and Recovery for MIR

Durable workflow styles, event resumption, retries, checkpoints, rerouting, compensation, idempotency, and conceptual recovery ports.

Why durable execution

Model inference, tool I/O, sandbox startup, approvals, retries, and evidence capture have variable latency and can outlive an HTTP request. The durable record—not an in-memory agent loop—must remain the source of lifecycle truth.

Compatible implementation styles

Durable workflow engine

Persisted orchestration and timers.

Queues and workers

At-least-once delivery with idempotent commands.

Event store and outbox

Ordered events plus transactional publication.

Scheduled jobs or stateful actors

Useful for timeouts, leases, and long-running ownership.

No single stack is required. Preserve the same lifecycle, authority, checkpoint, and evidence semantics.

Event sequence and resumption

run.createdrun.provisioning_startedcontext.selectedmodel.requestedtool.action_validatedcheckpoint.createdtool.executedrun.recoveringrun.recoveredrun.completed

A resumed worker loads the durable state, last accepted sequence, pending command, effect receipt, checkpoint, and active deadline before doing new work.

Recovery patterns

  • Retry with bounded budget and circuit breaker.
  • Checkpoint restore and alternate model/tool route.
  • Saga compensation for external side effects.
  • Dead-letter queue, manual review, and safe termination.

Idempotency

Record command ID, idempotency key, effect receipt, duplicate-result reuse, side-effect status lookup, and compensation key. A duplicate delivery should retrieve the prior result or prove that the effect status is unknown; it must not blindly repeat a material write.

C# contracts

using System.ComponentModel.DataAnnotations;

/// <summary>Contains a durable checkpoint reference.</summary>
public sealed record CheckpointRecord
{
    /// <summary>Gets the checkpoint identifier.</summary>
    [Display(Name = "Checkpoint")]
    public required string CheckpointId { get; init; }

    /// <summary>Gets the content hash of checkpoint state.</summary>
    [Display(Name = "State Hash")]
    public required string StateHash { get; init; }

    /// <summary>Gets when the checkpoint was created.</summary>
    [Display(Name = "Created At Utc")]
    public required DateTimeOffset CreatedAtUtc { get; init; }
}

/// <summary>Stores and retrieves durable checkpoints.</summary>
public interface ICheckpointStore
{
    /// <summary>Creates a checkpoint before a material effect.</summary>
    /// <param name="runId">The stable run identifier.</param>
    /// <param name="cancellationToken">Signals cancellation of checkpoint I/O.</param>
    /// <returns>The created checkpoint record.</returns>
    Task<CheckpointRecord> CreateAsync(string runId, CancellationToken cancellationToken);
}

/// <summary>Describes an authorized recovery plan.</summary>
public sealed record RecoveryPlan
{
    /// <summary>Gets the recovery strategy.</summary>
    [Display(Name = "Strategy")]
    public required string Strategy { get; init; }

    /// <summary>Gets the checkpoint to restore when required.</summary>
    [Display(Name = "Checkpoint")]
    public string? CheckpointId { get; init; }
}

/// <summary>Coordinates validated recovery.</summary>
public interface IRecoveryCoordinator
{
    /// <summary>Builds a bounded recovery plan.</summary>
    /// <param name="runId">The stable run identifier.</param>
    /// <param name="cancellationToken">Signals cancellation of diagnosis I/O.</param>
    /// <returns>The proposed recovery plan.</returns>
    Task<RecoveryPlan> PlanAsync(string runId, CancellationToken cancellationToken);
}

/// <summary>Stores command and effect identities for deduplication.</summary>
public interface IIdempotencyStore
{
    /// <summary>Attempts to reserve an idempotency key.</summary>
    /// <param name="key">The stable command key.</param>
    /// <param name="cancellationToken">Signals cancellation of storage I/O.</param>
    /// <returns>True when the key was reserved by this caller.</returns>
    Task<bool> TryReserveAsync(string key, CancellationToken cancellationToken);
}

These files are conceptual MiRuntime editorial references, not a product SDK or certification profile.

Transactional boundary

Generic “retry” is insufficient for partial writes and external side effects. Persist intent and evidence with an outbox where possible; otherwise use effect receipts, status lookup, compensation, and an explicit unknown-effect state that requires review.

Source record

References

Suggest a correction
  1. Microsoft. Azure Architecture Center. Published Current documentation; last reviewed 2026-06-23 UTC. Official architecture guidance.

  2. Microsoft. Microsoft Learn. Published Current documentation; last reviewed 2026-06-23 UTC. Official architecture guidance.

  3. National Institute of Standards and Technology. NIST. Published 2023-01-26; last reviewed 2026-06-20 UTC. Government framework.